@stacksjs/ts-cloud 0.16.30 → 0.16.32

package/dist/{chunk-aeqm2v91.js → chunk-xbh2vr95.js}

@@ -1,4 +1,4 @@
-import{bd,L,d,Td,M,p,ge,g,qt,Nd,po,go,Od,Md,Fd,Hd,Wr,Co,Xt,Gd,qd,Xd,Yd}from"./chunk-2c8pcbq8.js";import{x,u}from"./chunk-f733qy2d.js";import{pe,$t,D,Mt,s,hi,Qs,Br,jc,zc,Z,c,qs,Ve,_r,Kc,Ft,js,Wc,xr,zs,Or,yi,Ht,Ei,bi,je,Gt,fd,Ad,Ti,wi,ft,oo,i,Ri,co,lo}from"./chunk-9n0q2cxj.js";import{n}from"./chunk-m93g67j0.js";import{o}from"./chunk-qrs912nk.js";import{fn}from"./chunk-z8qz33yk.js";import{Ie}from"./chunk-b6ar7eqc.js";import{An,bu,ds,k,w,ls,vu}from"./chunk-26cq0zjv.js";import{Ae,ir,ms,rt,z,se,b,ye,ar,oe,it,dr}from"./chunk-t3yzfbe7.js";import{K}from"./chunk-92w1g5d9.js";import{v,hr,Ps,xt,fr,Lu,Ot,Mu,mc,Qe,dt,zn,_,Lt,Tr}from"./chunk-h3kkh31v.js";import{I}from"./chunk-1erk1r1m.js";import{$e}from"./chunk-dm4vt53n.js";import{we}from"./chunk-9g8as6sa.js";import{f}from"./chunk-yc2rm4v9.js";function cn(e){let t=Dc(e.name),r=Xu(e.configText);if(ww(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=fh({...e,name:t}),l=e.configText.slice(0,r.end).trimEnd(),m=e.configText.slice(r.end),h=l.endsWith("{")?`
+import{bd,L,d,Td,M,p,ge,g,qt,Nd,po,go,xd,Md,Fd,Hd,Wr,Co,Xt,Gd,qd,Xd,Yd}from"./chunk-r45340yc.js";import{O,u}from"./chunk-kavwrxm8.js";import{pe,$t,D,Mt,s,hi,Qs,Br,jc,zc,Z,c,qs,Ve,_r,Kc,Ft,js,Wc,Or,zs,xr,yi,Ht,Ei,bi,je,Gt,fd,Ad,Ti,wi,ft,oo,i,Ri,co,lo}from"./chunk-nq51dyxz.js";import{n}from"./chunk-m93g67j0.js";import{o}from"./chunk-qrs912nk.js";import{fn}from"./chunk-57fhsqzb.js";import{Ie}from"./chunk-efssa93f.js";import{An,bu,ds,k,w,ls,vu}from"./chunk-jh38v9zp.js";import{Ae,ir,ms,rt,z,se,b,ye,ar,oe,it,dr}from"./chunk-t1gts5j9.js";import{K}from"./chunk-4hdp9ms2.js";import{v,hr,Ps,Ot,fr,Lu,xt,Mu,mc,Qe,dt,zn,_,Lt,Tr}from"./chunk-peeqkk92.js";import{I}from"./chunk-s909414m.js";import{$e}from"./chunk-dm4vt53n.js";import{we}from"./chunk-9g8as6sa.js";import{f}from"./chunk-wbabf3hg.js";function cn(e){let t=Dc(e.name),r=Xu(e.configText);if(ww(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=fh({...e,name:t}),l=e.configText.slice(0,r.end).trimEnd(),m=e.configText.slice(r.end),h=l.endsWith("{")?`
 `:l.endsWith(",")?`
 
 `:`,
@@ -23,7 +23,7 @@ ${h}},
 ${y}// Deploy onto the box '${r}' owns rather than provisioning one.
 ${y}attachTo: '${r}',
 ${h}},
-`))}import{createHash as kw}from"node:crypto";function Iw(e){return kw("sha256").update(ko(e)).digest("hex")}function ko(e){if(Array.isArray(e))return`[${e.map((t)=>ko(t)).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0&&typeof t!=="function").sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${ko(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function E(e,t){let r=`dashboard:${t.username.toLowerCase()}`;return e.getActorByExternalId("user",r)??e.createActor({kind:"user",externalId:r,displayName:t.name??t.username,metadata:{source:"dashboard",role:t.role}})}function ou(e,t){let r=new hi({cwd:e}),a=Iw(t),l=r.getProjectBySlug(t.project.slug),m=t.project.slug.length>=3?t.project.slug:`${t.project.slug}-org`,h=(l?.organizationId?r.getOrganization(l.organizationId):void 0)??r.getOrganizationBySlug(m)??r.createOrganization({id:l?.organizationId,slug:m,name:t.project.name}),S=l?l.name!==t.project.name||l.desiredConfigHash!==a||l.organizationId!==h.id?r.updateProject(l.id,l.version,{name:t.project.name,organizationId:h.id,desiredConfigHash:a}):l:r.createProject({organizationId:h.id,slug:t.project.slug,name:t.project.name,desiredConfigHash:a}),R=new Map;for(let[j,B]of Object.entries(t.environments??{})){let W=r.getEnvironmentBySlug(S.id,j)??r.createEnvironment({projectId:S.id,slug:j,name:j.replace(/(^|[-_])(\w)/g,(ce,Ee,Re)=>Re.toUpperCase()),kind:String(B?.type??j),region:B?.region??t.project.region,desiredState:s(B)});R.set(j,W);let Y=new Map(r.listResources(S.id,W.id).map((ce)=>[`${ce.kind}:${ce.slug}`,ce])),te=(ce,Ee,Re,de)=>{let Me=`${ce}:${Ee}`,ae=Y.get(Me),Le=s(de);if(ae){if(ae.name!==Re||ko(ae.desiredState)!==ko(Le))Y.set(Me,r.updateResource(ae.id,ae.version,{name:Re,desiredState:Le}));return}let Je=r.createResource({projectId:S.id,environmentId:W.id,kind:ce,slug:Ee,name:Re,provider:t.cloud?.provider,desiredState:Le,metadata:{source:"cloud-config"}});Y.set(Me,Je)};for(let[ce,Ee]of Object.entries(t.sites??{}))te("application",ce,ce,Ee);let le=B?.app;if(le)for(let ce of["http","queue","cli"])te("function",ce,`${ce.toUpperCase()} function`,{...s(le),function:ce});let X=t.infrastructure;for(let[ce,Ee]of Object.entries(X?.functions??{}))te("function",ce,ce,Ee);if(X?.compute)te("server",`${S.slug}-server`,S.name,{...s(X.compute),label:S.name});for(let[ce,Ee]of Object.entries(X?.databases??{}))te("database",ce,ce,Ee);if(X?.appDatabase)te("database","application-database","Application database",X.appDatabase);else if(X?.database)te("database","application-database","Application database",{engine:X.database})}let y=new c(r).recoverExpired(),C=r.reconcileOrphanedOperations({policy:"fail"}),T={requeued:y.requeued+C.requeued,failed:y.failed+y.cancelled+C.failed};return{store:r,organization:h,project:S,environments:R,reconciliation:T}}var Ew=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function Zi(e,t){let{store:r,organization:a,project:l}=e,m=new Set;for(let h of t){let S=E(r,h);m.add(S.id);let R=r.getMembershipForActor(a.id,S.id);if(R&&R.source!=="legacy")continue;let y=r.listResources(l.id).filter((V)=>V.kind==="application"&&Object.hasOwn(h.sites,V.slug)),C=h.role==="admin"?"owner":"viewer",T=h.role==="admin"||y.length===0?{type:"organization"}:{type:"resource",id:y[0].id},j=R?R.roleTemplate!==C||ko(R.scope)!==ko(T)?r.updateMembership({id:R.id,roleTemplate:C,scope:T,actorId:S.id}):R:r.createMembership({organizationId:a.id,actorId:S.id,roleTemplate:C,scope:T,source:"legacy"}),B=new Set;if(h.role==="member"&&y.length===0)for(let V of $t("viewer"))B.add(`deny|${V}|organization|`);for(let V of y){let W=h.sites[V.slug];for(let Y of Ew)B.add(`allow|${Y}|resource|${V.id}`);if(W==="owner")B.add(`allow|config:write|resource|${V.id}`)}for(let V of r.listGrants(j.id).filter((W)=>W.source==="legacy")){let W=`${V.effect}|${V.capability}|${V.scope.type}|${V.scope.id??""}`;if(!B.has(W))r.removeGrant(V.id,S.id)}for(let V of B){let[W,Y,te,le]=V.split("|");r.upsertGrant({organizationId:a.id,membershipId:j.id,effect:W,capability:Y,scope:te==="organization"?{type:"organization"}:{type:te,id:le},source:"legacy"})}}for(let h of r.listMemberships(a.id))if(h.source==="legacy"&&!m.has(h.actorId))r.revokeMembership(h.id)}async function _e(e){let{controlPlane:t,environment:r,actor:a}=e,l=E(t.store,a),m=t.environments.get(r),h=e.resourceSlug&&m?t.store.listResources(t.project.id,m.id).find((C)=>C.slug===e.resourceSlug):void 0,S=new c(t.store,{workerId:`dashboard:${process.pid}`}),R=S.enqueue({projectId:t.project.id,environmentId:m?.id,resourceId:h?.id,actorId:l.id,kind:e.kind,input:e.input??{},lockKey:h?`resource:${h.id}`:m?`environment:${m.id}`:`project:${t.project.id}`,providerKey:h?.provider??"dashboard",buildSlot:e.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!S.claim(R.id)?.operation)throw Error(`Could not claim control-plane operation ${R.id}`);try{let C=await e.execute(),T=typeof C.stdout==="string"?String(C.stdout):"",j=typeof C.stderr==="string"?String(C.stderr):"";if(T)S.appendLog(R.id,T,{stream:"stdout"});if(j)S.appendLog(R.id,j,{stream:"stderr"});let B=C.ok?S.complete(R.id,tf(C)):S.fail(R.id,Rw(C),tf(C));return{result:C,operation:B}}catch(C){throw S.fail(R.id,C instanceof Error?C.message:String(C),{ok:!1,threw:!0}),C}}function Rw(e){let t=e;return String(t.error??t.stderr??"Operation failed")}function tf(e){let t=e,r=typeof t.stdout==="string"?t.stdout:"",a=typeof t.stderr==="string"?t.stderr:"",l={ok:e.ok,stdoutBytes:Buffer.byteLength(r),stderrBytes:Buffer.byteLength(a)};if(typeof t.operation==="string")l.operation=t.operation;if(typeof t.error==="string")l.error=t.error;return s(l)}var au=[{id:"server.overview",path:"/",label:"Dashboard",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/server"]},{id:"server.activity",path:"/server/activity",label:"Activity",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/activity"]},{id:"services.list",path:"/server/sites",label:"Services",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/sites","/services"]},{id:"deployments.list",path:"/server/deployments",label:"Deployments",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/deployments"]},{id:"logs.list",path:"/server/logs",label:"Logs",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/logs"]},{id:"sources.integrations",path:"/integrations",label:"Git integrations",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.create",path:"/applications/new",label:"Create application",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.compose",path:"/applications/compose",label:"Compose applications",group:"applications",modes:["server"],adminOnly:!1},{id:"operations.queue",path:"/operations/queue",label:"Deployment queue",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.previews",path:"/operations/previews",label:"Preview environments",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.releases",path:"/operations/releases",label:"Releases & promotion",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"runtime.workloads",path:"/operations/workloads",label:"Workloads",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"observability.overview",path:"/operations/observability",label:"Observability",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"alerts.overview",path:"/operations/alerts",label:"Alerts & health",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"spend.overview",path:"/operations/spend",label:"Spend & budgets",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"automation.jobs",path:"/operations/jobs",label:"Workers & schedules",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/workers","/serverless/scheduler"]},{id:"configuration.entries",path:"/operations/configuration",label:"Environment & secrets",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/serverless/secrets"]},{id:"metrics.overview",path:"/server/metrics",label:"Metrics",group:"operations",modes:["server"],adminOnly:!0},{id:"runtime.services",path:"/server/services",label:"Runtime services",group:"operations",modes:["server"],adminOnly:!0},{id:"backups.list",path:"/data/backups",label:"Backups & recovery",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/backups"]},{id:"volumes.list",path:"/data/volumes",label:"Persistent volumes",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:[]},{id:"fleet.list",path:"/server/fleet",label:"Fleet inventory",group:"operations",modes:["server"],adminOnly:!1,legacyPaths:[]},{id:"operations.run",path:"/server/actions",label:"Run operations",group:"operations",modes:["server"],adminOnly:!0},{id:"infrastructure.topology",path:"/infrastructure/topology",label:"Infrastructure map",group:"infrastructure",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/topology"]},{id:"data.services",path:"/data/services",label:"Data services",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/database","/databases","/server/database","/serverless/data"]},{id:"network.firewall",path:"/server/firewall",label:"Network & firewall",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"security.posture",path:"/security",label:"Security posture",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/security"]},{id:"access.ssh",path:"/server/ssh-keys",label:"SSH keys",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"runtime.terminal",path:"/server/terminal",label:"Terminal",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"organization.people",path:"/server/team",label:"People & access",group:"organization",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/team"]},{id:"organization.automation",path:"/account/automation",label:"API & automation",group:"organization",modes:["server","serverless"],adminOnly:!0},{id:"serverless.overview",path:"/serverless",label:"Dashboard",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.deployments",path:"/serverless/deployments",label:"Deployments",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.logs",path:"/serverless/logs",label:"Logs",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.metrics",path:"/serverless/metrics",label:"Metrics",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.traces",path:"/serverless/traces",label:"Traces",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.functions",path:"/serverless/functions",label:"Functions",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.queues",path:"/serverless/queues",label:"Queues",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.assets",path:"/serverless/assets",label:"Assets",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.network",path:"/serverless/firewall",label:"Network",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.alerts",path:"/serverless/alarms",label:"Alerts",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.cost",path:"/serverless/cost",label:"Costs",group:"settings",modes:["serverless"],adminOnly:!0}],Aw=new Map(au.flatMap((e)=>(e.legacyPaths??[]).map((t)=>[t,e.path])));function cu(e){return Aw.get(e)}function Ty(e,t){return au.filter((r)=>r.modes.includes(e)&&(!t||!r.adminOnly))}var Oc=()=>{};async function du(e,t=Oc){for(let r of e){let a=new o(r.replicaRegion),l;try{l=await a.headBucket(r.replicaBucket)}catch(m){if(m?.statusCode===301)throw Error(`Failover replica bucket ${r.replicaBucket} already exists outside ${r.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${r.name}.`);if(m?.statusCode===403)throw Error(`Failover replica bucket ${r.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${r.name}.failover.bucket to a name you own.`);throw m}if(l.exists&&l.region&&l.region!==r.replicaRegion)throw Error(`Failover replica bucket ${r.replicaBucket} is in ${l.region}, not ${r.replicaRegion}.`);if(!l.exists)t(`Creating failover replica bucket ${r.replicaBucket} in ${r.replicaRegion}`),await a.createBucket(r.replicaBucket);if(await a.putPublicAccessBlock(r.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await a.putBucketEncryption(r.replicaBucket,"AES256"),r.replicate){if((await a.getBucketVersioning(r.replicaBucket)).Status!=="Enabled")t(`Enabling versioning on ${r.replicaBucket} (S3 replication requires it)`),await a.putBucketVersioning(r.replicaBucket,"Enabled")}}}async function lu(e,t,r=Oc){for(let a of e){let l=t[a.distributionArnOutput];if(!l)throw Error(`Stack output ${a.distributionArnOutput} is missing, so the failover replica ${a.replicaBucket} cannot be scoped to its distribution.`);let m=new o(a.replicaRegion),R={Version:"2012-10-17",Statement:[...((await m.getBucketPolicy(a.replicaBucket))?.Statement??[]).filter((y)=>y?.Sid!==go),Od({replicaBucket:a.replicaBucket,distributionArn:l})]};r(`Granting ${l} read access to ${a.replicaBucket}`),await m.putBucketPolicy(a.replicaBucket,R)}}async function uu(e,t=Oc){let r={};for(let a of e){let l=new o(a.primaryRegion),m=new o(a.replicaRegion),[h,S]=await Promise.all([l.listAllObjects({bucket:a.primaryBucket}),m.listAllObjects({bucket:a.replicaBucket})]),R=new Map(S.map((C)=>[C.Key,C.Size])),y=h.filter((C)=>R.get(C.Key)!==C.Size);for(let C of y)await m.copyObject({sourceBucket:a.primaryBucket,sourceKey:C.Key,destinationBucket:a.replicaBucket,destinationKey:C.Key});if(y.length>0)t(`Copied ${y.length} object(s) from ${a.primaryBucket} to ${a.replicaBucket}`);r[a.replicaBucket]=y.length}return r}async function pu(e,t=Oc){for(let r of e){let a=new o(r.replicaRegion);if(!(await a.headBucket(r.replicaBucket)).exists)continue;await a.emptyBucket(r.replicaBucket),await a.deleteBucket(r.replicaBucket),t(`Deleted failover replica bucket ${r.replicaBucket}`)}}import Bi from"node:process";import{existsSync as Cw}from"node:fs";import{join as Pw}from"node:path";async function gu(e){let t=Date.now(),r=e.sourceDir??"dist";if(!Cw(Pw(r,"index.html")))return tp(t,`${r}/ has no index.html — build first.`);if(!Bi.env.AWS_ACCESS_KEY_ID||!Bi.env.AWS_SECRET_ACCESS_KEY)return tp(t,"Missing AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in env.");let a=_w(e.dnsProvider);if("error"in a)return tp(t,a.error);let l=await fn({siteName:e.siteName,region:e.region??"us-east-1",domain:e.domain,bucket:e.bucket,stackName:e.stackName,certificateArn:e.certificateArn,defaultRootObject:e.defaultRootObject??"index.html",errorDocument:e.errorDocument??"404.html",cacheControl:e.cacheControl??"max-age=3600, public",sourceDir:r,cleanBucket:e.cleanBucket??!1,singlePageApp:e.singlePageApp??!1,dnsProvider:a,tags:{ManagedBy:"ts-cloud",Application:e.siteName,...e.tags},onProgress:e.onProgress});return{success:!!l.success,domain:l.domain,url:l.domain?`https://${l.domain}`:l.distributionDomain?`https://${l.distributionDomain}`:void 0,bucket:l.bucket,distributionId:l.distributionId,distributionDomain:l.distributionDomain,certificateArn:l.certificateArn,filesUploaded:l.filesUploaded,filesSkipped:l.filesSkipped,message:l.message,durationMs:Date.now()-t}}function _w(e){let t=typeof e==="string"?{provider:e}:e??{provider:"porkbun"};if(t.provider==="porkbun"){let r=t,a=r?.apiKey??Bi.env.PORKBUN_API_KEY,l=r?.secretKey??Bi.env.PORKBUN_SECRET_KEY??Bi.env.PORKBUN_SECRET_API_KEY;if(!a||!l)return{error:"Missing PORKBUN_API_KEY / PORKBUN_SECRET_KEY in env."};return{provider:"porkbun",apiKey:a,secretKey:l}}if(t.provider==="godaddy"){let r=t,a=r?.apiKey??Bi.env.GODADDY_API_KEY,l=r?.secretKey??Bi.env.GODADDY_API_SECRET,m=r?.environment??Bi.env.GODADDY_ENVIRONMENT;if(!a||!l)return{error:"Missing GODADDY_API_KEY / GODADDY_API_SECRET in env."};return{provider:"godaddy",apiKey:a,apiSecret:l,environment:m}}return{error:`Unsupported DNS provider: ${t.provider}`}}function tp(e,t){return{success:!1,message:t,durationMs:Date.now()-e}}import{createHash as Tw}from"node:crypto";var xw=`let coldStart = true
+`))}import{createHash as kw}from"node:crypto";function Iw(e){return kw("sha256").update(ko(e)).digest("hex")}function ko(e){if(Array.isArray(e))return`[${e.map((t)=>ko(t)).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0&&typeof t!=="function").sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${ko(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function E(e,t){let r=`dashboard:${t.username.toLowerCase()}`;return e.getActorByExternalId("user",r)??e.createActor({kind:"user",externalId:r,displayName:t.name??t.username,metadata:{source:"dashboard",role:t.role}})}function ou(e,t){let r=new hi({cwd:e}),a=Iw(t),l=r.getProjectBySlug(t.project.slug),m=t.project.slug.length>=3?t.project.slug:`${t.project.slug}-org`,h=(l?.organizationId?r.getOrganization(l.organizationId):void 0)??r.getOrganizationBySlug(m)??r.createOrganization({id:l?.organizationId,slug:m,name:t.project.name}),S=l?l.name!==t.project.name||l.desiredConfigHash!==a||l.organizationId!==h.id?r.updateProject(l.id,l.version,{name:t.project.name,organizationId:h.id,desiredConfigHash:a}):l:r.createProject({organizationId:h.id,slug:t.project.slug,name:t.project.name,desiredConfigHash:a}),R=new Map;for(let[j,B]of Object.entries(t.environments??{})){let W=r.getEnvironmentBySlug(S.id,j)??r.createEnvironment({projectId:S.id,slug:j,name:j.replace(/(^|[-_])(\w)/g,(ce,Ee,Re)=>Re.toUpperCase()),kind:String(B?.type??j),region:B?.region??t.project.region,desiredState:s(B)});R.set(j,W);let Y=new Map(r.listResources(S.id,W.id).map((ce)=>[`${ce.kind}:${ce.slug}`,ce])),te=(ce,Ee,Re,de)=>{let Me=`${ce}:${Ee}`,ae=Y.get(Me),Le=s(de);if(ae){if(ae.name!==Re||ko(ae.desiredState)!==ko(Le))Y.set(Me,r.updateResource(ae.id,ae.version,{name:Re,desiredState:Le}));return}let Je=r.createResource({projectId:S.id,environmentId:W.id,kind:ce,slug:Ee,name:Re,provider:t.cloud?.provider,desiredState:Le,metadata:{source:"cloud-config"}});Y.set(Me,Je)};for(let[ce,Ee]of Object.entries(t.sites??{}))te("application",ce,ce,Ee);let le=B?.app;if(le)for(let ce of["http","queue","cli"])te("function",ce,`${ce.toUpperCase()} function`,{...s(le),function:ce});let X=t.infrastructure;for(let[ce,Ee]of Object.entries(X?.functions??{}))te("function",ce,ce,Ee);if(X?.compute)te("server",`${S.slug}-server`,S.name,{...s(X.compute),label:S.name});for(let[ce,Ee]of Object.entries(X?.databases??{}))te("database",ce,ce,Ee);if(X?.appDatabase)te("database","application-database","Application database",X.appDatabase);else if(X?.database)te("database","application-database","Application database",{engine:X.database})}let y=new c(r).recoverExpired(),C=r.reconcileOrphanedOperations({policy:"fail"}),T={requeued:y.requeued+C.requeued,failed:y.failed+y.cancelled+C.failed};return{store:r,organization:h,project:S,environments:R,reconciliation:T}}var Ew=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function Zi(e,t){let{store:r,organization:a,project:l}=e,m=new Set;for(let h of t){let S=E(r,h);m.add(S.id);let R=r.getMembershipForActor(a.id,S.id);if(R&&R.source!=="legacy")continue;let y=r.listResources(l.id).filter((V)=>V.kind==="application"&&Object.hasOwn(h.sites,V.slug)),C=h.role==="admin"?"owner":"viewer",T=h.role==="admin"||y.length===0?{type:"organization"}:{type:"resource",id:y[0].id},j=R?R.roleTemplate!==C||ko(R.scope)!==ko(T)?r.updateMembership({id:R.id,roleTemplate:C,scope:T,actorId:S.id}):R:r.createMembership({organizationId:a.id,actorId:S.id,roleTemplate:C,scope:T,source:"legacy"}),B=new Set;if(h.role==="member"&&y.length===0)for(let V of $t("viewer"))B.add(`deny|${V}|organization|`);for(let V of y){let W=h.sites[V.slug];for(let Y of Ew)B.add(`allow|${Y}|resource|${V.id}`);if(W==="owner")B.add(`allow|config:write|resource|${V.id}`)}for(let V of r.listGrants(j.id).filter((W)=>W.source==="legacy")){let W=`${V.effect}|${V.capability}|${V.scope.type}|${V.scope.id??""}`;if(!B.has(W))r.removeGrant(V.id,S.id)}for(let V of B){let[W,Y,te,le]=V.split("|");r.upsertGrant({organizationId:a.id,membershipId:j.id,effect:W,capability:Y,scope:te==="organization"?{type:"organization"}:{type:te,id:le},source:"legacy"})}}for(let h of r.listMemberships(a.id))if(h.source==="legacy"&&!m.has(h.actorId))r.revokeMembership(h.id)}async function _e(e){let{controlPlane:t,environment:r,actor:a}=e,l=E(t.store,a),m=t.environments.get(r),h=e.resourceSlug&&m?t.store.listResources(t.project.id,m.id).find((C)=>C.slug===e.resourceSlug):void 0,S=new c(t.store,{workerId:`dashboard:${process.pid}`}),R=S.enqueue({projectId:t.project.id,environmentId:m?.id,resourceId:h?.id,actorId:l.id,kind:e.kind,input:e.input??{},lockKey:h?`resource:${h.id}`:m?`environment:${m.id}`:`project:${t.project.id}`,providerKey:h?.provider??"dashboard",buildSlot:e.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!S.claim(R.id)?.operation)throw Error(`Could not claim control-plane operation ${R.id}`);try{let C=await e.execute(),T=typeof C.stdout==="string"?String(C.stdout):"",j=typeof C.stderr==="string"?String(C.stderr):"";if(T)S.appendLog(R.id,T,{stream:"stdout"});if(j)S.appendLog(R.id,j,{stream:"stderr"});let B=C.ok?S.complete(R.id,tf(C)):S.fail(R.id,Rw(C),tf(C));return{result:C,operation:B}}catch(C){throw S.fail(R.id,C instanceof Error?C.message:String(C),{ok:!1,threw:!0}),C}}function Rw(e){let t=e;return String(t.error??t.stderr??"Operation failed")}function tf(e){let t=e,r=typeof t.stdout==="string"?t.stdout:"",a=typeof t.stderr==="string"?t.stderr:"",l={ok:e.ok,stdoutBytes:Buffer.byteLength(r),stderrBytes:Buffer.byteLength(a)};if(typeof t.operation==="string")l.operation=t.operation;if(typeof t.error==="string")l.error=t.error;return s(l)}var au=[{id:"server.overview",path:"/",label:"Dashboard",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/server"]},{id:"server.activity",path:"/server/activity",label:"Activity",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/activity"]},{id:"services.list",path:"/server/sites",label:"Services",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/sites","/services"]},{id:"deployments.list",path:"/server/deployments",label:"Deployments",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/deployments"]},{id:"logs.list",path:"/server/logs",label:"Logs",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/logs"]},{id:"sources.integrations",path:"/integrations",label:"Git integrations",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.create",path:"/applications/new",label:"Create application",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.compose",path:"/applications/compose",label:"Compose applications",group:"applications",modes:["server"],adminOnly:!1},{id:"operations.queue",path:"/operations/queue",label:"Deployment queue",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.previews",path:"/operations/previews",label:"Preview environments",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.releases",path:"/operations/releases",label:"Releases & promotion",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"runtime.workloads",path:"/operations/workloads",label:"Workloads",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"observability.overview",path:"/operations/observability",label:"Observability",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"alerts.overview",path:"/operations/alerts",label:"Alerts & health",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"spend.overview",path:"/operations/spend",label:"Spend & budgets",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"automation.jobs",path:"/operations/jobs",label:"Workers & schedules",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/workers","/serverless/scheduler"]},{id:"configuration.entries",path:"/operations/configuration",label:"Environment & secrets",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/serverless/secrets"]},{id:"metrics.overview",path:"/server/metrics",label:"Metrics",group:"operations",modes:["server"],adminOnly:!0},{id:"runtime.services",path:"/server/services",label:"Runtime services",group:"operations",modes:["server"],adminOnly:!0},{id:"backups.list",path:"/data/backups",label:"Backups & recovery",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/backups"]},{id:"volumes.list",path:"/data/volumes",label:"Persistent volumes",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:[]},{id:"fleet.list",path:"/server/fleet",label:"Fleet inventory",group:"operations",modes:["server"],adminOnly:!1,legacyPaths:[]},{id:"operations.run",path:"/server/actions",label:"Run operations",group:"operations",modes:["server"],adminOnly:!0},{id:"infrastructure.topology",path:"/infrastructure/topology",label:"Infrastructure map",group:"infrastructure",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/topology"]},{id:"data.services",path:"/data/services",label:"Data services",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/database","/databases","/server/database","/serverless/data"]},{id:"network.firewall",path:"/server/firewall",label:"Network & firewall",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"security.posture",path:"/security",label:"Security posture",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/security"]},{id:"access.ssh",path:"/server/ssh-keys",label:"SSH keys",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"runtime.terminal",path:"/server/terminal",label:"Terminal",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"organization.people",path:"/server/team",label:"People & access",group:"organization",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/team"]},{id:"organization.automation",path:"/account/automation",label:"API & automation",group:"organization",modes:["server","serverless"],adminOnly:!0},{id:"serverless.overview",path:"/serverless",label:"Dashboard",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.deployments",path:"/serverless/deployments",label:"Deployments",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.logs",path:"/serverless/logs",label:"Logs",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.metrics",path:"/serverless/metrics",label:"Metrics",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.traces",path:"/serverless/traces",label:"Traces",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.functions",path:"/serverless/functions",label:"Functions",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.queues",path:"/serverless/queues",label:"Queues",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.assets",path:"/serverless/assets",label:"Assets",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.network",path:"/serverless/firewall",label:"Network",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.alerts",path:"/serverless/alarms",label:"Alerts",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.cost",path:"/serverless/cost",label:"Costs",group:"settings",modes:["serverless"],adminOnly:!0}],Aw=new Map(au.flatMap((e)=>(e.legacyPaths??[]).map((t)=>[t,e.path])));function cu(e){return Aw.get(e)}function Ty(e,t){return au.filter((r)=>r.modes.includes(e)&&(!t||!r.adminOnly))}var Oc=()=>{};async function du(e,t=Oc){for(let r of e){let a=new o(r.replicaRegion),l;try{l=await a.headBucket(r.replicaBucket)}catch(m){if(m?.statusCode===301)throw Error(`Failover replica bucket ${r.replicaBucket} already exists outside ${r.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${r.name}.`);if(m?.statusCode===403)throw Error(`Failover replica bucket ${r.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${r.name}.failover.bucket to a name you own.`);throw m}if(l.exists&&l.region&&l.region!==r.replicaRegion)throw Error(`Failover replica bucket ${r.replicaBucket} is in ${l.region}, not ${r.replicaRegion}.`);if(!l.exists)t(`Creating failover replica bucket ${r.replicaBucket} in ${r.replicaRegion}`),await a.createBucket(r.replicaBucket);if(await a.putPublicAccessBlock(r.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await a.putBucketEncryption(r.replicaBucket,"AES256"),r.replicate){if((await a.getBucketVersioning(r.replicaBucket)).Status!=="Enabled")t(`Enabling versioning on ${r.replicaBucket} (S3 replication requires it)`),await a.putBucketVersioning(r.replicaBucket,"Enabled")}}}async function lu(e,t,r=Oc){for(let a of e){let l=t[a.distributionArnOutput];if(!l)throw Error(`Stack output ${a.distributionArnOutput} is missing, so the failover replica ${a.replicaBucket} cannot be scoped to its distribution.`);let m=new o(a.replicaRegion),R={Version:"2012-10-17",Statement:[...((await m.getBucketPolicy(a.replicaBucket))?.Statement??[]).filter((y)=>y?.Sid!==go),xd({replicaBucket:a.replicaBucket,distributionArn:l})]};r(`Granting ${l} read access to ${a.replicaBucket}`),await m.putBucketPolicy(a.replicaBucket,R)}}async function uu(e,t=Oc){let r={};for(let a of e){let l=new o(a.primaryRegion),m=new o(a.replicaRegion),[h,S]=await Promise.all([l.listAllObjects({bucket:a.primaryBucket}),m.listAllObjects({bucket:a.replicaBucket})]),R=new Map(S.map((C)=>[C.Key,C.Size])),y=h.filter((C)=>R.get(C.Key)!==C.Size);for(let C of y)await m.copyObject({sourceBucket:a.primaryBucket,sourceKey:C.Key,destinationBucket:a.replicaBucket,destinationKey:C.Key});if(y.length>0)t(`Copied ${y.length} object(s) from ${a.primaryBucket} to ${a.replicaBucket}`);r[a.replicaBucket]=y.length}return r}async function pu(e,t=Oc){for(let r of e){let a=new o(r.replicaRegion);if(!(await a.headBucket(r.replicaBucket)).exists)continue;await a.emptyBucket(r.replicaBucket),await a.deleteBucket(r.replicaBucket),t(`Deleted failover replica bucket ${r.replicaBucket}`)}}import Bi from"node:process";import{existsSync as Cw}from"node:fs";import{join as Pw}from"node:path";async function gu(e){let t=Date.now(),r=e.sourceDir??"dist";if(!Cw(Pw(r,"index.html")))return tp(t,`${r}/ has no index.html — build first.`);if(!Bi.env.AWS_ACCESS_KEY_ID||!Bi.env.AWS_SECRET_ACCESS_KEY)return tp(t,"Missing AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in env.");let a=_w(e.dnsProvider);if("error"in a)return tp(t,a.error);let l=await fn({siteName:e.siteName,region:e.region??"us-east-1",domain:e.domain,bucket:e.bucket,stackName:e.stackName,certificateArn:e.certificateArn,defaultRootObject:e.defaultRootObject??"index.html",errorDocument:e.errorDocument??"404.html",cacheControl:e.cacheControl??"max-age=3600, public",sourceDir:r,cleanBucket:e.cleanBucket??!1,singlePageApp:e.singlePageApp??!1,dnsProvider:a,tags:{ManagedBy:"ts-cloud",Application:e.siteName,...e.tags},onProgress:e.onProgress});return{success:!!l.success,domain:l.domain,url:l.domain?`https://${l.domain}`:l.distributionDomain?`https://${l.distributionDomain}`:void 0,bucket:l.bucket,distributionId:l.distributionId,distributionDomain:l.distributionDomain,certificateArn:l.certificateArn,filesUploaded:l.filesUploaded,filesSkipped:l.filesSkipped,message:l.message,durationMs:Date.now()-t}}function _w(e){let t=typeof e==="string"?{provider:e}:e??{provider:"porkbun"};if(t.provider==="porkbun"){let r=t,a=r?.apiKey??Bi.env.PORKBUN_API_KEY,l=r?.secretKey??Bi.env.PORKBUN_SECRET_KEY??Bi.env.PORKBUN_SECRET_API_KEY;if(!a||!l)return{error:"Missing PORKBUN_API_KEY / PORKBUN_SECRET_KEY in env."};return{provider:"porkbun",apiKey:a,secretKey:l}}if(t.provider==="godaddy"){let r=t,a=r?.apiKey??Bi.env.GODADDY_API_KEY,l=r?.secretKey??Bi.env.GODADDY_API_SECRET,m=r?.environment??Bi.env.GODADDY_ENVIRONMENT;if(!a||!l)return{error:"Missing GODADDY_API_KEY / GODADDY_API_SECRET in env."};return{provider:"godaddy",apiKey:a,apiSecret:l,environment:m}}return{error:`Unsupported DNS provider: ${t.provider}`}}function tp(e,t){return{success:!1,message:t,durationMs:Date.now()-e}}import{createHash as Tw}from"node:crypto";var xw=`let coldStart = true
 const initializedAt = new Date().toISOString()
 export const handler = async (event) => {
   const currentColdStart = coldStart
@@ -36,41 +36,41 @@ export const handler = async (event) => {
     body: JSON.stringify({ ok: statusCode === 200, service: 'ts-cloud-static-api', path, coldStart: currentColdStart, initializedAt })
   }
 }
-`;function of(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function Dw(e){return["NoSuchEntity","ResourceNotFoundException","404"].includes(of(e))}function rf(e){return["EntityAlreadyExists","ResourceAlreadyExistsException","ResourceConflictException","409"].includes(of(e))}function nf(e,t){let r=e?.Items;if(!r)return[];if(Array.isArray(r))return r;let a=r[t];if(a===void 0)return[];return Array.isArray(a)?a:[a]}function rp(e){let t=e?.Aliases?.Items,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function Ow(e){if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected CloudFront alias is invalid");if(!/^[A-Za-z0-9-_]{1,64}$/.test(e.functionName))throw Error("Lambda function name is invalid");let t=e.pathPattern?.startsWith("/")?e.pathPattern:`/${e.pathPattern||"api/*"}`;if(t==="/"||t==="/*"||!t.endsWith("*"))throw Error("API path must be a non-default wildcard pattern such as /api/*");let r=e.originId||`${e.functionName}-url`,a=e.roleName||`${e.functionName}-execution`;if(!/^[A-Za-z0-9_.-]{1,64}$/.test(a))throw Error("IAM role name is invalid");let l=e.memorySize??256,m=e.timeout??10,h=e.logRetentionDays??14;if(l<128||l>10240)throw Error("Lambda memory must be between 128 and 10240 MB");if(m<1||m>900)throw Error("Lambda timeout must be between 1 and 900 seconds");return{region:e.region||"us-east-1",pathPattern:t,originId:r,roleName:a,memorySize:l,timeout:m,logRetentionDays:h}}function Ah(e){let t=e.region||"us-east-1";return{cloudfront:new I(e.profile),iam:new Ie(t,e.profile),lambda:new b(t,e.profile),logs:new ye(t,e.profile),sts:new Ae(t,e.profile),sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}async function wy(e,t){let r=Ow(e),a=t||Ah({profile:e.profile,region:r.region}),[l,m,h]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId),a.cloudfront.getDistributionConfig(e.distributionId)]);if(!l.Account)throw Error("AWS identity did not return an account ID");if(!m.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!(rp(m).length?rp(m):rp(h.DistributionConfig)).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let R,y=!0;try{R=await a.iam.getRole({RoleName:r.roleName})}catch(ot){if(!Dw(ot))throw ot;y=!1}let C=R?.Arn||`arn:aws:iam::${l.Account}:role/${r.roleName}`,T=await a.lambda.functionExists(e.functionName),j=T?await a.lambda.getFunctionUrl(e.functionName):null,B=await a.cloudfront.listOriginAccessControls(),V=`${e.functionName}-lambda-url`,W=B.some((ot)=>ot.Name===V&&ot.OriginAccessControlOriginType==="lambda"),Y=nf(h.DistributionConfig.Origins,"Origin"),te=nf(h.DistributionConfig.CacheBehaviors,"CacheBehavior"),le=Y.some((ot)=>String(ot.Id)===r.originId),X=te.some((ot)=>String(ot.PathPattern)===r.pathPattern),ce=[...!y?[`create IAM execution role ${r.roleName}`]:[`reconcile IAM execution policy ${r.roleName}`],...T?[`update Lambda ${e.functionName} code and configuration`]:[`create Lambda ${e.functionName}`],...!j?["create private AWS_IAM function URL"]:[],...!W?[`create Lambda origin access control ${V}`]:[],"grant CloudFront function-URL and invocation permissions",`${X?"reconcile":"add"} ${r.pathPattern} behavior without changing the default behavior`],Ee={command:`cloud cdn:origin:remove ${e.distributionId} FUNCTION_URL_HOST --id ${r.originId} --path '${r.pathPattern}' --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,removeFunction:!T,removeRole:!y},Re={mode:e.apply?"apply":"plan",accountId:l.Account,identityArn:l.Arn,distribution:{id:m.Id,arn:m.ARN,alias:e.expectedAlias,domainName:m.DomainName,status:m.Status},function:{name:e.functionName,existed:T,runtime:"nodejs22.x",urlExisted:!!j,url:j?.FunctionUrl},role:{name:r.roleName,existed:y,arn:C},origin:{id:r.originId,pathPattern:r.pathPattern,existed:le,behaviorExisted:X,accessControlExisted:W},changes:ce,rollback:Ee,applied:!1};if(!e.apply)return Re;let de=`${e.distributionId}:${r.pathPattern}`;if(e.confirm!==de)throw Error(`Pass exact confirmation token ${de} to mutate the live distribution`);if(!R)R=await a.iam.createRole({RoleName:r.roleName,Description:`Execution role for ${e.functionName}`,AssumeRolePolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]}),Tags:[{Key:"ManagedBy",Value:"ts-cloud"}]});await a.iam.putRolePolicy({RoleName:r.roleName,PolicyName:"lambda-logs",PolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:${r.region}:${l.Account}:log-group:/aws/lambda/${e.functionName}:*`}]})});try{await a.logs.createLogGroup(`/aws/lambda/${e.functionName}`,{ManagedBy:"ts-cloud"})}catch(ot){if(!rf(ot))throw ot}await a.logs.putRetentionPolicy(`/aws/lambda/${e.functionName}`,r.logRetentionDays);let Me=e.code||xw;if(T)await a.lambda.updateFunctionCodeInline(e.functionName,Me,"index.mjs"),await a.lambda.waitForFunctionActive(e.functionName),await a.lambda.updateFunctionConfiguration({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:R.Arn,Handler:"index.handler",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize});else{let ot;for(let Pt=0;Pt<8;Pt++)try{await a.lambda.createFunctionWithCode({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:R.Arn,Handler:"index.handler",Code:Me,Filename:"index.mjs",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize}),ot=void 0;break}catch(Qt){if(ot=Qt,!String(Qt.message).toLowerCase().includes("role"))throw Qt;await a.sleep(1000)}if(ot)throw ot}await a.lambda.waitForFunctionActive(e.functionName);let ae=j||await a.lambda.createFunctionUrl({FunctionName:e.functionName,AuthType:"AWS_IAM",InvokeMode:"BUFFERED"});if(!ae.FunctionUrl)throw Error("Lambda did not return a function URL");let Le=new URL(ae.FunctionUrl).hostname,Je=await a.cloudfront.findOrCreateOriginAccessControl(V,"lambda"),gt=m.ARN||`arn:aws:cloudfront::${l.Account}:distribution/${e.distributionId}`,Jt=[{FunctionName:e.functionName,StatementId:"AllowCloudFrontFunctionUrl",Action:"lambda:InvokeFunctionUrl",Principal:"cloudfront.amazonaws.com",SourceArn:gt,FunctionUrlAuthType:"AWS_IAM"},{FunctionName:e.functionName,StatementId:"AllowCloudFrontInvoke",Action:"lambda:InvokeFunction",Principal:"cloudfront.amazonaws.com",SourceArn:gt,InvokedViaFunctionUrl:!0}];for(let ot of Jt)try{await a.lambda.addPermission(ot)}catch(Pt){if(!rf(Pt))throw Pt}return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:Le,pathPattern:r.pathPattern,originAccessControlId:Je.Id}),{...Re,function:{...Re.function,url:ae.FunctionUrl},applied:!0}}async function Ry(e){let t=`https://${e.alias}/`,r=`https://${e.alias}/api/health`,a=await fetch(t,{redirect:"follow",headers:{"cache-control":"no-cache"}}),l=new Uint8Array(await a.arrayBuffer()),m=Tw("sha256").update(l).digest("hex"),h=Date.now(),S=await fetch(r,{redirect:"follow",headers:{"cache-control":"no-cache"}}),R=Date.now()-h,y=await S.text(),C=y;try{C=JSON.parse(y)}catch{}let T;if(e.logs&&e.functionName){let j=await e.logs.filterLogEvents({logGroupName:`/aws/lambda/${e.functionName}`,startTime:h-60000,filterPattern:'"Init Duration"',limit:25});for(let B of j.events||[]){let V=B.message?.match(/Init Duration:\s*([0-9.]+)\s*ms/i);if(V)T=Number(V[1])}}return{frontend:{url:t,status:a.status,sha256:m,unchanged:e.expectedFrontendSha256?m===e.expectedFrontendSha256:void 0,bytes:l.byteLength},api:{url:r,status:S.status,latencyMs:R,healthy:S.ok&&!!C?.ok,body:C},coldStart:{observed:T!==void 0,initDurationMs:T},verifiedAt:(e.now?.()||new Date).toISOString()}}function Dy(e){let t=(e.memoryMb||256)/1024,r=Math.max(0,e.requests-(e.includeFreeTier===!1?0:1e6)),a=Math.max(0,e.requests*(e.averageDurationMs/1000)*t-(e.includeFreeTier===!1?0:400000)),l=r/1e6*0.2+a*0.0000166667,m=9.010025,h=16.425;return{lambdaUsd:Number(l.toFixed(2)),alwaysOnFargateAndAlbUsd:Number(25.435025000000003 .toFixed(2)),assumptions:["us-east-1 public list rates snapshot, July 2026","Lambda x86 request and duration pricing with optional monthly free tier","Fargate comparison uses one always-on 0.25 vCPU/0.5 GB task plus one ALB before LCU charges","excludes CloudFront, data transfer, logs, taxes, and application data services"]}}import{createHash as $w}from"node:crypto";function Nw(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function jw(e){return Nw(e)==="ValidationError"&&String(e.message).includes("does not exist")}function Bw(e){return Object.fromEntries((e||[]).map((t)=>[t.OutputKey,t.OutputValue]))}function Mw(e){let t=e?.Aliases?.Items??e?.Aliases,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function sf(e){if(!/^[a-z][a-z0-9-]{1,62}$/.test(e.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected distribution alias is invalid");let t=e.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!t)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let r=e.stackName||`${e.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(r))throw Error("CloudFormation stack name is invalid");let a=e.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(a)||a==="/*")throw Error("Backend path must be a non-default wildcard pattern");let l=e.originId||`${e.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(l))throw Error("CloudFront origin ID is invalid");if(e.originVerifySecret&&e.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!e.originDomain!==!!e.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:r,region:e.region||"us-east-1",pathPattern:a,originId:l,digest:t}}function yh(e){let t=e.region||"us-east-1";return{cloudformation:new f(t,e.profile),cloudfront:new I(e.profile),sts:new Ae(t,e.profile),fetch,sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}function Ih(e){let t=sf(e),r=Fd({name:e.name,slug:e.slug,domain:e.originDomain||e.expectedAlias,imageUri:e.imageUri,certificateArn:e.certificateArn,originVerifySecret:e.originVerifySecret,desiredCount:e.desiredCount,database:e.database,cache:e.cache,queue:e.queue}),a=Md(r);return a.Description=`Managed backend for existing static frontend ${e.expectedAlias}`,a.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:e.distributionId,ExistingDistributionAlias:e.expectedAlias,BackendPathPattern:t.pathPattern,ContainerDigest:t.digest},a}async function Lw(e,t,r){let a;for(let l=0;l<30;l++){let m=Date.now();try{let h=await e.fetch(t,{redirect:"manual",headers:r?{"x-origin-verify":r}:void 0}),S=Date.now()-m,R=await h.text(),y=R;try{y=JSON.parse(R)}catch{}if(h.ok)return{url:t,status:h.status,latencyMs:S,body:y};a=Error(`origin returned ${h.status}`)}catch(h){a=h}if(l<29)await e.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${a instanceof Error?a.message:String(a)}`)}async function Py(e,t){let r=sf(e),a=t||yh({region:r.region,profile:e.profile}),[l,m]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId)]);if(!l.Account)throw Error("AWS identity did not return an account ID");if(!m.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!Mw(m).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let h;try{h=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0]}catch(ce){if(!jw(ce))throw ce}let S=Ih(e),R=JSON.stringify(S);if(Buffer.byteLength(R)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let y=Object.values(S.Resources||{}).reduce((ce,Ee)=>(ce[Ee.Type]=(ce[Ee.Type]||0)+1,ce),{}),C=[`cloud cdn:origin:remove ${e.distributionId} ${e.originDomain||"ALB_HOST"} --id ${r.originId} --path '${r.pathPattern}' --profile ${e.profile||"default"} --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${r.stackName} only with an approved data-retention decision.`],T={mode:e.apply?"apply":"plan",accountId:l.Account,stack:{name:r.stackName,existed:!!h,status:h?.StackStatus,templateSha256:$w("sha256").update(R).digest("hex"),resourceCount:Object.keys(S.Resources||{}).length,resourceTypes:y},distribution:{id:m.Id,alias:e.expectedAlias,domainName:m.DomainName,status:m.Status,pathPattern:r.pathPattern,originId:r.originId},artifact:{imageUri:e.imageUri,digest:r.digest},services:{database:e.database!==!1,cache:e.cache!==!1,queue:e.queue!==!1,mail:"ses",desiredCount:e.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:C};if(!e.apply)return T;let j=`${e.distributionId}:${r.pathPattern}:${r.stackName}`;if(e.confirm!==j)throw Error(`Pass exact confirmation token ${j} to provision the backend and change live routing`);if(h)try{await a.cloudformation.updateStack({stackName:r.stackName,templateBody:R,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-update-complete")}catch(ce){if(!String(ce.message).includes("No updates are to be performed"))throw ce}else await a.cloudformation.createStack({stackName:r.stackName,templateBody:R,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-create-complete");let B=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0],V=Bw(B?.Outputs),W=V.AppLoadBalancerDnsName;if(!W)throw Error("Backend stack did not return AppLoadBalancerDnsName");let Y=!1;if(e.originDomain&&e.originDomain!==W){if(!a.dns)throw Error(`External DNS provider is required to map ${e.originDomain} to ${W}`);let ce=await a.dns.upsertRecord(e.originDomain,{name:e.originDomain,type:"CNAME",content:W,ttl:300});if(!ce.success)throw Error(ce.message||"External DNS update failed");Y=!0}let te=e.originDomain||W,le=e.certificateArn?"https-only":"http-only",X=e.skipHealthCheck?void 0:await Lw(a,`${le==="https-only"?"https":"http"}://${te}/api/health`,e.originVerifySecret);return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:te,pathPattern:r.pathPattern,protocolPolicy:le,customHeaders:e.originVerifySecret?{"X-Origin-Verify":e.originVerifySecret}:void 0}),{...T,outputs:V,health:X,cloudFrontApplied:!0,dnsApplied:Y,applied:!0}}function Ny(e={}){let r={fargate:730*(e.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(e.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(r).reduce((a,l)=>a+l,0).toFixed(2)),components:Object.fromEntries(Object.entries(r).map(([a,l])=>[a,Number(l.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}import{execFileSync as Fw}from"node:child_process";import{createHash as zw}from"node:crypto";import{existsSync as af,mkdirSync as Uw,mkdtempSync as qw,readdirSync as Vw,readFileSync as Ww,rmSync as Hw,statSync as cf,writeFileSync as Kw}from"node:fs";import{tmpdir as Jw}from"node:os";import{basename as Gw,join as Rs,relative as Qw,resolve as np}from"node:path";var Yw=new Set([".git","node_modules","dist","coverage"]);function df(e,t=e){let r=[];for(let a of Vw(e).sort()){if(Yw.has(a))continue;let l=Rs(e,a);if(Td(l,t))continue;let m=cf(l);if(m.isDirectory())r.push(...df(l,t));else if(m.isFile())r.push(Qw(t,l))}return r}function Sh(e){let t=np(e);if(!af(t)||!cf(t).isDirectory())throw Error(`Container context does not exist: ${t}`);let r=zw("sha256");for(let a of df(t))r.update(a),r.update("\x00"),r.update(Ww(Rs(t,a))),r.update("\x00");return r.digest("hex")}function Ch(e){return{ecr:new $e(e.region||"us-east-1",e.profile),run:(t,r,a)=>{Fw(t,r,{cwd:a?.cwd,env:a?.env,stdio:a?.stdio||"inherit"})}}}async function ky(e,t){let r=np(e.context),a=np(e.dockerfile||Rs(r,"Dockerfile"));if(!af(a))throw Error(`Dockerfile does not exist: ${a}`);if(!e.repository.split("/").every((V)=>/^[a-z0-9][a-z0-9._-]*$/.test(V)&&!/[._-]$/.test(V)&&!/[._-]{2}/.test(V)))throw Error("ECR repository name is invalid");let h=t||Ch(e),S=Sh(r),R=`sha-${S.slice(0,20)}`,y="";try{y=(await h.ecr.describeRepositories({repositoryNames:[e.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!y)y=(await h.ecr.createRepository({repositoryName:e.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!y)throw Error(`Could not resolve ECR repository URI for ${e.repository}`);await h.ecr.putLifecyclePolicy({repositoryName:e.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let C=`${y}:${R}`,T=qw(Rs(Jw(),"ts-cloud-container-"));try{h.run("docker",["version"],{stdio:"ignore"}),h.run("docker",["build","--platform",e.platform||"linux/amd64","--provenance=false","--sbom=false","--file",a,"--tag",C,r],{cwd:r});let V=(await h.ecr.getAuthorizationToken()).authorizationData?.[0];if(!V?.authorizationToken||!V.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let W=V.proxyEndpoint.replace(/^https?:\/\//,""),Y=Rs(T,"docker");Uw(Y,{recursive:!0}),Kw(Rs(Y,"config.json"),JSON.stringify({auths:{[W]:{auth:V.authorizationToken}}}),{mode:384}),h.run("docker",["push",C],{env:{...process.env,DOCKER_CONFIG:Y}})}finally{Hw(T,{recursive:!0,force:!0})}let B=(await h.ecr.describeImages({repositoryName:e.repository,imageIds:[{imageTag:R}]})).imageDetails?.[0]?.imageDigest;if(!B||!/^sha256:[a-f0-9]{64}$/i.test(B))throw Error(`ECR did not return an immutable digest for ${Gw(C)}`);return{repository:e.repository,tag:R,imageUri:C,digest:B,digestUri:`${y}@${B}`,contextSha256:S}}import{existsSync as Zw,readdirSync as Xw,readFileSync as ek,statSync as tk}from"node:fs";import{join as lf,relative as rk}from"node:path";function Eo(e,t){let r=e.environments?.[t]?.app;if(!r)throw Error(`No serverless app configured for environment '${t}'. Add environments.${t}.app to your config.`);let a=e.project.slug,l=e.environments?.[t]?.region||e.project.region||"us-east-1";return{app:r,slug:a,region:l,stackName:qt(e,t),artifactBucket:Nd(a,t),assetsBucket:po(a,t)}}async function Io(e,t=8){let r;for(let a=0;a<t;a++)try{return await e()}catch(l){let m=l?.code||l?.name||"",h=String(l?.message||"");if(m==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(h)){r=l,await new Promise((S)=>setTimeout(S,3000));continue}throw l}throw r}var uf=(e,t)=>`releases/${e}/${t}/current.json`;async function Nc(e,t,r,a){try{return await e.getObjectJson(t,uf(r,a))}catch{return null}}async function pf(e,t,r,a,l){await e.putObjectJson(t,uf(r,a),l)}async function nk(e,t){if(!e.secrets)return{};let r=new z(t),a={},l=Array.isArray(e.secrets)?e.secrets.map((m)=>({envName:m.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:m})):Object.entries(e.secrets).map(([m,h])=>({envName:m,secretId:h}));if(Array.isArray(e.secrets)){let m=new Map;for(let{envName:S,secretId:R}of l)m.set(S,[...m.get(S)??[],R]);let h=[...m.entries()].filter(([,S])=>S.length>1);if(h.length){let S=h.map(([R,y])=>`${R} ← ${y.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${S}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:m,secretId:h}of l){let R=(await r.getSecretValue({SecretId:h})).SecretString??"";try{let y=JSON.parse(R);if(y&&typeof y==="object"&&!Array.isArray(y)){for(let[C,T]of Object.entries(y))a[C]=String(T);continue}}catch{}a[m]=R}return a}function es(e,t){let r={},a=t.DbProxyEndpoint||t.DbEndpoint;if(a)r.DB_CONNECTION="mysql",r.DB_HOST=a,r.DB_PORT="3306",r.DB_DATABASE=r.DB_DATABASE||"app";if(t.CacheEndpoint){if(r.REDIS_HOST=t.CacheEndpoint,r.REDIS_PORT="6379",e.cache?.driver==="elasticache")r.CACHE_STORE="redis",r.CACHE_DRIVER="redis",r.SESSION_DRIVER="redis"}return r}function rr(e,t,r,a,l,m,h,S={}){let R=e.kind==="php"?Xd({cacheDriver:e.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:a,TSCLOUD_ENV:r,MAINTENANCE_MODE:"0",...e.octane?{TSCLOUD_OCTANE:"1"}:{},...e.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...e.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...R,...S,...t.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${t.slug}-${r}-cache`}:{},...h?{TSCLOUD_QUEUE:h,SQS_QUEUE:h}:{},...m?{ASSET_URL:m}:{},...e.env??{},...l}}function ik(e){let t=e.slice(e.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[t]??"application/octet-stream"}function*gf(e){for(let t of Xw(e)){let r=lf(e,t);if(tk(r).isDirectory())yield*gf(r);else yield r}}async function ok(e,t,r,a,l=!1){let m=0;for(let h of gf(r)){let S=rk(r,h).replace(/\\/g,"/");if(!l&&S.split("/").some((R)=>R.startsWith(".")))continue;await e.putObject({bucket:t,key:`${a}/${S}`,body:ek(h),contentType:ik(h),cacheControl:"public, max-age=31536000, immutable"}),m++}return m}function sk(e,t){let r=Object.entries(t).reduce((a,[l,m])=>a+Buffer.byteLength(`${l}=${m}`,"utf8"),0);if(r>4096){let a=Object.entries(t).map(([l,m])=>[l,Buffer.byteLength(`${l}=${m}`,"utf8")]).sort((l,m)=>m[1]-l[1]).slice(0,5).map(([l,m])=>`${l} (${m}B)`).join(", ");throw Error(`${e}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${a}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function Qa(e,t,r,a){sk(t,r),await Io(()=>e.updateFunctionConfiguration({FunctionName:t,Environment:{Variables:r}})),await e.waitForFunctionActive(t,120);let l=a.kind==="image"?{FunctionName:t,ImageUri:a.imageUri}:{FunctionName:t,S3Bucket:a.bucket,S3Key:a.key};await Io(()=>e.updateFunctionCode(l)),await e.waitForFunctionActive(t,120)}async function $c(e,t){let a=(await Io(()=>e.publishVersion({FunctionName:t}))).Version;if(!a)throw Error(`publishVersion returned no version for ${t}`);return await Io(()=>e.updateAlias({FunctionName:t,Name:"live",FunctionVersion:a})),a}async function Ea(e,t,r={}){let a=Eo(e,t),{app:l,slug:m,region:h,stackName:S,artifactBucket:R}=a,y=r.projectRoot??process.cwd();ls(`Deploying serverless app: ${m} (${t})`),k(`Stack: ${S}`),k(`Region: ${h}`);let C=new o(h),T=new f(h),j=new b(h),B=l.kind==="php",V=l.packaging==="image",W=Co(l),Y,te,le,X,ce=[];if(V&&W.usesLayer&&W.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${W.kind}${W.kind==="node"?` ${W.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(V){w("Building + pushing container image");let{buildAndPushServerlessImage:be}=await import("./chunk-d8wcqgpx.js"),De=await be({app:l,projectRoot:y,region:h,repository:`${m}-${t}`,skipBuild:r.skipBuild,onStep:(mt)=>k(`  ${mt}`)});Y=De.handlers,te={kind:"image",imageUri:De.imageUri},le=De.tag,ce.push({ParameterKey:"ImageUri",ParameterValue:De.imageUri})}else{w("Packaging application");let be=B?Yd({projectRoot:y,app:l,skipBuild:r.skipBuild,onStep:(_t)=>k(`  ${_t}`)}):await Wr({projectRoot:y,app:l,skipBuild:r.skipBuild,onStep:(_t)=>k(`  ${_t}`)}),De=Hd(m,t,be.sha256);if(k(`Artifact: ${be.sha256.slice(0,12)} (${(be.zip.length/1024).toFixed(0)} KB)`),Y=be.handlers,le=be.sha256,W.usesLayer){let _t=W.layerEnvVar?process.env[W.layerEnvVar]:void 0;if(X=l.layers??(_t?[_t]:void 0),!X?.length){let Ne=W.layerKind==="php"?"serverless:build-php-layer":W.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${W.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${W.layerEnvVar} env var (build one with \`cloud ${Ne}\`)${W.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await C.bucketExists(R))w(`Creating artifact bucket ${R}`),await C.createBucket(R);if(await C.headObject(R,De).then((_t)=>_t!==null).catch(()=>!1))k("Artifact already uploaded — reusing");else w("Uploading artifact"),await C.putObject({bucket:R,key:De,body:be.zip,contentType:"application/zip"});te={kind:"zip",bucket:R,key:De},ce.push({ParameterKey:"ArtifactBucket",ParameterValue:R},{ParameterKey:"ArtifactKey",ParameterValue:De})}let Ee=qd({config:e,environment:t,app:l,handlers:Y,runtimeLayers:X}),Re=JSON.stringify(Ee.template),de=["CAPABILITY_NAMED_IAM"],Me=await T.describeStacks({stackName:S}).then((be)=>be.Stacks[0]?.StackStatus).catch(()=>{return}),ae=Me!==void 0;if(Me&&/DELETE_IN_PROGRESS/.test(Me))w("Waiting for an in-progress stack delete to finish"),await T.waitForStack(S,"stack-delete-complete").catch(()=>{}),ae=!1;else if(Me&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(Me))w(`Deleting unusable stack (status ${Me}) before recreate`),await T.deleteStack(S),await T.waitForStack(S,"stack-delete-complete").catch(()=>{}),ae=!1;w(ae?"Updating infrastructure stack":"Creating infrastructure stack");try{if(ae)await T.updateStack({stackName:S,templateBody:Re,parameters:ce,capabilities:de}),await T.waitForStack(S,"stack-update-complete");else await T.createStack({stackName:S,templateBody:Re,parameters:ce,capabilities:de,onFailure:"DELETE"}),await T.waitForStack(S,"stack-create-complete")}catch(be){if(/No updates are to be performed/i.test(String(be?.message)))k("No infrastructure changes");else throw be}let Le=await T.getStackOutputs(S).catch(()=>({})),Je;if(l.assets){let be=lf(y,l.assets);if(Zw(be)){let De=l.assetDomain||Le.AssetsCdnDomain;Je=De?`https://${De}/${le}`:void 0,w(`Syncing assets from ${l.assets}`);let mt=await ok(C,a.assetsBucket,be,le,l.dotFilesAsAssets);k(`Uploaded ${mt} asset(s)${Je?` → ${Je}`:""}`)}else ds(`Assets directory not found: ${be}`)}w("Resolving secrets");let gt=await nk(l,h);if(l.database?.connection==="aurora-serverless")try{let De=await new z(h).getSecretValue({SecretId:`${m}/${t}/db`}),mt=JSON.parse(De.SecretString??"{}");if(mt.username)gt.DB_USERNAME=mt.username;if(mt.password)gt.DB_PASSWORD=mt.password}catch(be){ds(`Could not resolve Aurora DB credentials: ${be.message}`)}if(!await C.bucketExists(R))await C.createBucket(R);let Jt=await Nc(C,R,m,t),ot={},Pt=Ee.queueNames[0],Qt=es(l,Le);if(w("Activating functions"),ot.http=rr(l,a,t,"http",gt,Je,Pt,Qt),await Qa(j,Ee.functionNames.http,ot.http,te),ot.cli=rr(l,a,t,"cli",gt,Je,Pt,Qt),await Qa(j,Ee.functionNames.cli,ot.cli,te),Ee.queueNames.length)ot.queue=rr(l,a,t,"queue",gt,Je,Pt,Qt),await Qa(j,Ee.functionNames.queue,ot.queue,te);let lt=(l.provisionedConcurrency??0)>0,G={};if(lt){if(w("Publishing versions + flipping live alias"),G.http=await $c(j,Ee.functionNames.http),G.cli=await $c(j,Ee.functionNames.cli),Ee.queueNames.length)G.queue=await $c(j,Ee.functionNames.queue)}if(await pf(C,R,m,t,{sha:le,code:te,previousSha:Jt?.sha,previousCode:Jt?.code,previousFunctionEnv:Jt?.functionEnv,...lt?{functionVersions:G,previousFunctionVersions:Jt?.functionVersions}:{},functionEnv:ot,functionNames:{http:Ee.functionNames.http,cli:Ee.functionNames.cli,...Ee.queueNames.length?{queue:Ee.functionNames.queue}:{}},assetUrl:Je,timestamp:new Date().toISOString()}),!r.skipDeployHooks&&l.deploy?.length){w("Running deploy hooks");for(let be of l.deploy){k(`  deploy: ${be}`);let De=await j.invoke({FunctionName:Ee.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:be},LogType:"Tail"});if(De.FunctionError)throw bu("Deploy hook failed — the new build is ALREADY LIVE."),k(`  Roll back with: cloud serverless:rollback --env ${t}`),Error(`Deploy hook failed (${be}): ${De.Payload}`)}}let ue=Le.HttpApiEndpoint;if(!r.skipHealthCheck&&ue){w("Health check");try{let be=await fetch(ue,{method:"GET"});k(`GET ${ue} → ${be.status}`)}catch(be){ds(`Health check could not reach ${ue}: ${be.message}`)}}vu(["Serverless deploy complete","",ue?`URL:   ${ue}`:"",`Stack: ${S}`,`Build: ${le.slice(0,12)}`].filter(Boolean).join(`
-`),"green")}async function ln(e,t){let r=Eo(e,t),a=new o(r.region),l=new b(r.region),m=await Nc(a,r.artifactBucket,r.slug,t);if(!m)throw Error("No previous release to redeploy. Run a full deploy first.");ls(`Redeploying ${r.slug} (${t}) — build ${m.sha.slice(0,12)}`);for(let[h,S]of Object.entries(m.functionNames)){if(!S)continue;w(`Re-activating ${h} (${S})`),await Qa(l,S,m.functionEnv[h]??{},m.code);let R=m.functionVersions?.[h];if(R)await Io(()=>l.updateAlias({FunctionName:S,Name:"live",FunctionVersion:R}))}An("Redeploy complete")}async function un(e,t){let r=Eo(e,t),a=new o(r.region),l=new b(r.region),m=await Nc(a,r.artifactBucket,r.slug,t);if(!m?.previousCode)throw Error("No previous release to roll back to.");ls(`Rolling back ${r.slug} (${t}) → ${m.previousSha?.slice(0,12)}`);for(let[h,S]of Object.entries(m.functionNames)){if(!S)continue;w(`Restoring ${h} (${S})`);let R=m.previousFunctionEnv?.[h]??m.functionEnv[h]??{};await Qa(l,S,R,m.previousCode);let y=m.previousFunctionVersions?.[h];if(y)await Io(()=>l.updateAlias({FunctionName:S,Name:"live",FunctionVersion:y}))}await pf(a,r.artifactBucket,r.slug,t,{...m,sha:m.previousSha??m.sha,code:m.previousCode,functionEnv:m.previousFunctionEnv??m.functionEnv,functionVersions:m.previousFunctionVersions??m.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),An("Rollback complete")}async function nr(e,t,r,a){let l=Eo(e,t),m=new b(l.region),h=`${l.slug}-${t}-http`,R={...(await m.getFunction(h)).Configuration?.Environment?.Variables??{}};if(R.MAINTENANCE_MODE=r?"1":"0",r&&a)R.MAINTENANCE_BYPASS_SECRET=a;if(!r)delete R.MAINTENANCE_BYPASS_SECRET;if(await Io(()=>m.updateFunctionConfiguration({FunctionName:h,Environment:{Variables:R}})),(l.app.provisionedConcurrency??0)>0)await m.waitForFunctionActive(h,120),await $c(m,h);An(r?"Application is now in maintenance mode (503)":"Application is live")}async function tt(e,t,r){let a=Eo(e,t),l=new b(a.region),m=`${a.slug}-${t}-cli`,h=await l.invoke({FunctionName:m,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(h.FunctionError)throw Error(`Command failed: ${h.Payload}`);return h.Payload??""}async function Ar(e,t){let r=Eo(e,t),a=new f(r.region),l=new b(r.region),m=new o(r.region),h="not deployed",S={};try{let{Stacks:V}=await a.describeStacks({stackName:r.stackName});h=V?.[0]?.StackStatus??h;for(let W of V?.[0]?.Outputs??[])if(W.OutputKey)S[W.OutputKey]=W.OutputValue??""}catch{}let R=Gd(r.app,r.slug,t),y=r.app.provisionedConcurrency??0,C=["http","cli",...R.length?["queue"]:[]],T=`${r.slug}-${t}`,j=[];for(let V of C){let W=`${T}-${V}`,Y={mode:V,name:W,version:"$LATEST"};if(y>0){let te=await l.getAlias(W,"live").catch(()=>null);if(te?.FunctionVersion){Y.version=te.FunctionVersion;let le=await l.getProvisionedConcurrencyConfig(W,"live").catch(()=>null);if(le)Y.provisioned={status:le.Status??"-",allocated:le.AllocatedProvisionedConcurrentExecutions??0,requested:le.RequestedProvisionedConcurrentExecutions??0}}}j.push(Y)}let B=await Nc(m,r.artifactBucket,r.slug,t).catch(()=>null);return{slug:r.slug,environment:t,region:r.region,stackStatus:h,endpoint:S.HttpApiEndpoint,assetUrl:B?.assetUrl,scheduler:r.app.scheduler??"on",queues:R,provisionedConcurrency:y,functions:j,lastRelease:B?{sha:B.sha,timestamp:B.timestamp}:void 0}}function ak(e,t){return`${e}-${t}-db`}async function mf(e,t,r,a){let l=Eo(e,t);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:m}=await import("./chunk-94tb2msg.js"),h=new m(l.region),S=ak(l.slug,t);w(`Scaling ${S} → ${r}–${a} ACUs`),await h.modifyDBCluster({DBClusterIdentifier:S,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:a},ApplyImmediately:!0}),An(`Scaling applied to ${S} (takes effect shortly).`)}class ip{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async call(e,t){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${e}`},body:JSON.stringify(t)})}async listWebACLs(e="REGIONAL"){return(await this.call("ListWebACLs",{Scope:e,Limit:100}))?.WebACLs??[]}async getWebACLRules(e,t,r="REGIONAL"){return((await this.call("GetWebACL",{Name:e,Id:t,Scope:r}))?.WebACL?.Rules??[]).map((m)=>({Name:m.Name,Priority:m.Priority,Action:m.Action?Object.keys(m.Action)[0]:m.OverrideAction?Object.keys(m.OverrideAction)[0]:"count"}))}}var ck=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"routing",label:"Routing"},{index:4,id:"apps",label:"Applications"},{index:5,id:"runtime",label:"Background runtime"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],dk=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"entry",label:"Entry points"},{index:4,id:"compute",label:"Compute"},{index:5,id:"messaging",label:"Messaging & pooling"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],lk=[{match:/^redis/,kind:"cache",label:"Redis"},{match:/^(?:mysql|mariadb)/,kind:"database",label:"MySQL"},{match:/^postgres/,kind:"database",label:"PostgreSQL"},{match:/^meilisearch/,kind:"database",label:"Meilisearch"},{match:/^vitess|^vtgate/,kind:"database",label:"Vitess"},{match:/^memcached/,kind:"cache",label:"Memcached"}],uk=/^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;function Oe(e,t=""){let r=e==null?"":String(e).trim();return r&&r!=="-"&&r!=="—"?r:t}function pk(e){return Array.isArray(e)?e.length:0}function Un(e){let t=Oe(e).toLowerCase();if(!t)return"unknown";if(["running","live","active","available","success","ok","healthy","enabled"].includes(t))return"ok";if(["failed","stopped","unreachable","error","critical","disabled"].includes(t))return"bad";if(["configured","creating","pending","degraded","shadowed","warn","unknown"].includes(t))return"warn";return"warn"}function ur(e,t,r){if(r.has(t.source)&&r.has(t.target))e.push(t)}function Tt(e,t={}){let r=[],a=[],l=[],m=e.server??{},h=Array.isArray(e.sites)?e.sites:[],S=Array.isArray(e.services)?e.services:[],R=Array.isArray(e.workers)?e.workers:[],y=e.security??{},C=!!e._serverReachable&&!e.metricsUnavailable,T="box";if(!C)l.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let j=[...new Set(h.map((de)=>Oe(de.domain)||Oe(de.route).split("/")[0]).filter((de)=>de&&de!=="internal"&&de!=="loopback"))],B=Array.isArray(y.tlsCertificates)?y.tlsCertificates:[],V=B.filter((de)=>Number(de?.daysRemaining??999)<21).length;r.push({id:"dns",label:j.length===1?j[0]:"Public domains",kind:"dns",layer:1,status:V?"warn":j.length?"ok":"unknown",sub:j.length>1?`${j.length} domains`:"DNS & certificates",facts:[{label:"Domains",value:j.length?j.slice(0,6).join(", "):"none resolved"},{label:"Certificates",value:B.length?`${B.length} issued`:"none reported"},...V?[{label:"Expiring",value:`${V} within 21 days`}]:[]],href:"/server/security",external:!0});let W=y.firewall??{},Y=Array.isArray(y.ports)?y.ports:[];r.push({id:"firewall",label:"Host firewall",kind:"firewall",layer:2,status:Un(W.status),sub:Oe(W.summary,"Inbound filtering"),facts:[{label:"State",value:Oe(W.status,"unknown")},{label:"Open ports",value:Y.length?Y.map((de)=>Oe(de.listen)).join(", "):"not reported"}],href:"/server/firewall",group:"box"});let te=S.find((de)=>uk.test(Oe(de.name)));r.push({id:"proxy",label:Oe(te?.name,"Reverse proxy"),kind:"proxy",layer:3,status:te?Un(te.status):"unknown",sub:"TLS termination & routing",facts:[{label:"Service",value:Oe(te?.name,"not detected")},{label:"State",value:Oe(te?.status,C?"not running":"not probed")},{label:"Routes",value:`${h.length} site${h.length===1?"":"s"}`}],href:"/server/services",group:"box"});for(let de of h){let Me=`site:${Oe(de.name)}`;if(!Oe(de.name))continue;r.push({id:Me,label:Oe(de.name),kind:"site",layer:4,status:Un(de.status),sub:Oe(de.runtime,"runtime"),facts:[{label:"Route",value:Oe(de.route,"internal")},{label:"Runtime",value:Oe(de.runtime,"unknown")},{label:"Delivery",value:Oe(de.deploy,"unknown")},{label:"TLS",value:Oe(de.tls,"unknown")},...de.responseMs!=null?[{label:"Response",value:`${Math.round(Number(de.responseMs))} ms`}]:[],...de.httpStatus!=null?[{label:"HTTP",value:String(de.httpStatus)}]:[]],href:"/server/sites",group:"box"})}for(let de of R){let Me=`worker:${Oe(de.name)}`;if(!Oe(de.name))continue;r.push({id:Me,label:Oe(de.name),kind:"worker",layer:5,status:Un(de.status),sub:`${Number(de.processes??1)} process${Number(de.processes??1)===1?"":"es"}`,facts:[{label:"Processes",value:String(de.processes??1)},{label:"State",value:Oe(de.status,"unknown")},...Oe(de.site)?[{label:"Site",value:Oe(de.site)}]:[]],href:"/operations/jobs",group:"box"})}let le=e.serverScheduler??{};if(le.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:5,status:"ok",sub:"Cron dispatch",facts:[{label:"Last run",value:Oe(le.lastRun,"unknown")}],href:"/operations/jobs",group:"box"});let X=S.map((de)=>{let Me=Oe(de.name),ae=lk.find((Le)=>Le.match.test(Me));return ae?{service:de,name:Me,...ae}:null}).filter((de)=>!!de);for(let de of X)r.push({id:`data:${de.name}`,label:de.label,kind:de.kind,layer:6,status:Un(de.service.status),sub:de.name,facts:[{label:"Unit",value:de.name},{label:"State",value:Oe(de.service.status,"unknown")}],href:"/data/services",group:"box"});let ce=e.backup??{};if(ce.enabled)r.push({id:"backup",label:"Backups",kind:"backup",layer:7,status:"ok",sub:Oe(ce.destination,"destination"),facts:[{label:"Destination",value:Oe(ce.destination,"unknown")},{label:"Schedule",value:Oe(ce.schedule,"unknown")},{label:"Retention",value:`${ce.retention??0} copies`},{label:"Last run",value:Oe(ce.last,"unknown")}],href:"/data/backups"});let Ee=new Set(r.map((de)=>de.id));ur(a,{source:"internet",target:"dns",flow:"request",label:"https"},Ee),ur(a,{source:"dns",target:"firewall",flow:"request",label:"443/80"},Ee),ur(a,{source:"firewall",target:"proxy",flow:"request"},Ee);for(let de of h){let Me=`site:${Oe(de.name)}`;ur(a,{source:"proxy",target:Me,flow:"request",label:Oe(de.path)||void 0,status:Un(de.status)},Ee)}for(let de of R){let Me=`worker:${Oe(de.name)}`,ae=`site:${Oe(de.site)}`;if(Ee.has(ae))ur(a,{source:ae,target:Me,flow:"async",label:"queue"},Ee);else ur(a,{source:"proxy",target:Me,flow:"async",label:"queue"},Ee)}for(let de of R)ur(a,{source:"scheduler",target:`worker:${Oe(de.name)}`,flow:"async",label:"dispatch"},Ee);let Re=[...h.map((de)=>`site:${Oe(de.name)}`),...R.map((de)=>`worker:${Oe(de.name)}`)];for(let de of X)for(let Me of Re)ur(a,{source:Me,target:`data:${de.name}`,flow:"data",label:"localhost"},Ee);if(X.length&&Re.length)l.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");for(let de of X)ur(a,{source:`data:${de.name}`,target:"backup",flow:"backup",label:"snapshot"},Ee);for(let de of h)ur(a,{source:`site:${Oe(de.name)}`,target:"backup",flow:"backup"},Ee);return{mode:"server",project:Oe(t.project)||Oe(e.project?.name)||Oe(m.name,"project"),environment:Oe(t.environment)||Oe(e.environment,"production"),provider:Oe(m.provider,"unknown"),region:Oe(m.region,"unknown"),generatedAt:new Date().toISOString(),layers:ck,groups:[{id:"box",label:Oe(m.name,"App server"),sub:[Oe(m.provider),Oe(m.region),Oe(m.ip)].filter(Boolean).join(" · ")}],nodes:r,links:a,notes:l}}function ts(e,t={}){let r=[],a=[],l=[],m=e.app??{},h=Array.isArray(e.functions)?e.functions:[],S=Array.isArray(e.queues)?e.queues:[],R=e.metrics??{};if(!h.length)l.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let y=Oe(m.url),C=y.replace(/^https?:\/\//,"").split("/")[0];r.push({id:"dns",label:C||"Application domain",kind:"dns",layer:1,status:C?"ok":"unknown",sub:"DNS & certificates",facts:[{label:"Endpoint",value:y||"not resolved"}],external:!0});let T=e.waf;if(T)r.push({id:"waf",label:"WAF",kind:"waf",layer:2,status:Un(T.status??"active"),sub:Oe(T.scope,"Managed rules"),facts:[{label:"Web ACL",value:Oe(T.name,"unnamed")},...T.blocked!=null?[{label:"Blocked (24h)",value:String(T.blocked)}]:[],{label:"Rules",value:String(pk(e.wafRules))}],href:"/serverless/firewall"});let j=e.assetsInfo;if(j)r.push({id:"cdn",label:"Asset CDN",kind:"cdn",layer:2,status:"ok",sub:Oe(j.cdn,"CloudFront"),facts:[{label:"Distribution",value:Oe(j.cdn,"unknown")},{label:"Custom domain",value:Oe(j.customDomain,"none")}],href:"/serverless/assets"}),r.push({id:"assets",label:"Asset bucket",kind:"storage",layer:6,status:"ok",sub:Oe(j.bucket,"S3"),facts:[{label:"Bucket",value:Oe(j.bucket,"unknown")},...j.files?[{label:"Objects",value:String(j.files)}]:[],...j.sizeMb?[{label:"Size",value:`${j.sizeMb} MB`}]:[]],href:"/serverless/assets"});let B=h.find((ae)=>Oe(ae.key).startsWith("http"));r.push({id:"gateway",label:"HTTP entry point",kind:"gateway",layer:3,status:B?"ok":"unknown",sub:"Function URL / API Gateway",facts:[{label:"Endpoint",value:y||"not resolved"},{label:"Invocations (24h)",value:String(R.invocations??0)},...R.errorRatePct!=null?[{label:"Error rate",value:`${R.errorRatePct}%`}]:[]],href:"/serverless/metrics"});for(let ae of h){let Le=`fn:${Oe(ae.name)}`;if(!Oe(ae.name))continue;let Je=Number(ae.errors??0),gt=Number(ae.invocations??0);r.push({id:Le,label:Oe(ae.key,Oe(ae.name)),kind:"function",layer:4,status:Je>0?gt&&Je/gt>0.02?"bad":"warn":gt?"ok":"idle",sub:Oe(ae.runtime,"lambda"),facts:[{label:"Function",value:Oe(ae.name)},{label:"Memory",value:`${ae.memory??0} MB`},{label:"Timeout",value:`${ae.timeout??0}s`},{label:"Invocations (24h)",value:String(gt)},{label:"Errors (24h)",value:String(Je)},{label:"p95",value:`${ae.p95??0} ms`},...ae.provisioned?[{label:"Provisioned",value:Oe(ae.provisioned)}]:[]],href:"/serverless/functions"})}for(let ae of S){let Le=`queue:${Oe(ae.name)}`;if(!Oe(ae.name))continue;let Je=Number(ae.dlq??0);r.push({id:Le,label:Oe(ae.name),kind:"queue",layer:5,status:Je>0?"bad":Number(ae.visible??0)>0?"warn":"ok",sub:"SQS",facts:[{label:"Visible",value:String(ae.visible??0)},{label:"In flight",value:String(ae.inFlight??0)},{label:"Processed (24h)",value:String(ae.processed??0)},{label:"Dead letter",value:String(Je)}],href:"/serverless/queues"})}let V=e.aurora;if(V)r.push({id:"database",label:"Aurora Serverless",kind:"database",layer:6,status:Un(V.status),sub:Oe(V.engine,"aurora"),facts:[{label:"Cluster",value:Oe(V.id,"unknown")},{label:"Capacity",value:`${V.currentAcu??0} ACU (${V.minAcu??0}–${V.maxAcu??0})`},{label:"Connections",value:String(V.connections??0)}],href:"/serverless/data"});let W=e.proxy;if(W)r.push({id:"rds-proxy",label:"RDS Proxy",kind:"database",layer:5,status:Un(W.status),sub:"Connection pooling",facts:[{label:"Proxy",value:Oe(W.name,"unknown")},{label:"Endpoint",value:Oe(W.endpoint,"unknown")},{label:"Pooled",value:String(W.pooledConns??0)}],href:"/serverless/data"});let Y=e.redis;if(Y)r.push({id:"cache",label:"ElastiCache",kind:"cache",layer:6,status:Un(Y.status),sub:Oe(Y.node,"redis"),facts:[{label:"Group",value:Oe(Y.id,"unknown")},{label:"Hit rate",value:`${Y.hitRate??0}%`}],href:"/serverless/data"});let te=e.efs;if(te)r.push({id:"efs",label:"EFS",kind:"filesystem",layer:6,status:Un(te.status),sub:Oe(te.mount,"/mnt/local"),facts:[{label:"File system",value:Oe(te.id,"unknown")},{label:"Mount",value:Oe(te.mount,"unknown")},{label:"Size",value:`${te.sizeMb??0} MB`}],href:"/data/volumes"});let le=e.scheduler??{};if(le.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:3,status:"ok",sub:Oe(le.expression,"rate(1 minute)"),facts:[{label:"Expression",value:Oe(le.expression,"unknown")},{label:"Last run",value:Oe(le.lastRun,"unknown")}],href:"/operations/jobs"});let X=new Set(r.map((ae)=>ae.id)),ce=X.has("waf")?"waf":"gateway";ur(a,{source:"internet",target:"dns",flow:"request",label:"https"},X),ur(a,{source:"dns",target:ce,flow:"request"},X),ur(a,{source:"dns",target:"cdn",flow:"request",label:"assets"},X),ur(a,{source:"waf",target:"gateway",flow:"request",label:"allowed"},X),ur(a,{source:"cdn",target:"assets",flow:"data",label:"origin"},X);let Ee=h.filter((ae)=>Oe(ae.key).startsWith("http")),Re=h.filter((ae)=>Oe(ae.key).startsWith("queue")),de=h.filter((ae)=>Oe(ae.key).startsWith("cli"));for(let ae of Ee)ur(a,{source:"gateway",target:`fn:${Oe(ae.name)}`,flow:"request",label:"invoke"},X);for(let ae of de)ur(a,{source:"scheduler",target:`fn:${Oe(ae.name)}`,flow:"async",label:"schedule"},X);for(let ae of S){for(let Le of Ee)ur(a,{source:`fn:${Oe(Le.name)}`,target:`queue:${Oe(ae.name)}`,flow:"async",label:"publish"},X);for(let Le of Re)ur(a,{source:`queue:${Oe(ae.name)}`,target:`fn:${Oe(Le.name)}`,flow:"async",label:"consume"},X)}let Me=["rds-proxy","database","cache","efs","assets"];for(let ae of h){let Le=`fn:${Oe(ae.name)}`;if(X.has("rds-proxy"))ur(a,{source:Le,target:"rds-proxy",flow:"data",label:"pooled"},X);else ur(a,{source:Le,target:"database",flow:"data",label:"sql"},X);for(let Je of Me.filter((gt)=>gt!=="rds-proxy"&&gt!=="database"))ur(a,{source:Le,target:Je,flow:"data"},X)}return ur(a,{source:"rds-proxy",target:"database",flow:"data",label:"sql"},X),{mode:"serverless",project:Oe(t.project)||Oe(m.name,"application"),environment:Oe(t.environment)||Oe(m.env,"production"),provider:"aws",region:Oe(m.region,"unknown"),generatedAt:new Date().toISOString(),layers:dk,groups:[],nodes:r,links:a,notes:l}}function Eh(e,t,r={}){return e==="serverless"?ts(t,r):Tt(t,r)}function ff(e){return String(e).padStart(2,"0")}function As(e){return`${e.getUTCFullYear()}-${ff(e.getUTCMonth()+1)}-${ff(e.getUTCDate())}`}function gk(e){let t=Math.max(0,Math.round((Date.now()-e)/1000));if(t<60)return`${t}s ago`;let r=Math.round(t/60);if(r<60)return`${r}m ago`;let a=Math.round(r/60);if(a<48)return`${a}h ago`;return`${Math.round(a/24)}d ago`}async function Ya(e,t,r,a,l,m){let h=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:t}],StartTime:l,EndTime:m,Period:86400,Statistics:[a]}).catch(()=>[]);if(!h.length)return 0;if(a==="Sum")return h.reduce((S,R)=>S+(R.Sum??0),0);if(a==="Maximum")return Math.max(...h.map((S)=>S.Maximum??0));return h.reduce((S,R)=>S+(R.Average??0),0)/h.length}async function Za(e,t,r,a,l,m,h){let S=await e.getMetricStatistics({Namespace:t,MetricName:r,Dimensions:a,StartTime:m,EndTime:h,Period:86400,Statistics:[l]}).catch(()=>[]);if(!S.length)return 0;if(l==="Sum")return S.reduce((R,y)=>R+(y.Sum??0),0);if(l==="Maximum")return Math.max(...S.map((R)=>R.Maximum??0));return S.reduce((R,y)=>R+(y.Average??0),0)/S.length}async function op(e,t,r,a,l){let m=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:t}],StartTime:a,EndTime:l,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(m.reduce((h,S)=>h+(S.Percentiles?.[r]??0),0))}async function pn(e,t){let r=await Ar(e,t),a=r.region,l=new oe(a),m=new b(a),h=new ye(a),S=new Date,R=new Date(S.getTime()-86400000),y=e.environments?.[t]?.app,C={};C.app={name:r.slug,env:t,region:a,runtime:y?.kind==="php"?`php-${y?.phpVersion??"8.3"} (fpm)`:y?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},C.maintenance={enabled:!1},C.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let T=0,j=0,B=0,V=[],W=[],Y=[];for(let ce of r.functions){let[Ee,Re,de,Me,ae,Le,Je,gt,Jt]=await Promise.all([Ya(l,ce.name,"Invocations","Sum",R,S),Ya(l,ce.name,"Errors","Sum",R,S),Ya(l,ce.name,"Throttles","Sum",R,S),Ya(l,ce.name,"Duration","Average",R,S),m.getFunction(ce.name).catch(()=>null),op(l,ce.name,"p50",R,S),op(l,ce.name,"p95",R,S),op(l,ce.name,"p99",R,S),l.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:ce.name}],StartTime:new Date(S.getTime()-43200000),EndTime:S,Period:3600,Stat:"Sum"}).catch(()=>[])]);T+=Ee,j+=Re,B=Math.max(B,Me);let ot=ae?.Configuration?.MemorySize??0,Pt=Object.keys(ae?.Configuration?.Environment?.Variables??{}),Qt=[],lt=0;try{let{events:ue=[]}=await h.filterLogEvents({logGroupName:`/aws/lambda/${ce.name}`,startTime:R.getTime(),limit:120});for(let be of ue){let De=(be.message??"").trim(),mt=/Max Memory Used:\s*(\d+)\s*MB/.exec(De);if(mt)lt=Math.max(lt,Number(mt[1]));if(De&&!/^(?:START|END|REPORT|INIT_START)/.test(De))Y.push({source:ce.mode||ce.name,timestamp:new Date(be.timestamp??0).toISOString(),when:gk(be.timestamp??0),message:De.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(De)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(De)?"warn":"info"})}Qt=ue.filter((be)=>!/^(?:START|END|REPORT|INIT_START)/.test((be.message??"").trim())).slice(-6).map((be)=>({ts:new Date(be.timestamp??0).toISOString().slice(11,19),msg:(be.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(be.message??"")}))}catch{}let G=Math.max(1,...Jt);V.push({key:ce.mode,name:ce.name,version:ce.version,memory:ot,timeout:ae?.Configuration?.Timeout??0,runtime:ae?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(Ee),errors:Math.round(Re),p95:Je||Math.round(Me),status:"active",provisioned:ce.provisioned?`${ce.provisioned.allocated}/${ce.provisioned.requested}`:void 0}),W.push({key:ce.mode,name:ce.name,runtime:ae?.Configuration?.Runtime??"provided.al2023",arch:ae?.Configuration?.Architectures?.[0]??"x86_64",memory:ot,timeout:ae?.Configuration?.Timeout??0,ephemeral:ae?.Configuration?.EphemeralStorage?.Size??512,version:ce.version,concurrency:y?.concurrency??"—",invocations:Math.round(Ee),errors:Math.round(Re),throttles:Math.round(de),p50:Le||Math.round(Me),p95:Je||Math.round(Me),p99:gt||Math.round(Me),maxMem:lt,spark:Jt.length?Jt.map((ue)=>Math.round(ue/G*100)):[0],env:Pt.length?Pt:["(none)"],recent:Qt.length?Qt:[{ts:"—",msg:"no recent events",err:!1}]})}C.functions=V,C.functionsDetail=W,C.serverlessLogs=Y.sort((ce,Ee)=>String(Ee.timestamp).localeCompare(String(ce.timestamp))).slice(0,600),C.serverlessLogsEmptyReason=Y.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let te=T?Number((j/T*100).toFixed(2)):0,le=Math.round(await Ya(l,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",R,S));C.metrics={invocations:Math.round(T),errorRatePct:te,p95Ms:Math.round(B),coldStartPct:void 0,concurrency:le,estCostUsd:void 0};try{let ce=new se(a),Ee=[],Re=[],de=0;try{let{QueueUrl:ae}=await ce.getQueueUrl(`${r.slug}-${t}-dlq`),{Attributes:Le}=await ce.getQueueAttributes(ae);de=Number(Le.ApproximateNumberOfMessages??0)}catch{}let Me=y?Xt(y,r.slug,t):[];for(let ae of Me){let Le=ae.name.replace(`${r.slug}-${t}-`,""),Je=0,gt=0;try{let{QueueUrl:ot}=await ce.getQueueUrl(ae.name),{Attributes:Pt}=await ce.getQueueAttributes(ot);Je=Number(Pt.ApproximateNumberOfMessages??0),gt=Number(Pt.ApproximateNumberOfMessagesNotVisible??0)}catch{}let Jt=Math.round(await Za(l,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:ae.name}],"Sum",R,S));Ee.push({name:Le,visible:Je,inFlight:gt,processed:Jt,dlq:de}),Re.push({name:ae.name,short:Le,visible:Je,inFlight:gt,delayed:0,processed:Jt,oldestSec:0,concurrency:ae.concurrency??y?.queueConcurrency??"—",tries:y?.queueTries??3,visTimeout:(y?.queueTimeout??120)*6,dlq:de})}if(Ee.length)C.queues=Ee;if(Re.length)C.queuesDetail=Re;C.dlqItems=[]}catch{}try{let ce=new f(a),{Stacks:Ee}=await ce.describeStacks({stackName:qt(e,t)}),Re={};for(let de of Ee?.[0]?.Outputs??[])if(de.OutputKey)Re[de.OutputKey]=de.OutputValue??"";if(y?.database?.connection==="aurora-serverless"){let de=`${r.slug}-${t}-db`,Me=[{Name:"DBClusterIdentifier",Value:de}],[ae,Le]=await Promise.all([Za(l,"AWS/RDS","ServerlessDatabaseCapacity",Me,"Average",R,S),Za(l,"AWS/RDS","DatabaseConnections",Me,"Maximum",R,S)]);if(C.aurora={id:de,engine:"aurora-mysql",minAcu:y?.database?.minCapacity??0.5,maxAcu:y?.database?.maxCapacity??4,currentAcu:ae?Number(ae.toFixed(1)):y?.database?.minCapacity??0.5,database:"app",connections:Math.round(Le),status:Re.DbEndpoint?"available":"creating"},y?.rdsProxy)C.proxy={name:`${r.slug}-${t}-proxy`,endpoint:Re.DbProxyEndpoint??"—",pooledConns:Math.round(Le),status:"available"}}if(y?.cache?.driver==="elasticache"){let de=`${r.slug}-${t}-cache`,Me=[{Name:"CacheClusterId",Value:`${de}-001`}],[ae,Le]=await Promise.all([Za(l,"AWS/ElastiCache","CacheHits",Me,"Sum",R,S),Za(l,"AWS/ElastiCache","CacheMisses",Me,"Sum",R,S)]),Je=ae+Le>0?Number((ae/(ae+Le)*100).toFixed(1)):0;C.redis={id:de,node:"cache.t4g.micro",engine:"redis",hitRate:Je,status:Re.CacheEndpoint?"available":"creating"}}if(y?.efs){let de=0;try{if(Re.EfsFileSystemId){let Me=new dr(a),{FileSystems:ae}=await Me.describeFileSystems({FileSystemId:Re.EfsFileSystemId});de=Number(((ae?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}C.efs={id:Re.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:de,status:"available"}}C.assetsInfo=Re.AssetsCdnDomain?{bucket:Re.AssetsBucketName??`${r.slug}-${t}-assets`,cdn:Re.AssetsCdnDomain,customDomain:y?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:C.app.build}:void 0}catch{}if(C.assetsInfo)try{let Ee=await new o(a).list({bucket:C.assetsInfo.bucket,maxKeys:1000});C.assetsInfo.files=Ee.length,C.assetsInfo.sizeMb=Number((Ee.reduce((Re,de)=>Re+(de.Size??0),0)/1048576).toFixed(1)),C.assetsRecent=Ee.slice(0,8).map((Re)=>({path:`/${Re.Key}`,size:`${Math.max(1,Math.round((Re.Size??0)/1024))} KB`,type:Re.Key.split(".").pop()??""}))}catch{}try{if(y?.secrets){let ce=Array.isArray(y.secrets)?y.secrets.map((Ee)=>({key:Ee.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:Ee})):Object.entries(y.secrets).map(([Ee,Re])=>({key:Ee,source:String(Re)}));C.secretsList=ce.map((Ee)=>({...Ee,updated:"—"}))}}catch{}try{let ce=new o(a),Ee=`${r.slug}-${t}-deployments`,Re=await ce.getObjectJson(Ee,`deployments/${r.slug}/${t}/history.json`).catch(()=>null);if(Re?.records?.length)C.deploymentsDetail=Re.records.slice(-12).reverse().map((de)=>({sha:(de.sha??"").slice(0,7),status:de.status??"success",when:de.timestamp??"—",took:de.took??"—",by:de.by??"—",version:de.version??"—",hooks:de.hooks??[]}))}catch{}C.metricsTotals={invocations:C.metrics.invocations,errors:Math.round(j),errorRatePct:te,p95Ms:C.metrics.p95Ms,throttles:W.reduce((ce,Ee)=>ce+Ee.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:le},C.metricsPerFn=W.map((ce)=>({key:ce.key,invocations:ce.invocations,errors:ce.errors,throttles:ce.throttles,avgMs:ce.p50,maxMs:ce.p99,costUsd:void 0}));try{C.invSpark=await l.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((ce)=>ce.mode==="http")?.name??""}],StartTime:new Date(S.getTime()-86400000),EndTime:S,Period:3600,Stat:"Sum"})}catch{}try{let ce=new ms,Ee=S,Re=new Date(Date.UTC(Ee.getUTCFullYear(),Ee.getUTCMonth(),1)),de=new Date(Date.UTC(Ee.getUTCFullYear(),Ee.getUTCMonth()-1,1)),[Me,ae]=await Promise.all([ce.getCostByService({start:As(Re),end:As(Ee),granularity:"MONTHLY"}).catch(()=>[]),ce.getCostByService({start:As(de),end:As(Re),granularity:"MONTHLY"}).catch(()=>[])]);if(Me.length){let Le=Me.reduce((lt,G)=>lt+G.amount,0),Je=ae.reduce((lt,G)=>lt+G.amount,0),gt=Ee.getUTCDate(),Jt=new Date(Date.UTC(Ee.getUTCFullYear(),Ee.getUTCMonth()+1,0)).getUTCDate();C.costSummary={monthToDateUsd:Number(Le.toFixed(2)),projectedUsd:Number((Le/gt*Jt).toFixed(2)),lastMonthUsd:Number(Je.toFixed(2)),dailyAvgUsd:Number((Le/gt).toFixed(2))},C.costServices=Me.filter((lt)=>lt.amount>0).sort((lt,G)=>G.amount-lt.amount).slice(0,12).map((lt)=>({name:lt.service,usd:Number(lt.amount.toFixed(2)),note:""})),C.metrics.estCostUsd=Number((Le/gt).toFixed(2)),C.metricsTotals.estCostUsd=C.metrics.estCostUsd,C.costTrend=await ce.getDailyTotals({start:As(Re),end:As(Ee)}).catch(()=>[]);let ot=Me.find((lt)=>/lambda/i.test(lt.service))?.amount??0,Pt=(lt)=>lt.invocations*(lt.p50/1000)*(lt.memory/1024),Qt=W.reduce((lt,G)=>lt+Pt(G),0)||1;C.costPerFn=W.map((lt)=>({key:lt.key,requests:lt.invocations,gbSec:Math.round(Pt(lt)),usd:Number((ot*(Pt(lt)/Qt)).toFixed(2))}))}}catch{}if(y?.firewall)try{let ce=await l.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:R,EndTime:S,Period:86400,Statistics:["Sum"]}).catch(()=>[]),Ee=await l.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:R,EndTime:S,Period:86400,Statistics:["Sum"]}).catch(()=>[]);C.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${t}-waf`,allowed24h:Math.round(Ee.reduce((Re,de)=>Re+(de.Sum??0),0)),blocked24h:Math.round(ce.reduce((Re,de)=>Re+(de.Sum??0),0))};try{let Re=new ip(a),de=await Re.listWebACLs("REGIONAL"),Me=de.find((ae)=>ae.Name?.includes(`${r.slug}-${t}`))??de[0];if(Me?.Name&&Me.Id){C.waf.acl=Me.Name;let ae=await Re.getWebACLRules(Me.Name,Me.Id,"REGIONAL");if(ae.length)C.wafRules=ae.map((Le)=>({name:Le.Name??"—",detail:`priority ${Le.Priority??0}`,action:Le.Action??"count",blocked24h:0}))}}catch{}}catch{}let X=[];if(C.aurora)X.push({name:"Aurora Serverless v2",detail:`${C.aurora.id} · ${C.aurora.minAcu}-${C.aurora.maxAcu} ACU`,status:C.aurora.status});if(C.proxy)X.push({name:"RDS Proxy",detail:C.proxy.name,status:C.proxy.status});if(C.redis)X.push({name:`ElastiCache (${C.redis.engine})`,detail:`${C.redis.node} · ${C.redis.hitRate}% hit rate`,status:C.redis.status});if(C.efs)X.push({name:"EFS",detail:`${C.efs.mount} · ${C.efs.sizeMb} MB`,status:C.efs.status});if(X.length)C.dataServices=X;if(r.scheduler!=="off"&&y?.kind==="php")try{let ce=await tt(e,t,"schedule:list"),Ee=[];for(let Re of(ce||"").split(`
+`;function of(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function Dw(e){return["NoSuchEntity","ResourceNotFoundException","404"].includes(of(e))}function rf(e){return["EntityAlreadyExists","ResourceAlreadyExistsException","ResourceConflictException","409"].includes(of(e))}function nf(e,t){let r=e?.Items;if(!r)return[];if(Array.isArray(r))return r;let a=r[t];if(a===void 0)return[];return Array.isArray(a)?a:[a]}function rp(e){let t=e?.Aliases?.Items,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function Ow(e){if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected CloudFront alias is invalid");if(!/^[A-Za-z0-9-_]{1,64}$/.test(e.functionName))throw Error("Lambda function name is invalid");let t=e.pathPattern?.startsWith("/")?e.pathPattern:`/${e.pathPattern||"api/*"}`;if(t==="/"||t==="/*"||!t.endsWith("*"))throw Error("API path must be a non-default wildcard pattern such as /api/*");let r=e.originId||`${e.functionName}-url`,a=e.roleName||`${e.functionName}-execution`;if(!/^[A-Za-z0-9_.-]{1,64}$/.test(a))throw Error("IAM role name is invalid");let l=e.memorySize??256,m=e.timeout??10,h=e.logRetentionDays??14;if(l<128||l>10240)throw Error("Lambda memory must be between 128 and 10240 MB");if(m<1||m>900)throw Error("Lambda timeout must be between 1 and 900 seconds");return{region:e.region||"us-east-1",pathPattern:t,originId:r,roleName:a,memorySize:l,timeout:m,logRetentionDays:h}}function Ah(e){let t=e.region||"us-east-1";return{cloudfront:new I(e.profile),iam:new Ie(t,e.profile),lambda:new b(t,e.profile),logs:new ye(t,e.profile),sts:new Ae(t,e.profile),sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}async function wy(e,t){let r=Ow(e),a=t||Ah({profile:e.profile,region:r.region}),[l,m,h]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId),a.cloudfront.getDistributionConfig(e.distributionId)]);if(!l.Account)throw Error("AWS identity did not return an account ID");if(!m.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!(rp(m).length?rp(m):rp(h.DistributionConfig)).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let R,y=!0;try{R=await a.iam.getRole({RoleName:r.roleName})}catch(ot){if(!Dw(ot))throw ot;y=!1}let C=R?.Arn||`arn:aws:iam::${l.Account}:role/${r.roleName}`,T=await a.lambda.functionExists(e.functionName),j=T?await a.lambda.getFunctionUrl(e.functionName):null,B=await a.cloudfront.listOriginAccessControls(),V=`${e.functionName}-lambda-url`,W=B.some((ot)=>ot.Name===V&&ot.OriginAccessControlOriginType==="lambda"),Y=nf(h.DistributionConfig.Origins,"Origin"),te=nf(h.DistributionConfig.CacheBehaviors,"CacheBehavior"),le=Y.some((ot)=>String(ot.Id)===r.originId),X=te.some((ot)=>String(ot.PathPattern)===r.pathPattern),ce=[...!y?[`create IAM execution role ${r.roleName}`]:[`reconcile IAM execution policy ${r.roleName}`],...T?[`update Lambda ${e.functionName} code and configuration`]:[`create Lambda ${e.functionName}`],...!j?["create private AWS_IAM function URL"]:[],...!W?[`create Lambda origin access control ${V}`]:[],"grant CloudFront function-URL and invocation permissions",`${X?"reconcile":"add"} ${r.pathPattern} behavior without changing the default behavior`],Ee={command:`cloud cdn:origin:remove ${e.distributionId} FUNCTION_URL_HOST --id ${r.originId} --path '${r.pathPattern}' --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,removeFunction:!T,removeRole:!y},Re={mode:e.apply?"apply":"plan",accountId:l.Account,identityArn:l.Arn,distribution:{id:m.Id,arn:m.ARN,alias:e.expectedAlias,domainName:m.DomainName,status:m.Status},function:{name:e.functionName,existed:T,runtime:"nodejs22.x",urlExisted:!!j,url:j?.FunctionUrl},role:{name:r.roleName,existed:y,arn:C},origin:{id:r.originId,pathPattern:r.pathPattern,existed:le,behaviorExisted:X,accessControlExisted:W},changes:ce,rollback:Ee,applied:!1};if(!e.apply)return Re;let de=`${e.distributionId}:${r.pathPattern}`;if(e.confirm!==de)throw Error(`Pass exact confirmation token ${de} to mutate the live distribution`);if(!R)R=await a.iam.createRole({RoleName:r.roleName,Description:`Execution role for ${e.functionName}`,AssumeRolePolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]}),Tags:[{Key:"ManagedBy",Value:"ts-cloud"}]});await a.iam.putRolePolicy({RoleName:r.roleName,PolicyName:"lambda-logs",PolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:${r.region}:${l.Account}:log-group:/aws/lambda/${e.functionName}:*`}]})});try{await a.logs.createLogGroup(`/aws/lambda/${e.functionName}`,{ManagedBy:"ts-cloud"})}catch(ot){if(!rf(ot))throw ot}await a.logs.putRetentionPolicy(`/aws/lambda/${e.functionName}`,r.logRetentionDays);let Me=e.code||xw;if(T)await a.lambda.updateFunctionCodeInline(e.functionName,Me,"index.mjs"),await a.lambda.waitForFunctionActive(e.functionName),await a.lambda.updateFunctionConfiguration({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:R.Arn,Handler:"index.handler",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize});else{let ot;for(let Pt=0;Pt<8;Pt++)try{await a.lambda.createFunctionWithCode({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:R.Arn,Handler:"index.handler",Code:Me,Filename:"index.mjs",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize}),ot=void 0;break}catch(Qt){if(ot=Qt,!String(Qt.message).toLowerCase().includes("role"))throw Qt;await a.sleep(1000)}if(ot)throw ot}await a.lambda.waitForFunctionActive(e.functionName);let ae=j||await a.lambda.createFunctionUrl({FunctionName:e.functionName,AuthType:"AWS_IAM",InvokeMode:"BUFFERED"});if(!ae.FunctionUrl)throw Error("Lambda did not return a function URL");let Le=new URL(ae.FunctionUrl).hostname,Je=await a.cloudfront.findOrCreateOriginAccessControl(V,"lambda"),gt=m.ARN||`arn:aws:cloudfront::${l.Account}:distribution/${e.distributionId}`,Jt=[{FunctionName:e.functionName,StatementId:"AllowCloudFrontFunctionUrl",Action:"lambda:InvokeFunctionUrl",Principal:"cloudfront.amazonaws.com",SourceArn:gt,FunctionUrlAuthType:"AWS_IAM"},{FunctionName:e.functionName,StatementId:"AllowCloudFrontInvoke",Action:"lambda:InvokeFunction",Principal:"cloudfront.amazonaws.com",SourceArn:gt,InvokedViaFunctionUrl:!0}];for(let ot of Jt)try{await a.lambda.addPermission(ot)}catch(Pt){if(!rf(Pt))throw Pt}return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:Le,pathPattern:r.pathPattern,originAccessControlId:Je.Id}),{...Re,function:{...Re.function,url:ae.FunctionUrl},applied:!0}}async function Ry(e){let t=`https://${e.alias}/`,r=`https://${e.alias}/api/health`,a=await fetch(t,{redirect:"follow",headers:{"cache-control":"no-cache"}}),l=new Uint8Array(await a.arrayBuffer()),m=Tw("sha256").update(l).digest("hex"),h=Date.now(),S=await fetch(r,{redirect:"follow",headers:{"cache-control":"no-cache"}}),R=Date.now()-h,y=await S.text(),C=y;try{C=JSON.parse(y)}catch{}let T;if(e.logs&&e.functionName){let j=await e.logs.filterLogEvents({logGroupName:`/aws/lambda/${e.functionName}`,startTime:h-60000,filterPattern:'"Init Duration"',limit:25});for(let B of j.events||[]){let V=B.message?.match(/Init Duration:\s*([0-9.]+)\s*ms/i);if(V)T=Number(V[1])}}return{frontend:{url:t,status:a.status,sha256:m,unchanged:e.expectedFrontendSha256?m===e.expectedFrontendSha256:void 0,bytes:l.byteLength},api:{url:r,status:S.status,latencyMs:R,healthy:S.ok&&!!C?.ok,body:C},coldStart:{observed:T!==void 0,initDurationMs:T},verifiedAt:(e.now?.()||new Date).toISOString()}}function Dy(e){let t=(e.memoryMb||256)/1024,r=Math.max(0,e.requests-(e.includeFreeTier===!1?0:1e6)),a=Math.max(0,e.requests*(e.averageDurationMs/1000)*t-(e.includeFreeTier===!1?0:400000)),l=r/1e6*0.2+a*0.0000166667,m=9.010025,h=16.425;return{lambdaUsd:Number(l.toFixed(2)),alwaysOnFargateAndAlbUsd:Number(25.435025000000003 .toFixed(2)),assumptions:["us-east-1 public list rates snapshot, July 2026","Lambda x86 request and duration pricing with optional monthly free tier","Fargate comparison uses one always-on 0.25 vCPU/0.5 GB task plus one ALB before LCU charges","excludes CloudFront, data transfer, logs, taxes, and application data services"]}}import{createHash as $w}from"node:crypto";function Nw(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function jw(e){return Nw(e)==="ValidationError"&&String(e.message).includes("does not exist")}function Bw(e){return Object.fromEntries((e||[]).map((t)=>[t.OutputKey,t.OutputValue]))}function Mw(e){let t=e?.Aliases?.Items??e?.Aliases,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function sf(e){if(!/^[a-z][a-z0-9-]{1,62}$/.test(e.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected distribution alias is invalid");let t=e.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!t)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let r=e.stackName||`${e.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(r))throw Error("CloudFormation stack name is invalid");let a=e.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(a)||a==="/*")throw Error("Backend path must be a non-default wildcard pattern");let l=e.originId||`${e.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(l))throw Error("CloudFront origin ID is invalid");if(e.originVerifySecret&&e.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!e.originDomain!==!!e.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:r,region:e.region||"us-east-1",pathPattern:a,originId:l,digest:t}}function yh(e){let t=e.region||"us-east-1";return{cloudformation:new f(t,e.profile),cloudfront:new I(e.profile),sts:new Ae(t,e.profile),fetch,sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}function Ih(e){let t=sf(e),r=Fd({name:e.name,slug:e.slug,domain:e.originDomain||e.expectedAlias,imageUri:e.imageUri,certificateArn:e.certificateArn,originVerifySecret:e.originVerifySecret,desiredCount:e.desiredCount,database:e.database,cache:e.cache,queue:e.queue}),a=Md(r);return a.Description=`Managed backend for existing static frontend ${e.expectedAlias}`,a.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:e.distributionId,ExistingDistributionAlias:e.expectedAlias,BackendPathPattern:t.pathPattern,ContainerDigest:t.digest},a}async function Lw(e,t,r){let a;for(let l=0;l<30;l++){let m=Date.now();try{let h=await e.fetch(t,{redirect:"manual",headers:r?{"x-origin-verify":r}:void 0}),S=Date.now()-m,R=await h.text(),y=R;try{y=JSON.parse(R)}catch{}if(h.ok)return{url:t,status:h.status,latencyMs:S,body:y};a=Error(`origin returned ${h.status}`)}catch(h){a=h}if(l<29)await e.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${a instanceof Error?a.message:String(a)}`)}async function Py(e,t){let r=sf(e),a=t||yh({region:r.region,profile:e.profile}),[l,m]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId)]);if(!l.Account)throw Error("AWS identity did not return an account ID");if(!m.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!Mw(m).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let h;try{h=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0]}catch(ce){if(!jw(ce))throw ce}let S=Ih(e),R=JSON.stringify(S);if(Buffer.byteLength(R)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let y=Object.values(S.Resources||{}).reduce((ce,Ee)=>(ce[Ee.Type]=(ce[Ee.Type]||0)+1,ce),{}),C=[`cloud cdn:origin:remove ${e.distributionId} ${e.originDomain||"ALB_HOST"} --id ${r.originId} --path '${r.pathPattern}' --profile ${e.profile||"default"} --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${r.stackName} only with an approved data-retention decision.`],T={mode:e.apply?"apply":"plan",accountId:l.Account,stack:{name:r.stackName,existed:!!h,status:h?.StackStatus,templateSha256:$w("sha256").update(R).digest("hex"),resourceCount:Object.keys(S.Resources||{}).length,resourceTypes:y},distribution:{id:m.Id,alias:e.expectedAlias,domainName:m.DomainName,status:m.Status,pathPattern:r.pathPattern,originId:r.originId},artifact:{imageUri:e.imageUri,digest:r.digest},services:{database:e.database!==!1,cache:e.cache!==!1,queue:e.queue!==!1,mail:"ses",desiredCount:e.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:C};if(!e.apply)return T;let j=`${e.distributionId}:${r.pathPattern}:${r.stackName}`;if(e.confirm!==j)throw Error(`Pass exact confirmation token ${j} to provision the backend and change live routing`);if(h)try{await a.cloudformation.updateStack({stackName:r.stackName,templateBody:R,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-update-complete")}catch(ce){if(!String(ce.message).includes("No updates are to be performed"))throw ce}else await a.cloudformation.createStack({stackName:r.stackName,templateBody:R,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-create-complete");let B=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0],V=Bw(B?.Outputs),W=V.AppLoadBalancerDnsName;if(!W)throw Error("Backend stack did not return AppLoadBalancerDnsName");let Y=!1;if(e.originDomain&&e.originDomain!==W){if(!a.dns)throw Error(`External DNS provider is required to map ${e.originDomain} to ${W}`);let ce=await a.dns.upsertRecord(e.originDomain,{name:e.originDomain,type:"CNAME",content:W,ttl:300});if(!ce.success)throw Error(ce.message||"External DNS update failed");Y=!0}let te=e.originDomain||W,le=e.certificateArn?"https-only":"http-only",X=e.skipHealthCheck?void 0:await Lw(a,`${le==="https-only"?"https":"http"}://${te}/api/health`,e.originVerifySecret);return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:te,pathPattern:r.pathPattern,protocolPolicy:le,customHeaders:e.originVerifySecret?{"X-Origin-Verify":e.originVerifySecret}:void 0}),{...T,outputs:V,health:X,cloudFrontApplied:!0,dnsApplied:Y,applied:!0}}function Ny(e={}){let r={fargate:730*(e.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(e.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(r).reduce((a,l)=>a+l,0).toFixed(2)),components:Object.fromEntries(Object.entries(r).map(([a,l])=>[a,Number(l.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}import{execFileSync as Fw}from"node:child_process";import{createHash as zw}from"node:crypto";import{existsSync as af,mkdirSync as Uw,mkdtempSync as qw,readdirSync as Vw,readFileSync as Ww,rmSync as Hw,statSync as cf,writeFileSync as Kw}from"node:fs";import{tmpdir as Jw}from"node:os";import{basename as Gw,join as Rs,relative as Qw,resolve as np}from"node:path";var Yw=new Set([".git","node_modules","dist","coverage"]);function df(e,t=e){let r=[];for(let a of Vw(e).sort()){if(Yw.has(a))continue;let l=Rs(e,a);if(Td(l,t))continue;let m=cf(l);if(m.isDirectory())r.push(...df(l,t));else if(m.isFile())r.push(Qw(t,l))}return r}function Sh(e){let t=np(e);if(!af(t)||!cf(t).isDirectory())throw Error(`Container context does not exist: ${t}`);let r=zw("sha256");for(let a of df(t))r.update(a),r.update("\x00"),r.update(Ww(Rs(t,a))),r.update("\x00");return r.digest("hex")}function Ch(e){return{ecr:new $e(e.region||"us-east-1",e.profile),run:(t,r,a)=>{Fw(t,r,{cwd:a?.cwd,env:a?.env,stdio:a?.stdio||"inherit"})}}}async function ky(e,t){let r=np(e.context),a=np(e.dockerfile||Rs(r,"Dockerfile"));if(!af(a))throw Error(`Dockerfile does not exist: ${a}`);if(!e.repository.split("/").every((V)=>/^[a-z0-9][a-z0-9._-]*$/.test(V)&&!/[._-]$/.test(V)&&!/[._-]{2}/.test(V)))throw Error("ECR repository name is invalid");let h=t||Ch(e),S=Sh(r),R=`sha-${S.slice(0,20)}`,y="";try{y=(await h.ecr.describeRepositories({repositoryNames:[e.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!y)y=(await h.ecr.createRepository({repositoryName:e.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!y)throw Error(`Could not resolve ECR repository URI for ${e.repository}`);await h.ecr.putLifecyclePolicy({repositoryName:e.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let C=`${y}:${R}`,T=qw(Rs(Jw(),"ts-cloud-container-"));try{h.run("docker",["version"],{stdio:"ignore"}),h.run("docker",["build","--platform",e.platform||"linux/amd64","--provenance=false","--sbom=false","--file",a,"--tag",C,r],{cwd:r});let V=(await h.ecr.getAuthorizationToken()).authorizationData?.[0];if(!V?.authorizationToken||!V.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let W=V.proxyEndpoint.replace(/^https?:\/\//,""),Y=Rs(T,"docker");Uw(Y,{recursive:!0}),Kw(Rs(Y,"config.json"),JSON.stringify({auths:{[W]:{auth:V.authorizationToken}}}),{mode:384}),h.run("docker",["push",C],{env:{...process.env,DOCKER_CONFIG:Y}})}finally{Hw(T,{recursive:!0,force:!0})}let B=(await h.ecr.describeImages({repositoryName:e.repository,imageIds:[{imageTag:R}]})).imageDetails?.[0]?.imageDigest;if(!B||!/^sha256:[a-f0-9]{64}$/i.test(B))throw Error(`ECR did not return an immutable digest for ${Gw(C)}`);return{repository:e.repository,tag:R,imageUri:C,digest:B,digestUri:`${y}@${B}`,contextSha256:S}}import{existsSync as Zw,readdirSync as Xw,readFileSync as ek,statSync as tk}from"node:fs";import{join as lf,relative as rk}from"node:path";function Eo(e,t){let r=e.environments?.[t]?.app;if(!r)throw Error(`No serverless app configured for environment '${t}'. Add environments.${t}.app to your config.`);let a=e.project.slug,l=e.environments?.[t]?.region||e.project.region||"us-east-1";return{app:r,slug:a,region:l,stackName:qt(e,t),artifactBucket:Nd(a,t),assetsBucket:po(a,t)}}async function Io(e,t=8){let r;for(let a=0;a<t;a++)try{return await e()}catch(l){let m=l?.code||l?.name||"",h=String(l?.message||"");if(m==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(h)){r=l,await new Promise((S)=>setTimeout(S,3000));continue}throw l}throw r}var uf=(e,t)=>`releases/${e}/${t}/current.json`;async function Nc(e,t,r,a){try{return await e.getObjectJson(t,uf(r,a))}catch{return null}}async function pf(e,t,r,a,l){await e.putObjectJson(t,uf(r,a),l)}async function nk(e,t){if(!e.secrets)return{};let r=new z(t),a={},l=Array.isArray(e.secrets)?e.secrets.map((m)=>({envName:m.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:m})):Object.entries(e.secrets).map(([m,h])=>({envName:m,secretId:h}));if(Array.isArray(e.secrets)){let m=new Map;for(let{envName:S,secretId:R}of l)m.set(S,[...m.get(S)??[],R]);let h=[...m.entries()].filter(([,S])=>S.length>1);if(h.length){let S=h.map(([R,y])=>`${R} ← ${y.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${S}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:m,secretId:h}of l){let R=(await r.getSecretValue({SecretId:h})).SecretString??"";try{let y=JSON.parse(R);if(y&&typeof y==="object"&&!Array.isArray(y)){for(let[C,T]of Object.entries(y))a[C]=String(T);continue}}catch{}a[m]=R}return a}function es(e,t){let r={},a=t.DbProxyEndpoint||t.DbEndpoint;if(a)r.DB_CONNECTION="mysql",r.DB_HOST=a,r.DB_PORT="3306",r.DB_DATABASE=r.DB_DATABASE||"app";if(t.CacheEndpoint){if(r.REDIS_HOST=t.CacheEndpoint,r.REDIS_PORT="6379",e.cache?.driver==="elasticache")r.CACHE_STORE="redis",r.CACHE_DRIVER="redis",r.SESSION_DRIVER="redis"}return r}function rr(e,t,r,a,l,m,h,S={}){let R=e.kind==="php"?Xd({cacheDriver:e.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:a,TSCLOUD_ENV:r,MAINTENANCE_MODE:"0",...e.octane?{TSCLOUD_OCTANE:"1"}:{},...e.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...e.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...R,...S,...t.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${t.slug}-${r}-cache`}:{},...h?{TSCLOUD_QUEUE:h,SQS_QUEUE:h}:{},...m?{ASSET_URL:m}:{},...e.env??{},...l}}function ik(e){let t=e.slice(e.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[t]??"application/octet-stream"}function*gf(e){for(let t of Xw(e)){let r=lf(e,t);if(tk(r).isDirectory())yield*gf(r);else yield r}}async function ok(e,t,r,a,l=!1){let m=0;for(let h of gf(r)){let S=rk(r,h).replace(/\\/g,"/");if(!l&&S.split("/").some((R)=>R.startsWith(".")))continue;await e.putObject({bucket:t,key:`${a}/${S}`,body:ek(h),contentType:ik(h),cacheControl:"public, max-age=31536000, immutable"}),m++}return m}function sk(e,t){let r=Object.entries(t).reduce((a,[l,m])=>a+Buffer.byteLength(`${l}=${m}`,"utf8"),0);if(r>4096){let a=Object.entries(t).map(([l,m])=>[l,Buffer.byteLength(`${l}=${m}`,"utf8")]).sort((l,m)=>m[1]-l[1]).slice(0,5).map(([l,m])=>`${l} (${m}B)`).join(", ");throw Error(`${e}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${a}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function Qa(e,t,r,a){sk(t,r),await Io(()=>e.updateFunctionConfiguration({FunctionName:t,Environment:{Variables:r}})),await e.waitForFunctionActive(t,120);let l=a.kind==="image"?{FunctionName:t,ImageUri:a.imageUri}:{FunctionName:t,S3Bucket:a.bucket,S3Key:a.key};await Io(()=>e.updateFunctionCode(l)),await e.waitForFunctionActive(t,120)}async function $c(e,t){let a=(await Io(()=>e.publishVersion({FunctionName:t}))).Version;if(!a)throw Error(`publishVersion returned no version for ${t}`);return await Io(()=>e.updateAlias({FunctionName:t,Name:"live",FunctionVersion:a})),a}async function Ea(e,t,r={}){let a=Eo(e,t),{app:l,slug:m,region:h,stackName:S,artifactBucket:R}=a,y=r.projectRoot??process.cwd();ls(`Deploying serverless app: ${m} (${t})`),k(`Stack: ${S}`),k(`Region: ${h}`);let C=new o(h),T=new f(h),j=new b(h),B=l.kind==="php",V=l.packaging==="image",W=Co(l),Y,te,le,X,ce=[];if(V&&W.usesLayer&&W.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${W.kind}${W.kind==="node"?` ${W.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(V){w("Building + pushing container image");let{buildAndPushServerlessImage:be}=await import("./chunk-0qdgw73b.js"),xe=await be({app:l,projectRoot:y,region:h,repository:`${m}-${t}`,skipBuild:r.skipBuild,onStep:(mt)=>k(`  ${mt}`)});Y=xe.handlers,te={kind:"image",imageUri:xe.imageUri},le=xe.tag,ce.push({ParameterKey:"ImageUri",ParameterValue:xe.imageUri})}else{w("Packaging application");let be=B?Yd({projectRoot:y,app:l,skipBuild:r.skipBuild,onStep:(_t)=>k(`  ${_t}`)}):await Wr({projectRoot:y,app:l,skipBuild:r.skipBuild,onStep:(_t)=>k(`  ${_t}`)}),xe=Hd(m,t,be.sha256);if(k(`Artifact: ${be.sha256.slice(0,12)} (${(be.zip.length/1024).toFixed(0)} KB)`),Y=be.handlers,le=be.sha256,W.usesLayer){let _t=W.layerEnvVar?process.env[W.layerEnvVar]:void 0;if(X=l.layers??(_t?[_t]:void 0),!X?.length){let Ne=W.layerKind==="php"?"serverless:build-php-layer":W.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${W.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${W.layerEnvVar} env var (build one with \`cloud ${Ne}\`)${W.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await C.bucketExists(R))w(`Creating artifact bucket ${R}`),await C.createBucket(R);if(await C.headObject(R,xe).then((_t)=>_t!==null).catch(()=>!1))k("Artifact already uploaded — reusing");else w("Uploading artifact"),await C.putObject({bucket:R,key:xe,body:be.zip,contentType:"application/zip"});te={kind:"zip",bucket:R,key:xe},ce.push({ParameterKey:"ArtifactBucket",ParameterValue:R},{ParameterKey:"ArtifactKey",ParameterValue:xe})}let Ee=qd({config:e,environment:t,app:l,handlers:Y,runtimeLayers:X}),Re=JSON.stringify(Ee.template),de=["CAPABILITY_NAMED_IAM"],Me=await T.describeStacks({stackName:S}).then((be)=>be.Stacks[0]?.StackStatus).catch(()=>{return}),ae=Me!==void 0;if(Me&&/DELETE_IN_PROGRESS/.test(Me))w("Waiting for an in-progress stack delete to finish"),await T.waitForStack(S,"stack-delete-complete").catch(()=>{}),ae=!1;else if(Me&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(Me))w(`Deleting unusable stack (status ${Me}) before recreate`),await T.deleteStack(S),await T.waitForStack(S,"stack-delete-complete").catch(()=>{}),ae=!1;w(ae?"Updating infrastructure stack":"Creating infrastructure stack");try{if(ae)await T.updateStack({stackName:S,templateBody:Re,parameters:ce,capabilities:de}),await T.waitForStack(S,"stack-update-complete");else await T.createStack({stackName:S,templateBody:Re,parameters:ce,capabilities:de,onFailure:"DELETE"}),await T.waitForStack(S,"stack-create-complete")}catch(be){if(/No updates are to be performed/i.test(String(be?.message)))k("No infrastructure changes");else throw be}let Le=await T.getStackOutputs(S).catch(()=>({})),Je;if(l.assets){let be=lf(y,l.assets);if(Zw(be)){let xe=l.assetDomain||Le.AssetsCdnDomain;Je=xe?`https://${xe}/${le}`:void 0,w(`Syncing assets from ${l.assets}`);let mt=await ok(C,a.assetsBucket,be,le,l.dotFilesAsAssets);k(`Uploaded ${mt} asset(s)${Je?` → ${Je}`:""}`)}else ds(`Assets directory not found: ${be}`)}w("Resolving secrets");let gt=await nk(l,h);if(l.database?.connection==="aurora-serverless")try{let xe=await new z(h).getSecretValue({SecretId:`${m}/${t}/db`}),mt=JSON.parse(xe.SecretString??"{}");if(mt.username)gt.DB_USERNAME=mt.username;if(mt.password)gt.DB_PASSWORD=mt.password}catch(be){ds(`Could not resolve Aurora DB credentials: ${be.message}`)}if(!await C.bucketExists(R))await C.createBucket(R);let Jt=await Nc(C,R,m,t),ot={},Pt=Ee.queueNames[0],Qt=es(l,Le);if(w("Activating functions"),ot.http=rr(l,a,t,"http",gt,Je,Pt,Qt),await Qa(j,Ee.functionNames.http,ot.http,te),ot.cli=rr(l,a,t,"cli",gt,Je,Pt,Qt),await Qa(j,Ee.functionNames.cli,ot.cli,te),Ee.queueNames.length)ot.queue=rr(l,a,t,"queue",gt,Je,Pt,Qt),await Qa(j,Ee.functionNames.queue,ot.queue,te);let lt=(l.provisionedConcurrency??0)>0,G={};if(lt){if(w("Publishing versions + flipping live alias"),G.http=await $c(j,Ee.functionNames.http),G.cli=await $c(j,Ee.functionNames.cli),Ee.queueNames.length)G.queue=await $c(j,Ee.functionNames.queue)}if(await pf(C,R,m,t,{sha:le,code:te,previousSha:Jt?.sha,previousCode:Jt?.code,previousFunctionEnv:Jt?.functionEnv,...lt?{functionVersions:G,previousFunctionVersions:Jt?.functionVersions}:{},functionEnv:ot,functionNames:{http:Ee.functionNames.http,cli:Ee.functionNames.cli,...Ee.queueNames.length?{queue:Ee.functionNames.queue}:{}},assetUrl:Je,timestamp:new Date().toISOString()}),!r.skipDeployHooks&&l.deploy?.length){w("Running deploy hooks");for(let be of l.deploy){k(`  deploy: ${be}`);let xe=await j.invoke({FunctionName:Ee.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:be},LogType:"Tail"});if(xe.FunctionError)throw bu("Deploy hook failed — the new build is ALREADY LIVE."),k(`  Roll back with: cloud serverless:rollback --env ${t}`),Error(`Deploy hook failed (${be}): ${xe.Payload}`)}}let ue=Le.HttpApiEndpoint;if(!r.skipHealthCheck&&ue){w("Health check");try{let be=await fetch(ue,{method:"GET"});k(`GET ${ue} → ${be.status}`)}catch(be){ds(`Health check could not reach ${ue}: ${be.message}`)}}vu(["Serverless deploy complete","",ue?`URL:   ${ue}`:"",`Stack: ${S}`,`Build: ${le.slice(0,12)}`].filter(Boolean).join(`
+`),"green")}async function ln(e,t){let r=Eo(e,t),a=new o(r.region),l=new b(r.region),m=await Nc(a,r.artifactBucket,r.slug,t);if(!m)throw Error("No previous release to redeploy. Run a full deploy first.");ls(`Redeploying ${r.slug} (${t}) — build ${m.sha.slice(0,12)}`);for(let[h,S]of Object.entries(m.functionNames)){if(!S)continue;w(`Re-activating ${h} (${S})`),await Qa(l,S,m.functionEnv[h]??{},m.code);let R=m.functionVersions?.[h];if(R)await Io(()=>l.updateAlias({FunctionName:S,Name:"live",FunctionVersion:R}))}An("Redeploy complete")}async function un(e,t){let r=Eo(e,t),a=new o(r.region),l=new b(r.region),m=await Nc(a,r.artifactBucket,r.slug,t);if(!m?.previousCode)throw Error("No previous release to roll back to.");ls(`Rolling back ${r.slug} (${t}) → ${m.previousSha?.slice(0,12)}`);for(let[h,S]of Object.entries(m.functionNames)){if(!S)continue;w(`Restoring ${h} (${S})`);let R=m.previousFunctionEnv?.[h]??m.functionEnv[h]??{};await Qa(l,S,R,m.previousCode);let y=m.previousFunctionVersions?.[h];if(y)await Io(()=>l.updateAlias({FunctionName:S,Name:"live",FunctionVersion:y}))}await pf(a,r.artifactBucket,r.slug,t,{...m,sha:m.previousSha??m.sha,code:m.previousCode,functionEnv:m.previousFunctionEnv??m.functionEnv,functionVersions:m.previousFunctionVersions??m.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),An("Rollback complete")}async function nr(e,t,r,a){let l=Eo(e,t),m=new b(l.region),h=`${l.slug}-${t}-http`,R={...(await m.getFunction(h)).Configuration?.Environment?.Variables??{}};if(R.MAINTENANCE_MODE=r?"1":"0",r&&a)R.MAINTENANCE_BYPASS_SECRET=a;if(!r)delete R.MAINTENANCE_BYPASS_SECRET;if(await Io(()=>m.updateFunctionConfiguration({FunctionName:h,Environment:{Variables:R}})),(l.app.provisionedConcurrency??0)>0)await m.waitForFunctionActive(h,120),await $c(m,h);An(r?"Application is now in maintenance mode (503)":"Application is live")}async function tt(e,t,r){let a=Eo(e,t),l=new b(a.region),m=`${a.slug}-${t}-cli`,h=await l.invoke({FunctionName:m,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(h.FunctionError)throw Error(`Command failed: ${h.Payload}`);return h.Payload??""}async function Ar(e,t){let r=Eo(e,t),a=new f(r.region),l=new b(r.region),m=new o(r.region),h="not deployed",S={};try{let{Stacks:V}=await a.describeStacks({stackName:r.stackName});h=V?.[0]?.StackStatus??h;for(let W of V?.[0]?.Outputs??[])if(W.OutputKey)S[W.OutputKey]=W.OutputValue??""}catch{}let R=Gd(r.app,r.slug,t),y=r.app.provisionedConcurrency??0,C=["http","cli",...R.length?["queue"]:[]],T=`${r.slug}-${t}`,j=[];for(let V of C){let W=`${T}-${V}`,Y={mode:V,name:W,version:"$LATEST"};if(y>0){let te=await l.getAlias(W,"live").catch(()=>null);if(te?.FunctionVersion){Y.version=te.FunctionVersion;let le=await l.getProvisionedConcurrencyConfig(W,"live").catch(()=>null);if(le)Y.provisioned={status:le.Status??"-",allocated:le.AllocatedProvisionedConcurrentExecutions??0,requested:le.RequestedProvisionedConcurrentExecutions??0}}}j.push(Y)}let B=await Nc(m,r.artifactBucket,r.slug,t).catch(()=>null);return{slug:r.slug,environment:t,region:r.region,stackStatus:h,endpoint:S.HttpApiEndpoint,assetUrl:B?.assetUrl,scheduler:r.app.scheduler??"on",queues:R,provisionedConcurrency:y,functions:j,lastRelease:B?{sha:B.sha,timestamp:B.timestamp}:void 0}}function ak(e,t){return`${e}-${t}-db`}async function mf(e,t,r,a){let l=Eo(e,t);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:m}=await import("./chunk-pf6sanwe.js"),h=new m(l.region),S=ak(l.slug,t);w(`Scaling ${S} → ${r}–${a} ACUs`),await h.modifyDBCluster({DBClusterIdentifier:S,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:a},ApplyImmediately:!0}),An(`Scaling applied to ${S} (takes effect shortly).`)}class ip{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async call(e,t){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${e}`},body:JSON.stringify(t)})}async listWebACLs(e="REGIONAL"){return(await this.call("ListWebACLs",{Scope:e,Limit:100}))?.WebACLs??[]}async getWebACLRules(e,t,r="REGIONAL"){return((await this.call("GetWebACL",{Name:e,Id:t,Scope:r}))?.WebACL?.Rules??[]).map((m)=>({Name:m.Name,Priority:m.Priority,Action:m.Action?Object.keys(m.Action)[0]:m.OverrideAction?Object.keys(m.OverrideAction)[0]:"count"}))}}var ck=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"routing",label:"Routing"},{index:4,id:"apps",label:"Applications"},{index:5,id:"runtime",label:"Background runtime"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],dk=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"entry",label:"Entry points"},{index:4,id:"compute",label:"Compute"},{index:5,id:"messaging",label:"Messaging & pooling"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],lk=[{match:/^redis/,kind:"cache",label:"Redis"},{match:/^(?:mysql|mariadb)/,kind:"database",label:"MySQL"},{match:/^postgres/,kind:"database",label:"PostgreSQL"},{match:/^meilisearch/,kind:"database",label:"Meilisearch"},{match:/^vitess|^vtgate/,kind:"database",label:"Vitess"},{match:/^memcached/,kind:"cache",label:"Memcached"}],uk=/^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;function De(e,t=""){let r=e==null?"":String(e).trim();return r&&r!=="-"&&r!=="—"?r:t}function pk(e){return Array.isArray(e)?e.length:0}function Un(e){let t=De(e).toLowerCase();if(!t)return"unknown";if(["running","live","active","available","success","ok","healthy","enabled"].includes(t))return"ok";if(["failed","stopped","unreachable","error","critical","disabled"].includes(t))return"bad";if(["configured","creating","pending","degraded","shadowed","warn","unknown"].includes(t))return"warn";return"warn"}function ur(e,t,r){if(r.has(t.source)&&r.has(t.target))e.push(t)}function Tt(e,t={}){let r=[],a=[],l=[],m=e.server??{},h=Array.isArray(e.sites)?e.sites:[],S=Array.isArray(e.services)?e.services:[],R=Array.isArray(e.workers)?e.workers:[],y=e.security??{},C=!!e._serverReachable&&!e.metricsUnavailable,T="box";if(!C)l.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let j=[...new Set(h.map((de)=>De(de.domain)||De(de.route).split("/")[0]).filter((de)=>de&&de!=="internal"&&de!=="loopback"))],B=Array.isArray(y.tlsCertificates)?y.tlsCertificates:[],V=B.filter((de)=>Number(de?.daysRemaining??999)<21).length;r.push({id:"dns",label:j.length===1?j[0]:"Public domains",kind:"dns",layer:1,status:V?"warn":j.length?"ok":"unknown",sub:j.length>1?`${j.length} domains`:"DNS & certificates",facts:[{label:"Domains",value:j.length?j.slice(0,6).join(", "):"none resolved"},{label:"Certificates",value:B.length?`${B.length} issued`:"none reported"},...V?[{label:"Expiring",value:`${V} within 21 days`}]:[]],href:"/server/security",external:!0});let W=y.firewall??{},Y=Array.isArray(y.ports)?y.ports:[];r.push({id:"firewall",label:"Host firewall",kind:"firewall",layer:2,status:Un(W.status),sub:De(W.summary,"Inbound filtering"),facts:[{label:"State",value:De(W.status,"unknown")},{label:"Open ports",value:Y.length?Y.map((de)=>De(de.listen)).join(", "):"not reported"}],href:"/server/firewall",group:"box"});let te=S.find((de)=>uk.test(De(de.name)));r.push({id:"proxy",label:De(te?.name,"Reverse proxy"),kind:"proxy",layer:3,status:te?Un(te.status):"unknown",sub:"TLS termination & routing",facts:[{label:"Service",value:De(te?.name,"not detected")},{label:"State",value:De(te?.status,C?"not running":"not probed")},{label:"Routes",value:`${h.length} site${h.length===1?"":"s"}`}],href:"/server/services",group:"box"});for(let de of h){let Me=`site:${De(de.name)}`;if(!De(de.name))continue;r.push({id:Me,label:De(de.name),kind:"site",layer:4,status:Un(de.status),sub:De(de.runtime,"runtime"),facts:[{label:"Route",value:De(de.route,"internal")},{label:"Runtime",value:De(de.runtime,"unknown")},{label:"Delivery",value:De(de.deploy,"unknown")},{label:"TLS",value:De(de.tls,"unknown")},...de.responseMs!=null?[{label:"Response",value:`${Math.round(Number(de.responseMs))} ms`}]:[],...de.httpStatus!=null?[{label:"HTTP",value:String(de.httpStatus)}]:[]],href:"/server/sites",group:"box"})}for(let de of R){let Me=`worker:${De(de.name)}`;if(!De(de.name))continue;r.push({id:Me,label:De(de.name),kind:"worker",layer:5,status:Un(de.status),sub:`${Number(de.processes??1)} process${Number(de.processes??1)===1?"":"es"}`,facts:[{label:"Processes",value:String(de.processes??1)},{label:"State",value:De(de.status,"unknown")},...De(de.site)?[{label:"Site",value:De(de.site)}]:[]],href:"/operations/jobs",group:"box"})}let le=e.serverScheduler??{};if(le.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:5,status:"ok",sub:"Cron dispatch",facts:[{label:"Last run",value:De(le.lastRun,"unknown")}],href:"/operations/jobs",group:"box"});let X=S.map((de)=>{let Me=De(de.name),ae=lk.find((Le)=>Le.match.test(Me));return ae?{service:de,name:Me,...ae}:null}).filter((de)=>!!de);for(let de of X)r.push({id:`data:${de.name}`,label:de.label,kind:de.kind,layer:6,status:Un(de.service.status),sub:de.name,facts:[{label:"Unit",value:de.name},{label:"State",value:De(de.service.status,"unknown")}],href:"/data/services",group:"box"});let ce=e.backup??{};if(ce.enabled)r.push({id:"backup",label:"Backups",kind:"backup",layer:7,status:"ok",sub:De(ce.destination,"destination"),facts:[{label:"Destination",value:De(ce.destination,"unknown")},{label:"Schedule",value:De(ce.schedule,"unknown")},{label:"Retention",value:`${ce.retention??0} copies`},{label:"Last run",value:De(ce.last,"unknown")}],href:"/data/backups"});let Ee=new Set(r.map((de)=>de.id));ur(a,{source:"internet",target:"dns",flow:"request",label:"https"},Ee),ur(a,{source:"dns",target:"firewall",flow:"request",label:"443/80"},Ee),ur(a,{source:"firewall",target:"proxy",flow:"request"},Ee);for(let de of h){let Me=`site:${De(de.name)}`;ur(a,{source:"proxy",target:Me,flow:"request",label:De(de.path)||void 0,status:Un(de.status)},Ee)}for(let de of R){let Me=`worker:${De(de.name)}`,ae=`site:${De(de.site)}`;if(Ee.has(ae))ur(a,{source:ae,target:Me,flow:"async",label:"queue"},Ee);else ur(a,{source:"proxy",target:Me,flow:"async",label:"queue"},Ee)}for(let de of R)ur(a,{source:"scheduler",target:`worker:${De(de.name)}`,flow:"async",label:"dispatch"},Ee);let Re=[...h.map((de)=>`site:${De(de.name)}`),...R.map((de)=>`worker:${De(de.name)}`)];for(let de of X)for(let Me of Re)ur(a,{source:Me,target:`data:${de.name}`,flow:"data",label:"localhost"},Ee);if(X.length&&Re.length)l.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");for(let de of X)ur(a,{source:`data:${de.name}`,target:"backup",flow:"backup",label:"snapshot"},Ee);for(let de of h)ur(a,{source:`site:${De(de.name)}`,target:"backup",flow:"backup"},Ee);return{mode:"server",project:De(t.project)||De(e.project?.name)||De(m.name,"project"),environment:De(t.environment)||De(e.environment,"production"),provider:De(m.provider,"unknown"),region:De(m.region,"unknown"),generatedAt:new Date().toISOString(),layers:ck,groups:[{id:"box",label:De(m.name,"App server"),sub:[De(m.provider),De(m.region),De(m.ip)].filter(Boolean).join(" · ")}],nodes:r,links:a,notes:l}}function ts(e,t={}){let r=[],a=[],l=[],m=e.app??{},h=Array.isArray(e.functions)?e.functions:[],S=Array.isArray(e.queues)?e.queues:[],R=e.metrics??{};if(!h.length)l.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let y=De(m.url),C=y.replace(/^https?:\/\//,"").split("/")[0];r.push({id:"dns",label:C||"Application domain",kind:"dns",layer:1,status:C?"ok":"unknown",sub:"DNS & certificates",facts:[{label:"Endpoint",value:y||"not resolved"}],external:!0});let T=e.waf;if(T)r.push({id:"waf",label:"WAF",kind:"waf",layer:2,status:Un(T.status??"active"),sub:De(T.scope,"Managed rules"),facts:[{label:"Web ACL",value:De(T.name,"unnamed")},...T.blocked!=null?[{label:"Blocked (24h)",value:String(T.blocked)}]:[],{label:"Rules",value:String(pk(e.wafRules))}],href:"/serverless/firewall"});let j=e.assetsInfo;if(j)r.push({id:"cdn",label:"Asset CDN",kind:"cdn",layer:2,status:"ok",sub:De(j.cdn,"CloudFront"),facts:[{label:"Distribution",value:De(j.cdn,"unknown")},{label:"Custom domain",value:De(j.customDomain,"none")}],href:"/serverless/assets"}),r.push({id:"assets",label:"Asset bucket",kind:"storage",layer:6,status:"ok",sub:De(j.bucket,"S3"),facts:[{label:"Bucket",value:De(j.bucket,"unknown")},...j.files?[{label:"Objects",value:String(j.files)}]:[],...j.sizeMb?[{label:"Size",value:`${j.sizeMb} MB`}]:[]],href:"/serverless/assets"});let B=h.find((ae)=>De(ae.key).startsWith("http"));r.push({id:"gateway",label:"HTTP entry point",kind:"gateway",layer:3,status:B?"ok":"unknown",sub:"Function URL / API Gateway",facts:[{label:"Endpoint",value:y||"not resolved"},{label:"Invocations (24h)",value:String(R.invocations??0)},...R.errorRatePct!=null?[{label:"Error rate",value:`${R.errorRatePct}%`}]:[]],href:"/serverless/metrics"});for(let ae of h){let Le=`fn:${De(ae.name)}`;if(!De(ae.name))continue;let Je=Number(ae.errors??0),gt=Number(ae.invocations??0);r.push({id:Le,label:De(ae.key,De(ae.name)),kind:"function",layer:4,status:Je>0?gt&&Je/gt>0.02?"bad":"warn":gt?"ok":"idle",sub:De(ae.runtime,"lambda"),facts:[{label:"Function",value:De(ae.name)},{label:"Memory",value:`${ae.memory??0} MB`},{label:"Timeout",value:`${ae.timeout??0}s`},{label:"Invocations (24h)",value:String(gt)},{label:"Errors (24h)",value:String(Je)},{label:"p95",value:`${ae.p95??0} ms`},...ae.provisioned?[{label:"Provisioned",value:De(ae.provisioned)}]:[]],href:"/serverless/functions"})}for(let ae of S){let Le=`queue:${De(ae.name)}`;if(!De(ae.name))continue;let Je=Number(ae.dlq??0);r.push({id:Le,label:De(ae.name),kind:"queue",layer:5,status:Je>0?"bad":Number(ae.visible??0)>0?"warn":"ok",sub:"SQS",facts:[{label:"Visible",value:String(ae.visible??0)},{label:"In flight",value:String(ae.inFlight??0)},{label:"Processed (24h)",value:String(ae.processed??0)},{label:"Dead letter",value:String(Je)}],href:"/serverless/queues"})}let V=e.aurora;if(V)r.push({id:"database",label:"Aurora Serverless",kind:"database",layer:6,status:Un(V.status),sub:De(V.engine,"aurora"),facts:[{label:"Cluster",value:De(V.id,"unknown")},{label:"Capacity",value:`${V.currentAcu??0} ACU (${V.minAcu??0}–${V.maxAcu??0})`},{label:"Connections",value:String(V.connections??0)}],href:"/serverless/data"});let W=e.proxy;if(W)r.push({id:"rds-proxy",label:"RDS Proxy",kind:"database",layer:5,status:Un(W.status),sub:"Connection pooling",facts:[{label:"Proxy",value:De(W.name,"unknown")},{label:"Endpoint",value:De(W.endpoint,"unknown")},{label:"Pooled",value:String(W.pooledConns??0)}],href:"/serverless/data"});let Y=e.redis;if(Y)r.push({id:"cache",label:"ElastiCache",kind:"cache",layer:6,status:Un(Y.status),sub:De(Y.node,"redis"),facts:[{label:"Group",value:De(Y.id,"unknown")},{label:"Hit rate",value:`${Y.hitRate??0}%`}],href:"/serverless/data"});let te=e.efs;if(te)r.push({id:"efs",label:"EFS",kind:"filesystem",layer:6,status:Un(te.status),sub:De(te.mount,"/mnt/local"),facts:[{label:"File system",value:De(te.id,"unknown")},{label:"Mount",value:De(te.mount,"unknown")},{label:"Size",value:`${te.sizeMb??0} MB`}],href:"/data/volumes"});let le=e.scheduler??{};if(le.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:3,status:"ok",sub:De(le.expression,"rate(1 minute)"),facts:[{label:"Expression",value:De(le.expression,"unknown")},{label:"Last run",value:De(le.lastRun,"unknown")}],href:"/operations/jobs"});let X=new Set(r.map((ae)=>ae.id)),ce=X.has("waf")?"waf":"gateway";ur(a,{source:"internet",target:"dns",flow:"request",label:"https"},X),ur(a,{source:"dns",target:ce,flow:"request"},X),ur(a,{source:"dns",target:"cdn",flow:"request",label:"assets"},X),ur(a,{source:"waf",target:"gateway",flow:"request",label:"allowed"},X),ur(a,{source:"cdn",target:"assets",flow:"data",label:"origin"},X);let Ee=h.filter((ae)=>De(ae.key).startsWith("http")),Re=h.filter((ae)=>De(ae.key).startsWith("queue")),de=h.filter((ae)=>De(ae.key).startsWith("cli"));for(let ae of Ee)ur(a,{source:"gateway",target:`fn:${De(ae.name)}`,flow:"request",label:"invoke"},X);for(let ae of de)ur(a,{source:"scheduler",target:`fn:${De(ae.name)}`,flow:"async",label:"schedule"},X);for(let ae of S){for(let Le of Ee)ur(a,{source:`fn:${De(Le.name)}`,target:`queue:${De(ae.name)}`,flow:"async",label:"publish"},X);for(let Le of Re)ur(a,{source:`queue:${De(ae.name)}`,target:`fn:${De(Le.name)}`,flow:"async",label:"consume"},X)}let Me=["rds-proxy","database","cache","efs","assets"];for(let ae of h){let Le=`fn:${De(ae.name)}`;if(X.has("rds-proxy"))ur(a,{source:Le,target:"rds-proxy",flow:"data",label:"pooled"},X);else ur(a,{source:Le,target:"database",flow:"data",label:"sql"},X);for(let Je of Me.filter((gt)=>gt!=="rds-proxy"&&gt!=="database"))ur(a,{source:Le,target:Je,flow:"data"},X)}return ur(a,{source:"rds-proxy",target:"database",flow:"data",label:"sql"},X),{mode:"serverless",project:De(t.project)||De(m.name,"application"),environment:De(t.environment)||De(m.env,"production"),provider:"aws",region:De(m.region,"unknown"),generatedAt:new Date().toISOString(),layers:dk,groups:[],nodes:r,links:a,notes:l}}function Eh(e,t,r={}){return e==="serverless"?ts(t,r):Tt(t,r)}function ff(e){return String(e).padStart(2,"0")}function As(e){return`${e.getUTCFullYear()}-${ff(e.getUTCMonth()+1)}-${ff(e.getUTCDate())}`}function gk(e){let t=Math.max(0,Math.round((Date.now()-e)/1000));if(t<60)return`${t}s ago`;let r=Math.round(t/60);if(r<60)return`${r}m ago`;let a=Math.round(r/60);if(a<48)return`${a}h ago`;return`${Math.round(a/24)}d ago`}async function Ya(e,t,r,a,l,m){let h=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:t}],StartTime:l,EndTime:m,Period:86400,Statistics:[a]}).catch(()=>[]);if(!h.length)return 0;if(a==="Sum")return h.reduce((S,R)=>S+(R.Sum??0),0);if(a==="Maximum")return Math.max(...h.map((S)=>S.Maximum??0));return h.reduce((S,R)=>S+(R.Average??0),0)/h.length}async function Za(e,t,r,a,l,m,h){let S=await e.getMetricStatistics({Namespace:t,MetricName:r,Dimensions:a,StartTime:m,EndTime:h,Period:86400,Statistics:[l]}).catch(()=>[]);if(!S.length)return 0;if(l==="Sum")return S.reduce((R,y)=>R+(y.Sum??0),0);if(l==="Maximum")return Math.max(...S.map((R)=>R.Maximum??0));return S.reduce((R,y)=>R+(y.Average??0),0)/S.length}async function op(e,t,r,a,l){let m=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:t}],StartTime:a,EndTime:l,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(m.reduce((h,S)=>h+(S.Percentiles?.[r]??0),0))}async function pn(e,t){let r=await Ar(e,t),a=r.region,l=new oe(a),m=new b(a),h=new ye(a),S=new Date,R=new Date(S.getTime()-86400000),y=e.environments?.[t]?.app,C={};C.app={name:r.slug,env:t,region:a,runtime:y?.kind==="php"?`php-${y?.phpVersion??"8.3"} (fpm)`:y?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},C.maintenance={enabled:!1},C.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let T=0,j=0,B=0,V=[],W=[],Y=[];for(let ce of r.functions){let[Ee,Re,de,Me,ae,Le,Je,gt,Jt]=await Promise.all([Ya(l,ce.name,"Invocations","Sum",R,S),Ya(l,ce.name,"Errors","Sum",R,S),Ya(l,ce.name,"Throttles","Sum",R,S),Ya(l,ce.name,"Duration","Average",R,S),m.getFunction(ce.name).catch(()=>null),op(l,ce.name,"p50",R,S),op(l,ce.name,"p95",R,S),op(l,ce.name,"p99",R,S),l.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:ce.name}],StartTime:new Date(S.getTime()-43200000),EndTime:S,Period:3600,Stat:"Sum"}).catch(()=>[])]);T+=Ee,j+=Re,B=Math.max(B,Me);let ot=ae?.Configuration?.MemorySize??0,Pt=Object.keys(ae?.Configuration?.Environment?.Variables??{}),Qt=[],lt=0;try{let{events:ue=[]}=await h.filterLogEvents({logGroupName:`/aws/lambda/${ce.name}`,startTime:R.getTime(),limit:120});for(let be of ue){let xe=(be.message??"").trim(),mt=/Max Memory Used:\s*(\d+)\s*MB/.exec(xe);if(mt)lt=Math.max(lt,Number(mt[1]));if(xe&&!/^(?:START|END|REPORT|INIT_START)/.test(xe))Y.push({source:ce.mode||ce.name,timestamp:new Date(be.timestamp??0).toISOString(),when:gk(be.timestamp??0),message:xe.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(xe)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(xe)?"warn":"info"})}Qt=ue.filter((be)=>!/^(?:START|END|REPORT|INIT_START)/.test((be.message??"").trim())).slice(-6).map((be)=>({ts:new Date(be.timestamp??0).toISOString().slice(11,19),msg:(be.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(be.message??"")}))}catch{}let G=Math.max(1,...Jt);V.push({key:ce.mode,name:ce.name,version:ce.version,memory:ot,timeout:ae?.Configuration?.Timeout??0,runtime:ae?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(Ee),errors:Math.round(Re),p95:Je||Math.round(Me),status:"active",provisioned:ce.provisioned?`${ce.provisioned.allocated}/${ce.provisioned.requested}`:void 0}),W.push({key:ce.mode,name:ce.name,runtime:ae?.Configuration?.Runtime??"provided.al2023",arch:ae?.Configuration?.Architectures?.[0]??"x86_64",memory:ot,timeout:ae?.Configuration?.Timeout??0,ephemeral:ae?.Configuration?.EphemeralStorage?.Size??512,version:ce.version,concurrency:y?.concurrency??"—",invocations:Math.round(Ee),errors:Math.round(Re),throttles:Math.round(de),p50:Le||Math.round(Me),p95:Je||Math.round(Me),p99:gt||Math.round(Me),maxMem:lt,spark:Jt.length?Jt.map((ue)=>Math.round(ue/G*100)):[0],env:Pt.length?Pt:["(none)"],recent:Qt.length?Qt:[{ts:"—",msg:"no recent events",err:!1}]})}C.functions=V,C.functionsDetail=W,C.serverlessLogs=Y.sort((ce,Ee)=>String(Ee.timestamp).localeCompare(String(ce.timestamp))).slice(0,600),C.serverlessLogsEmptyReason=Y.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let te=T?Number((j/T*100).toFixed(2)):0,le=Math.round(await Ya(l,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",R,S));C.metrics={invocations:Math.round(T),errorRatePct:te,p95Ms:Math.round(B),coldStartPct:void 0,concurrency:le,estCostUsd:void 0};try{let ce=new se(a),Ee=[],Re=[],de=0;try{let{QueueUrl:ae}=await ce.getQueueUrl(`${r.slug}-${t}-dlq`),{Attributes:Le}=await ce.getQueueAttributes(ae);de=Number(Le.ApproximateNumberOfMessages??0)}catch{}let Me=y?Xt(y,r.slug,t):[];for(let ae of Me){let Le=ae.name.replace(`${r.slug}-${t}-`,""),Je=0,gt=0;try{let{QueueUrl:ot}=await ce.getQueueUrl(ae.name),{Attributes:Pt}=await ce.getQueueAttributes(ot);Je=Number(Pt.ApproximateNumberOfMessages??0),gt=Number(Pt.ApproximateNumberOfMessagesNotVisible??0)}catch{}let Jt=Math.round(await Za(l,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:ae.name}],"Sum",R,S));Ee.push({name:Le,visible:Je,inFlight:gt,processed:Jt,dlq:de}),Re.push({name:ae.name,short:Le,visible:Je,inFlight:gt,delayed:0,processed:Jt,oldestSec:0,concurrency:ae.concurrency??y?.queueConcurrency??"—",tries:y?.queueTries??3,visTimeout:(y?.queueTimeout??120)*6,dlq:de})}if(Ee.length)C.queues=Ee;if(Re.length)C.queuesDetail=Re;C.dlqItems=[]}catch{}try{let ce=new f(a),{Stacks:Ee}=await ce.describeStacks({stackName:qt(e,t)}),Re={};for(let de of Ee?.[0]?.Outputs??[])if(de.OutputKey)Re[de.OutputKey]=de.OutputValue??"";if(y?.database?.connection==="aurora-serverless"){let de=`${r.slug}-${t}-db`,Me=[{Name:"DBClusterIdentifier",Value:de}],[ae,Le]=await Promise.all([Za(l,"AWS/RDS","ServerlessDatabaseCapacity",Me,"Average",R,S),Za(l,"AWS/RDS","DatabaseConnections",Me,"Maximum",R,S)]);if(C.aurora={id:de,engine:"aurora-mysql",minAcu:y?.database?.minCapacity??0.5,maxAcu:y?.database?.maxCapacity??4,currentAcu:ae?Number(ae.toFixed(1)):y?.database?.minCapacity??0.5,database:"app",connections:Math.round(Le),status:Re.DbEndpoint?"available":"creating"},y?.rdsProxy)C.proxy={name:`${r.slug}-${t}-proxy`,endpoint:Re.DbProxyEndpoint??"—",pooledConns:Math.round(Le),status:"available"}}if(y?.cache?.driver==="elasticache"){let de=`${r.slug}-${t}-cache`,Me=[{Name:"CacheClusterId",Value:`${de}-001`}],[ae,Le]=await Promise.all([Za(l,"AWS/ElastiCache","CacheHits",Me,"Sum",R,S),Za(l,"AWS/ElastiCache","CacheMisses",Me,"Sum",R,S)]),Je=ae+Le>0?Number((ae/(ae+Le)*100).toFixed(1)):0;C.redis={id:de,node:"cache.t4g.micro",engine:"redis",hitRate:Je,status:Re.CacheEndpoint?"available":"creating"}}if(y?.efs){let de=0;try{if(Re.EfsFileSystemId){let Me=new dr(a),{FileSystems:ae}=await Me.describeFileSystems({FileSystemId:Re.EfsFileSystemId});de=Number(((ae?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}C.efs={id:Re.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:de,status:"available"}}C.assetsInfo=Re.AssetsCdnDomain?{bucket:Re.AssetsBucketName??`${r.slug}-${t}-assets`,cdn:Re.AssetsCdnDomain,customDomain:y?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:C.app.build}:void 0}catch{}if(C.assetsInfo)try{let Ee=await new o(a).list({bucket:C.assetsInfo.bucket,maxKeys:1000});C.assetsInfo.files=Ee.length,C.assetsInfo.sizeMb=Number((Ee.reduce((Re,de)=>Re+(de.Size??0),0)/1048576).toFixed(1)),C.assetsRecent=Ee.slice(0,8).map((Re)=>({path:`/${Re.Key}`,size:`${Math.max(1,Math.round((Re.Size??0)/1024))} KB`,type:Re.Key.split(".").pop()??""}))}catch{}try{if(y?.secrets){let ce=Array.isArray(y.secrets)?y.secrets.map((Ee)=>({key:Ee.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:Ee})):Object.entries(y.secrets).map(([Ee,Re])=>({key:Ee,source:String(Re)}));C.secretsList=ce.map((Ee)=>({...Ee,updated:"—"}))}}catch{}try{let ce=new o(a),Ee=`${r.slug}-${t}-deployments`,Re=await ce.getObjectJson(Ee,`deployments/${r.slug}/${t}/history.json`).catch(()=>null);if(Re?.records?.length)C.deploymentsDetail=Re.records.slice(-12).reverse().map((de)=>({sha:(de.sha??"").slice(0,7),status:de.status??"success",when:de.timestamp??"—",took:de.took??"—",by:de.by??"—",version:de.version??"—",hooks:de.hooks??[]}))}catch{}C.metricsTotals={invocations:C.metrics.invocations,errors:Math.round(j),errorRatePct:te,p95Ms:C.metrics.p95Ms,throttles:W.reduce((ce,Ee)=>ce+Ee.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:le},C.metricsPerFn=W.map((ce)=>({key:ce.key,invocations:ce.invocations,errors:ce.errors,throttles:ce.throttles,avgMs:ce.p50,maxMs:ce.p99,costUsd:void 0}));try{C.invSpark=await l.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((ce)=>ce.mode==="http")?.name??""}],StartTime:new Date(S.getTime()-86400000),EndTime:S,Period:3600,Stat:"Sum"})}catch{}try{let ce=new ms,Ee=S,Re=new Date(Date.UTC(Ee.getUTCFullYear(),Ee.getUTCMonth(),1)),de=new Date(Date.UTC(Ee.getUTCFullYear(),Ee.getUTCMonth()-1,1)),[Me,ae]=await Promise.all([ce.getCostByService({start:As(Re),end:As(Ee),granularity:"MONTHLY"}).catch(()=>[]),ce.getCostByService({start:As(de),end:As(Re),granularity:"MONTHLY"}).catch(()=>[])]);if(Me.length){let Le=Me.reduce((lt,G)=>lt+G.amount,0),Je=ae.reduce((lt,G)=>lt+G.amount,0),gt=Ee.getUTCDate(),Jt=new Date(Date.UTC(Ee.getUTCFullYear(),Ee.getUTCMonth()+1,0)).getUTCDate();C.costSummary={monthToDateUsd:Number(Le.toFixed(2)),projectedUsd:Number((Le/gt*Jt).toFixed(2)),lastMonthUsd:Number(Je.toFixed(2)),dailyAvgUsd:Number((Le/gt).toFixed(2))},C.costServices=Me.filter((lt)=>lt.amount>0).sort((lt,G)=>G.amount-lt.amount).slice(0,12).map((lt)=>({name:lt.service,usd:Number(lt.amount.toFixed(2)),note:""})),C.metrics.estCostUsd=Number((Le/gt).toFixed(2)),C.metricsTotals.estCostUsd=C.metrics.estCostUsd,C.costTrend=await ce.getDailyTotals({start:As(Re),end:As(Ee)}).catch(()=>[]);let ot=Me.find((lt)=>/lambda/i.test(lt.service))?.amount??0,Pt=(lt)=>lt.invocations*(lt.p50/1000)*(lt.memory/1024),Qt=W.reduce((lt,G)=>lt+Pt(G),0)||1;C.costPerFn=W.map((lt)=>({key:lt.key,requests:lt.invocations,gbSec:Math.round(Pt(lt)),usd:Number((ot*(Pt(lt)/Qt)).toFixed(2))}))}}catch{}if(y?.firewall)try{let ce=await l.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:R,EndTime:S,Period:86400,Statistics:["Sum"]}).catch(()=>[]),Ee=await l.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:R,EndTime:S,Period:86400,Statistics:["Sum"]}).catch(()=>[]);C.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${t}-waf`,allowed24h:Math.round(Ee.reduce((Re,de)=>Re+(de.Sum??0),0)),blocked24h:Math.round(ce.reduce((Re,de)=>Re+(de.Sum??0),0))};try{let Re=new ip(a),de=await Re.listWebACLs("REGIONAL"),Me=de.find((ae)=>ae.Name?.includes(`${r.slug}-${t}`))??de[0];if(Me?.Name&&Me.Id){C.waf.acl=Me.Name;let ae=await Re.getWebACLRules(Me.Name,Me.Id,"REGIONAL");if(ae.length)C.wafRules=ae.map((Le)=>({name:Le.Name??"—",detail:`priority ${Le.Priority??0}`,action:Le.Action??"count",blocked24h:0}))}}catch{}}catch{}let X=[];if(C.aurora)X.push({name:"Aurora Serverless v2",detail:`${C.aurora.id} · ${C.aurora.minAcu}-${C.aurora.maxAcu} ACU`,status:C.aurora.status});if(C.proxy)X.push({name:"RDS Proxy",detail:C.proxy.name,status:C.proxy.status});if(C.redis)X.push({name:`ElastiCache (${C.redis.engine})`,detail:`${C.redis.node} · ${C.redis.hitRate}% hit rate`,status:C.redis.status});if(C.efs)X.push({name:"EFS",detail:`${C.efs.mount} · ${C.efs.sizeMb} MB`,status:C.efs.status});if(X.length)C.dataServices=X;if(r.scheduler!=="off"&&y?.kind==="php")try{let ce=await tt(e,t,"schedule:list"),Ee=[];for(let Re of(ce||"").split(`
 `)){let de=/^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(Re);if(de&&/[*\d]/.test(de[1])&&de[1].trim().split(/\s+/).length===5)Ee.push({command:de[2].trim().replace(/^php artisan /,""),cron:de[1].trim(),desc:"",lastRun:"—",lastStatus:"ok"})}if(Ee.length)C.schedulerTasks=Ee}catch{}return C.topology=ts(C,{project:e.project.name,environment:t}),C}function Mi(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:null}function mk(e){if(!/^\d{4}-\d{2}-\d{2}$/.test(e))return null;let t=Date.parse(`${e}T12:00:00.000Z`);return Number.isFinite(t)?new Date(t).toISOString():null}function mu(e,t){if(!e||typeof e!=="object")return[];let r={source:t.name},a=[],l=t.now,m=(y,C,T,j=l)=>{if(C!==null)a.push({name:y,value:C,unit:T,timestamp:j,attributes:r})};m("storage.egress.month",Mi(e.monthBytes),"bytes"),m("storage.egress.today",Mi(e.todayBytes),"bytes"),m("storage.egress.projected_month",Mi(e.projectedMonthBytes),"bytes");let h=Mi(e.budgetBytes);if(h!==null&&h>0){m("storage.egress.budget",h,"bytes");let y=e.budgetUsedPercent,C=typeof y==="number"&&Number.isFinite(y)?y:Mi(e.monthBytes)!==null?Math.round(Mi(e.monthBytes)/h*1000)/10:null;m("storage.egress.budget_used_percent",C,"percent")}let S=t.maxReplayDays??45,R=Array.isArray(e.days)?e.days.slice(-S):[];for(let y of R){let C=mk(String(y?.date??"")),T=Mi(y?.bytes);if(!C||T===null)continue;a.push({name:"storage.egress.day",value:T,unit:"bytes",timestamp:C,attributes:r});let j=Mi(y?.downloads);if(j!==null)a.push({name:"storage.egress.day_downloads",value:j,unit:"count",timestamp:C,attributes:r})}return a}async function hu(e,t=process.env,r=fetch){let a=e.tokenEnv?t[e.tokenEnv]:void 0,l=await r(e.url,{headers:a?{Authorization:`Bearer ${a}`}:{},signal:AbortSignal.timeout(1e4)});if(!l.ok)throw Error(`HTTP ${l.status}`);return await l.json()}async function ba(e,t){let r=[],a=[];if(!Array.isArray(e)||e.length===0)return{metrics:r,errors:a};let l=await Promise.all(e.map(async(m)=>{if(!m?.name||!m?.url)return{endpoint:m,error:"egress endpoint needs both a name and a url"};try{let h=await hu(m,t.env,t.fetchImpl);return{endpoint:m,report:h}}catch(h){return{endpoint:m,error:h instanceof Error?h.message:String(h)}}}));for(let m of l){let h=`egress:${m.endpoint?.name??"unnamed"}`;if("error"in m&&m.error){a.push({source:h,message:m.error});continue}r.push(...mu(m.report,{name:m.endpoint.name,now:t.now}))}return{metrics:r,errors:a}}import{createHash as x_}from"node:crypto";import{existsSync as Ai,mkdtempSync as wm,readdirSync as GS,rmSync as bs,statSync as sw}from"node:fs";import{readFile as ii,writeFile as ys}from"node:fs/promises";import{tmpdir as Vu}from"node:os";import{dirname as D_,extname as Ec,join as Ut,normalize as O_,relative as $_,resolve as N_,sep as j_}from"node:path";import{fileURLToPath as B_}from"node:url";class Fo extends Error{status;code;requestId;constructor(e,t,r,a){super(r);this.status=e;this.code=t;this.requestId=a}}class hl{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),a=await r.json().catch(()=>({}));if(!r.ok)throw new Fo(r.status,a.error?.code??"api_error",a.error?.message??"API request failed.",a.error?.requestId??r.headers.get("x-request-id")??void 0);return a}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,a])=>[r,String(a)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,a])=>[r,String(a)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,a])=>a!==void 0).map(([a,l])=>[a,String(l)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,a]of Object.entries(e))if(a)t.set(r,String(a));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,a]of Object.entries(e))if(a)t.set(r,String(a));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as nI}from"node:crypto";import{lstatSync as fk,readdirSync as hk,readFileSync as yk}from"node:fs";import{relative as vk,resolve as hf,sep as bk}from"node:path";function Sk(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function Ro(e,t,r){return{path:e,reason:t,weight:r}}function yf(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function Cs(e,t,r,a,l,m){return{framework:e,strategy:t,confidence:r,evidence:a,defaults:{build:l,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:m}}function _s(e){let t=Sk(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(Cs("dockerfile","dockerfile",0.99,[Ro("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let a=yf(t.get("composer.json"));if(t.has("artisan")&&a.require?.["laravel/framework"])r.push(Cs("laravel","server",0.98,[Ro("artisan","Laravel Artisan entrypoint is present.",0.45),Ro("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(Cs("php","server",0.82,[Ro("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let l=yf(t.get("package.json"));if(t.has("package.json")){let m=t.has("bun.lock")||t.has("bun.lockb")||l.engines?.bun,h=m?"bun":"node",S=m?"bun":"node",R=[Ro("package.json",`Defines ${l.scripts?.build?"build and ":""}${l.scripts?.start?"start ":""}scripts.`,0.55)];if(m)R.push(Ro(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let y=!!(l.dependencies?.vite||l.devDependencies?.vite||l.dependencies?.["@stacksjs/bunpress"]||l.devDependencies?.["@stacksjs/bunpress"])&&!l.scripts?.start,C=y?{kind:"static",installCommand:`${h} install --frozen-lockfile`,buildCommand:`${h} run build`,publishDirectory:"dist"}:{kind:"server",runtime:h,installCommand:`${h} install --frozen-lockfile`,buildCommand:l.scripts?.build?`${h} run build`:void 0,startCommand:l.scripts?.start?`${h} run start`:h==="bun"?"bun run index.ts":"node index.js"};r.push(Cs(S,C.kind,Math.min(0.94,R.reduce((T,j)=>T+j.weight,0)),R,C,y?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${h} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(Cs("static","static",0.78,[Ro(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(Cs("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((m,h)=>h.confidence-m.confidence||m.framework.localeCompare(h.framework))}function sp(e,t={}){let r=hf(e),a=t.maxFiles??1e4,l=t.maxContentBytes??262144,m=[],h=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),S=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),R=(y)=>{for(let C of hk(y).sort()){if(S.has(C))continue;let T=hf(y,C),j=vk(r,T).split(bk).join("/");if(!j||j.startsWith("../"))throw Error("Detection path escaped the application root");let B=fk(T);if(B.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${j}`);if(B.isDirectory())R(T);else if(B.isFile()){if(m.length>=a)throw Error("Application file-count limit exceeded");let V={path:j,size:B.size};if(h.has(j)&&B.size<=l)V.content=yk(T,"utf8");m.push(V)}}};return R(r),m}function cp(e){if(Array.isArray(e))return`[${e.map(cp).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${cp(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function Xa(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function In(e,t,r,a){return{path:e,code:t,message:r,alternatives:a}}function ap(e){return JSON.parse(JSON.stringify(e))}function wk(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,a])=>[r,typeof a==="string"?a:`\${${a.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return ap({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return ap({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return ap({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function qn(e,t=[]){let r=[],a=(V)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(V),l=Object.fromEntries(Object.entries(e.environment??{}).map(([V,W])=>{if(typeof W==="string"&&a(V))return r.push(In(`environment.${V}`,"write_only_secret_required",`${V} must be supplied through the write-only secrets boundary.`)),[V,{secretRef:V}];return[V,W]})),m=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let V=Object.fromEntries(Object.entries(e.build.buildArgs).map(([W,Y])=>{if(a(W))return r.push(In(`build.buildArgs.${W}`,"write_only_build_secret_required",`${W} must be declared in secretNames instead of buildArgs.`)),[W,"[REDACTED]"];return[W,Y]}));m={...e.build,buildArgs:V}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(In("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!Xa((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(In("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((V)=>!Xa(V)))r.push(In("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!Xa(e.build.context)||!Xa(e.build.dockerfile)))r.push(In("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!Xa(e.build.publishDirectory))r.push(In("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(In("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(In("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(In("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(In("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(In("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let h=e.runtime.healthCheck;if(h&&h.protocol!=="tcp"&&(!h.path||!h.path.startsWith("/")||/[\r\n]/.test(h.path)))r.push(In("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(In("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let S=Object.values(l).flatMap((V)=>typeof V==="object"?[V.secretRef]:[]),R=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...S])].sort(),y=new Set(t),C=R.filter((V)=>!y.has(V)),T={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:m,runtime:e.runtime,environment:l,domain:e.domain}},j=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),B=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&C.length===0,issues:r,missingSecrets:C,manifest:T,configPatch:wk({...e,build:m,environment:l}),capabilityRequirements:j,costDrivers:B,serializedManifest:`${cp(T)}
 `}}function vf(e){let t=e.replace(/\\/g,"/");return!!t&&!t.startsWith("/")&&!/^[A-Za-z]:\//.test(t)&&!t.split("/").includes("..")&&!/[\0\r\n]/.test(t)}function bf(e,t,r={}){let a=r.maxBytes??104857600,l=r.maxEntries??1e4,m=r.maxExpandedBytes??524288000;if(e.byteLength>a)throw Error("Archive exceeds the compressed size limit");let h=new DataView(e.buffer,e.byteOffset,e.byteLength),S=[],R=0;if(t.toLowerCase().endsWith(".zip")||e[0]===80&&e[1]===75){let C=0;while(C+30<=e.length){let T=h.getUint32(C,!0);if(T===33639248||T===101010256)break;if(T!==67324752)throw Error("Malformed ZIP local header");let j=h.getUint16(C+6,!0),B=h.getUint32(C+18,!0),V=h.getUint32(C+22,!0),W=h.getUint16(C+26,!0),Y=h.getUint16(C+28,!0);if(j&8)throw Error("ZIP data descriptors are not accepted for uploaded artifacts");let te=new TextDecoder().decode(e.subarray(C+30,C+30+W));if(!vf(te))throw Error(`Unsafe archive path: ${te}`);if(S.push(te),R+=V,S.length>l||R>m)throw Error("Archive expansion limit exceeded");C+=30+W+Y+B}return{format:"zip",entries:S.length,expandedBytes:R,paths:S}}if(!t.toLowerCase().match(/\.(?:tar|tar\.gz|tgz)$/))throw Error("Only ZIP and uncompressed TAR artifacts are supported");let y=0;while(y+512<=e.length){let C=e.subarray(y,y+512);if(C.every((W)=>W===0))break;let T=(W,Y)=>new TextDecoder().decode(C.subarray(W,W+Y)).replace(/\0.*$/,""),j=`${T(345,155)}${T(345,155)?"/":""}${T(0,100)}`,B=Number.parseInt(T(124,12).trim()||"0",8),V=String.fromCharCode(C[156]??0);if(!vf(j))throw Error(`Unsafe archive path: ${j}`);if(V==="1"||V==="2")throw Error(`Archive links are not accepted: ${j}`);if(!Number.isFinite(B)||B<0)throw Error("Malformed TAR entry size");if(S.push(j),R+=B,S.length>l||R>m)throw Error("Archive expansion limit exceeded");y+=512+Math.ceil(B/512)*512}return{format:"tar",entries:S.length,expandedBytes:R,paths:S}}var Sf=new Set(["source","build","runtime","environment","domain","review"]);function wf(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function kf(e){return/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(e)}function If(e){for(let[r,a]of Object.entries(e.environment??{}))if(typeof a==="string"&&kf(r)&&a)throw Error(`${r} must be stored through the write-only secrets boundary`);if(e.build.kind==="dockerfile"){for(let[r,a]of Object.entries(e.build.buildArgs??{}))if(kf(r)&&a)throw Error(`${r} must be declared as a build secret name`)}let t=JSON.stringify(e);if(/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Drafts cannot contain credential-bearing URLs")}function Ef(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),schemaVersion:Number(e.schema_version),name:String(e.name),step:String(e.step),input:wf(e.input,{}),suppliedSecretNames:wf(e.supplied_secret_names,[]),status:String(e.status),version:Number(e.version),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class dp{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}create(e){if(If(e.draft),e.draft.projectId!==e.projectId)throw Error("Draft project does not match its storage scope");let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Draft project was not found");let r=this.idFn(),a=this.now(),l=e.step??"source";if(!Sf.has(l))throw Error("Invalid draft step");let m=[...new Set(e.suppliedSecretNames??[])].sort(),h=qn(e.draft,m).valid?"ready":"draft";return this.controlPlane.database.run("INSERT INTO application_drafts (id, organization_id, project_id, schema_version, name, step, input, supplied_secret_names, status, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.projectId,e.name.trim().slice(0,100),l,JSON.stringify(e.draft),JSON.stringify(m),h,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.draft.created",payload:{draftId:r,step:l,status:h,requiredSecretNames:e.draft.requiredSecretNames??[]}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_drafts WHERE id=?").get(e);return t?Ef(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_drafts WHERE project_id=? ORDER BY updated_at DESC").all(e).map(Ef)}update(e,t,r){let a=this.get(e);if(!a||a.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);if(!Sf.has(r.step))throw Error("Invalid draft step");if(r.draft.projectId!==a.projectId)throw Error("Draft project cannot be changed");If(r.draft);let l=[...new Set(r.suppliedSecretNames??a.suppliedSecretNames)].sort(),m=qn(r.draft,l).valid?"ready":"draft",h=this.now();if(this.controlPlane.database.run("UPDATE application_drafts SET name=?, step=?, input=?, supplied_secret_names=?, status=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.draft.name.slice(0,100),r.step,JSON.stringify(r.draft),JSON.stringify(l),m,h,e,t]).changes!==1)throw Error(`Application draft ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,actorId:r.actorId,type:"application.draft.updated",payload:{draftId:e,fromVersion:t,toVersion:t+1,step:r.step,status:m}}),this.get(e)}markApplied(e,t,r){let a=this.get(e);if(!a||a.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);let l=qn(a.input,a.suppliedSecretNames);if(!l.valid)throw Error(`Draft is not deployable: ${[...l.issues.map((h)=>h.message),...l.missingSecrets.map((h)=>`Missing secret ${h}`)].join("; ")}`);let m=this.now();return this.controlPlane.database.run("UPDATE application_drafts SET status='applied', step='review', version=version+1, updated_at=? WHERE id=? AND version=?",[m,e,t]),this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,actorId:r,type:"application.draft.applied",payload:s({draftId:e,manifest:l.manifest})}),this.get(e)}}import{createCipheriv as kk,createDecipheriv as Ik,createHash as Cf,randomBytes as Ek}from"node:crypto";function ec(e){return typeof e==="string"&&e?e:void 0}function lp(e){return Cf("sha256").update(e).digest("hex").slice(0,16)}function Rf(e){let t=new URL(e.includes("://")?e:`https://${e}`);if(t.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(t.hostname))throw Error("Registry host must use HTTPS");if(t.username||t.password||t.search||t.hash)throw Error("Registry host cannot contain credentials");return`${t.protocol}//${t.host}`}function Rk(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:ec(e.credential_fingerprint),credentialExpiresAt:ec(e.credential_expires_at),status:String(e.status),healthMessage:ec(e.health_message),lastTestedAt:ec(e.last_tested_at),version:Number(e.version),createdByActorId:ec(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class up{controlPlane;key;nowFn;idFn;constructor(e,t){this.controlPlane=e;if(!t.encryptionKey)throw Error("Registry encryption key is required");this.key=Cf("sha256").update(`ts-cloud:registry:${t.encryptionKey}`).digest(),this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}encrypt(e){let t=Ek(12),r=kk("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Registry credential envelope is invalid");let m=Ik("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}current(e){let t=Rk(e);return t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime()?{...t,status:"expired",healthMessage:"Registry credential expired; rotate it before pulling images."}:t}create(e){if(!["docker_hub","ghcr","ecr","gcr","generic"].includes(e.provider))throw Error("A supported registry provider is required");let t=e.credential?JSON.stringify(e.credential):void 0,r=this.idFn(),a=this.now();return this.controlPlane.database.run("INSERT INTO registry_connections (id, organization_id, provider, name, host, credential_ciphertext, credential_fingerprint, credential_expires_at, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.provider,e.name.trim().slice(0,80),Rf(e.host),t?this.encrypt(t):null,t?lp(t):null,e.credentialExpiresAt??null,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"registry.connection.created",payload:{connectionId:r,provider:e.provider,host:Rf(e.host),credentialConfigured:!!t}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM registry_connections WHERE id=?").get(e);return t?this.current(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM registry_connections WHERE organization_id=? ORDER BY name").all(e).map((t)=>this.current(t))}credential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM registry_connections WHERE id=?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotate(e,t,r={}){let a=this.get(e);if(!a||a.status==="disconnected")throw Error("Registry connection was not found");let l=JSON.stringify(t);return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=?, credential_fingerprint=?, credential_expires_at=?, status='pending', health_message=NULL, version=version+1, updated_at=? WHERE id=?",[this.encrypt(l),lp(l),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:r.actorId,type:"registry.credential.rotated",payload:{connectionId:e,fingerprint:lp(l),expiresAt:r.expiresAt??null}}),this.get(e)}disconnect(e,t){let r=this.get(e);if(!r)throw Error("Registry connection was not found");return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=NULL, credential_fingerprint=NULL, status='disconnected', health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"registry.connection.disconnected",level:"warning",payload:{connectionId:e}}),this.get(e)}async test(e,t={}){let r=this.get(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active registry connection was not found");let a=this.credential(e),l=t.fetch??fetch,m=new AbortController,h=setTimeout(()=>m.abort(),t.timeoutMs??15000),S=a?.token?`Bearer ${a.token}`:a?.username||a?.password?`Basic ${Buffer.from(`${a.username??""}:${a.password??""}`).toString("base64")}`:void 0;try{let R=await l(`${r.host}/v2/`,{method:"GET",redirect:"error",signal:m.signal,headers:S?{Authorization:S}:void 0}),y=R.headers.get("www-authenticate")??"";if(R.status===401&&y.startsWith("Bearer ")&&a){let j=Object.fromEntries([...y.slice(7).matchAll(/(\w+)="([^"]+)"/g)].map((te)=>[te[1],te[2]])),B=new URL(j.realm??"");if(B.protocol!=="https:")throw Error("Registry authentication realm must use HTTPS");if(j.service)B.searchParams.set("service",j.service);if(t.image)B.searchParams.set("scope",`repository:${Pf(t.image).repository}:pull`);let V=await l(B,{signal:m.signal,redirect:"error",headers:S?{Authorization:S}:void 0});if(!V.ok)throw Error(`Registry authentication failed (${V.status})`);let W=await V.json(),Y=W.token??W.access_token;if(!Y)throw Error("Registry did not return an access token");R=t.image?await Af(l,r.host,t.image,Y,m.signal):await l(`${r.host}/v2/`,{signal:m.signal,redirect:"error",headers:{Authorization:`Bearer ${Y}`}})}else if(R.ok&&t.image)R=await Af(l,r.host,t.image,a?.token,m.signal,S);let C=R.ok?"healthy":"degraded",T=R.ok?t.image?"Registry image is readable.":"Registry connection is healthy.":`Registry request failed (${R.status})`;return this.controlPlane.database.run("UPDATE registry_connections SET status=?, health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[C,T,this.now(),this.now(),e]),this.get(e)}catch(R){let y=m.signal.aborted?"Registry request timed out.":R instanceof Error?R.message:"Registry test failed";return this.controlPlane.database.run("UPDATE registry_connections SET status='degraded', health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[y.slice(0,1000),this.now(),this.now(),e]),this.get(e)}finally{clearTimeout(h)}}}function Pf(e){let t=e.replace(/^https?:\/\//,""),r=t.indexOf("/");if(r<1)throw Error("Image must include registry/repository");let a=t.slice(r+1),l=a.lastIndexOf("@"),m=a.lastIndexOf(":"),h=l>=0?l:m>a.lastIndexOf("/")?m:-1,S=h>=0?a.slice(0,h):a,R=h>=0?a.slice(h+1):"latest";if(!/^[A-Za-z0-9_.\/-]+$/.test(S)||!/^[A-Za-z0-9_.:+-]+$/.test(R))throw Error("Image reference is invalid");return{repository:S,reference:R}}async function Af(e,t,r,a,l,m){let h=Pf(r);return e(`${t}/v2/${h.repository}/manifests/${encodeURIComponent(h.reference)}`,{method:"HEAD",redirect:"error",signal:l,headers:{Accept:"application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",...a?{Authorization:`Bearer ${a}`}:m?{Authorization:m}:{}}})}import{createHash as Ak}from"node:crypto";import{chmodSync as _f,existsSync as Tf,mkdirSync as Ck,renameSync as Pk,unlinkSync as xf,writeFileSync as _k}from"node:fs";import{basename as Tk,join as xk}from"node:path";function pp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),filename:String(e.filename),sha256:String(e.sha256),size:Number(e.size),format:String(e.format),entryCount:Number(e.entry_count),expandedBytes:Number(e.expanded_bytes),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at)}}class gp{controlPlane;root;idFn;nowFn;constructor(e,t){this.controlPlane=e;this.root=d(t.cwd,"artifacts"),this.idFn=t.id??(()=>crypto.randomUUID()),this.nowFn=t.now??(()=>new Date)}create(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Artifact project was not found");let r=Tk(e.filename).slice(0,200);if(!r||r!==e.filename)throw Error("Artifact filename must not contain a path");let a=bf(e.bytes,r),l=Ak("sha256").update(e.bytes).digest("hex"),m=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? AND sha256=?").get(e.projectId,l);if(m)return pp(m);let h=this.idFn();Ck(this.root,{recursive:!0,mode:448}),_f(this.root,448);let S=xk(this.root,`${h}.archive`),R=`${S}.partial`;try{_k(R,e.bytes,{mode:384,flag:"wx"}),Pk(R,S),_f(S,384),this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[h,e.organizationId,e.projectId,r,S,l,e.bytes.byteLength,a.format,a.entries,a.expandedBytes,e.actorId??null,this.nowFn().toISOString()])}catch(y){if(Tf(R))xf(R);if(Tf(S))xf(S);throw y}return this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.artifact.created",payload:{artifactId:h,filename:r,sha256:l,size:e.bytes.byteLength,entries:a.entries}}),this.get(h)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE id=?").get(e);return t?pp(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? ORDER BY created_at DESC").all(e).map(pp)}}function Bc(e){let t=e.drafts.get(e.draftId);if(!t||t.version!==e.expectedVersion)throw Error(`Application draft ${e.draftId} changed since version ${e.expectedVersion}`);if(t.status==="applied")throw Error("Application draft was already applied");let r=e.controlPlane.getProject(t.projectId),a=r?e.controlPlane.listEnvironments(r.id).find((y)=>y.id===t.input.environmentId):void 0;if(!r||!a||a.projectId!==r.id||r.organizationId!==t.organizationId)throw Error("Draft deployment scope was not found");if(e.confirmEnvironment!==a.slug)throw Error(`Type ${a.slug} to confirm this deployment target`);let l=qn(t.input,t.suppliedSecretNames);if(!l.valid)throw Error(`Application plan is invalid: ${[...l.issues.map((y)=>y.message),...l.missingSecrets.map((y)=>`Missing secret ${y}`)].join("; ")}`);let m=e.controlPlane.listResources(r.id,a.id).find((y)=>y.kind==="application"&&y.slug===t.input.slug),h=JSON.parse(JSON.stringify({manifest:l.manifest,configPatch:l.configPatch})),S=m?e.controlPlane.updateResource(m.id,m.version,{name:t.input.name,desiredState:h}):e.controlPlane.createResource({projectId:r.id,environmentId:a.id,kind:"application",slug:t.input.slug,name:t.input.name,desiredState:h,metadata:{source:"application-onboarding",draftId:t.id}}),R=new c(e.controlPlane).enqueue({projectId:r.id,environmentId:a.id,resourceId:S.id,actorId:e.actorId,kind:"application.create",idempotencyKey:`application-draft:${t.id}:v${t.version}`,correlationId:`application-draft:${t.id}`,input:h,lockKey:`resource:${S.id}`,providerKey:S.provider??"default",buildSlot:t.input.build.kind!=="prebuilt_image",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return e.drafts.markApplied(t.id,t.version,e.actorId),e.controlPlane.appendEvent({organizationId:t.organizationId,projectId:r.id,resourceId:S.id,operationId:R.id,actorId:e.actorId,type:"application.create.queued",payload:{draftId:t.id,environment:a.slug,strategy:t.input.build.kind,costDrivers:l.costDrivers}}),{plan:l,resource:S,operation:R}}function Yr(e){let t=["static","compute","serverless_zip","serverless_image"].includes(e.kind),r=["container","compose"].includes(e.kind)&&(e.replicas??1)>1,a=e.kind==="container"||e.kind==="serverless_zip"||e.kind==="serverless_image",l=(m,h)=>h&&(m==="atomic"?e.kind==="static"||e.hasHealthGate:e.hasHealthGate);return[{strategy:"atomic",supported:l("atomic",t),explanation:t?e.hasHealthGate||e.kind==="static"?"Activate an immutable version with an atomic pointer/alias switch.":"Atomic activation needs a readiness gate for this runtime.":"This driver has no atomic pointer or alias primitive.",capacityMultiplier:1,costImpact:"none",rollback:"Switch the pointer/alias back to the previous immutable release."},{strategy:"rolling",supported:l("rolling",r),explanation:r?e.hasHealthGate?"Replace healthy replicas within the configured capacity envelope.":"Rolling activation requires a health/readiness gate.":"Rolling activation requires a capable container/Compose driver and at least two replicas.",capacityMultiplier:1.5,costImpact:"temporary",rollback:"Stop replacement and restore the prior task/service definition."},{strategy:"blue_green",supported:l("blue_green",a),explanation:a?e.hasHealthGate?"Provision a complete green target and switch traffic after health passes.":"Blue-green requires a health gate before traffic can switch.":"The provider does not expose two traffic-addressable revisions.",capacityMultiplier:2,costImpact:"temporary",rollback:"Return all traffic to the preserved blue target."},{strategy:"canary",supported:l("canary",a),explanation:a?e.hasHealthGate?"Shift bounded traffic steps while evaluating health.":"Canary requires a health gate and measurable traffic target.":"The provider does not expose weighted traffic primitives.",capacityMultiplier:1.25,costImpact:"temporary",rollback:"Set canary weight to zero and preserve its diagnostics."}]}function Hi(e,t){let r=Yr(e).find((a)=>a.strategy===t);if(!r.supported)throw Error(`${t} is unavailable: ${r.explanation}`);return r}import{createHash as Dk}from"node:crypto";var Ok=/^sha256:[a-f0-9]{64}$/,$k=/^[a-f0-9]{40,64}$/i;function Xn(e){return typeof e==="string"&&e?e:void 0}function Ao(e,t){try{return JSON.parse(String(e))}catch{return t}}function Df(e){return{id:String(e.id),organizationId:String(e.organization_id),digest:String(e.digest),kind:String(e.kind),uri:String(e.uri),size:Number(e.size),mediaType:String(e.media_type),provenance:Ao(e.provenance,{}),attestation:Ao(e.attestation,{}),verifiedAt:String(e.verified_at),createdAt:String(e.created_at)}}function Of(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),artifactId:String(e.artifact_id),kind:String(e.kind),sourceSha:Xn(e.source_sha),configHash:String(e.config_hash),manifest:Ao(e.manifest,{}),provenance:Ao(e.provenance,{}),strategy:String(e.strategy),status:String(e.status),healthGate:e.health_gate==null?void 0:Ao(e.health_gate,void 0),hooks:Ao(e.hooks,{migrations:"none",preActivate:[],postActivate:[]}),drainSeconds:Number(e.drain_seconds),graceSeconds:Number(e.grace_seconds),automaticRollback:Number(e.automatic_rollback)===1,rollbackAttempts:Number(e.rollback_attempts),previousReleaseId:Xn(e.previous_release_id),promotedFromReleaseId:Xn(e.promoted_from_release_id),actorId:Xn(e.actor_id),trigger:String(e.trigger),pinned:Number(e.pinned)===1,pinReason:Xn(e.pin_reason),activatedAt:Xn(e.activated_at),failedAt:Xn(e.failed_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Nk(e){return{sequence:Number(e.sequence),id:String(e.id),releaseId:String(e.release_id),fromStatus:Xn(e.from_status),toStatus:String(e.to_status),trafficPercent:e.traffic_percent==null?void 0:Number(e.traffic_percent),health:Ao(e.health,{}),message:String(e.message),operationId:Xn(e.operation_id),createdAt:String(e.created_at)}}function jk(e,t){let r=[],a=(l,m,h)=>{if(JSON.stringify(m)===JSON.stringify(h))return;if(m&&h&&typeof m==="object"&&typeof h==="object"&&!Array.isArray(m)&&!Array.isArray(h)){for(let S of[...new Set([...Object.keys(m),...Object.keys(h)])].sort())a(l?`${l}.${S}`:S,m[S],h[S]);return}r.push({path:l,...m!==void 0?{before:m}:{},...h!==void 0?{after:h}:{}})};return a("",e,t),r}class Uo{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}registerArtifact(e){if(!Ok.test(e.digest)||!/^(?:s3|https|oci|file):/.test(e.uri)||!Number.isInteger(e.size)||e.size<0)throw Error("Artifact requires a SHA-256 digest, supported immutable URI, and non-negative byte size");let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE organization_id=? AND digest=?").get(e.organizationId,e.digest);if(t)return Df(t);let r=this.id(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_artifacts (id, organization_id, digest, kind, uri, size, media_type, provenance, attestation, verified_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.digest,e.kind,e.uri,e.size,e.mediaType??"application/octet-stream",JSON.stringify(s(e.provenance??{})),JSON.stringify(s(e.attestation??{})),a,a]),this.getArtifact(r)}getArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE id=?").get(e);return t?Df(t):void 0}create(e){let t=this.getArtifact(e.artifactId),r=this.controlPlane.getResource(e.resourceId),a=this.controlPlane.listEnvironments(e.projectId).find((T)=>T.id===e.environmentId);if(!t||t.organizationId!==e.organizationId||t.kind!==e.kind)throw Error("Release artifact does not match the organization and deployable kind");if(!r||r.projectId!==e.projectId||r.environmentId!==e.environmentId||!a)throw Error("Release target scope does not match the resource");if(e.sourceSha&&!$k.test(e.sourceSha))throw Error("Release source must be an immutable commit SHA");Hi({kind:e.kind,provider:r.provider,hasHealthGate:!!e.healthGate,replicas:e.replicas},e.strategy);let l=s(e.config),m=Dk("sha256").update(JSON.stringify(l)).digest("hex"),h=this.active(e.resourceId),S=this.id(),R=this.now().toISOString(),y=e.approvalRequired?"awaiting_approval":"built",C=e.hooks??{migrations:"none",preActivate:[],postActivate:[]};return this.controlPlane.database.run("INSERT INTO releases (id, organization_id, project_id, environment_id, resource_id, artifact_id, kind, source_sha, config_hash, manifest, provenance, strategy, status, health_gate, hooks, drain_seconds, grace_seconds, automatic_rollback, previous_release_id, promoted_from_release_id, actor_id, trigger, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[S,e.organizationId,e.projectId,e.environmentId,e.resourceId,e.artifactId,e.kind,e.sourceSha??null,m,JSON.stringify(s(e.manifest)),JSON.stringify(s(e.provenance??{})),e.strategy,y,e.healthGate?JSON.stringify(e.healthGate):null,JSON.stringify(C),Math.max(0,Math.min(3600,Math.floor(e.drainSeconds??30))),Math.max(0,Math.min(3600,Math.floor(e.graceSeconds??30))),e.automaticRollback===!1?0:1,h?.id??null,e.promotedFromReleaseId??null,e.actorId??null,e.trigger??"manual",R,R]),this.recordTransition(S,void 0,y,{message:e.promotedFromReleaseId?"Immutable artifact promoted without rebuild.":"Immutable release record created."}),this.get(S)}get(e){let t=this.controlPlane.database.query("SELECT * FROM releases WHERE id=?").get(e);return t?Of(t):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM releases ORDER BY created_at DESC, rowid DESC").all().map(Of).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(!e.resourceId||t.resourceId===e.resourceId)&&(!e.status||t.status===e.status))}active(e){return this.list({resourceId:e,status:"active"})[0]}transitions(e){return this.controlPlane.database.query("SELECT * FROM release_transitions WHERE release_id=? ORDER BY sequence").all(e).map(Nk)}recordTransition(e,t,r,a){this.controlPlane.database.run("INSERT INTO release_transitions (id, release_id, from_status, to_status, traffic_percent, health, message, operation_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",[this.id(),e,t??null,r,a.trafficPercent??null,JSON.stringify(s(a.health??{})),a.message.slice(0,1000),a.operationId??null,this.now().toISOString()])}progress(e,t){let r=this.get(e);if(!r)throw Error(`Release ${e} was not found`);return this.recordTransition(e,r.status,r.status,t),this.transitions(e).at(-1)}transition(e,t,r){let a=this.get(e);if(!a)throw Error(`Release ${e} was not found`);if(!{built:["awaiting_approval","activating","failed"],awaiting_approval:["built","failed"],activating:["active","failed","rolled_back"],active:["superseded","failed","rolled_back"],failed:["activating","rolled_back"],rolled_back:["activating"],superseded:["activating"]}[a.status].includes(t))throw Error(`Invalid release transition ${a.status} → ${t}`);let m=this.now().toISOString();if(t==="active"){let h=this.active(a.resourceId);if(h&&h.id!==e)this.controlPlane.database.run("UPDATE releases SET status='superseded', updated_at=? WHERE id=?",[m,h.id]),this.recordTransition(h.id,"active","superseded",{message:`Superseded by ${e}.`,operationId:r.operationId})}return this.controlPlane.database.run("UPDATE releases SET status=?, rollback_attempts=rollback_attempts+?, activated_at=CASE WHEN ?='active' THEN ? ELSE activated_at END, failed_at=CASE WHEN ?='failed' THEN ? ELSE failed_at END, updated_at=? WHERE id=?",[t,t==="rolled_back"?1:0,t,m,t,m,m,e]),this.recordTransition(e,a.status,t,r),this.get(e)}approve(e,t){let r=this.get(e);if(!r||r.status!=="awaiting_approval")throw Error("Release is not awaiting approval");let a=this.id(),l=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_approvals (id, release_id, environment_id, decision, actor_id, comment, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,r.environmentId,t.decision,t.actorId,t.comment?.slice(0,1000)??null,l]),this.transition(e,t.decision==="approved"?"built":"failed",{message:t.decision==="approved"?"Environment gate approved.":"Environment gate rejected."})}approvals(e){return this.controlPlane.database.query("SELECT * FROM release_approvals WHERE release_id=? ORDER BY created_at").all(e).map((t)=>({id:String(t.id),releaseId:String(t.release_id),environmentId:String(t.environment_id),decision:String(t.decision),actorId:String(t.actor_id),comment:Xn(t.comment),createdAt:String(t.created_at)}))}promote(e,t){let r=this.get(e);if(!r||!["active","superseded"].includes(r.status))throw Error("Only a tested active/superseded release can be promoted");return this.create({organizationId:r.organizationId,projectId:r.projectId,environmentId:t.targetEnvironmentId,resourceId:t.targetResourceId,artifactId:r.artifactId,kind:r.kind,sourceSha:r.sourceSha,config:t.config,manifest:r.manifest,provenance:r.provenance,strategy:t.strategy??r.strategy,healthGate:t.healthGate??r.healthGate,hooks:r.hooks,drainSeconds:r.drainSeconds,graceSeconds:r.graceSeconds,automaticRollback:r.automaticRollback,promotedFromReleaseId:r.id,actorId:t.actorId,trigger:"promotion",approvalRequired:t.approvalRequired})}compare(e,t){let r=this.get(e),a=this.get(t);if(!r||!a)throw Error("Both releases are required for comparison");return{artifactChanged:r.artifactId!==a.artifactId,sourceChanged:r.sourceSha!==a.sourceSha,configChanged:r.configHash!==a.configHash,manifestChanges:jk(r.manifest,a.manifest),dataCaveat:a.hooks.migrations==="none"?"No database migration is recorded.":`Database hooks are ${a.hooks.migrations}; release rollback does not roll back data.`}}pin(e,t,r){if(!this.get(e))throw Error("Release was not found");return this.controlPlane.database.run("UPDATE releases SET pinned=?, pin_reason=?, updated_at=? WHERE id=?",[t?1:0,t?r?.slice(0,500)??"operator":null,this.now().toISOString(),e]),this.get(e)}retentionCandidates(e){let t=Math.max(1,Math.min(100,Math.floor(e.keepPerResource??10))),r=new Map;for(let a of this.list()){let l=r.get(a.resourceId)??[];l.push(a),r.set(a.resourceId,l)}return[...r.values()].flatMap((a)=>a.slice(t)).filter((a)=>new Date(a.createdAt)<e.before&&!a.pinned&&!["active","activating","awaiting_approval"].includes(a.status)&&!this.list().some((l)=>l.previousReleaseId===a.id&&["active","activating"].includes(l.status)))}}class It{controlPlane;releases;queue;constructor(e){this.controlPlane=e;this.releases=new Uo(e),this.queue=new c(e)}enqueueActivation(e,t={}){let r=this.releases.get(e.id);if(!r)throw Error("Release was not found");if(!["built","failed","rolled_back","superseded"].includes(r.status))throw Error(`Release ${r.status} cannot be activated`);let a=t.action??"activate",l=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:`release.${a}`,idempotencyKey:`release:${r.id}:${a}:${r.rollbackAttempts}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:t.targetReleaseId??null},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:r.automaticRollback?2:1,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return this.releases.transition(r.id,"activating",{message:`${a} queued.`,operationId:l.id,trafficPercent:0}),l}completeHealthGate(e,t){let r=this.releases.get(e);if(!r||r.status!=="activating")throw Error("Release is not activating");if(t.healthy)return{release:this.releases.transition(r.id,"active",{message:t.message??"Health gate passed; activation completed.",operationId:t.operationId,trafficPercent:100,health:t.health})};let a=this.releases.transition(r.id,"failed",{message:t.message??"Health gate failed.",operationId:t.operationId,trafficPercent:0,health:t.health}),l=r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!r.automaticRollback||r.rollbackAttempts>=1||!l)return{release:a};let m=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"release.rollback",idempotencyKey:`release:${r.id}:automatic-rollback`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:l.id,automatic:!0},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return{release:a,rollbackOperation:m}}enqueueRollback(e,t={}){let r=this.releases.get(e.id);if(!r||r.status!=="active")throw Error("Only the active release can be rolled back");let a=t.targetReleaseId?this.releases.get(t.targetReleaseId):r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!a||a.resourceId!==r.resourceId||!["superseded","active"].includes(a.status))throw Error("Rollback requires a preserved prior release for the same resource");return this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:"release.rollback",idempotencyKey:`release:${r.id}:manual-rollback:${a.id}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:a.id,automatic:!1},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}}function Km(e){if(e.strategy==="canary")return[5,25,50,100].map((t,r)=>({step:`canary-${t}`,trafficPercent:t,waitSeconds:r===3?e.drainSeconds:e.graceSeconds,requiresHealth:!0}));if(e.strategy==="blue_green")return[{step:"green-health",trafficPercent:0,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"traffic-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];if(e.strategy==="rolling")return[{step:"rolling-replacement",trafficPercent:50,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"rolling-complete",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];return[{step:"immutable-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!!e.healthGate}]}async function fl(e,t){if(t.release.artifactId!==t.artifact.id)throw Error("Release activation artifact identity changed");Hi({kind:t.release.kind,hasHealthGate:!!t.release.healthGate,replicas:Number(t.release.manifest?.replicas)||void 0},t.release.strategy);let r=e.capability(t);if(!r.supported)throw Error(`${t.release.strategy} is unavailable in ${e.name}: ${r.explanation}`);return e.activate({...t,transitions:Km(t.release)})}async function Al(e,t){if(!t.previous)throw Error("Rollback requires the preserved previous release");return e.rollback({...t,transitions:[{step:"rollback",trafficPercent:0,waitSeconds:t.release.drainSeconds,requiresHealth:!0}]})}var Wm=["release.activate","release.rollback"];function Bk(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function yl(e){let t=new It(e.store),r=async(a)=>{let l=Bk(a.operation.input),m=typeof l.releaseId==="string"?l.releaseId:"",h=t.releases.get(m);if(!h)throw Error(`Queued release ${m||"(missing)"} was not found`);if(h.projectId!==a.operation.projectId||h.environmentId!==a.operation.environmentId||h.resourceId!==a.operation.resourceId)throw Error("Queued release does not match the operation scope");let S=t.releases.getArtifact(h.artifactId);if(!S||S.digest!==t.releases.getArtifact(h.artifactId)?.digest)throw Error("Immutable release artifact is unavailable");let R=typeof l.targetReleaseId==="string"&&l.targetReleaseId?l.targetReleaseId:h.previousReleaseId,y=R?t.releases.get(R):void 0;if(y&&(y.resourceId!==h.resourceId||y.artifactId===h.artifactId&&y.id===h.id))throw Error("Rollback target does not match the release resource");let C=await e.resolveDriver(h);a.checkpoint("verify",`Verifying ${S.digest} and ${h.configHash} for ${C.name}.`),a.log(`Artifact ${S.digest}; source ${h.sourceSha??"not recorded"}; config ${h.configHash}.`,{stream:"system"}),a.throwIfCancellationRequested();let T;try{T=a.operation.kind==="release.rollback"?await Al(C,{release:h,artifact:S,previous:y}):await fl(C,{release:h,artifact:S,previous:y})}catch(j){if(a.operation.kind==="release.activate"&&t.releases.get(h.id)?.status==="activating")t.completeHealthGate(h.id,{healthy:!1,operationId:a.operation.id,message:j instanceof Error?j.message:String(j)});throw j}for(let j of T.transitions)t.releases.progress(h.id,{message:`${a.operation.kind==="release.rollback"?"Rollback":"Activation"} traffic at ${j.trafficPercent}%.`,trafficPercent:j.trafficPercent,health:j.observed,operationId:a.operation.id}),a.log(`Traffic ${j.trafficPercent}%: ${j.healthy?"healthy":"unhealthy"}.`,{stream:j.healthy?"step":"stderr",step:"health"});if(a.checkpoint("health","Evaluating the provider health result."),!T.activated||!T.healthy){if(a.operation.kind==="release.activate"&&t.releases.get(h.id)?.status==="activating")t.completeHealthGate(h.id,{healthy:!1,operationId:a.operation.id,health:{resourceVersions:T.resourceVersions},message:T.error??"Provider health gate failed."});throw Error(T.error??`${C.name} reported an unhealthy release`)}if(a.operation.kind==="release.activate"&&h.healthGate?.name){if(!e.resolveHealthGate)throw t.completeHealthGate(h.id,{healthy:!1,operationId:a.operation.id,message:`Named health gate ${h.healthGate.name} is not available to this worker.`}),Error(`Named health gate ${h.healthGate.name} is unavailable`);a.checkpoint("named-health-gate",`Waiting on ${h.healthGate.name}.`);let j=await e.resolveHealthGate(h.healthGate.name,h);if(a.log(`${h.healthGate.name}: ${j.healthy?"healthy":"unhealthy"}${j.message?` — ${j.message}`:""}.`,{stream:j.healthy?"step":"stderr",step:"health"}),!j.healthy)throw t.completeHealthGate(h.id,{healthy:!1,operationId:a.operation.id,health:j.evidence,message:j.message??`Named health gate ${h.healthGate.name} failed.`}),Error(j.message??`Named health gate ${h.healthGate.name} failed`)}if(a.operation.kind==="release.rollback"){let j=t.releases.get(h.id);if(j.status!=="rolled_back")t.releases.transition(j.id,"rolled_back",{message:`Traffic restored through ${C.name}.`,operationId:a.operation.id,trafficPercent:0,health:{resourceVersions:T.resourceVersions}});if(y&&y.status!=="active"){let B=y.status==="activating"?y:t.releases.transition(y.id,"activating",{message:"Rollback target restoring traffic.",operationId:a.operation.id,trafficPercent:0});t.releases.transition(B.id,"active",{message:"Previous immutable release restored.",operationId:a.operation.id,trafficPercent:100,health:{resourceVersions:T.resourceVersions}})}}else t.completeHealthGate(h.id,{healthy:!0,operationId:a.operation.id,health:{providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions},message:"Provider activation and health gates completed."});return a.checkpoint("finalize","Persisted the terminal release state."),{releaseId:h.id,artifactDigest:S.digest,provider:C.name,providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions,status:t.releases.get(h.id).status}};return Object.fromEntries(Wm.map((a)=>[a,r]))}import{createCipheriv as Mk,createDecipheriv as Lk,createHash as Mf,randomBytes as mp}from"node:crypto";var Lf={github:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitlab:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},bitbucket:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitea:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!1,deployKeys:!0},generic_https:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!1},generic_ssh:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!0}};function Wt(e){return typeof e==="string"&&e?e:void 0}function To(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function ei(e){return JSON.stringify(s(e))}function Po(e){return Mf("sha256").update(e).digest("hex")}function $f(e){let t=e.trim().replace(/\/$/,""),r=new URL(t.includes("://")?t:`https://${t}`);if(r.username||r.password||r.search||r.hash)throw Error("Source host cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(r.hostname)))throw Error("Source host must use HTTPS");return`${r.protocol}//${r.host}${r.pathname.replace(/\/$/,"")}`}function Nf(e){let t=e.trim();if(t.length<2||t.length>80)throw Error("Connection name must contain 2-80 characters");return t}function fp(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function jf(e){let t=e.trim()||".";if(t.startsWith("/")||t.split("/").includes("..")||/[\0\r\n]/.test(t))throw Error("Monorepo root must stay inside the repository");return t.replace(/^\.\//,"")||"."}function Mc(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Boolean))].slice(0,100)}function Fk(e){let t=e.trim();if(/\r|\n/.test(t)||/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Clone URL cannot contain credentials or control characters");if(!/^(?:https?:\/\/|ssh:\/\/|git@[A-Za-z0-9.-]+:)/.test(t))throw Error("Clone URL must use HTTPS or SSH");return t}function zk(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),owner:Wt(e.owner),authKind:String(e.auth_kind),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:Wt(e.credential_fingerprint),grantedScopes:To(e.granted_scopes,[]),capabilities:To(e.capabilities,Lf[String(e.provider)]),status:String(e.status),healthMessage:Wt(e.health_message),lastTestedAt:Wt(e.last_tested_at),lastSyncedAt:Wt(e.last_synced_at),credentialExpiresAt:Wt(e.credential_expires_at),version:Number(e.version),createdByActorId:Wt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function hp(e){return{id:String(e.id),connectionId:String(e.connection_id),providerRepositoryId:String(e.provider_repository_id),fullName:String(e.full_name),cloneUrl:String(e.clone_url),defaultBranch:String(e.default_branch),visibility:String(e.visibility),archived:Number(e.archived)===1,metadata:To(e.metadata,{}),syncedAt:String(e.synced_at)}}function Bf(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Wt(e.environment_id),resourceId:Wt(e.resource_id),connectionId:String(e.connection_id),repositoryId:Wt(e.repository_id),repositoryFullName:String(e.repository_full_name),defaultBranch:String(e.default_branch),branchRule:Wt(e.branch_rule),tagRule:Wt(e.tag_rule),monorepoRoot:String(e.monorepo_root),includePaths:To(e.include_paths,[]),excludePaths:To(e.exclude_paths,[]),submodules:Number(e.submodules)===1,cloneDepth:e.clone_depth==null?void 0:Number(e.clone_depth),deployKeyId:Wt(e.deploy_key_id),autoDeploy:Number(e.auto_deploy)===1,pullRequestPreviews:Number(e.pull_request_previews)===1,status:String(e.status),disabledReason:Wt(e.disabled_reason),version:Number(e.version),createdByActorId:Wt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function yp(e){return{id:String(e.id),connectionId:String(e.connection_id),name:String(e.name),publicKey:String(e.public_key),publicKeyFingerprint:String(e.public_key_fingerprint),host:String(e.host),hostKey:String(e.host_key),hostKeyFingerprint:String(e.host_key_fingerprint),createdByActorId:Wt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function vp(e){return{id:String(e.id),connectionId:String(e.connection_id),repositoryId:Wt(e.repository_id),repositoryFullName:String(e.repository_full_name),providerWebhookId:Wt(e.provider_webhook_id),events:To(e.events,[]),status:String(e.status),healthMessage:Wt(e.health_message),lastDeliveryAt:Wt(e.last_delivery_at),lastReconciledAt:Wt(e.last_reconciled_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function bp(e){return{id:String(e.id),connectionId:String(e.connection_id),webhookId:String(e.webhook_id),providerDeliveryId:String(e.provider_delivery_id),event:String(e.event),action:Wt(e.action),commitSha:Wt(e.commit_sha),signatureStatus:String(e.signature_status),status:String(e.status),payloadSummary:To(e.payload_summary,{}),operationId:Wt(e.operation_id),error:Wt(e.error),receivedAt:String(e.received_at),processedAt:Wt(e.processed_at)}}class Qo{controlPlane;key;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.key=t.encryptionKey?Mf("sha256").update(t.encryptionKey).digest():void 0,this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let t=mp(12),r=Mk("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted source credential is unavailable");let m=Lk("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}createConnection(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Source connection organization was not found");let t=this.now(),r=this.idFn(),a=e.credential?JSON.stringify(e.credential):void 0;return this.run(`INSERT INTO source_connections (id, organization_id, provider, name, host, owner, auth_kind, credential_ciphertext, credential_fingerprint, granted_scopes, capabilities, status, credential_expires_at, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)`,[r,e.organizationId,e.provider,Nf(e.name),$f(e.host),e.owner?.trim()||null,e.authKind??(a?"access_token":"none"),a?this.encrypt(a):null,a?Po(a).slice(0,16):null,ei([...new Set(e.grantedScopes??[])].sort()),ei(Lf[e.provider]),e.credentialExpiresAt??null,e.createdByActorId??null,t,t]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"source.connection.created",payload:{connectionId:r,provider:e.provider,host:$f(e.host),owner:e.owner??null,scopes:e.grantedScopes??[]}}),this.getConnection(r)}getConnection(e){let t=this.controlPlane.database.query("SELECT * FROM source_connections WHERE id = ?").get(e);return t?this.currentConnection(t):void 0}listConnections(e){return this.controlPlane.database.query("SELECT * FROM source_connections WHERE organization_id = ? ORDER BY name").all(e).map((t)=>this.currentConnection(t))}currentConnection(e){let t=zk(e);if(t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime())return{...t,status:"expired",healthMessage:"Source credential expired; rotate it before deploying."};return t}getCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM source_connections WHERE id = ?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotateCredential(e,t,r={}){let a=this.getConnection(e);if(!a||a.status==="disconnected")throw Error("Active source connection was not found");let l=JSON.stringify(t);return this.run("UPDATE source_connections SET credential_ciphertext = ?, credential_fingerprint = ?, credential_expires_at = ?, status = 'pending', health_message = NULL, version = version + 1, updated_at = ? WHERE id = ?",[this.encrypt(l),Po(l).slice(0,16),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:r.actorId,type:"source.credential.rotated",payload:{connectionId:e,fingerprint:Po(l).slice(0,16),expiresAt:r.expiresAt??null}}),this.getConnection(e)}updateHealth(e,t){let r=this.getConnection(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");let a=this.now(),l=t.grantedScopes?[...new Set(t.grantedScopes.map((m)=>m.trim()).filter(Boolean))].sort():void 0;if(this.run("UPDATE source_connections SET status = ?, health_message = ?, granted_scopes = COALESCE(?, granted_scopes), last_tested_at = COALESCE(?, last_tested_at), last_synced_at = COALESCE(?, last_synced_at), version = version + 1, updated_at = ? WHERE id = ?",[t.status,t.message?.slice(0,1000)??null,l?ei(l):null,t.tested?a:null,t.synced?a:null,a,e]),l&&JSON.stringify(l)!==JSON.stringify([...r.grantedScopes].sort()))this.controlPlane.appendEvent({organizationId:r.organizationId,type:"source.connection.scopes_updated",payload:{connectionId:e,grantedScopes:l}});return this.getConnection(e)}upsertRepository(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");let r=this.now(),a=this.controlPlane.database.query("SELECT id FROM source_repositories WHERE connection_id = ? AND provider_repository_id = ?").get(e.connectionId,e.providerRepositoryId),l=a?String(a.id):this.idFn();return this.run(`INSERT INTO source_repositories (id, connection_id, provider_repository_id, full_name, clone_url, default_branch, visibility, archived, metadata, synced_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(connection_id, provider_repository_id) DO UPDATE SET full_name=excluded.full_name, clone_url=excluded.clone_url, default_branch=excluded.default_branch, visibility=excluded.visibility, archived=excluded.archived, metadata=excluded.metadata, synced_at=excluded.synced_at`,[l,e.connectionId,e.providerRepositoryId,fp(e.fullName),Fk(e.cloneUrl),e.defaultBranch.trim()||"main",e.visibility,e.archived?1:0,ei(e.metadata),r]),hp(this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(l))}listRepositories(e,t,r=100){let a=t?.trim().toLowerCase();return(a?this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? AND lower(full_name) LIKE ? ORDER BY full_name LIMIT ?").all(e,`%${a}%`,Math.min(500,r)):this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? ORDER BY full_name LIMIT ?").all(e,Math.min(500,r))).map(hp)}getRepository(e){let t=this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(e);return t?hp(t):void 0}createDeployKey(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status)||!t.capabilities.deployKeys)throw Error("An active deploy-key capable source connection is required");if(!/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/=]+/.test(e.publicKey.trim()))throw Error("A valid SSH public key is required");if(!/BEGIN (?:OPENSSH|RSA) PRIVATE KEY/.test(e.privateKey))throw Error("A valid SSH private key is required");if(!/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+)\s+[A-Za-z0-9+/=]+/.test(e.hostKey.trim()))throw Error("A pinned SSH host key is required");let r=this.idFn(),a=this.now(),l=`sha256:${Po(e.publicKey.trim())}`,m=`sha256:${Po(e.hostKey.trim())}`;return this.run("INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,Nf(e.name),e.publicKey.trim(),l,this.encrypt(e.privateKey),e.host.trim().toLowerCase(),e.hostKey.trim(),m,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"source.deploy_key.created",payload:{connectionId:e.connectionId,deployKeyId:r,publicFingerprint:l,hostFingerprint:m}}),yp(this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(r))}getDeployKey(e){let t=this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(e);return t?yp(t):void 0}listDeployKeys(e){return this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE connection_id = ? ORDER BY name, created_at").all(e).map(yp)}revokeDeployKey(e,t){let r=this.getDeployKey(e),a=r?this.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Deploy key was not found");let l=this.listBindings({connectionId:a.id}).filter((h)=>h.deployKeyId===e),m=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_bindings SET deploy_key_id=NULL, status='disabled', auto_deploy=0, disabled_reason='Source deploy key was revoked', version=version+1, updated_at=? WHERE deploy_key_id=?",[m,e]),this.run("DELETE FROM source_deploy_keys WHERE id=?",[e])})(),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:t,type:"source.deploy_key.revoked",level:"warning",payload:{connectionId:a.id,deployKeyId:e,affectedBindingIds:l.map((h)=>h.id)}}),{affectedBindings:l}}getDeployPrivateKey(e){let t=this.controlPlane.database.query("SELECT private_key_ciphertext FROM source_deploy_keys WHERE id = ?").get(e);if(!t)throw Error("Deploy key was not found");return this.decrypt(String(t.private_key_ciphertext))}createBinding(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");if(e.deployKeyId&&this.getDeployKey(e.deployKeyId)?.connectionId!==t.id)throw Error("Deploy key does not belong to this connection");let r=this.idFn(),a=this.now();return this.run(`INSERT INTO source_bindings (id, project_id, environment_id, resource_id, connection_id, repository_id, repository_full_name, default_branch, branch_rule, tag_rule, monorepo_root, include_paths, exclude_paths, submodules, clone_depth, deploy_key_id, auto_deploy, pull_request_previews, status, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`,[r,e.projectId,e.environmentId??null,e.resourceId??null,e.connectionId,e.repositoryId??null,fp(e.repositoryFullName),e.defaultBranch?.trim()||"main",e.branchRule?.trim()||null,e.tagRule?.trim()||null,jf(e.monorepoRoot??"."),ei(Mc(e.includePaths)),ei(Mc(e.excludePaths)),e.submodules?1:0,e.cloneDepth??null,e.deployKeyId??null,e.autoDeploy===!1?0:1,e.pullRequestPreviews===!1?0:1,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,projectId:e.projectId,actorId:e.actorId,type:"source.binding.created",payload:{bindingId:r,connectionId:e.connectionId,repository:e.repositoryFullName,branch:e.defaultBranch??"main"}}),this.getBinding(r)}getBinding(e){let t=this.controlPlane.database.query("SELECT * FROM source_bindings WHERE id = ?").get(e);return t?Bf(t):void 0}listBindings(e={}){return this.controlPlane.database.query("SELECT * FROM source_bindings ORDER BY created_at DESC").all().map(Bf).filter((r)=>(!e.connectionId||r.connectionId===e.connectionId)&&(!e.projectId||r.projectId===e.projectId)&&(!e.status||r.status===e.status))}updateBinding(e,t,r){let a=this.getBinding(e);if(!a||a.version!==t)throw Error(`Source binding ${e} changed since version ${t}`);let l=this.getConnection(a.connectionId);if((!l||["disconnected","expired"].includes(l.status))&&(r.status==="active"||r.autoDeploy===!0))throw Error("Rotate or reconnect the source credential before enabling this binding");if(r.deployKeyId&&this.getDeployKey(r.deployKeyId)?.connectionId!==a.connectionId)throw Error("Deploy key does not belong to this connection");let m=this.now();if(this.controlPlane.database.run("UPDATE source_bindings SET default_branch=?, branch_rule=?, tag_rule=?, monorepo_root=?, include_paths=?, exclude_paths=?, submodules=?, clone_depth=?, deploy_key_id=?, auto_deploy=?, pull_request_previews=?, status=?, disabled_reason=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.defaultBranch?.trim()||a.defaultBranch,r.branchRule===void 0?a.branchRule??null:r.branchRule.trim()||null,r.tagRule===void 0?a.tagRule??null:r.tagRule.trim()||null,r.monorepoRoot===void 0?a.monorepoRoot:jf(r.monorepoRoot),ei(r.includePaths===void 0?a.includePaths:Mc(r.includePaths)),ei(r.excludePaths===void 0?a.excludePaths:Mc(r.excludePaths)),r.submodules??a.submodules?1:0,r.cloneDepth===void 0?a.cloneDepth??null:r.cloneDepth,r.deployKeyId===void 0?a.deployKeyId??null:r.deployKeyId,r.autoDeploy??a.autoDeploy?1:0,r.pullRequestPreviews??a.pullRequestPreviews?1:0,r.status??a.status,r.disabledReason===void 0?a.disabledReason??null:r.disabledReason.slice(0,1000),m,e,t]).changes!==1)throw Error(`Source binding ${e} changed since version ${t}`);let S=this.getConnection(a.connectionId);return this.controlPlane.appendEvent({organizationId:S.organizationId,projectId:a.projectId,actorId:r.actorId,type:"source.binding.updated",payload:{bindingId:e,fromVersion:t,toVersion:t+1,status:r.status??a.status}}),this.getBinding(e)}createWebhook(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");let r=this.idFn(),a=this.now(),l=e.endpointToken??mp(24).toString("base64url"),m=e.secret??mp(32).toString("base64url"),h=[...new Set(e.events??["push","pull_request"])].filter((S)=>["push","pull_request"].includes(S));if(!h.length)throw Error("At least one supported webhook event is required");return this.run("INSERT INTO source_webhooks (id, connection_id, repository_id, repository_full_name, endpoint_token_hash, endpoint_token_ciphertext, secret_ciphertext, events, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)",[r,e.connectionId,e.repositoryId??null,fp(e.repositoryFullName),Po(l),this.encrypt(l),this.encrypt(m),ei(h),a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,type:"source.webhook.created",payload:{webhookId:r,connectionId:t.id,repository:e.repositoryFullName,events:h}}),{webhook:{...this.getWebhook(r),endpointToken:l},secret:m}}getWebhook(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE id = ?").get(e);return t?vp(t):void 0}getWebhookByEndpointToken(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE endpoint_token_hash = ?").get(Po(e));return t?vp(t):void 0}getWebhookSecret(e){let t=this.controlPlane.database.query("SELECT secret_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t)throw Error("Source webhook was not found");return this.decrypt(String(t.secret_ciphertext))}getWebhookEndpointToken(e){let t=this.controlPlane.database.query("SELECT endpoint_token_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t?.endpoint_token_ciphertext)throw Error("Source webhook endpoint token is unavailable");return this.decrypt(String(t.endpoint_token_ciphertext))}listWebhooks(e){return this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE connection_id = ? ORDER BY repository_full_name").all(e).map(vp)}updateWebhookState(e,t){let r=this.getWebhook(e);if(!r)throw Error("Source webhook was not found");let a=this.now();this.run("UPDATE source_webhooks SET provider_webhook_id=COALESCE(?, provider_webhook_id), status=?, health_message=?, last_reconciled_at=COALESCE(?, last_reconciled_at), updated_at=? WHERE id=?",[t.providerWebhookId??null,t.status,t.healthMessage?.slice(0,1000)??null,t.reconciled?a:null,a,e]);let l=this.getConnection(r.connectionId);if(l)this.controlPlane.appendEvent({organizationId:l.organizationId,type:"source.webhook.updated",payload:{webhookId:e,connectionId:l.id,repository:r.repositoryFullName,status:t.status,reconciled:t.reconciled??!1,providerWebhookId:t.providerWebhookId??r.providerWebhookId??null}});return this.getWebhook(e)}getDeliveryByProviderId(e,t){let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE connection_id = ? AND provider_delivery_id = ?").get(e,t);return r?bp(r):void 0}recordDelivery(e){let t=this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId);if(t)return{delivery:t,duplicate:!0};let r=this.idFn(),a=this.now();return this.controlPlane.database.transaction(()=>{this.run("INSERT INTO source_webhook_deliveries (id, connection_id, webhook_id, provider_delivery_id, event, action, commit_sha, signature_status, status, payload_summary, operation_id, error, received_at, processed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,e.webhookId,e.providerDeliveryId,e.event.slice(0,100),e.action?.slice(0,100)??null,e.commitSha?.slice(0,128)??null,e.signatureStatus,e.status,ei(e.payloadSummary??{}),e.operationId??null,e.error?.slice(0,2000)??null,a,["enqueued","ignored","rejected","failed"].includes(e.status)?a:null]),this.run("UPDATE source_webhooks SET last_delivery_at=?, updated_at=? WHERE id=?",[a,a,e.webhookId])})(),{delivery:this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId),duplicate:!1}}updateDelivery(e,t){this.run("UPDATE source_webhook_deliveries SET status=?, operation_id=?, error=?, processed_at=? WHERE id=?",[t.status,t.operationId??null,t.error?.slice(0,2000)??null,this.now(),e]);let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE id = ?").get(e);if(!r)throw Error("Source webhook delivery was not found");return bp(r)}listDeliveries(e,t=100){return this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE webhook_id = ? ORDER BY received_at DESC LIMIT ?").all(e,Math.min(500,Math.max(1,t))).map(bp)}disconnectConnection(e,t){let r=this.getConnection(e);if(!r)throw Error("Source connection was not found");let a=this.listBindings({connectionId:e,status:"active"}),l=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_connections SET status='disconnected', credential_ciphertext=NULL, health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[l,e]),this.run("UPDATE source_bindings SET status='disabled', auto_deploy=0, disabled_reason='Source connection was disconnected', version=version+1, updated_at=? WHERE connection_id=? AND status='active'",[l,e]),this.run("UPDATE source_webhooks SET status='disabled', health_message='Source connection was disconnected', updated_at=? WHERE connection_id=?",[l,e])})(),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"source.connection.disconnected",level:"warning",payload:{connectionId:e,affectedBindingIds:a.map((m)=>m.id),affectedRepositories:a.map((m)=>m.repositoryFullName)}}),{connection:this.getConnection(e),affectedBindings:a}}}import{createSign as Uk}from"node:crypto";class Yt extends Error{status;retryAfterSeconds;constructor(e,t,r){super(e);this.status=t;this.retryAfterSeconds=r;this.name="SourceProviderError"}}var zf={repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0};function Li(e){let t=Number(e??"1");return Number.isInteger(t)&&t>0?t:1}function eo(e){return Math.max(1,Math.min(100,e??50))}function Nn(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function tc(e){let t=new URL(e);if(t.username||t.password||t.protocol!=="https:")throw Error("Webhook endpoint must be credential-free HTTPS");return t.href}function Ff(e){return Buffer.from(e).toString("base64url")}function qk(e,t){if(!e.appId||!e.privateKey)throw Error("GitHub App credentials require appId and privateKey");let r=Ff(JSON.stringify({alg:"RS256",typ:"JWT"})),a=Math.floor(t.getTime()/1000)-30,l=Ff(JSON.stringify({iat:a,exp:a+540,iss:e.appId})),m=Uk("RSA-SHA256");return m.update(`${r}.${l}`),m.end(),`${r}.${l}.${m.sign(e.privateKey).toString("base64url")}`}class rc{connection;credential;capabilities=zf;fetchFn;timeoutMs;nowFn;constructor(e,t,r={}){this.connection=e;this.credential=t;this.fetchFn=r.fetch??((a,l)=>globalThis.fetch(a,l)),this.timeoutMs=Math.max(100,r.timeoutMs??20000),this.nowFn=r.now??(()=>new Date)}async request(e,t={}){let r=new URL(`${this.apiRoot().replace(/\/$/,"")}/`),a=new URL(e.replace(/^\//,""),r);if(a.origin!==r.origin)throw Error("Provider pagination cannot leave the configured host");let l=new AbortController,m=setTimeout(()=>l.abort(),this.timeoutMs);try{let h=await this.fetchFn(a,{...t,redirect:"error",signal:l.signal,headers:{Accept:"application/json","User-Agent":"ts-cloud-source/1",...await this.authorization(),...t.headers}});if(!h.ok){let S=Number(h.headers.get("retry-after")??""),R=h.headers.get("x-request-id")??h.headers.get("x-github-request-id");throw new Yt(`Source provider request failed (${h.status})${R?` [request ${R}]`:""}`,h.status,Number.isFinite(S)?S:void 0)}if(h.status===204)return{data:void 0,headers:h.headers};return{data:await h.json(),headers:h.headers}}catch(h){if(h instanceof Yt)throw h;if(l.signal.aborted)throw new Yt(`Source provider request exceeded ${this.timeoutMs}ms`);throw new Yt(h instanceof Error?h.message.replace(/(?:token|password|secret)=[^\s&]+/gi,"$1=[REDACTED]"):"Source provider request failed")}finally{clearTimeout(m)}}async deleteWebhook(e,t){await this.request(this.webhookPath(e,t),{method:"DELETE"})}}class Il extends rc{provider="github";installationToken;apiRoot(){return this.connection.host==="https://github.com"?"https://api.github.com":`${this.connection.host}/api/v3`}async authorization(){if(this.credential?.token)return{Authorization:`Bearer ${this.credential.token}`,"X-GitHub-Api-Version":"2022-11-28"};if(!this.credential?.installationId)return{};if(!this.installationToken||this.installationToken.expiresAt<this.nowFn().getTime()+60000){let e=qk(this.credential,this.nowFn()),t=this.apiRoot().replace(/\/$/,""),r=new AbortController,a=setTimeout(()=>r.abort(),this.timeoutMs);try{let l=await this.fetchFn(`${t}/app/installations/${encodeURIComponent(this.credential.installationId)}/access_tokens`,{method:"POST",signal:r.signal,redirect:"error",headers:{Accept:"application/vnd.github+json",Authorization:`Bearer ${e}`,"X-GitHub-Api-Version":"2022-11-28","User-Agent":"ts-cloud-source/1"}});if(!l.ok)throw new Yt(`GitHub App token refresh failed (${l.status})`,l.status);let m=await l.json();this.installationToken={value:m.token,expiresAt:new Date(m.expires_at).getTime()}}finally{clearTimeout(a)}}return{Authorization:`Bearer ${this.installationToken.value}`,"X-GitHub-Api-Version":"2022-11-28"}}async testConnection(){let e=this.credential?.installationId?"/installation/repositories?per_page=1":"/user",{data:t,headers:r}=await this.request(e);return{ok:!0,account:t.login??this.connection.owner,scopes:(r.get("x-oauth-scopes")??this.connection.grantedScopes.join(",")).split(",").map((a)=>a.trim()).filter(Boolean),message:"GitHub connection is healthy"}}async listRepositories(e={}){let t=eo(e.limit),r=Li(e.cursor),a=this.credential?.installationId?`/installation/repositories?per_page=${t}&page=${r}`:`/user/repos?per_page=${t}&page=${r}&sort=updated`,{data:l}=await this.request(a),m=Array.isArray(l)?l:l.repositories;return{repositories:(e.search?m.filter((S)=>S.full_name.toLowerCase().includes(e.search.toLowerCase())):m).map((S)=>({providerRepositoryId:String(S.id),fullName:S.full_name,cloneUrl:S.clone_url,defaultBranch:S.default_branch||"main",visibility:S.visibility??(S.private?"private":"public"),archived:!!S.archived,metadata:{}})),nextCursor:m.length===t?String(r+1):void 0}}async refs(e,t,r={}){let a=eo(r.limit),l=Li(r.cursor),{data:m}=await this.request(`/repos/${Nn(e)}/${t}?per_page=${a}&page=${l}`);return{refs:m.map((h)=>({name:h.name,commitSha:h.commit.sha,protected:h.protected})),nextCursor:m.length===a?String(l+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${Nn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events,url:e.config.url??""}}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:JSON.stringify({name:"web",active:!0,events:t.events,config:{url:tc(t.url),content_type:"json",secret:t.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:JSON.stringify({active:!0,events:r.events,config:{url:tc(r.url),content_type:"json",secret:r.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${Nn(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}class Sl extends rc{provider="gitlab";apiRoot(){return`${this.connection.host}/api/v4`}async authorization(){return this.credential?.token?{"PRIVATE-TOKEN":this.credential.token}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username,scopes:this.connection.grantedScopes,message:"GitLab connection is healthy"}}async listRepositories(e={}){let t=eo(e.limit),r=Li(e.cursor),a=e.search?`&search=${encodeURIComponent(e.search)}`:"",{data:l,headers:m}=await this.request(`/projects?membership=true&simple=true&order_by=last_activity_at&per_page=${t}&page=${r}${a}`);return{repositories:l.map((h)=>({providerRepositoryId:String(h.id),fullName:h.path_with_namespace,cloneUrl:h.http_url_to_repo,defaultBranch:h.default_branch??"main",visibility:h.visibility??"unknown",archived:!!h.archived,metadata:{}})),nextCursor:m.get("x-next-page")||void 0}}async refs(e,t,r={}){let a=eo(r.limit),l=Li(r.cursor),{data:m,headers:h}=await this.request(`/projects/${encodeURIComponent(Nn(e))}/repository/${t}?per_page=${a}&page=${l}`);return{refs:m.map((S)=>({name:S.name,commitSha:S.commit.id,protected:S.protected})),nextCursor:h.get("x-next-page")||void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/projects/${encodeURIComponent(Nn(e))}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:!0,events:[...e.push_events?["push"]:[],...e.merge_requests_events?["pull_request"]:[]],url:e.url}}body(e){return JSON.stringify({url:tc(e.url),token:e.secret,enable_ssl_verification:!0,push_events:e.events.includes("push"),merge_requests_events:e.events.includes("pull_request")})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="failure"||r.state==="error"?"failed":r.state;await this.request(`/projects/${encodeURIComponent(Nn(e))}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,target_url:r.url,description:r.description.slice(0,255),name:r.context??"ts-cloud/preview"})})}}class Cl extends rc{provider="bitbucket";apiRoot(){return this.connection.host==="https://bitbucket.org"?"https://api.bitbucket.org/2.0":`${this.connection.host}/2.0`}async authorization(){return this.credential?.token?{Authorization:`Bearer ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username??e.display_name,scopes:this.connection.grantedScopes,message:"Bitbucket connection is healthy"}}async listRepositories(e={}){if(!this.connection.owner)throw Error("Bitbucket repository discovery requires an owner/workspace");let t=Li(e.cursor),r=eo(e.limit),a=e.search?`&q=name~%22${encodeURIComponent(e.search)}%22`:"",{data:l}=await this.request(`/repositories/${encodeURIComponent(this.connection.owner)}?pagelen=${r}&page=${t}${a}`);return{repositories:l.values.map((m)=>({providerRepositoryId:m.uuid,fullName:m.full_name,cloneUrl:m.links.clone.find((h)=>h.name==="https")?.href??m.links.clone[0]?.href??"",defaultBranch:m.mainbranch?.name??"main",visibility:m.is_private?"private":"public",archived:!1,metadata:{}})),nextCursor:l.next?String(t+1):void 0}}async refs(e,t,r={}){let a=Li(r.cursor),l=eo(r.limit),{data:m}=await this.request(`/repositories/${Nn(e)}/refs/${t}?pagelen=${l}&page=${a}`);return{refs:m.values.map((h)=>({name:h.name,commitSha:h.target.hash})),nextCursor:m.next?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repositories/${Nn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:e.uuid,active:e.active,events:e.events.map((t)=>t.replace("repo:push","push").replace("pullrequest:","pull_request:")),url:e.url}}body(e){return JSON.stringify({description:"ts-cloud deploy",url:tc(e.url),active:!0,events:e.events.map((t)=>t==="push"?"repo:push":t.replace("pull_request:","pullrequest:"))})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.values.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="success"?"SUCCESSFUL":r.state==="pending"?"INPROGRESS":"FAILED";await this.request(`/repositories/${Nn(e)}/commit/${encodeURIComponent(t)}/statuses/build/ts-cloud-preview`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,key:"ts-cloud-preview",name:r.context??"ts-cloud/preview",url:r.url,description:r.description.slice(0,255)})})}}class El extends rc{provider="gitea";capabilities={...zf,tokenRefresh:!1};apiRoot(){return`${this.connection.host}/api/v1`}async authorization(){return this.credential?.token?{Authorization:`token ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.login,scopes:this.connection.grantedScopes,message:"Gitea connection is healthy"}}async listRepositories(e={}){let t=Li(e.cursor),r=eo(e.limit),a=e.search?`/repos/search?q=${encodeURIComponent(e.search)}&limit=${r}&page=${t}`:`/user/repos?limit=${r}&page=${t}`,{data:l,headers:m}=await this.request(a),h=Array.isArray(l)?l:l.data;return{repositories:h.map((S)=>({providerRepositoryId:String(S.id),fullName:S.full_name,cloneUrl:S.clone_url,defaultBranch:S.default_branch??"main",visibility:S.private?"private":"public",archived:!!S.archived,metadata:{}})),nextCursor:m.get("x-hasmore")==="true"||h.length===r?String(t+1):void 0}}async refs(e,t,r={}){let a=Li(r.cursor),l=eo(r.limit),{data:m}=await this.request(`/repos/${Nn(e)}/${t}?limit=${l}&page=${a}`);return{refs:m.map((h)=>({name:h.name,commitSha:h.commit.id})),nextCursor:m.length===l?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${Nn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events??[],url:e.config.url??""}}body(e){return JSON.stringify({type:"gitea",active:!0,events:e.events,config:{url:tc(e.url),content_type:"json",secret:e.secret,insecure_ssl:"0"}})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${Nn(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}function Ze(e,t,r={}){switch(e.provider){case"github":return new Il(e,t,r);case"gitlab":return new Sl(e,t,r);case"bitbucket":return new Cl(e,t,r);case"gitea":return new El(e,t,r);default:throw Error(`${e.provider} uses bounded Git discovery instead of a hosted provider API`)}}import{createHmac as Vk,timingSafeEqual as Wk}from"node:crypto";function Gr(e,t){if(e instanceof Headers)return e.get(t)??void 0;return Object.entries(e).find(([a])=>a.toLowerCase()===t.toLowerCase())?.[1]}function Uf(e,t){let r=Buffer.from(e),a=Buffer.from(t);return r.length===a.length&&Wk(r,a)}function Hk(e,t){return Vk("sha256",e).update(t).digest("hex")}function Kk(e,t,r,a,l){if(e==="gitlab")return Uf(Gr(r,"x-gitlab-token")??"",t);let m=e==="github"?Gr(r,"x-hub-signature-256"):e==="gitea"?Gr(r,"x-gitea-signature"):Gr(r,"x-hub-signature")??Gr(r,"x-ts-cloud-signature");if(!m)return!1;if(e==="generic_https"||e==="generic_ssh"){let h=Number(Gr(r,"x-ts-cloud-timestamp"));if(!Number.isFinite(h)||Math.abs(l.getTime()-h*1000)>300000)return!1}return Uf(m.replace(/^sha256=/,""),Hk(t,a))}function Jk(e,t){return{github:["x-github-delivery"],gitlab:["x-gitlab-event-uuid","x-request-id"],bitbucket:["x-request-uuid"],gitea:["x-gitea-delivery"],generic_https:["x-ts-cloud-delivery"],generic_ssh:["x-ts-cloud-delivery"]}[e].map((a)=>Gr(t,a)?.trim()).find(Boolean)}function to(e){let t=String(e??"").trim().replace(/^\/+|\/+$/g,"");return/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t)?t:""}function Sp(e){return[...new Set(e.flatMap((t)=>{if(!t||typeof t!=="object")return[];let r=t;return[...r.added??[],...r.modified??[],...r.removed??[]].map(String)}).filter((t)=>t&&!t.includes("\x00")).slice(0,500))]}function Jm(e,t,r){let a=e,l=t,m=r;if(a==="github"){let h=Gr(l,"x-github-event"),S=to(m.repository?.full_name);if(h==="push")return{event:"push",repository:S,ref:String(m.ref??""),branch:String(m.ref??"").replace(/^refs\/heads\//,""),tag:String(m.ref??"").startsWith("refs/tags/")?String(m.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(m.after??m.head_commit?.id??""),changedPaths:Sp(m.commits??[]),deleted:m.deleted===!0||/^0{40,64}$/.test(String(m.after??""))};if(h==="pull_request")return{event:"pull_request",action:String(m.action??""),repository:S,branch:String(m.pull_request?.head?.ref??""),commitSha:String(m.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(m.number)||void 0,fork:to(m.pull_request?.head?.repo?.full_name)!==S}}if(a==="gitlab"){let h=String(m.object_kind??"").toLowerCase(),S=to(m.project?.path_with_namespace);if(h==="push"||h==="tag_push")return{event:"push",repository:S,ref:String(m.ref??""),branch:String(m.ref??"").replace(/^refs\/heads\//,""),tag:h==="tag_push"?String(m.ref??"").replace(/^refs\/tags\//,""):void 0,commitSha:String(m.checkout_sha??m.after??""),changedPaths:Sp(m.commits??[]),deleted:/^0{40,64}$/.test(String(m.after??""))};if(h==="merge_request")return{event:"pull_request",action:String(m.object_attributes?.action??m.object_attributes?.state??""),repository:S,branch:String(m.object_attributes?.source_branch??""),commitSha:String(m.object_attributes?.last_commit?.id??""),changedPaths:[],pullRequestNumber:Number(m.object_attributes?.iid)||void 0,fork:m.object_attributes?.source_project_id!==m.object_attributes?.target_project_id}}if(a==="bitbucket"){let h=Gr(l,"x-event-key")??"",S=to(m.repository?.full_name);if(h==="repo:push"){let R=m.push?.changes?.[0]??{},y=R.new??R.old??{},C=R.new?.target??R.old?.target;return{event:"push",repository:S,ref:String(y.name??""),branch:y.type==="branch"?String(y.name):void 0,tag:y.type==="tag"?String(y.name):void 0,commitSha:String(C?.hash??""),changedPaths:[],deleted:R.closed===!0||R.new==null}}if(h.startsWith("pullrequest:"))return{event:"pull_request",action:h.replace("pullrequest:",""),repository:S,branch:String(m.pullrequest?.source?.branch?.name??""),commitSha:String(m.pullrequest?.source?.commit?.hash??""),changedPaths:[],pullRequestNumber:Number(m.pullrequest?.id)||void 0,fork:to(m.pullrequest?.source?.repository?.full_name)!==S}}if(a==="gitea"){let h=Gr(l,"x-gitea-event"),S=to(m.repository?.full_name);if(h==="push")return{event:"push",repository:S,ref:String(m.ref??""),branch:String(m.ref??"").replace(/^refs\/heads\//,""),tag:String(m.ref??"").startsWith("refs/tags/")?String(m.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(m.after??""),changedPaths:Sp(m.commits??[]),deleted:m.deleted===!0||/^0{40,64}$/.test(String(m.after??""))};if(h==="pull_request")return{event:"pull_request",action:String(m.action??""),repository:S,branch:String(m.pull_request?.head?.ref??""),commitSha:String(m.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(m.number)||void 0,fork:to(m.pull_request?.head?.repo?.full_name)!==S}}if(a==="generic_https"||a==="generic_ssh"){if(m.event!=="push"&&m.event!=="pull_request")return;return{event:m.event,action:typeof m.action==="string"?m.action:void 0,repository:to(m.repository),ref:typeof m.ref==="string"?m.ref:void 0,branch:typeof m.branch==="string"?m.branch:void 0,tag:typeof m.tag==="string"?m.tag:void 0,commitSha:String(m.commitSha??""),changedPaths:Array.isArray(m.changedPaths)?m.changedPaths.map(String).slice(0,500):[],pullRequestNumber:Number(m.pullRequestNumber)||void 0,fork:m.fork===!0,deleted:m.deleted===!0}}return}function Ts(e,t){let r="^";for(let a=0;a<t.length;a++){let l=t[a];if(l==="*"&&t[a+1]==="*")r+=".*",a++;else if(l==="*")r+="[^/]*";else if(l==="?")r+="[^/]";else r+=l.replace(/[|\\{}()[\]^$+?.]/g,"\\$&")}return new RegExp(`${r}$`).test(e)}function Gk(e,t){if(t.event==="pull_request")return e.pullRequestPreviews;if(!e.autoDeploy)return!1;if(t.tag)return!!e.tagRule&&Ts(t.tag,e.tagRule);return Ts(t.branch??"",e.branchRule??e.defaultBranch)}function Qk(e,t){if(!t.length)return!0;return t.filter((a)=>!e.excludePaths.some((l)=>Ts(a,l))).some((a)=>!e.includePaths.length||e.includePaths.some((l)=>Ts(a,l)))}function qf(e,t){return Gr(t,e==="github"?"x-github-event":e==="gitlab"?"x-gitlab-event":e==="bitbucket"?"x-event-key":e==="gitea"?"x-gitea-event":"x-ts-cloud-event")??"unknown"}function Do(){return{accepted:!1,duplicate:!1,status:"rejected",operations:[],message:"Webhook unavailable"}}async function bl(e){if(e.rawBody.byteLength>2097152)return Do();let t=e.sources.getWebhookByEndpointToken(e.endpointToken);if(!t||t.status==="disabled")return Do();let r=e.sources.getConnection(t.connectionId);if(!r||r.status==="disconnected"||r.status==="expired")return Do();let a=Jk(r.provider,e.headers);if(!a||a.length>200)return Do();if(!Kk(r.provider,e.sources.getWebhookSecret(t.id),e.headers,e.rawBody,e.now??new Date))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:qf(r.provider,e.headers),signatureStatus:Gr(e.headers,"x-hub-signature-256")||Gr(e.headers,"x-gitlab-token")||Gr(e.headers,"x-hub-signature")||Gr(e.headers,"x-gitea-signature")?"invalid":"missing",status:"rejected",error:"Webhook signature verification failed"}),Do();let m;try{m=JSON.parse(new TextDecoder().decode(e.rawBody))}catch{return Do()}let h=Jm(r.provider,e.headers,m);if(!h||!h.repository||!/^[a-f0-9]{7,64}$/i.test(h.commitSha))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:qf(r.provider,e.headers),signatureStatus:"verified",status:"rejected",error:"Unsupported or malformed source event"}),Do();let S=e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:h.event,action:h.action,commitSha:h.commitSha,signatureStatus:"verified",status:"accepted",payloadSummary:{repository:h.repository,ref:h.ref??null,branch:h.branch??null,tag:h.tag??null,commitSha:h.commitSha,pullRequestNumber:h.pullRequestNumber??null,changedPathCount:h.changedPaths.length}});if(S.duplicate&&S.delivery.status!=="accepted")return{accepted:!0,duplicate:!0,status:"duplicate",operations:[],message:"Delivery already processed"};let R=new Ve(e.controlPlane),y=e.sources.listBindings({connectionId:r.id,status:"active"}).filter((B)=>{if(B.repositoryFullName.toLowerCase()!==h.repository.toLowerCase()||!Qk(B,h.changedPaths))return!1;let V=B.resourceId?R.getDefinitionForResource(B.resourceId):void 0,W=h.event==="push"&&!!V?.branchRule&&!!h.branch&&Ts(h.branch,V.branchRule);return Gk(B,h)||W});if(!y.length)return e.sources.updateDelivery(S.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:S.duplicate,status:"ignored",operations:[],message:"Verified event did not match an active deployment rule"};let C=new c(e.controlPlane),T=new Set(["closed","merged","declined"]),j=y.flatMap((B)=>{if(h.event==="push"&&B.resourceId&&h.branch){let W=R.getDefinitionForResource(B.resourceId);if(W?.branchRule&&Ts(h.branch,W.branchRule)){let Y=R.findForBranch(W.id,h.repository,h.branch);if(h.deleted){if(!W.cleanupOnClose||!Y||Y.status==="destroyed")return[];let ce=C.enqueue({projectId:B.projectId,environmentId:B.environmentId,resourceId:B.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${Y.id}:branch-delete:${a}`,correlationId:`preview:${Y.id}`,input:{previewId:Y.id,reason:"branch_deleted",source:{repository:h.repository,commitSha:h.commitSha,branch:h.branch}},lockKey:`preview:${Y.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return R.transition(Y.id,"queued",{operationId:ce.id}),[ce]}let te=R.upsert({definitionId:W.id,sourceProvider:r.provider,repository:h.repository,branch:h.branch,commitSha:h.commitSha});if(!te.changed)return[];let le=te.created?"preview.create":"preview.update",X=C.enqueue({projectId:B.projectId,environmentId:B.environmentId,resourceId:B.resourceId,kind:le,idempotencyKey:`preview:${te.preview.id}:${h.commitSha}`,correlationId:`preview:${te.preview.id}`,input:{previewId:te.preview.id,source:{connectionId:r.id,bindingId:B.id,repository:h.repository,commitSha:h.commitSha,branch:h.branch,monorepoRoot:B.monorepoRoot,submodules:B.submodules,cloneDepth:B.cloneDepth??null}},lockKey:`preview:${te.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return R.transition(te.preview.id,"queued",{operationId:X.id}),[X]}}if(h.event==="pull_request"&&B.resourceId&&h.pullRequestNumber){let W=R.getDefinitionForResource(B.resourceId);if(W){let Y=T.has(String(h.action??"").toLowerCase()),te=R.findForPullRequest(W.id,h.repository,h.pullRequestNumber);if(Y){if(!W.cleanupOnClose||!te||te.status==="destroyed")return[];let le=C.enqueue({projectId:B.projectId,environmentId:B.environmentId,resourceId:B.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${te.id}:destroy:${a}`,correlationId:`preview:${te.id}`,input:{previewId:te.id,reason:"pull_request_closed",source:{repository:h.repository,commitSha:h.commitSha,branch:h.branch??null,pullRequestNumber:h.pullRequestNumber}},lockKey:`preview:${te.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return R.transition(te.id,"queued",{operationId:le.id}),[le]}try{let le=R.upsert({definitionId:W.id,sourceProvider:r.provider,repository:h.repository,branch:h.branch??`pr-${h.pullRequestNumber}`,pullRequestNumber:h.pullRequestNumber,fork:h.fork,commitSha:h.commitSha});if(!le.changed)return[];let X=le.created?"preview.create":"preview.update",ce=C.enqueue({projectId:B.projectId,environmentId:B.environmentId,resourceId:B.resourceId,kind:X,idempotencyKey:`preview:${le.preview.id}:${h.commitSha}`,correlationId:`preview:${le.preview.id}`,input:{previewId:le.preview.id,source:{connectionId:r.id,bindingId:B.id,repository:h.repository,commitSha:h.commitSha,branch:h.branch??null,pullRequestNumber:h.pullRequestNumber,fork:!!h.fork,monorepoRoot:B.monorepoRoot,submodules:B.submodules,cloneDepth:B.cloneDepth??null},inheritedSecretNames:le.inheritedSecrets},lockKey:`preview:${le.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return R.transition(le.preview.id,"queued",{operationId:ce.id}),[ce]}catch(le){return e.controlPlane.appendEvent({projectId:B.projectId,resourceId:B.resourceId,type:"preview.rejected",level:"warning",payload:{repository:h.repository,pullRequestNumber:h.pullRequestNumber,fork:!!h.fork,reason:le instanceof Error?le.message:String(le)}}),[]}}}let V=h.event==="pull_request"?"deploy.preview":"deploy.source";return[C.enqueue({projectId:B.projectId,environmentId:B.environmentId,resourceId:B.resourceId,kind:V,idempotencyKey:`source:${r.id}:${a}:${B.id}:${h.commitSha}`,correlationId:`source:${a}`,input:{source:{connectionId:r.id,bindingId:B.id,repository:h.repository,commitSha:h.commitSha,branch:h.branch??null,tag:h.tag??null,monorepoRoot:B.monorepoRoot,submodules:B.submodules,cloneDepth:B.cloneDepth??null},preview:h.event==="pull_request"?{number:h.pullRequestNumber??null,action:h.action??null}:null},lockKey:B.resourceId?`resource:${B.resourceId}`:`environment:${B.environmentId??B.projectId}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:h.event==="pull_request"?14:90}).operation]});if(!j.length)return e.sources.updateDelivery(S.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:S.duplicate,status:"ignored",operations:[],message:"Verified event required no preview lifecycle change"};return e.sources.updateDelivery(S.delivery.id,{status:"enqueued",operationId:j[0]?.id}),e.controlPlane.appendEvent({organizationId:r.organizationId,projectId:y[0]?.projectId,operationId:j[0]?.id,type:"source.webhook.enqueued",payload:{webhookId:t.id,deliveryId:S.delivery.id,repository:h.repository,commitSha:h.commitSha,operationIds:j.map((B)=>B.id)}}),{accepted:!0,duplicate:S.duplicate,status:"enqueued",operations:j,message:`${j.length} deployment operation${j.length===1?"":"s"} enqueued`}}function Zt(e,t){if(!t.endpointToken)throw Error("The webhook endpoint token is only available at creation time");let r=new URL(e);if(r.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(r.hostname))throw Error("Webhook base URL must use HTTPS");return new URL(`/api/source/webhooks/${encodeURIComponent(t.endpointToken)}`,r).href}import{chmodSync as Vf,mkdtempSync as Yk,rmSync as Zk,writeFileSync as Wf}from"node:fs";import{tmpdir as Xk}from"node:os";import{join as Lc,resolve as eI}from"node:path";function Kf(e,t){let r=e.trim();if(/\r|\n|\0/.test(r))throw Error("Git remote contains control characters");if(r.startsWith("https://")){let l=new URL(r);if(l.username||l.password||l.search||l.hash)throw Error("HTTPS Git remotes cannot contain credentials, queries, or fragments");return l.href}let a=r.startsWith("ssh://")?new URL(r).hostname:r.match(/^git@([A-Za-z0-9.-]+):/)?.[1];if(!a)throw Error("Git remote must use credential-free HTTPS or SSH");if(!t||t.host.toLowerCase()!==a.toLowerCase())throw Error("SSH Git remote requires a deploy key with a pinned key for the same host");return r}function tI(e,t,r){let a=e.replaceAll(t,"[REMOTE]").slice(0,4000);for(let l of[r?.token,r?.privateKey])if(l)a=a.replaceAll(l,"[REDACTED]");return a}function rI(e){let t={PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",GIT_TERMINAL_PROMPT:"0",GIT_CONFIG_NOSYSTEM:"1",GIT_OPTIONAL_LOCKS:"0"},r;if(e.credential?.token){let a=e.credential.username??"oauth2";t.GIT_CONFIG_COUNT="1",t.GIT_CONFIG_KEY_0="http.extraHeader",t.GIT_CONFIG_VALUE_0=`Authorization: Basic ${Buffer.from(`${a}:${e.credential.token}`).toString("base64")}`}if(e.deployKey){r=Yk(Lc(Xk(),"ts-cloud-git-transport-"));let a=Lc(r,"key"),l=Lc(r,"known_hosts");Wf(a,e.deployKey.privateKey,{mode:384}),Wf(l,`${e.deployKey.host} ${e.deployKey.hostKey}
 `,{mode:384}),Vf(a,384),Vf(l,384),t.GIT_SSH_COMMAND=`ssh -i ${a} -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=${l} -o GlobalKnownHostsFile=/dev/null -o BatchMode=yes`}return{env:t,cleanup:()=>{if(r)Zk(r,{recursive:!0,force:!0})}}}async function No(e,t,r){let a=rI(r),l=Bun.spawn([r.executable??"git",...e],{stdout:"pipe",stderr:"pipe",env:a.env}),m=Math.max(100,r.timeoutMs??120000),h,S=new Promise((R,y)=>{h=setTimeout(()=>{l.kill(),y(Error(`Git operation exceeded ${m}ms`))},m)});try{let R=Promise.all([l.exited,new Response(l.stdout).text(),new Response(l.stderr).text()]),[y,C,T]=await Promise.race([R,S]);if(y!==0)throw Error(tI(T||`Git exited with ${y}`,t,r.credential));return C}finally{if(h)clearTimeout(h);a.cleanup()}}function Hf(e,t){let r=new Map;for(let a of e.split(`
-`)){let l=a.trim().match(/^([a-f0-9]{40,64})\s+(.+)$/i);if(!l||!l[2].startsWith(t)||l[2].endsWith("^{}"))continue;let m=l[2].slice(t.length);r.set(m,{name:m,commitSha:l[1]})}return[...r.values()].sort((a,l)=>a.name.localeCompare(l.name))}async function Ho(e,t={}){let r=Kf(e,t.deployKey),a=await No(["ls-remote","--heads","--tags","--",r],r,t);return{branches:Hf(a,"refs/heads/"),tags:Hf(a,"refs/tags/")}}async function Go(e,t={}){let r=Kf(e.remote,t.deployKey),a=eI(e.destination),l=e.ref?.trim()||e.binding.defaultBranch;if(!/^[A-Za-z0-9._/-]{1,255}$/.test(l)||l.startsWith("-")||l.includes(".."))throw Error("Git ref contains unsupported characters");let m=["clone","--no-tags","--single-branch","--branch",l],h=[...new Set(e.sparsePaths??[])];if(h.some((R)=>!R||R.startsWith("/")||R.split("/").includes("..")||/[\0\r\n]/.test(R)))throw Error("Sparse checkout paths must stay inside the repository");if(h.length)m.push("--filter=blob:none","--no-checkout");if(e.binding.cloneDepth)m.push("--depth",String(e.binding.cloneDepth));if(e.binding.submodules)m.push("--recurse-submodules","--shallow-submodules");if(m.push("--",r,a),await No(m,r,t),h.length)await No(["-C",a,"sparse-checkout","set","--cone","--",...h],r,t),await No(["-C",a,"checkout","--force"],r,t);if(e.commitSha){if(!/^[a-f0-9]{40,64}$/i.test(e.commitSha))throw Error("Expected source commit must be an immutable 40-64 character SHA");await No(["-C",a,"fetch","--no-tags","--depth","1","origin",e.commitSha],r,t),await No(["-C",a,"checkout","--detach","--force",e.commitSha],r,t)}let S=(await No(["-C",a,"rev-parse","HEAD"],r,t)).trim();if(!/^[a-f0-9]{40,64}$/i.test(S))throw Error("Git clone did not produce a valid commit SHA");if(e.commitSha&&S.toLowerCase()!==e.commitSha.toLowerCase())throw Error(`Git checkout resolved ${S} instead of the requested immutable commit`);return{directory:e.binding.monorepoRoot==="."?a:Lc(a,e.binding.monorepoRoot),commitSha:S}}function nc(e){return["github","gitlab","bitbucket","gitea"].includes(e)}async function qo(e,t,r){let a=e.getConnection(t);if(!a||["disconnected","expired"].includes(a.status))throw Error("Active source connection was not found");try{if(nc(a.provider)){let h=await Ze(a,e.getCredential(a.id)).testConnection();return e.updateHealth(a.id,{status:h.ok?"healthy":"degraded",message:h.message,tested:!0,grantedScopes:h.scopes})}let l=r?e.getRepository(r):e.listRepositories(a.id,void 0,1)[0];if(!l)return e.updateHealth(a.id,{status:"degraded",message:"Add a repository URL before testing this generic connection.",tested:!0});let m=a.provider==="generic_ssh"?e.listBindings({connectionId:a.id}).map((h)=>h.deployKeyId).filter(Boolean).map((h)=>e.getDeployKey(h)).find(Boolean):void 0;return await Ho(l.cloneUrl,{credential:e.getCredential(a.id),deployKey:m?{...m,privateKey:e.getDeployPrivateKey(m.id)}:void 0}),e.updateHealth(a.id,{status:"healthy",message:"Git repository access is healthy.",tested:!0})}catch(l){return e.updateHealth(a.id,{status:"degraded",message:l instanceof Error?l.message:"Connection test failed",tested:!0})}}async function Gi(e,t,r={}){let a=e.getConnection(t);if(!a||!nc(a.provider)||["disconnected","expired"].includes(a.status))throw Error("A hosted active source connection is required for repository discovery");let l=Ze(a,e.getCredential(a.id)),m=[],h;for(let S=0;S<Math.min(20,Math.max(1,r.maxPages??10));S++){let R=await l.listRepositories({cursor:h,search:r.search,limit:100});for(let y of R.repositories)m.push(e.upsertRepository({connectionId:a.id,...y}));if(h=R.nextCursor,!h)break}return e.updateHealth(a.id,{status:"healthy",message:`${m.length} repositories synchronized.`,synced:!0}),m}async function qi(e,t){let r=e.getConnection(t.connectionId);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");if(nc(r.provider)){let S=Ze(r,e.getCredential(r.id));return t.type==="tags"?S.listTags(t.repository,t):S.listBranches(t.repository,t)}let a=t.repositoryId?e.getRepository(t.repositoryId):e.listRepositories(r.id).find((S)=>S.fullName===t.repository);if(!a||a.connectionId!==r.id)throw Error("Generic repository metadata was not found");let l=t.deployKeyId?e.getDeployKey(t.deployKeyId):void 0;if(l&&l.connectionId!==r.id)throw Error("Deploy key does not belong to this connection");let m=await Ho(a.cloneUrl,{credential:e.getCredential(r.id),deployKey:l?{...l,privateKey:e.getDeployPrivateKey(l.id)}:void 0});return{refs:(t.type==="tags"?m.tags:m.branches).slice(0,Math.min(500,t.limit??100))}}async function Zr(e,t,r){let a=e.getWebhook(t),l=a?e.getConnection(a.connectionId):void 0;if(!a||!l||["disconnected","expired"].includes(l.status))throw Error("Active source webhook was not found");let m=Zt(r,{...a,endpointToken:e.getWebhookEndpointToken(a.id)});if(!nc(l.provider))return e.updateWebhookState(a.id,{status:"healthy",healthMessage:"Manual webhook endpoint is ready.",reconciled:!0});try{let h=Ze(l,e.getCredential(l.id)),S=e.getWebhookSecret(a.id),R=a.providerWebhookId?await h.updateWebhook(a.repositoryFullName,a.providerWebhookId,{url:m,secret:S,events:a.events}):await h.createWebhook(a.repositoryFullName,{url:m,secret:S,events:a.events});return e.updateWebhookState(a.id,{providerWebhookId:R.providerWebhookId,status:R.active?"healthy":"degraded",healthMessage:R.active?"Provider webhook is synchronized.":"Provider webhook exists but is inactive.",reconciled:!0})}catch(h){return e.updateWebhookState(a.id,{status:"degraded",healthMessage:h instanceof Error?h.message:"Webhook reconciliation failed",reconciled:!0})}}async function vl(e,t){let r=e.getWebhook(t),a=r?e.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Source webhook was not found");if(nc(a.provider)&&r.providerWebhookId&&!["disconnected","expired"].includes(a.status))await Ze(a,e.getCredential(a.id)).deleteWebhook(r.repositoryFullName,r.providerWebhookId);return e.updateWebhookState(r.id,{status:"disabled",healthMessage:"Webhook disabled."})}var Vi="1.6.0";function Vo(){let e={type:"object",required:["error"],properties:{error:{type:"object",required:["code","message","requestId"],properties:{code:{type:"string"},message:{type:"string"},requestId:{type:"string",format:"uuid"},details:{}}}}},t=(a)=>({type:"object",required:["data","page","requestId"],properties:{data:{type:"array",items:a},page:{type:"object",required:["hasMore"],properties:{nextCursor:{type:"string"},hasMore:{type:"boolean"}}},requestId:{type:"string",format:"uuid"}}}),r=(a)=>({"200":{description:"A stable cursor page.",content:{"application/json":{schema:t(a)}}},default:{$ref:"#/components/responses/Error"}});return{openapi:"3.1.0",info:{title:"ts-cloud API",version:Vi,description:"Additive changes are released within v1. Breaking request or response changes require a new URL version."},servers:[{url:"/"}],security:[{bearerAuth:[]}],paths:{...lo(),"/api/v1/projects":{get:{operationId:"listProjects",summary:"List accessible projects",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Project"})}},"/api/v1/projects/{projectId}/environments":{get:{operationId:"listEnvironments",summary:"List accessible project environments",parameters:[{$ref:"#/components/parameters/ProjectId"},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Environment"})}},"/api/v1/services":{get:{operationId:"listServices",summary:"List accessible services",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Service"})}},"/api/v1/source/connections":{get:{operationId:"listSourceConnections",summary:"List safe Git connection metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceConnection"})},post:{operationId:"createSourceConnection",summary:"Create an encrypted Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["provider","name","host"],properties:{provider:{type:"string",enum:["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"]},name:{type:"string"},host:{type:"string",format:"uri"},token:{type:"string",writeOnly:!0},repositoryFullName:{type:"string"},repositoryUrl:{type:"string"}}}}}},responses:{"201":{description:"Encrypted connection created."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectSourceConnection",summary:"Preview or safely disconnect a Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["id"],properties:{id:{type:"string"},preview:{type:"boolean"}}}}}},responses:{"200":{description:"Impact preview or disconnected connection."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/repositories":{get:{operationId:"listSourceRepositories",summary:"List or synchronize granted repositories",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"sync",in:"query",schema:{type:"boolean"}},{name:"search",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceRepository"})}},"/api/v1/source/refs":{get:{operationId:"listSourceRefs",summary:"List repository branches or tags",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"repository",in:"query",required:!0,schema:{type:"string"}},{name:"repositoryId",in:"query",schema:{type:"string"}},{name:"type",in:"query",schema:{type:"string",enum:["branches","tags"]}}],responses:{"200":{description:"Provider reference page."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/bindings":{post:{operationId:"createSourceBinding",summary:"Bind a repository to an application",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/SourceBindingRequest"}}}},responses:{"201":{description:"Source binding created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/webhooks":{post:{operationId:"createSourceWebhook",summary:"Create and optionally reconcile a signed webhook",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["connectionId","repositoryFullName","baseUrl"],properties:{connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},baseUrl:{type:"string",format:"uri"},events:{type:"array",items:{type:"string",enum:["push","pull_request"]}},reconcile:{type:"boolean"}}}}}},responses:{"201":{description:"Webhook endpoint created; endpoint is revealed once."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-detections":{post:{operationId:"detectApplication",summary:"Detect bounded application build candidates",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["files"],properties:{files:{type:"array",maxItems:1e4,items:{$ref:"#/components/schemas/DetectionFile"}}}}}}},responses:{"200":{description:"Ranked detection candidates with evidence."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-plans":{post:{operationId:"planApplication",summary:"Validate and normalize an application manifest",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["draft"],properties:{draft:{$ref:"#/components/schemas/ApplicationInput"},suppliedSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}}}}}},responses:{"200":{description:"Validated plan, config patch, capabilities, costs, and missing secret names."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-drafts":{get:{operationId:"listApplicationDrafts",summary:"List resumable secret-free drafts",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/ApplicationDraft"})},post:{operationId:"createApplicationDraft",summary:"Create a resumable application draft",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/ApplicationDraftCreateRequest"}}}},responses:{"201":{description:"Draft created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateApplicationDraft",summary:"Optimistically update a draft",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/ApplicationDraftCreateRequest"},{type:"object",required:["id","version","step"],properties:{id:{type:"string"},version:{type:"integer",minimum:1}}}]}}}},responses:{"200":{description:"Updated draft."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/applications":{post:{operationId:"createApplication",summary:"Confirm and queue an application plan",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["draftId","version","confirmEnvironment"],properties:{draftId:{type:"string"},version:{type:"integer",minimum:1},confirmEnvironment:{type:"string",description:"Exact target environment slug."}}}}}},responses:{"202":{description:"Application operation queued; identical requests replay safely."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-artifacts":{post:{operationId:"uploadApplicationArtifact",summary:"Inspect and store a bounded ZIP or TAR source artifact",parameters:[{name:"X-Project-Id",in:"header",required:!0,schema:{type:"string"}},{name:"X-Artifact-Filename",in:"header",required:!0,schema:{type:"string"}}],requestBody:{required:!0,content:{"application/octet-stream":{schema:{type:"string",format:"binary",maxLength:104857600}}}},responses:{"201":{description:"Deduplicated artifact metadata; archive contents are never executed."},"413":{$ref:"#/components/responses/Error"},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/registry-connections":{get:{operationId:"listRegistryConnections",summary:"List safe private-registry metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/RegistryConnection"})},post:{operationId:"createRegistryConnection",summary:"Create an encrypted private-registry connection",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/RegistryConnectionRequest"}}}},responses:{"201":{description:"Encrypted registry connection created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateRegistryConnection",summary:"Test access or rotate write-only credentials",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/RegistryConnectionRequest"},{type:"object",required:["id","action"],properties:{id:{type:"string"},action:{type:"string",enum:["test","rotate"]},image:{type:"string"}}}]}}}},responses:{"200":{description:"Safe connection health metadata."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectRegistryConnection",summary:"Disconnect and erase registry credentials",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["id"],properties:{id:{type:"string"}}}}}},responses:{"200":{description:"Credentials erased and connection disconnected."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue":{get:{operationId:"listQueue",summary:"List authorized durable operations and blocking metadata",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"state",in:"query",schema:{type:"string",enum:["queued","running","succeeded","failed","cancelled","timed_out"]}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/QueueOperation"})}},"/api/v1/preview-definitions":{get:{operationId:"listPreviewDefinitions",summary:"List preview policies",responses:r({type:"object"})},post:{operationId:"createPreviewDefinition",summary:"Configure bounded preview policy",responses:{"200":{description:"Preview definition created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews":{get:{operationId:"listPreviews",summary:"List authorized persistent previews",responses:r({type:"object"})},post:{operationId:"createPreview",summary:"Create or update one immutable preview identity",responses:{"200":{description:"Preview deployment queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/destroy":{post:{operationId:"destroyPreview",summary:"Confirm tagged preview teardown",responses:{"200":{description:"Teardown queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/extend":{post:{operationId:"extendPreview",summary:"Extend preview TTL",responses:{"200":{description:"Expiry extended."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/rebuild":{post:{operationId:"rebuildPreview",summary:"Rebuild the exact recorded commit",responses:{"200":{description:"Rebuild queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/cleanup":{post:{operationId:"cleanupPreviews",summary:"Dry-run or queue TTL/keep-count teardown",responses:{"200":{description:"Cleanup plan or operations."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-templates":{get:{operationId:"listComposeTemplates",summary:"List pinned verified application templates",responses:r({type:"object"})}},"/api/v1/compose-applications":{get:{operationId:"listComposeApplications",summary:"List authorized multi-service applications",responses:r({type:"object"})},post:{operationId:"createComposeApplication",summary:"Import Compose or materialize a template",responses:{"200":{description:"Editable normalized application."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/preview":{post:{operationId:"previewComposeApplication",summary:"Parse and diagnose Compose without mutation",responses:{"200":{description:"Normalized preview and actionable diagnostics."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/services":{get:{operationId:"listComposeServices",summary:"Inspect per-service desired and observed state",responses:{"200":{description:"Service topology and status."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/{action}":{post:{operationId:"operateComposeApplication",summary:"Deploy, redeploy, start, stop, scale, or delete through the durable queue",responses:{"200":{description:"Scoped operation queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/release-artifacts":{post:{operationId:"createReleaseArtifact",summary:"Register a verified content-addressed artifact",responses:{"200":{description:"Artifact identity registered."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases":{get:{operationId:"listReleases",summary:"List unified authorized release history",responses:r({type:"object"})},post:{operationId:"createRelease",summary:"Create an immutable release from an existing artifact",responses:{"200":{description:"Release record created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/capabilities":{get:{operationId:"getReleaseCapabilities",summary:"Explain supported strategies, capacity, cost, and rollback",responses:{"200":{description:"Provider-aware strategy capabilities."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}":{get:{operationId:"getRelease",summary:"Inspect provenance, approvals, health, and transitions",responses:{"200":{description:"Release detail."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}/{action}":{post:{operationId:"operateRelease",summary:"Promote, approve, activate, roll back, report health, or pin",responses:{"200":{description:"Release lifecycle updated."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/settings":{get:{operationId:"getQueueSettings",summary:"Get effective concurrency limits",responses:{"200":{description:"Queue concurrency settings."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateQueueSettings",summary:"Confirm and audit production concurrency changes",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm","concurrency"],properties:{confirm:{const:"update queue limits"},concurrency:{$ref:"#/components/schemas/QueueConcurrency"}}}}}},responses:{"200":{description:"Updated effective limits."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/history":{delete:{operationId:"clearQueueHistory",summary:"Clear terminal jobs whose retention has elapsed",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm"],properties:{confirm:{const:"clear completed"},before:{type:"string",format:"date-time"},projectId:{type:"string"}}}}}},responses:{"200":{description:"Eligible history cleared with an audit event."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs":{get:{operationId:"listOperationLogs",summary:"Resume ordered sanitized operation logs from a cursor",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:{"200":{description:"Ordered log chunks and next cursor."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs/stream":{get:{operationId:"streamOperationLogs",summary:"Stream authorized operation logs with Last-Event-ID resume",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"Last-Event-ID",in:"header",schema:{type:"integer",minimum:0}}],responses:{"200":{description:"Server-sent log and completion events.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/cancel":{post:{operationId:"cancelOperation",summary:"Cancel queued work or request cooperative running cancellation",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{content:{"application/json":{schema:{type:"object"}}}},responses:{"200":{description:"Cancellation state recorded."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/retry":{post:{operationId:"retryOperation",summary:"Retry an allow-listed failure class within the attempt limit",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["errorClass"],properties:{errorClass:{type:"string"},delayMs:{type:"integer",minimum:0}}}}}},responses:{"200":{description:"Retry queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/deployments":{post:{operationId:"createDeployment",summary:"Queue a deployment",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/DeploymentRequest"}}}},responses:{"202":{description:"Queued operation.",content:{"application/json":{schema:{$ref:"#/components/schemas/OperationResponse"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations":{get:{operationId:"listOperations",summary:"List scoped operations",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Operation"})}},"/api/v1/events":{get:{operationId:"listEvents",summary:"List scoped audit events",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:r({$ref:"#/components/schemas/Event"})}},"/api/v1/events/stream":{get:{operationId:"streamEvents",summary:"Stream scoped audit events",responses:{"200":{description:"Authenticated server-sent event stream.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/openapi.json":{get:{operationId:"getOpenApi",summary:"Get the OpenAPI contract",security:[],responses:{"200":{description:"OpenAPI 3.1 contract."}}}}},components:{securitySchemes:{bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"tsc_v1"}},parameters:{Limit:{name:"limit",in:"query",schema:{type:"integer",minimum:1,maximum:100,default:50}},Cursor:{name:"cursor",in:"query",schema:{type:"string"}},ProjectId:{name:"projectId",in:"path",required:!0,schema:{type:"string"}},OperationId:{name:"operationId",in:"path",required:!0,schema:{type:"string"}}},responses:{Error:{description:"Stable error envelope.",content:{"application/json":{schema:e}}}},schemas:{Project:{type:"object",required:["id","slug","name"],properties:{id:{type:"string"},slug:{type:"string"},name:{type:"string"},description:{type:"string"}}},Environment:{type:"object",required:["id","projectId","slug","name","kind"],properties:{id:{type:"string"},projectId:{type:"string"},slug:{type:"string"},name:{type:"string"},kind:{type:"string"},region:{type:"string"}}},Service:{type:"object",required:["id","projectId","kind","slug","name"],properties:{id:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},kind:{type:"string"},slug:{type:"string"},name:{type:"string"},metadata:{type:"object",additionalProperties:!0}}},SourceConnection:{type:"object",required:["id","provider","name","host","status","credentialConfigured"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},status:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},grantedScopes:{type:"array",items:{type:"string"}}}},SourceRepository:{type:"object",required:["id","connectionId","fullName","cloneUrl","defaultBranch"],properties:{id:{type:"string"},connectionId:{type:"string"},fullName:{type:"string"},cloneUrl:{type:"string"},defaultBranch:{type:"string"},visibility:{type:"string"},archived:{type:"boolean"}}},SourceBindingRequest:{type:"object",additionalProperties:!1,required:["projectId","connectionId","repositoryFullName"],properties:{projectId:{type:"string"},environmentId:{type:"string"},resourceId:{type:"string"},connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},defaultBranch:{type:"string"},branchRule:{type:"string"},tagRule:{type:"string"},monorepoRoot:{type:"string"},includePaths:{type:"array",items:{type:"string"}},excludePaths:{type:"array",items:{type:"string"}},submodules:{type:"boolean"},cloneDepth:{type:"integer",minimum:1},deployKeyId:{type:"string"},autoDeploy:{type:"boolean"},pullRequestPreviews:{type:"boolean"}}},DetectionFile:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string"},size:{type:"integer",minimum:0},content:{type:"string",maxLength:262144}}},ApplicationInput:{type:"object",additionalProperties:!1,required:["schemaVersion","name","slug","projectId","environmentId","source","build","runtime"],properties:{schemaVersion:{const:1},name:{type:"string"},slug:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},source:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["git","local","artifact","image"]}},additionalProperties:!0},build:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["dockerfile","buildpack","static","server","serverless","prebuilt_image"]},secretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}},additionalProperties:!0},runtime:{type:"object",required:["architecture","target"],properties:{architecture:{type:"string",enum:["x86_64","arm64"]},target:{type:"string",enum:["server","serverless","container"]},port:{type:"integer",minimum:1,maximum:65535},healthCheck:{type:"object",additionalProperties:!0}},additionalProperties:!0},environment:{type:"object",additionalProperties:{oneOf:[{type:"string"},{type:"object",additionalProperties:!1,required:["secretRef"],properties:{secretRef:{type:"string"}}}]}},requiredSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}},domain:{type:"object",properties:{hostname:{type:"string"},path:{type:"string"},tls:{type:"boolean"}}}}},ApplicationDraftCreateRequest:{type:"object",additionalProperties:!1,required:["projectId","draft"],properties:{projectId:{type:"string"},name:{type:"string"},draft:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string",enum:["source","build","runtime","environment","domain","review"]},suppliedSecretNames:{type:"array",uniqueItems:!0,description:"Names only; values must use the secrets boundary.",items:{type:"string"}}}},ApplicationDraft:{type:"object",required:["id","projectId","input","step","status","version"],properties:{id:{type:"string"},projectId:{type:"string"},input:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string"},suppliedSecretNames:{type:"array",items:{type:"string"}},status:{type:"string",enum:["draft","ready","applied"]},version:{type:"integer"},createdAt:{type:"string",format:"date-time"},updatedAt:{type:"string",format:"date-time"}}},RegistryConnectionRequest:{type:"object",properties:{provider:{type:"string",enum:["docker_hub","ghcr","ecr","gcr","generic"]},name:{type:"string"},host:{type:"string"},username:{type:"string",writeOnly:!0},password:{type:"string",writeOnly:!0},token:{type:"string",writeOnly:!0},credentialExpiresAt:{type:"string",format:"date-time"},expiresAt:{type:"string",format:"date-time"}}},RegistryConnection:{type:"object",required:["id","provider","name","host","credentialConfigured","status","version"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},credentialExpiresAt:{type:"string",format:"date-time"},status:{type:"string",enum:["pending","healthy","degraded","expired","disconnected"]},healthMessage:{type:"string"},lastTestedAt:{type:"string",format:"date-time"},version:{type:"integer"}}},QueueConcurrency:{type:"object",additionalProperties:!1,properties:{project:{type:"integer",minimum:1,maximum:100},environment:{type:"integer",minimum:1,maximum:100},provider:{type:"integer",minimum:1,maximum:100},builds:{type:"integer",minimum:1,maximum:100}}},QueueOperation:{allOf:[{$ref:"#/components/schemas/Operation"},{type:"object",required:["queue"],properties:{queue:{type:"object",required:["maxAttempts","availableAt","timeoutSeconds","retryClasses","resumePolicy","cancellationMode","retentionUntil"],properties:{lockKey:{type:"string"},providerKey:{type:"string"},buildSlot:{type:"boolean"},maxAttempts:{type:"integer"},availableAt:{type:"string",format:"date-time"},timeoutSeconds:{type:"integer"},heartbeatAt:{type:"string",format:"date-time"},currentStep:{type:"string"},blockedReason:{type:"string"},retryClasses:{type:"array",items:{type:"string"}},resumePolicy:{type:"string",enum:["fail","requeue"]},cancellationMode:{type:"string",enum:["cooperative","provider_non_cancellable"]},retentionUntil:{type:"string",format:"date-time"}}},approximatePosition:{type:"object",properties:{ahead:{type:"integer"},precision:{const:"bounded"}}}}}]},DeploymentRequest:{type:"object",additionalProperties:!1,required:["projectId","environmentId"],properties:{projectId:{type:"string"},environmentId:{type:"string"},serviceId:{type:"string"},action:{type:"string",enum:["deploy","rollback"],default:"deploy"},revision:{type:"string"}}},Operation:{type:"object",required:["id","state","kind","correlationId","createdAt"],properties:{id:{type:"string"},state:{type:"string"},kind:{type:"string"},correlationId:{type:"string"},createdAt:{type:"string",format:"date-time"}}},OperationResponse:{type:"object",required:["operation","idempotentReplay","requestId"],properties:{operation:{$ref:"#/components/schemas/Operation"},idempotentReplay:{type:"boolean"},requestId:{type:"string",format:"uuid"}}},Event:{type:"object",required:["id","sequence","type","level","correlationId","createdAt"],properties:{id:{type:"string"},sequence:{type:"integer"},type:{type:"string"},level:{type:"string"},correlationId:{type:"string"},payload:{},createdAt:{type:"string",format:"date-time"}}}}}}}function iI(e){return Buffer.from(JSON.stringify(e)).toString("base64url")}function oI(e){if(!e)return;try{let t=JSON.parse(Buffer.from(e,"base64url").toString("utf8"));return t&&typeof t==="object"&&!Array.isArray(t)?t:void 0}catch{return}}function Qr(e,t,r,a=["createdAt","id"]){let l=Math.min(100,Math.max(1,Number(t.searchParams.get("limit"))||50)),m=oI(t.searchParams.get("cursor"));if(t.searchParams.has("cursor")&&!m)throw new i("invalid_cursor","The pagination cursor is invalid.",400);let h=0;if(m){let C=e.findIndex((T)=>a.every((j)=>T[j]===m[j]));if(C<0)throw new i("invalid_cursor","The pagination cursor is no longer available.",400);h=C+1}let S=e.slice(h,h+l),R=h+l<e.length,y=S.at(-1);return{data:S,page:{hasMore:R,nextCursor:R&&y?iI(Object.fromEntries(a.map((C)=>[C,y[C]]))):void 0},requestId:r}}function jo(e){let t=new Ri(e.controlPlane,e.identities),r=new c(e.controlPlane),a=new _r(e.controlPlane),l=new Or(e.controlPlane),m=new It(e.controlPlane),h=e.spend?.store??new yi(e.controlPlane,{now:e.now}),S={store:h,service:e.spend?.service??new Ht(h)},R=new Map,y=e.now??(()=>new Date),C=e.rateLimit??120,T=(B,V,W,Y={})=>new Response(JSON.stringify(B),{status:V,headers:{"content-type":"application/json; charset=utf-8","cache-control":"no-store","x-request-id":W,"x-api-version":Vi,...Y}}),j=(B,V,W,Y,te,le)=>T({error:{code:B,message:V,requestId:Y,details:te}},W,Y,le);return async(B,V)=>{let W=new URL(B.url);if(!W.pathname.startsWith("/api/v1"))return;let Y=crypto.randomUUID();if(W.pathname==="/api/v1/openapi.json"&&B.method==="GET")return T(Vo(),200,Y,{"cache-control":"public, max-age=300"});let te=B.headers.get("authorization")??"",le=te.startsWith("Bearer ")?te.slice(7).trim():"",X=le?e.identities.verifyToken(le,V):void 0;if(!X)return j("unauthorized","A valid bearer token is required.",401,Y,void 0,{"www-authenticate":'Bearer realm="ts-cloud", error="invalid_token"'});let ce=R.get(X.token.id),Ee=y().getTime(),Re=!ce||Ee-ce.start>=60000?{start:Ee,count:0}:ce;Re.count+=1,R.set(X.token.id,Re);let de=Math.max(0,C-Re.count),Me={"x-ratelimit-limit":String(C),"x-ratelimit-remaining":String(de),"x-ratelimit-reset":String(Math.ceil((Re.start+60000)/1000))};if(Re.count>C)return j("rate_limited","API rate limit exceeded.",429,Y,void 0,{...Me,"retry-after":String(Math.max(1,Math.ceil((Re.start+60000-Ee)/1000)))});try{let ae,Le=async()=>{let G=await B.text();if(G.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);try{return JSON.parse(G)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}},Je=/^\/api\/v1\/projects\/([^/]+)\/environments$/.exec(W.pathname),gt=/^\/api\/v1\/operations\/([^/]+)\/logs(?:\/(stream))?$/.exec(W.pathname),Jt=/^\/api\/v1\/operations\/([^/]+)\/(cancel|retry)$/.exec(W.pathname),ot=/^\/api\/v1\/previews\/([^/]+)\/(destroy|extend|rebuild)$/.exec(W.pathname),Pt=/^\/api\/v1\/compose-applications\/([^/]+)\/(deploy|redeploy|start|stop|scale|delete)$/.exec(W.pathname),Qt=/^\/api\/v1\/compose-applications\/([^/]+)\/services$/.exec(W.pathname),lt=/^\/api\/v1\/releases\/([^/]+)\/(promote|approve|activate|rollback|health|pin)$/.exec(W.pathname);if(B.method==="GET"&&W.pathname==="/api/v1/projects")ae=Qr(t.listProjects(X),W,Y);else if(B.method==="GET"&&Je)ae=Qr(t.listEnvironments(X,decodeURIComponent(Je[1])),W,Y);else if(B.method==="GET"&&W.pathname==="/api/v1/services"){let G=W.searchParams.get("projectId");if(!G)throw new i("validation_error","projectId is required.",422);ae=Qr(t.listServices(X,G,W.searchParams.get("environmentId")??void 0),W,Y)}else if(B.method==="GET"&&W.pathname==="/api/v1/operations")ae=Qr(t.listOperations(X,W.searchParams.get("projectId")??void 0),W,Y);else if(B.method==="GET"&&W.pathname==="/api/v1/previews"){let G=W.searchParams.get("projectId")??void 0,ue=a.previews.listInstances({projectId:G}).filter((be)=>{try{return t.authorize(X,"deployments:read",{type:"resource",id:be.resourceId}),!0}catch{return!1}}).map((be)=>({...be}));ae=Qr(ue,W,Y)}else if(B.method==="GET"&&W.pathname==="/api/v1/compose-templates")ae=Qr(Br().map((G)=>({...G})),W,Y,["id","version"]);else if(B.method==="GET"&&W.pathname==="/api/v1/releases/capabilities"){let G=String(W.searchParams.get("kind")??"");ae={capabilities:Yr({kind:G,hasHealthGate:W.searchParams.get("health")==="true",replicas:Number(W.searchParams.get("replicas"))||1}),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/releases"){let G=W.searchParams.get("projectId");if(!G)throw new i("validation_error","projectId is required.",422);t.authorize(X,"project:read",{type:"project",id:G});let ue=m.releases.list({projectId:G,environmentId:W.searchParams.get("environmentId")??void 0,resourceId:W.searchParams.get("resourceId")??void 0}).filter((be)=>{try{return t.authorize(X,"deployments:read",{type:"resource",id:be.resourceId}),!0}catch{return!1}}).map((be)=>({...be,artifact:m.releases.getArtifact(be.artifactId),transitions:m.releases.transitions(be.id),approvals:m.releases.approvals(be.id)}));ae=Qr(ue,W,Y)}else if(B.method==="POST"&&W.pathname==="/api/v1/release-artifacts"){let G=await Le();t.authorize(X,"applications:manage",{type:"organization"}),ae={artifact:m.releases.registerArtifact({organizationId:X.serviceAccount.organizationId,digest:String(G.digest??""),kind:String(G.kind??""),uri:String(G.uri??""),size:Number(G.size),mediaType:typeof G.mediaType==="string"?G.mediaType:void 0,provenance:G.provenance,attestation:G.attestation}),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/releases"){let G=await Le(),ue=String(G.resourceId??"");t.authorize(X,"applications:manage",{type:"resource",id:ue}),ae={release:m.releases.create({organizationId:X.serviceAccount.organizationId,projectId:String(G.projectId??""),environmentId:String(G.environmentId??""),resourceId:ue,artifactId:String(G.artifactId??""),kind:String(G.kind??""),sourceSha:typeof G.sourceSha==="string"?G.sourceSha:void 0,config:G.config??{},manifest:G.manifest??{},provenance:G.provenance,strategy:String(G.strategy??"atomic"),healthGate:G.healthGate,hooks:G.hooks,drainSeconds:Number(G.drainSeconds)||void 0,graceSeconds:Number(G.graceSeconds)||void 0,automaticRollback:G.automaticRollback!==!1,actorId:X.actor.id,trigger:typeof G.trigger==="string"?G.trigger:"api",approvalRequired:G.approvalRequired===!0,replicas:Number(G.replicas)||void 0}),requestId:Y}}else if(B.method==="GET"&&/^\/api\/v1\/releases\/[^/]+$/.test(W.pathname)){let G=decodeURIComponent(W.pathname.split("/").at(-1)),ue=m.releases.get(G);if(!ue)throw new i("not_found","Release was not found.",404);t.authorize(X,"deployments:read",{type:"resource",id:ue.resourceId}),ae={release:ue,artifact:m.releases.getArtifact(ue.artifactId),transitions:m.releases.transitions(G),approvals:m.releases.approvals(G),requestId:Y}}else if(B.method==="POST"&&lt){let G=m.releases.get(decodeURIComponent(lt[1]));if(!G)throw new i("not_found","Release was not found.",404);let ue=await Le(),be=lt[2];if(be==="promote"){let De=String(ue.targetResourceId??"");t.authorize(X,"deployments:create",{type:"resource",id:De}),ae={release:m.releases.promote(G.id,{targetEnvironmentId:String(ue.targetEnvironmentId??""),targetResourceId:De,config:ue.config??{},strategy:ue.strategy,healthGate:ue.healthGate,actorId:X.actor.id,approvalRequired:ue.approvalRequired===!0}),requestId:Y}}else if(be==="approve")t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={release:m.releases.approve(G.id,{actorId:X.actor.id,decision:ue.decision==="rejected"?"rejected":"approved",comment:typeof ue.comment==="string"?ue.comment:void 0}),requestId:Y};else if(be==="activate")t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={operation:t.operation(m.enqueueActivation(G,{actorId:X.actor.id})),requestId:Y};else if(be==="rollback")t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={operation:t.operation(m.enqueueRollback(G,{actorId:X.actor.id,targetReleaseId:typeof ue.targetReleaseId==="string"?ue.targetReleaseId:void 0})),requestId:Y};else if(be==="health"){t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId});let De=m.completeHealthGate(G.id,{healthy:ue.healthy===!0,operationId:typeof ue.operationId==="string"?ue.operationId:void 0,health:ue.health,message:typeof ue.message==="string"?ue.message:void 0});ae={release:De.release,rollbackOperation:De.rollbackOperation?t.operation(De.rollbackOperation):void 0,requestId:Y}}else t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={release:m.releases.pin(G.id,ue.pinned!==!1,typeof ue.reason==="string"?ue.reason:void 0),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/compose-applications"){let G=W.searchParams.get("projectId");if(!G)throw new i("validation_error","projectId is required.",422);t.authorize(X,"project:read",{type:"project",id:G});let ue=l.applications.list({projectId:G,environmentId:W.searchParams.get("environmentId")??void 0}).filter((be)=>{try{return t.authorize(X,"deployments:read",{type:"resource",id:be.resourceId}),!0}catch{return!1}}).map((be)=>({...be,services:l.applications.services(be.id)}));ae=Qr(ue,W,Y)}else if(B.method==="POST"&&W.pathname==="/api/v1/compose-applications/preview"){let G=await Le(),ue=String(G.projectId??"");t.authorize(X,"project:read",{type:"project",id:ue}),ae={result:l.applications.preview(String(G.source??""),{name:String(G.name??""),slug:typeof G.slug==="string"?G.slug:void 0,projectId:ue,environmentId:String(G.environmentId??"")}),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/compose-applications"){let G=await Le(),ue=String(G.projectId??"");t.authorize(X,"applications:manage",{type:"environment",id:String(G.environmentId??"")});let be={name:String(G.name??""),slug:typeof G.slug==="string"?G.slug:void 0,projectId:ue,environmentId:String(G.environmentId??""),createdByActorId:X.actor.id},De=typeof G.templateId==="string"?l.applications.fromTemplate(G.templateId,G.inputs&&typeof G.inputs==="object"&&!Array.isArray(G.inputs)?G.inputs:{},{...be,version:typeof G.templateVersion==="string"?G.templateVersion:void 0}):l.applications.import(String(G.source??""),be);ae={application:De.application,diagnostics:De.parsed.diagnostics,requestId:Y}}else if(B.method==="GET"&&Qt){let G=l.applications.get(decodeURIComponent(Qt[1]));if(!G)throw new i("not_found","Compose application was not found.",404);t.authorize(X,"deployments:read",{type:"resource",id:G.resourceId}),ae={application:G,services:l.applications.services(G.id),requestId:Y}}else if(B.method==="POST"&&Pt){let G=l.applications.get(decodeURIComponent(Pt[1]));if(!G)throw new i("not_found","Compose application was not found.",404);let ue=Pt[2],be=await Le();t.authorize(X,ue==="delete"||ue==="stop"?"deployments:cancel":"deployments:create",{type:"resource",id:G.resourceId}),ae={operation:t.operation(l.enqueue(G,ue,{actorId:X.actor.id,service:typeof be.service==="string"?be.service:void 0,replicas:Number.isFinite(Number(be.replicas))?Number(be.replicas):void 0,removeVolumes:be.removeVolumes===!0,confirmation:typeof be.confirm==="string"?be.confirm:void 0})),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/preview-definitions"){let G=W.searchParams.get("projectId");if(!G)throw new i("validation_error","projectId is required.",422);t.authorize(X,"project:read",{type:"project",id:G}),ae=Qr(a.previews.listDefinitions(G).map((ue)=>({...ue})),W,Y)}else if(B.method==="POST"&&W.pathname==="/api/v1/preview-definitions"){let G=await Le();t.authorize(X,"config:write",{type:"resource",id:String(G.resourceId??"")}),ae={definition:a.previews.createDefinition({...G,projectId:String(G.projectId??""),resourceId:String(G.resourceId??""),baseEnvironmentId:String(G.baseEnvironmentId??""),domainPattern:String(G.domainPattern??""),createdByActorId:X.actor.id}),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/previews"){let G=await Le(),ue=a.previews.getDefinition(String(G.definitionId??""));if(!ue)throw new i("not_found","Preview definition was not found.",404);t.authorize(X,"deployments:create",{type:"resource",id:ue.resourceId});let be=a.previews.upsert({definitionId:ue.id,sourceProvider:"api",repository:typeof G.repository==="string"?G.repository:"api",branch:String(G.branch??""),pullRequestNumber:Number(G.pullRequestNumber)||void 0,fork:G.fork===!0,commitSha:String(G.commitSha??""),createdByActorId:X.actor.id});ae={preview:be.preview,operation:t.operation(a.enqueueDeploy(be.preview,{created:be.created,actorId:X.actor.id})),requestId:Y}}else if(B.method==="POST"&&ot){let G=a.previews.getInstance(decodeURIComponent(ot[1]));if(!G)throw new i("not_found","Preview was not found.",404);let ue=await Le(),be=ot[2];if(be==="destroy"){if(t.authorize(X,"deployments:cancel",{type:"resource",id:G.resourceId}),ue.confirm!==G.name)throw new i("confirmation_required",`Type ${G.name} to confirm preview teardown.`,409);ae={operation:t.operation(a.enqueueDestroy(G,"api",X.actor.id)),requestId:Y}}else if(be==="extend")t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={preview:a.previews.extend(G.id,Number(ue.hours)),requestId:Y};else t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={operation:t.operation(a.enqueueDeploy(G,{actorId:X.actor.id,reason:"manual_rebuild"})),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/previews/cleanup"){t.authorize(X,"automation:manage",{type:"organization"});let G=await Le();if(!G.dryRun&&G.confirm!=="cleanup previews")throw new i("confirmation_required","Type cleanup previews to confirm preview cleanup.",409);ae={...a.cleanup({dryRun:G.dryRun===!0,maxAgeHours:Number(G.maxAgeHours)||void 0,keepCount:Number(G.keepCount)||void 0,actorId:X.actor.id}),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/queue"){let G=W.searchParams.get("projectId")??void 0,ue=W.searchParams.get("state"),be=r.list({projectId:G,state:["queued","running","succeeded","failed","cancelled","timed_out"].includes(ue)?ue:void 0,limit:500}).filter((De)=>{let mt=De.operation.resourceId?{type:"resource",id:De.operation.resourceId}:De.operation.environmentId?{type:"environment",id:De.operation.environmentId}:De.operation.projectId?{type:"project",id:De.operation.projectId}:{type:"organization"};try{return t.authorize(X,"deployments:read",mt),!0}catch{return!1}}).map((De)=>({...t.operation(De.operation),queue:De.job,approximatePosition:De.approximatePosition}));ae=Qr(be,W,Y)}else if(B.method==="GET"&&W.pathname==="/api/v1/queue/settings")t.authorize(X,"deployments:read",X.token.scope),ae={concurrency:r.limits,requestId:Y};else if(B.method==="PATCH"&&W.pathname==="/api/v1/queue/settings"){t.authorize(X,"automation:manage",{type:"organization"});let G=await Le();if(G.confirm!=="update queue limits")throw new i("confirmation_required","Type update queue limits to confirm production concurrency changes.",409);ae={concurrency:r.configureConcurrency(G.concurrency??{},{organizationId:X.serviceAccount.organizationId,actorId:X.actor.id}),requestId:Y}}else if(B.method==="DELETE"&&W.pathname==="/api/v1/queue/history"){t.authorize(X,"automation:manage",{type:"organization"});let G=await Le();if(G.confirm!=="clear completed")throw new i("confirmation_required","Type clear completed to confirm queue retention cleanup.",409);ae={deleted:r.clearCompleted({before:typeof G.before==="string"?G.before:void 0,actorId:X.actor.id,projectId:typeof G.projectId==="string"?G.projectId:void 0}),requestId:Y}}else if(B.method==="GET"&&gt){let G=e.controlPlane.getOperation(decodeURIComponent(gt[1]));if(!G)throw new i("not_found","Operation was not found.",404);let ue=G.resourceId?{type:"resource",id:G.resourceId}:G.environmentId?{type:"environment",id:G.environmentId}:G.projectId?{type:"project",id:G.projectId}:{type:"organization"};t.authorize(X,"deployments:read",ue);let be=B.headers.get("last-event-id")?.trim(),De=Number(be||W.searchParams.get("after")||0);if(gt[2]==="stream"){let _t=new TextEncoder,Ne=De,yt,ut=!1,Ke=new ReadableStream({start(zr){let Ss=()=>{if(ut)return;if(!e.identities.verifyToken(le,V)){if(ut=!0,yt)clearInterval(yt);zr.close();return}let Yn=r.logs(G.id,{after:Ne,limit:500});for(let or of Yn)Ne=or.sequence,zr.enqueue(_t.encode(`id: ${or.sequence}
+`)){let l=a.trim().match(/^([a-f0-9]{40,64})\s+(.+)$/i);if(!l||!l[2].startsWith(t)||l[2].endsWith("^{}"))continue;let m=l[2].slice(t.length);r.set(m,{name:m,commitSha:l[1]})}return[...r.values()].sort((a,l)=>a.name.localeCompare(l.name))}async function Ho(e,t={}){let r=Kf(e,t.deployKey),a=await No(["ls-remote","--heads","--tags","--",r],r,t);return{branches:Hf(a,"refs/heads/"),tags:Hf(a,"refs/tags/")}}async function Go(e,t={}){let r=Kf(e.remote,t.deployKey),a=eI(e.destination),l=e.ref?.trim()||e.binding.defaultBranch;if(!/^[A-Za-z0-9._/-]{1,255}$/.test(l)||l.startsWith("-")||l.includes(".."))throw Error("Git ref contains unsupported characters");let m=["clone","--no-tags","--single-branch","--branch",l],h=[...new Set(e.sparsePaths??[])];if(h.some((R)=>!R||R.startsWith("/")||R.split("/").includes("..")||/[\0\r\n]/.test(R)))throw Error("Sparse checkout paths must stay inside the repository");if(h.length)m.push("--filter=blob:none","--no-checkout");if(e.binding.cloneDepth)m.push("--depth",String(e.binding.cloneDepth));if(e.binding.submodules)m.push("--recurse-submodules","--shallow-submodules");if(m.push("--",r,a),await No(m,r,t),h.length)await No(["-C",a,"sparse-checkout","set","--cone","--",...h],r,t),await No(["-C",a,"checkout","--force"],r,t);if(e.commitSha){if(!/^[a-f0-9]{40,64}$/i.test(e.commitSha))throw Error("Expected source commit must be an immutable 40-64 character SHA");await No(["-C",a,"fetch","--no-tags","--depth","1","origin",e.commitSha],r,t),await No(["-C",a,"checkout","--detach","--force",e.commitSha],r,t)}let S=(await No(["-C",a,"rev-parse","HEAD"],r,t)).trim();if(!/^[a-f0-9]{40,64}$/i.test(S))throw Error("Git clone did not produce a valid commit SHA");if(e.commitSha&&S.toLowerCase()!==e.commitSha.toLowerCase())throw Error(`Git checkout resolved ${S} instead of the requested immutable commit`);return{directory:e.binding.monorepoRoot==="."?a:Lc(a,e.binding.monorepoRoot),commitSha:S}}function nc(e){return["github","gitlab","bitbucket","gitea"].includes(e)}async function qo(e,t,r){let a=e.getConnection(t);if(!a||["disconnected","expired"].includes(a.status))throw Error("Active source connection was not found");try{if(nc(a.provider)){let h=await Ze(a,e.getCredential(a.id)).testConnection();return e.updateHealth(a.id,{status:h.ok?"healthy":"degraded",message:h.message,tested:!0,grantedScopes:h.scopes})}let l=r?e.getRepository(r):e.listRepositories(a.id,void 0,1)[0];if(!l)return e.updateHealth(a.id,{status:"degraded",message:"Add a repository URL before testing this generic connection.",tested:!0});let m=a.provider==="generic_ssh"?e.listBindings({connectionId:a.id}).map((h)=>h.deployKeyId).filter(Boolean).map((h)=>e.getDeployKey(h)).find(Boolean):void 0;return await Ho(l.cloneUrl,{credential:e.getCredential(a.id),deployKey:m?{...m,privateKey:e.getDeployPrivateKey(m.id)}:void 0}),e.updateHealth(a.id,{status:"healthy",message:"Git repository access is healthy.",tested:!0})}catch(l){return e.updateHealth(a.id,{status:"degraded",message:l instanceof Error?l.message:"Connection test failed",tested:!0})}}async function Gi(e,t,r={}){let a=e.getConnection(t);if(!a||!nc(a.provider)||["disconnected","expired"].includes(a.status))throw Error("A hosted active source connection is required for repository discovery");let l=Ze(a,e.getCredential(a.id)),m=[],h;for(let S=0;S<Math.min(20,Math.max(1,r.maxPages??10));S++){let R=await l.listRepositories({cursor:h,search:r.search,limit:100});for(let y of R.repositories)m.push(e.upsertRepository({connectionId:a.id,...y}));if(h=R.nextCursor,!h)break}return e.updateHealth(a.id,{status:"healthy",message:`${m.length} repositories synchronized.`,synced:!0}),m}async function qi(e,t){let r=e.getConnection(t.connectionId);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");if(nc(r.provider)){let S=Ze(r,e.getCredential(r.id));return t.type==="tags"?S.listTags(t.repository,t):S.listBranches(t.repository,t)}let a=t.repositoryId?e.getRepository(t.repositoryId):e.listRepositories(r.id).find((S)=>S.fullName===t.repository);if(!a||a.connectionId!==r.id)throw Error("Generic repository metadata was not found");let l=t.deployKeyId?e.getDeployKey(t.deployKeyId):void 0;if(l&&l.connectionId!==r.id)throw Error("Deploy key does not belong to this connection");let m=await Ho(a.cloneUrl,{credential:e.getCredential(r.id),deployKey:l?{...l,privateKey:e.getDeployPrivateKey(l.id)}:void 0});return{refs:(t.type==="tags"?m.tags:m.branches).slice(0,Math.min(500,t.limit??100))}}async function Zr(e,t,r){let a=e.getWebhook(t),l=a?e.getConnection(a.connectionId):void 0;if(!a||!l||["disconnected","expired"].includes(l.status))throw Error("Active source webhook was not found");let m=Zt(r,{...a,endpointToken:e.getWebhookEndpointToken(a.id)});if(!nc(l.provider))return e.updateWebhookState(a.id,{status:"healthy",healthMessage:"Manual webhook endpoint is ready.",reconciled:!0});try{let h=Ze(l,e.getCredential(l.id)),S=e.getWebhookSecret(a.id),R=a.providerWebhookId?await h.updateWebhook(a.repositoryFullName,a.providerWebhookId,{url:m,secret:S,events:a.events}):await h.createWebhook(a.repositoryFullName,{url:m,secret:S,events:a.events});return e.updateWebhookState(a.id,{providerWebhookId:R.providerWebhookId,status:R.active?"healthy":"degraded",healthMessage:R.active?"Provider webhook is synchronized.":"Provider webhook exists but is inactive.",reconciled:!0})}catch(h){return e.updateWebhookState(a.id,{status:"degraded",healthMessage:h instanceof Error?h.message:"Webhook reconciliation failed",reconciled:!0})}}async function vl(e,t){let r=e.getWebhook(t),a=r?e.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Source webhook was not found");if(nc(a.provider)&&r.providerWebhookId&&!["disconnected","expired"].includes(a.status))await Ze(a,e.getCredential(a.id)).deleteWebhook(r.repositoryFullName,r.providerWebhookId);return e.updateWebhookState(r.id,{status:"disabled",healthMessage:"Webhook disabled."})}var Vi="1.6.0";function Vo(){let e={type:"object",required:["error"],properties:{error:{type:"object",required:["code","message","requestId"],properties:{code:{type:"string"},message:{type:"string"},requestId:{type:"string",format:"uuid"},details:{}}}}},t=(a)=>({type:"object",required:["data","page","requestId"],properties:{data:{type:"array",items:a},page:{type:"object",required:["hasMore"],properties:{nextCursor:{type:"string"},hasMore:{type:"boolean"}}},requestId:{type:"string",format:"uuid"}}}),r=(a)=>({"200":{description:"A stable cursor page.",content:{"application/json":{schema:t(a)}}},default:{$ref:"#/components/responses/Error"}});return{openapi:"3.1.0",info:{title:"ts-cloud API",version:Vi,description:"Additive changes are released within v1. Breaking request or response changes require a new URL version."},servers:[{url:"/"}],security:[{bearerAuth:[]}],paths:{...lo(),"/api/v1/projects":{get:{operationId:"listProjects",summary:"List accessible projects",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Project"})}},"/api/v1/projects/{projectId}/environments":{get:{operationId:"listEnvironments",summary:"List accessible project environments",parameters:[{$ref:"#/components/parameters/ProjectId"},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Environment"})}},"/api/v1/services":{get:{operationId:"listServices",summary:"List accessible services",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Service"})}},"/api/v1/source/connections":{get:{operationId:"listSourceConnections",summary:"List safe Git connection metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceConnection"})},post:{operationId:"createSourceConnection",summary:"Create an encrypted Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["provider","name","host"],properties:{provider:{type:"string",enum:["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"]},name:{type:"string"},host:{type:"string",format:"uri"},token:{type:"string",writeOnly:!0},repositoryFullName:{type:"string"},repositoryUrl:{type:"string"}}}}}},responses:{"201":{description:"Encrypted connection created."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectSourceConnection",summary:"Preview or safely disconnect a Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["id"],properties:{id:{type:"string"},preview:{type:"boolean"}}}}}},responses:{"200":{description:"Impact preview or disconnected connection."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/repositories":{get:{operationId:"listSourceRepositories",summary:"List or synchronize granted repositories",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"sync",in:"query",schema:{type:"boolean"}},{name:"search",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceRepository"})}},"/api/v1/source/refs":{get:{operationId:"listSourceRefs",summary:"List repository branches or tags",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"repository",in:"query",required:!0,schema:{type:"string"}},{name:"repositoryId",in:"query",schema:{type:"string"}},{name:"type",in:"query",schema:{type:"string",enum:["branches","tags"]}}],responses:{"200":{description:"Provider reference page."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/bindings":{post:{operationId:"createSourceBinding",summary:"Bind a repository to an application",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/SourceBindingRequest"}}}},responses:{"201":{description:"Source binding created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/webhooks":{post:{operationId:"createSourceWebhook",summary:"Create and optionally reconcile a signed webhook",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["connectionId","repositoryFullName","baseUrl"],properties:{connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},baseUrl:{type:"string",format:"uri"},events:{type:"array",items:{type:"string",enum:["push","pull_request"]}},reconcile:{type:"boolean"}}}}}},responses:{"201":{description:"Webhook endpoint created; endpoint is revealed once."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-detections":{post:{operationId:"detectApplication",summary:"Detect bounded application build candidates",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["files"],properties:{files:{type:"array",maxItems:1e4,items:{$ref:"#/components/schemas/DetectionFile"}}}}}}},responses:{"200":{description:"Ranked detection candidates with evidence."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-plans":{post:{operationId:"planApplication",summary:"Validate and normalize an application manifest",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["draft"],properties:{draft:{$ref:"#/components/schemas/ApplicationInput"},suppliedSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}}}}}},responses:{"200":{description:"Validated plan, config patch, capabilities, costs, and missing secret names."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-drafts":{get:{operationId:"listApplicationDrafts",summary:"List resumable secret-free drafts",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/ApplicationDraft"})},post:{operationId:"createApplicationDraft",summary:"Create a resumable application draft",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/ApplicationDraftCreateRequest"}}}},responses:{"201":{description:"Draft created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateApplicationDraft",summary:"Optimistically update a draft",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/ApplicationDraftCreateRequest"},{type:"object",required:["id","version","step"],properties:{id:{type:"string"},version:{type:"integer",minimum:1}}}]}}}},responses:{"200":{description:"Updated draft."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/applications":{post:{operationId:"createApplication",summary:"Confirm and queue an application plan",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["draftId","version","confirmEnvironment"],properties:{draftId:{type:"string"},version:{type:"integer",minimum:1},confirmEnvironment:{type:"string",description:"Exact target environment slug."}}}}}},responses:{"202":{description:"Application operation queued; identical requests replay safely."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-artifacts":{post:{operationId:"uploadApplicationArtifact",summary:"Inspect and store a bounded ZIP or TAR source artifact",parameters:[{name:"X-Project-Id",in:"header",required:!0,schema:{type:"string"}},{name:"X-Artifact-Filename",in:"header",required:!0,schema:{type:"string"}}],requestBody:{required:!0,content:{"application/octet-stream":{schema:{type:"string",format:"binary",maxLength:104857600}}}},responses:{"201":{description:"Deduplicated artifact metadata; archive contents are never executed."},"413":{$ref:"#/components/responses/Error"},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/registry-connections":{get:{operationId:"listRegistryConnections",summary:"List safe private-registry metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/RegistryConnection"})},post:{operationId:"createRegistryConnection",summary:"Create an encrypted private-registry connection",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/RegistryConnectionRequest"}}}},responses:{"201":{description:"Encrypted registry connection created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateRegistryConnection",summary:"Test access or rotate write-only credentials",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/RegistryConnectionRequest"},{type:"object",required:["id","action"],properties:{id:{type:"string"},action:{type:"string",enum:["test","rotate"]},image:{type:"string"}}}]}}}},responses:{"200":{description:"Safe connection health metadata."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectRegistryConnection",summary:"Disconnect and erase registry credentials",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["id"],properties:{id:{type:"string"}}}}}},responses:{"200":{description:"Credentials erased and connection disconnected."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue":{get:{operationId:"listQueue",summary:"List authorized durable operations and blocking metadata",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"state",in:"query",schema:{type:"string",enum:["queued","running","succeeded","failed","cancelled","timed_out"]}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/QueueOperation"})}},"/api/v1/preview-definitions":{get:{operationId:"listPreviewDefinitions",summary:"List preview policies",responses:r({type:"object"})},post:{operationId:"createPreviewDefinition",summary:"Configure bounded preview policy",responses:{"200":{description:"Preview definition created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews":{get:{operationId:"listPreviews",summary:"List authorized persistent previews",responses:r({type:"object"})},post:{operationId:"createPreview",summary:"Create or update one immutable preview identity",responses:{"200":{description:"Preview deployment queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/destroy":{post:{operationId:"destroyPreview",summary:"Confirm tagged preview teardown",responses:{"200":{description:"Teardown queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/extend":{post:{operationId:"extendPreview",summary:"Extend preview TTL",responses:{"200":{description:"Expiry extended."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/rebuild":{post:{operationId:"rebuildPreview",summary:"Rebuild the exact recorded commit",responses:{"200":{description:"Rebuild queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/cleanup":{post:{operationId:"cleanupPreviews",summary:"Dry-run or queue TTL/keep-count teardown",responses:{"200":{description:"Cleanup plan or operations."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-templates":{get:{operationId:"listComposeTemplates",summary:"List pinned verified application templates",responses:r({type:"object"})}},"/api/v1/compose-applications":{get:{operationId:"listComposeApplications",summary:"List authorized multi-service applications",responses:r({type:"object"})},post:{operationId:"createComposeApplication",summary:"Import Compose or materialize a template",responses:{"200":{description:"Editable normalized application."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/preview":{post:{operationId:"previewComposeApplication",summary:"Parse and diagnose Compose without mutation",responses:{"200":{description:"Normalized preview and actionable diagnostics."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/services":{get:{operationId:"listComposeServices",summary:"Inspect per-service desired and observed state",responses:{"200":{description:"Service topology and status."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/{action}":{post:{operationId:"operateComposeApplication",summary:"Deploy, redeploy, start, stop, scale, or delete through the durable queue",responses:{"200":{description:"Scoped operation queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/release-artifacts":{post:{operationId:"createReleaseArtifact",summary:"Register a verified content-addressed artifact",responses:{"200":{description:"Artifact identity registered."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases":{get:{operationId:"listReleases",summary:"List unified authorized release history",responses:r({type:"object"})},post:{operationId:"createRelease",summary:"Create an immutable release from an existing artifact",responses:{"200":{description:"Release record created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/capabilities":{get:{operationId:"getReleaseCapabilities",summary:"Explain supported strategies, capacity, cost, and rollback",responses:{"200":{description:"Provider-aware strategy capabilities."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}":{get:{operationId:"getRelease",summary:"Inspect provenance, approvals, health, and transitions",responses:{"200":{description:"Release detail."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}/{action}":{post:{operationId:"operateRelease",summary:"Promote, approve, activate, roll back, report health, or pin",responses:{"200":{description:"Release lifecycle updated."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/settings":{get:{operationId:"getQueueSettings",summary:"Get effective concurrency limits",responses:{"200":{description:"Queue concurrency settings."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateQueueSettings",summary:"Confirm and audit production concurrency changes",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm","concurrency"],properties:{confirm:{const:"update queue limits"},concurrency:{$ref:"#/components/schemas/QueueConcurrency"}}}}}},responses:{"200":{description:"Updated effective limits."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/history":{delete:{operationId:"clearQueueHistory",summary:"Clear terminal jobs whose retention has elapsed",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm"],properties:{confirm:{const:"clear completed"},before:{type:"string",format:"date-time"},projectId:{type:"string"}}}}}},responses:{"200":{description:"Eligible history cleared with an audit event."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs":{get:{operationId:"listOperationLogs",summary:"Resume ordered sanitized operation logs from a cursor",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:{"200":{description:"Ordered log chunks and next cursor."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs/stream":{get:{operationId:"streamOperationLogs",summary:"Stream authorized operation logs with Last-Event-ID resume",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"Last-Event-ID",in:"header",schema:{type:"integer",minimum:0}}],responses:{"200":{description:"Server-sent log and completion events.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/cancel":{post:{operationId:"cancelOperation",summary:"Cancel queued work or request cooperative running cancellation",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{content:{"application/json":{schema:{type:"object"}}}},responses:{"200":{description:"Cancellation state recorded."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/retry":{post:{operationId:"retryOperation",summary:"Retry an allow-listed failure class within the attempt limit",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["errorClass"],properties:{errorClass:{type:"string"},delayMs:{type:"integer",minimum:0}}}}}},responses:{"200":{description:"Retry queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/deployments":{post:{operationId:"createDeployment",summary:"Queue a deployment",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/DeploymentRequest"}}}},responses:{"202":{description:"Queued operation.",content:{"application/json":{schema:{$ref:"#/components/schemas/OperationResponse"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations":{get:{operationId:"listOperations",summary:"List scoped operations",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Operation"})}},"/api/v1/events":{get:{operationId:"listEvents",summary:"List scoped audit events",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:r({$ref:"#/components/schemas/Event"})}},"/api/v1/events/stream":{get:{operationId:"streamEvents",summary:"Stream scoped audit events",responses:{"200":{description:"Authenticated server-sent event stream.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/openapi.json":{get:{operationId:"getOpenApi",summary:"Get the OpenAPI contract",security:[],responses:{"200":{description:"OpenAPI 3.1 contract."}}}}},components:{securitySchemes:{bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"tsc_v1"}},parameters:{Limit:{name:"limit",in:"query",schema:{type:"integer",minimum:1,maximum:100,default:50}},Cursor:{name:"cursor",in:"query",schema:{type:"string"}},ProjectId:{name:"projectId",in:"path",required:!0,schema:{type:"string"}},OperationId:{name:"operationId",in:"path",required:!0,schema:{type:"string"}}},responses:{Error:{description:"Stable error envelope.",content:{"application/json":{schema:e}}}},schemas:{Project:{type:"object",required:["id","slug","name"],properties:{id:{type:"string"},slug:{type:"string"},name:{type:"string"},description:{type:"string"}}},Environment:{type:"object",required:["id","projectId","slug","name","kind"],properties:{id:{type:"string"},projectId:{type:"string"},slug:{type:"string"},name:{type:"string"},kind:{type:"string"},region:{type:"string"}}},Service:{type:"object",required:["id","projectId","kind","slug","name"],properties:{id:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},kind:{type:"string"},slug:{type:"string"},name:{type:"string"},metadata:{type:"object",additionalProperties:!0}}},SourceConnection:{type:"object",required:["id","provider","name","host","status","credentialConfigured"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},status:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},grantedScopes:{type:"array",items:{type:"string"}}}},SourceRepository:{type:"object",required:["id","connectionId","fullName","cloneUrl","defaultBranch"],properties:{id:{type:"string"},connectionId:{type:"string"},fullName:{type:"string"},cloneUrl:{type:"string"},defaultBranch:{type:"string"},visibility:{type:"string"},archived:{type:"boolean"}}},SourceBindingRequest:{type:"object",additionalProperties:!1,required:["projectId","connectionId","repositoryFullName"],properties:{projectId:{type:"string"},environmentId:{type:"string"},resourceId:{type:"string"},connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},defaultBranch:{type:"string"},branchRule:{type:"string"},tagRule:{type:"string"},monorepoRoot:{type:"string"},includePaths:{type:"array",items:{type:"string"}},excludePaths:{type:"array",items:{type:"string"}},submodules:{type:"boolean"},cloneDepth:{type:"integer",minimum:1},deployKeyId:{type:"string"},autoDeploy:{type:"boolean"},pullRequestPreviews:{type:"boolean"}}},DetectionFile:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string"},size:{type:"integer",minimum:0},content:{type:"string",maxLength:262144}}},ApplicationInput:{type:"object",additionalProperties:!1,required:["schemaVersion","name","slug","projectId","environmentId","source","build","runtime"],properties:{schemaVersion:{const:1},name:{type:"string"},slug:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},source:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["git","local","artifact","image"]}},additionalProperties:!0},build:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["dockerfile","buildpack","static","server","serverless","prebuilt_image"]},secretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}},additionalProperties:!0},runtime:{type:"object",required:["architecture","target"],properties:{architecture:{type:"string",enum:["x86_64","arm64"]},target:{type:"string",enum:["server","serverless","container"]},port:{type:"integer",minimum:1,maximum:65535},healthCheck:{type:"object",additionalProperties:!0}},additionalProperties:!0},environment:{type:"object",additionalProperties:{oneOf:[{type:"string"},{type:"object",additionalProperties:!1,required:["secretRef"],properties:{secretRef:{type:"string"}}}]}},requiredSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}},domain:{type:"object",properties:{hostname:{type:"string"},path:{type:"string"},tls:{type:"boolean"}}}}},ApplicationDraftCreateRequest:{type:"object",additionalProperties:!1,required:["projectId","draft"],properties:{projectId:{type:"string"},name:{type:"string"},draft:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string",enum:["source","build","runtime","environment","domain","review"]},suppliedSecretNames:{type:"array",uniqueItems:!0,description:"Names only; values must use the secrets boundary.",items:{type:"string"}}}},ApplicationDraft:{type:"object",required:["id","projectId","input","step","status","version"],properties:{id:{type:"string"},projectId:{type:"string"},input:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string"},suppliedSecretNames:{type:"array",items:{type:"string"}},status:{type:"string",enum:["draft","ready","applied"]},version:{type:"integer"},createdAt:{type:"string",format:"date-time"},updatedAt:{type:"string",format:"date-time"}}},RegistryConnectionRequest:{type:"object",properties:{provider:{type:"string",enum:["docker_hub","ghcr","ecr","gcr","generic"]},name:{type:"string"},host:{type:"string"},username:{type:"string",writeOnly:!0},password:{type:"string",writeOnly:!0},token:{type:"string",writeOnly:!0},credentialExpiresAt:{type:"string",format:"date-time"},expiresAt:{type:"string",format:"date-time"}}},RegistryConnection:{type:"object",required:["id","provider","name","host","credentialConfigured","status","version"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},credentialExpiresAt:{type:"string",format:"date-time"},status:{type:"string",enum:["pending","healthy","degraded","expired","disconnected"]},healthMessage:{type:"string"},lastTestedAt:{type:"string",format:"date-time"},version:{type:"integer"}}},QueueConcurrency:{type:"object",additionalProperties:!1,properties:{project:{type:"integer",minimum:1,maximum:100},environment:{type:"integer",minimum:1,maximum:100},provider:{type:"integer",minimum:1,maximum:100},builds:{type:"integer",minimum:1,maximum:100}}},QueueOperation:{allOf:[{$ref:"#/components/schemas/Operation"},{type:"object",required:["queue"],properties:{queue:{type:"object",required:["maxAttempts","availableAt","timeoutSeconds","retryClasses","resumePolicy","cancellationMode","retentionUntil"],properties:{lockKey:{type:"string"},providerKey:{type:"string"},buildSlot:{type:"boolean"},maxAttempts:{type:"integer"},availableAt:{type:"string",format:"date-time"},timeoutSeconds:{type:"integer"},heartbeatAt:{type:"string",format:"date-time"},currentStep:{type:"string"},blockedReason:{type:"string"},retryClasses:{type:"array",items:{type:"string"}},resumePolicy:{type:"string",enum:["fail","requeue"]},cancellationMode:{type:"string",enum:["cooperative","provider_non_cancellable"]},retentionUntil:{type:"string",format:"date-time"}}},approximatePosition:{type:"object",properties:{ahead:{type:"integer"},precision:{const:"bounded"}}}}}]},DeploymentRequest:{type:"object",additionalProperties:!1,required:["projectId","environmentId"],properties:{projectId:{type:"string"},environmentId:{type:"string"},serviceId:{type:"string"},action:{type:"string",enum:["deploy","rollback"],default:"deploy"},revision:{type:"string"}}},Operation:{type:"object",required:["id","state","kind","correlationId","createdAt"],properties:{id:{type:"string"},state:{type:"string"},kind:{type:"string"},correlationId:{type:"string"},createdAt:{type:"string",format:"date-time"}}},OperationResponse:{type:"object",required:["operation","idempotentReplay","requestId"],properties:{operation:{$ref:"#/components/schemas/Operation"},idempotentReplay:{type:"boolean"},requestId:{type:"string",format:"uuid"}}},Event:{type:"object",required:["id","sequence","type","level","correlationId","createdAt"],properties:{id:{type:"string"},sequence:{type:"integer"},type:{type:"string"},level:{type:"string"},correlationId:{type:"string"},payload:{},createdAt:{type:"string",format:"date-time"}}}}}}}function iI(e){return Buffer.from(JSON.stringify(e)).toString("base64url")}function oI(e){if(!e)return;try{let t=JSON.parse(Buffer.from(e,"base64url").toString("utf8"));return t&&typeof t==="object"&&!Array.isArray(t)?t:void 0}catch{return}}function Qr(e,t,r,a=["createdAt","id"]){let l=Math.min(100,Math.max(1,Number(t.searchParams.get("limit"))||50)),m=oI(t.searchParams.get("cursor"));if(t.searchParams.has("cursor")&&!m)throw new i("invalid_cursor","The pagination cursor is invalid.",400);let h=0;if(m){let C=e.findIndex((T)=>a.every((j)=>T[j]===m[j]));if(C<0)throw new i("invalid_cursor","The pagination cursor is no longer available.",400);h=C+1}let S=e.slice(h,h+l),R=h+l<e.length,y=S.at(-1);return{data:S,page:{hasMore:R,nextCursor:R&&y?iI(Object.fromEntries(a.map((C)=>[C,y[C]]))):void 0},requestId:r}}function jo(e){let t=new Ri(e.controlPlane,e.identities),r=new c(e.controlPlane),a=new _r(e.controlPlane),l=new xr(e.controlPlane),m=new It(e.controlPlane),h=e.spend?.store??new yi(e.controlPlane,{now:e.now}),S={store:h,service:e.spend?.service??new Ht(h)},R=new Map,y=e.now??(()=>new Date),C=e.rateLimit??120,T=(B,V,W,Y={})=>new Response(JSON.stringify(B),{status:V,headers:{"content-type":"application/json; charset=utf-8","cache-control":"no-store","x-request-id":W,"x-api-version":Vi,...Y}}),j=(B,V,W,Y,te,le)=>T({error:{code:B,message:V,requestId:Y,details:te}},W,Y,le);return async(B,V)=>{let W=new URL(B.url);if(!W.pathname.startsWith("/api/v1"))return;let Y=crypto.randomUUID();if(W.pathname==="/api/v1/openapi.json"&&B.method==="GET")return T(Vo(),200,Y,{"cache-control":"public, max-age=300"});let te=B.headers.get("authorization")??"",le=te.startsWith("Bearer ")?te.slice(7).trim():"",X=le?e.identities.verifyToken(le,V):void 0;if(!X)return j("unauthorized","A valid bearer token is required.",401,Y,void 0,{"www-authenticate":'Bearer realm="ts-cloud", error="invalid_token"'});let ce=R.get(X.token.id),Ee=y().getTime(),Re=!ce||Ee-ce.start>=60000?{start:Ee,count:0}:ce;Re.count+=1,R.set(X.token.id,Re);let de=Math.max(0,C-Re.count),Me={"x-ratelimit-limit":String(C),"x-ratelimit-remaining":String(de),"x-ratelimit-reset":String(Math.ceil((Re.start+60000)/1000))};if(Re.count>C)return j("rate_limited","API rate limit exceeded.",429,Y,void 0,{...Me,"retry-after":String(Math.max(1,Math.ceil((Re.start+60000-Ee)/1000)))});try{let ae,Le=async()=>{let G=await B.text();if(G.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);try{return JSON.parse(G)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}},Je=/^\/api\/v1\/projects\/([^/]+)\/environments$/.exec(W.pathname),gt=/^\/api\/v1\/operations\/([^/]+)\/logs(?:\/(stream))?$/.exec(W.pathname),Jt=/^\/api\/v1\/operations\/([^/]+)\/(cancel|retry)$/.exec(W.pathname),ot=/^\/api\/v1\/previews\/([^/]+)\/(destroy|extend|rebuild)$/.exec(W.pathname),Pt=/^\/api\/v1\/compose-applications\/([^/]+)\/(deploy|redeploy|start|stop|scale|delete)$/.exec(W.pathname),Qt=/^\/api\/v1\/compose-applications\/([^/]+)\/services$/.exec(W.pathname),lt=/^\/api\/v1\/releases\/([^/]+)\/(promote|approve|activate|rollback|health|pin)$/.exec(W.pathname);if(B.method==="GET"&&W.pathname==="/api/v1/projects")ae=Qr(t.listProjects(X),W,Y);else if(B.method==="GET"&&Je)ae=Qr(t.listEnvironments(X,decodeURIComponent(Je[1])),W,Y);else if(B.method==="GET"&&W.pathname==="/api/v1/services"){let G=W.searchParams.get("projectId");if(!G)throw new i("validation_error","projectId is required.",422);ae=Qr(t.listServices(X,G,W.searchParams.get("environmentId")??void 0),W,Y)}else if(B.method==="GET"&&W.pathname==="/api/v1/operations")ae=Qr(t.listOperations(X,W.searchParams.get("projectId")??void 0),W,Y);else if(B.method==="GET"&&W.pathname==="/api/v1/previews"){let G=W.searchParams.get("projectId")??void 0,ue=a.previews.listInstances({projectId:G}).filter((be)=>{try{return t.authorize(X,"deployments:read",{type:"resource",id:be.resourceId}),!0}catch{return!1}}).map((be)=>({...be}));ae=Qr(ue,W,Y)}else if(B.method==="GET"&&W.pathname==="/api/v1/compose-templates")ae=Qr(Br().map((G)=>({...G})),W,Y,["id","version"]);else if(B.method==="GET"&&W.pathname==="/api/v1/releases/capabilities"){let G=String(W.searchParams.get("kind")??"");ae={capabilities:Yr({kind:G,hasHealthGate:W.searchParams.get("health")==="true",replicas:Number(W.searchParams.get("replicas"))||1}),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/releases"){let G=W.searchParams.get("projectId");if(!G)throw new i("validation_error","projectId is required.",422);t.authorize(X,"project:read",{type:"project",id:G});let ue=m.releases.list({projectId:G,environmentId:W.searchParams.get("environmentId")??void 0,resourceId:W.searchParams.get("resourceId")??void 0}).filter((be)=>{try{return t.authorize(X,"deployments:read",{type:"resource",id:be.resourceId}),!0}catch{return!1}}).map((be)=>({...be,artifact:m.releases.getArtifact(be.artifactId),transitions:m.releases.transitions(be.id),approvals:m.releases.approvals(be.id)}));ae=Qr(ue,W,Y)}else if(B.method==="POST"&&W.pathname==="/api/v1/release-artifacts"){let G=await Le();t.authorize(X,"applications:manage",{type:"organization"}),ae={artifact:m.releases.registerArtifact({organizationId:X.serviceAccount.organizationId,digest:String(G.digest??""),kind:String(G.kind??""),uri:String(G.uri??""),size:Number(G.size),mediaType:typeof G.mediaType==="string"?G.mediaType:void 0,provenance:G.provenance,attestation:G.attestation}),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/releases"){let G=await Le(),ue=String(G.resourceId??"");t.authorize(X,"applications:manage",{type:"resource",id:ue}),ae={release:m.releases.create({organizationId:X.serviceAccount.organizationId,projectId:String(G.projectId??""),environmentId:String(G.environmentId??""),resourceId:ue,artifactId:String(G.artifactId??""),kind:String(G.kind??""),sourceSha:typeof G.sourceSha==="string"?G.sourceSha:void 0,config:G.config??{},manifest:G.manifest??{},provenance:G.provenance,strategy:String(G.strategy??"atomic"),healthGate:G.healthGate,hooks:G.hooks,drainSeconds:Number(G.drainSeconds)||void 0,graceSeconds:Number(G.graceSeconds)||void 0,automaticRollback:G.automaticRollback!==!1,actorId:X.actor.id,trigger:typeof G.trigger==="string"?G.trigger:"api",approvalRequired:G.approvalRequired===!0,replicas:Number(G.replicas)||void 0}),requestId:Y}}else if(B.method==="GET"&&/^\/api\/v1\/releases\/[^/]+$/.test(W.pathname)){let G=decodeURIComponent(W.pathname.split("/").at(-1)),ue=m.releases.get(G);if(!ue)throw new i("not_found","Release was not found.",404);t.authorize(X,"deployments:read",{type:"resource",id:ue.resourceId}),ae={release:ue,artifact:m.releases.getArtifact(ue.artifactId),transitions:m.releases.transitions(G),approvals:m.releases.approvals(G),requestId:Y}}else if(B.method==="POST"&&lt){let G=m.releases.get(decodeURIComponent(lt[1]));if(!G)throw new i("not_found","Release was not found.",404);let ue=await Le(),be=lt[2];if(be==="promote"){let xe=String(ue.targetResourceId??"");t.authorize(X,"deployments:create",{type:"resource",id:xe}),ae={release:m.releases.promote(G.id,{targetEnvironmentId:String(ue.targetEnvironmentId??""),targetResourceId:xe,config:ue.config??{},strategy:ue.strategy,healthGate:ue.healthGate,actorId:X.actor.id,approvalRequired:ue.approvalRequired===!0}),requestId:Y}}else if(be==="approve")t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={release:m.releases.approve(G.id,{actorId:X.actor.id,decision:ue.decision==="rejected"?"rejected":"approved",comment:typeof ue.comment==="string"?ue.comment:void 0}),requestId:Y};else if(be==="activate")t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={operation:t.operation(m.enqueueActivation(G,{actorId:X.actor.id})),requestId:Y};else if(be==="rollback")t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={operation:t.operation(m.enqueueRollback(G,{actorId:X.actor.id,targetReleaseId:typeof ue.targetReleaseId==="string"?ue.targetReleaseId:void 0})),requestId:Y};else if(be==="health"){t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId});let xe=m.completeHealthGate(G.id,{healthy:ue.healthy===!0,operationId:typeof ue.operationId==="string"?ue.operationId:void 0,health:ue.health,message:typeof ue.message==="string"?ue.message:void 0});ae={release:xe.release,rollbackOperation:xe.rollbackOperation?t.operation(xe.rollbackOperation):void 0,requestId:Y}}else t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={release:m.releases.pin(G.id,ue.pinned!==!1,typeof ue.reason==="string"?ue.reason:void 0),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/compose-applications"){let G=W.searchParams.get("projectId");if(!G)throw new i("validation_error","projectId is required.",422);t.authorize(X,"project:read",{type:"project",id:G});let ue=l.applications.list({projectId:G,environmentId:W.searchParams.get("environmentId")??void 0}).filter((be)=>{try{return t.authorize(X,"deployments:read",{type:"resource",id:be.resourceId}),!0}catch{return!1}}).map((be)=>({...be,services:l.applications.services(be.id)}));ae=Qr(ue,W,Y)}else if(B.method==="POST"&&W.pathname==="/api/v1/compose-applications/preview"){let G=await Le(),ue=String(G.projectId??"");t.authorize(X,"project:read",{type:"project",id:ue}),ae={result:l.applications.preview(String(G.source??""),{name:String(G.name??""),slug:typeof G.slug==="string"?G.slug:void 0,projectId:ue,environmentId:String(G.environmentId??"")}),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/compose-applications"){let G=await Le(),ue=String(G.projectId??"");t.authorize(X,"applications:manage",{type:"environment",id:String(G.environmentId??"")});let be={name:String(G.name??""),slug:typeof G.slug==="string"?G.slug:void 0,projectId:ue,environmentId:String(G.environmentId??""),createdByActorId:X.actor.id},xe=typeof G.templateId==="string"?l.applications.fromTemplate(G.templateId,G.inputs&&typeof G.inputs==="object"&&!Array.isArray(G.inputs)?G.inputs:{},{...be,version:typeof G.templateVersion==="string"?G.templateVersion:void 0}):l.applications.import(String(G.source??""),be);ae={application:xe.application,diagnostics:xe.parsed.diagnostics,requestId:Y}}else if(B.method==="GET"&&Qt){let G=l.applications.get(decodeURIComponent(Qt[1]));if(!G)throw new i("not_found","Compose application was not found.",404);t.authorize(X,"deployments:read",{type:"resource",id:G.resourceId}),ae={application:G,services:l.applications.services(G.id),requestId:Y}}else if(B.method==="POST"&&Pt){let G=l.applications.get(decodeURIComponent(Pt[1]));if(!G)throw new i("not_found","Compose application was not found.",404);let ue=Pt[2],be=await Le();t.authorize(X,ue==="delete"||ue==="stop"?"deployments:cancel":"deployments:create",{type:"resource",id:G.resourceId}),ae={operation:t.operation(l.enqueue(G,ue,{actorId:X.actor.id,service:typeof be.service==="string"?be.service:void 0,replicas:Number.isFinite(Number(be.replicas))?Number(be.replicas):void 0,removeVolumes:be.removeVolumes===!0,confirmation:typeof be.confirm==="string"?be.confirm:void 0})),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/preview-definitions"){let G=W.searchParams.get("projectId");if(!G)throw new i("validation_error","projectId is required.",422);t.authorize(X,"project:read",{type:"project",id:G}),ae=Qr(a.previews.listDefinitions(G).map((ue)=>({...ue})),W,Y)}else if(B.method==="POST"&&W.pathname==="/api/v1/preview-definitions"){let G=await Le();t.authorize(X,"config:write",{type:"resource",id:String(G.resourceId??"")}),ae={definition:a.previews.createDefinition({...G,projectId:String(G.projectId??""),resourceId:String(G.resourceId??""),baseEnvironmentId:String(G.baseEnvironmentId??""),domainPattern:String(G.domainPattern??""),createdByActorId:X.actor.id}),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/previews"){let G=await Le(),ue=a.previews.getDefinition(String(G.definitionId??""));if(!ue)throw new i("not_found","Preview definition was not found.",404);t.authorize(X,"deployments:create",{type:"resource",id:ue.resourceId});let be=a.previews.upsert({definitionId:ue.id,sourceProvider:"api",repository:typeof G.repository==="string"?G.repository:"api",branch:String(G.branch??""),pullRequestNumber:Number(G.pullRequestNumber)||void 0,fork:G.fork===!0,commitSha:String(G.commitSha??""),createdByActorId:X.actor.id});ae={preview:be.preview,operation:t.operation(a.enqueueDeploy(be.preview,{created:be.created,actorId:X.actor.id})),requestId:Y}}else if(B.method==="POST"&&ot){let G=a.previews.getInstance(decodeURIComponent(ot[1]));if(!G)throw new i("not_found","Preview was not found.",404);let ue=await Le(),be=ot[2];if(be==="destroy"){if(t.authorize(X,"deployments:cancel",{type:"resource",id:G.resourceId}),ue.confirm!==G.name)throw new i("confirmation_required",`Type ${G.name} to confirm preview teardown.`,409);ae={operation:t.operation(a.enqueueDestroy(G,"api",X.actor.id)),requestId:Y}}else if(be==="extend")t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={preview:a.previews.extend(G.id,Number(ue.hours)),requestId:Y};else t.authorize(X,"deployments:create",{type:"resource",id:G.resourceId}),ae={operation:t.operation(a.enqueueDeploy(G,{actorId:X.actor.id,reason:"manual_rebuild"})),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/previews/cleanup"){t.authorize(X,"automation:manage",{type:"organization"});let G=await Le();if(!G.dryRun&&G.confirm!=="cleanup previews")throw new i("confirmation_required","Type cleanup previews to confirm preview cleanup.",409);ae={...a.cleanup({dryRun:G.dryRun===!0,maxAgeHours:Number(G.maxAgeHours)||void 0,keepCount:Number(G.keepCount)||void 0,actorId:X.actor.id}),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/queue"){let G=W.searchParams.get("projectId")??void 0,ue=W.searchParams.get("state"),be=r.list({projectId:G,state:["queued","running","succeeded","failed","cancelled","timed_out"].includes(ue)?ue:void 0,limit:500}).filter((xe)=>{let mt=xe.operation.resourceId?{type:"resource",id:xe.operation.resourceId}:xe.operation.environmentId?{type:"environment",id:xe.operation.environmentId}:xe.operation.projectId?{type:"project",id:xe.operation.projectId}:{type:"organization"};try{return t.authorize(X,"deployments:read",mt),!0}catch{return!1}}).map((xe)=>({...t.operation(xe.operation),queue:xe.job,approximatePosition:xe.approximatePosition}));ae=Qr(be,W,Y)}else if(B.method==="GET"&&W.pathname==="/api/v1/queue/settings")t.authorize(X,"deployments:read",X.token.scope),ae={concurrency:r.limits,requestId:Y};else if(B.method==="PATCH"&&W.pathname==="/api/v1/queue/settings"){t.authorize(X,"automation:manage",{type:"organization"});let G=await Le();if(G.confirm!=="update queue limits")throw new i("confirmation_required","Type update queue limits to confirm production concurrency changes.",409);ae={concurrency:r.configureConcurrency(G.concurrency??{},{organizationId:X.serviceAccount.organizationId,actorId:X.actor.id}),requestId:Y}}else if(B.method==="DELETE"&&W.pathname==="/api/v1/queue/history"){t.authorize(X,"automation:manage",{type:"organization"});let G=await Le();if(G.confirm!=="clear completed")throw new i("confirmation_required","Type clear completed to confirm queue retention cleanup.",409);ae={deleted:r.clearCompleted({before:typeof G.before==="string"?G.before:void 0,actorId:X.actor.id,projectId:typeof G.projectId==="string"?G.projectId:void 0}),requestId:Y}}else if(B.method==="GET"&&gt){let G=e.controlPlane.getOperation(decodeURIComponent(gt[1]));if(!G)throw new i("not_found","Operation was not found.",404);let ue=G.resourceId?{type:"resource",id:G.resourceId}:G.environmentId?{type:"environment",id:G.environmentId}:G.projectId?{type:"project",id:G.projectId}:{type:"organization"};t.authorize(X,"deployments:read",ue);let be=B.headers.get("last-event-id")?.trim(),xe=Number(be||W.searchParams.get("after")||0);if(gt[2]==="stream"){let _t=new TextEncoder,Ne=xe,yt,ut=!1,Ke=new ReadableStream({start(zr){let Ss=()=>{if(ut)return;if(!e.identities.verifyToken(le,V)){if(ut=!0,yt)clearInterval(yt);zr.close();return}let Yn=r.logs(G.id,{after:Ne,limit:500});for(let or of Yn)Ne=or.sequence,zr.enqueue(_t.encode(`id: ${or.sequence}
 event: log
 data: ${JSON.stringify(or)}
 
 `));let Vt=e.controlPlane.getOperation(G.id);if(Vt&&["succeeded","failed","cancelled","timed_out"].includes(Vt.state)&&!r.logs(G.id,{after:Ne,limit:1}).length){if(ut=!0,yt)clearInterval(yt);zr.enqueue(_t.encode(`event: complete
 data: ${JSON.stringify({state:Vt.state,cursor:Ne})}
 
-`)),zr.close()}};if(Ss(),!ut)yt=setInterval(Ss,500);B.signal.addEventListener("abort",()=>{if(ut=!0,yt)clearInterval(yt);try{zr.close()}catch{}},{once:!0})},cancel(){if(ut=!0,yt)clearInterval(yt)}});return new Response(Ke,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no","x-request-id":Y,...Me}})}let mt=r.logs(G.id,{after:De,limit:Number(W.searchParams.get("limit"))||void 0});ae={data:mt,cursor:mt.at(-1)?.sequence??De,hasMore:mt.length>=Math.min(1000,Math.max(1,Number(W.searchParams.get("limit"))||200)),requestId:Y}}else if(B.method==="POST"&&Jt){let G=e.controlPlane.getOperation(decodeURIComponent(Jt[1]));if(!G)throw new i("not_found","Operation was not found.",404);let ue=G.resourceId?{type:"resource",id:G.resourceId}:G.environmentId?{type:"environment",id:G.environmentId}:G.projectId?{type:"project",id:G.projectId}:{type:"organization"},be=await Le();if(Jt[2]==="cancel")t.authorize(X,"deployments:cancel",ue),ae={operation:t.operation(r.requestCancellation(G.id,X.actor.id)),requestId:Y};else t.authorize(X,"deployments:create",ue),ae={operation:t.operation(r.retry(G.id,String(be.errorClass??"manual"),{delayMs:Number(be.delayMs)||0,actorId:X.actor.id})),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:read",X.token.scope),ae=Qr(e.sources.listConnections(X.serviceAccount.organizationId),W,Y,["createdAt","id"])}else if(B.method==="GET"&&W.pathname==="/api/v1/source/repositories"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:read",X.token.scope);let G=e.sources.getConnection(W.searchParams.get("connectionId")??"");if(!G||G.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);if(W.searchParams.get("sync")==="true")t.authorize(X,"sources:manage",{type:"organization"}),await Gi(e.sources,G.id,{search:W.searchParams.get("search")??void 0});ae=Qr(e.sources.listRepositories(G.id,W.searchParams.get("search")??void 0),W,Y,["fullName","id"])}else if(B.method==="GET"&&W.pathname==="/api/v1/source/refs"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:read",X.token.scope);let G=W.searchParams.get("connectionId")??"",ue=e.sources.getConnection(G);if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);ae=await qi(e.sources,{connectionId:G,repository:W.searchParams.get("repository")??"",repositoryId:W.searchParams.get("repositoryId")??void 0,type:W.searchParams.get("type")==="tags"?"tags":"branches",cursor:W.searchParams.get("cursor")??void 0,deployKeyId:W.searchParams.get("deployKeyId")??void 0})}else if(B.method==="POST"&&W.pathname==="/api/v1/application-detections"){t.authorize(X,"applications:manage",X.token.scope);let G=await Le();if(!Array.isArray(G.files)||G.files.length>1e4)throw new i("validation_error","files must contain at most 10,000 entries.",422);ae={candidates:_s(G.files.map((ue)=>({path:String(ue.path??""),size:Number(ue.size??0),content:typeof ue.content==="string"?ue.content.slice(0,262144):void 0}))),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/application-plans"){t.authorize(X,"applications:manage",X.token.scope);let G=await Le();ae={plan:qn(G.draft,Array.isArray(G.suppliedSecretNames)?G.suppliedSecretNames.map(String):[]),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let G=W.searchParams.get("projectId")??"";t.authorize(X,"applications:read",{type:"project",id:G}),ae=Qr(e.applications.drafts.list(G),W,Y,["updatedAt","id"])}else if(B.method==="POST"&&W.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let G=await Le(),ue=String(G.projectId??G.draft?.projectId??"");t.authorize(X,"applications:manage",{type:"project",id:ue});let be=e.controlPlane.getProject(ue);if(!be||be.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);let De=e.applications.drafts.create({organizationId:be.organizationId,projectId:ue,name:String(G.name??G.draft?.name??"Application draft"),draft:{...G.draft,projectId:ue},step:G.step,suppliedSecretNames:Array.isArray(G.suppliedSecretNames)?G.suppliedSecretNames.map(String):[],actorId:X.actor.id});return T({draft:De,requestId:Y},201,Y,Me)}else if(B.method==="PATCH"&&W.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let G=await Le(),ue=e.applications.drafts.get(String(G.id??""));if(!ue)throw new i("not_found","Application draft was not found.",404);t.authorize(X,"applications:manage",{type:"project",id:ue.projectId}),ae={draft:e.applications.drafts.update(ue.id,Number(G.version),{draft:{...G.draft,projectId:ue.projectId},step:G.step,suppliedSecretNames:Array.isArray(G.suppliedSecretNames)?G.suppliedSecretNames.map(String):void 0,actorId:X.actor.id}),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/applications"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let G=B.headers.get("idempotency-key")??"";if(!G)throw new i("idempotency_required","Idempotency-Key is required for application creation.",428);if(!/^[A-Za-z0-9._:-]{8,128}$/.test(G))throw new i("validation_error","Idempotency-Key must contain 8-128 safe characters.",422);let ue=await Le(),be=e.applications.drafts.get(String(ue.draftId??""));if(!be)throw new i("not_found","Application draft was not found.",404);t.authorize(X,"applications:manage",{type:"project",id:be.projectId});let De=nI("sha256").update(`POST
+`)),zr.close()}};if(Ss(),!ut)yt=setInterval(Ss,500);B.signal.addEventListener("abort",()=>{if(ut=!0,yt)clearInterval(yt);try{zr.close()}catch{}},{once:!0})},cancel(){if(ut=!0,yt)clearInterval(yt)}});return new Response(Ke,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no","x-request-id":Y,...Me}})}let mt=r.logs(G.id,{after:xe,limit:Number(W.searchParams.get("limit"))||void 0});ae={data:mt,cursor:mt.at(-1)?.sequence??xe,hasMore:mt.length>=Math.min(1000,Math.max(1,Number(W.searchParams.get("limit"))||200)),requestId:Y}}else if(B.method==="POST"&&Jt){let G=e.controlPlane.getOperation(decodeURIComponent(Jt[1]));if(!G)throw new i("not_found","Operation was not found.",404);let ue=G.resourceId?{type:"resource",id:G.resourceId}:G.environmentId?{type:"environment",id:G.environmentId}:G.projectId?{type:"project",id:G.projectId}:{type:"organization"},be=await Le();if(Jt[2]==="cancel")t.authorize(X,"deployments:cancel",ue),ae={operation:t.operation(r.requestCancellation(G.id,X.actor.id)),requestId:Y};else t.authorize(X,"deployments:create",ue),ae={operation:t.operation(r.retry(G.id,String(be.errorClass??"manual"),{delayMs:Number(be.delayMs)||0,actorId:X.actor.id})),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:read",X.token.scope),ae=Qr(e.sources.listConnections(X.serviceAccount.organizationId),W,Y,["createdAt","id"])}else if(B.method==="GET"&&W.pathname==="/api/v1/source/repositories"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:read",X.token.scope);let G=e.sources.getConnection(W.searchParams.get("connectionId")??"");if(!G||G.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);if(W.searchParams.get("sync")==="true")t.authorize(X,"sources:manage",{type:"organization"}),await Gi(e.sources,G.id,{search:W.searchParams.get("search")??void 0});ae=Qr(e.sources.listRepositories(G.id,W.searchParams.get("search")??void 0),W,Y,["fullName","id"])}else if(B.method==="GET"&&W.pathname==="/api/v1/source/refs"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:read",X.token.scope);let G=W.searchParams.get("connectionId")??"",ue=e.sources.getConnection(G);if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);ae=await qi(e.sources,{connectionId:G,repository:W.searchParams.get("repository")??"",repositoryId:W.searchParams.get("repositoryId")??void 0,type:W.searchParams.get("type")==="tags"?"tags":"branches",cursor:W.searchParams.get("cursor")??void 0,deployKeyId:W.searchParams.get("deployKeyId")??void 0})}else if(B.method==="POST"&&W.pathname==="/api/v1/application-detections"){t.authorize(X,"applications:manage",X.token.scope);let G=await Le();if(!Array.isArray(G.files)||G.files.length>1e4)throw new i("validation_error","files must contain at most 10,000 entries.",422);ae={candidates:_s(G.files.map((ue)=>({path:String(ue.path??""),size:Number(ue.size??0),content:typeof ue.content==="string"?ue.content.slice(0,262144):void 0}))),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/application-plans"){t.authorize(X,"applications:manage",X.token.scope);let G=await Le();ae={plan:qn(G.draft,Array.isArray(G.suppliedSecretNames)?G.suppliedSecretNames.map(String):[]),requestId:Y}}else if(B.method==="GET"&&W.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let G=W.searchParams.get("projectId")??"";t.authorize(X,"applications:read",{type:"project",id:G}),ae=Qr(e.applications.drafts.list(G),W,Y,["updatedAt","id"])}else if(B.method==="POST"&&W.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let G=await Le(),ue=String(G.projectId??G.draft?.projectId??"");t.authorize(X,"applications:manage",{type:"project",id:ue});let be=e.controlPlane.getProject(ue);if(!be||be.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);let xe=e.applications.drafts.create({organizationId:be.organizationId,projectId:ue,name:String(G.name??G.draft?.name??"Application draft"),draft:{...G.draft,projectId:ue},step:G.step,suppliedSecretNames:Array.isArray(G.suppliedSecretNames)?G.suppliedSecretNames.map(String):[],actorId:X.actor.id});return T({draft:xe,requestId:Y},201,Y,Me)}else if(B.method==="PATCH"&&W.pathname==="/api/v1/application-drafts"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let G=await Le(),ue=e.applications.drafts.get(String(G.id??""));if(!ue)throw new i("not_found","Application draft was not found.",404);t.authorize(X,"applications:manage",{type:"project",id:ue.projectId}),ae={draft:e.applications.drafts.update(ue.id,Number(G.version),{draft:{...G.draft,projectId:ue.projectId},step:G.step,suppliedSecretNames:Array.isArray(G.suppliedSecretNames)?G.suppliedSecretNames.map(String):void 0,actorId:X.actor.id}),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/applications"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);let G=B.headers.get("idempotency-key")??"";if(!G)throw new i("idempotency_required","Idempotency-Key is required for application creation.",428);if(!/^[A-Za-z0-9._:-]{8,128}$/.test(G))throw new i("validation_error","Idempotency-Key must contain 8-128 safe characters.",422);let ue=await Le(),be=e.applications.drafts.get(String(ue.draftId??""));if(!be)throw new i("not_found","Application draft was not found.",404);t.authorize(X,"applications:manage",{type:"project",id:be.projectId});let xe=nI("sha256").update(`POST
 /api/v1/applications
-${JSON.stringify(ue)}`).digest("hex"),mt=e.identities.getIdempotency(X.token.id,G);if(mt){if(mt.requestHash!==De)throw new i("idempotency_conflict","Idempotency-Key was already used for another request.",409);let Ne=mt.operationId?e.controlPlane.getOperation(mt.operationId):void 0,yt=Ne?.resourceId?e.controlPlane.getResource(Ne.resourceId):void 0;if(!Ne||!yt)throw new i("idempotency_unavailable","The original application operation is no longer available.",409);return T({resource:yt,operation:t.operation(Ne),plan:qn(be.input,be.suppliedSecretNames),idempotentReplay:!0,requestId:Y},202,Y,{...Me,"idempotent-replayed":"true"})}let _t=Bc({controlPlane:e.controlPlane,drafts:e.applications.drafts,draftId:be.id,expectedVersion:Number(ue.version),confirmEnvironment:String(ue.confirmEnvironment??""),actorId:X.actor.id});return e.identities.saveIdempotency({tokenId:X.token.id,key:G,requestHash:De,operationId:_t.operation.id,responseStatus:202,responseBody:{draftId:be.id}}),T({resource:_t.resource,operation:t.operation(_t.operation),plan:_t.plan,idempotentReplay:!1,requestId:Y},202,Y,Me)}else if(B.method==="GET"&&W.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(X,"applications:read",X.token.scope),ae=Qr(e.applications.registries.list(X.serviceAccount.organizationId),W,Y,["createdAt","id"])}else if(B.method==="POST"&&W.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(X,"applications:manage",{type:"organization"});let G=await Le(),ue=e.applications.registries.create({organizationId:X.serviceAccount.organizationId,provider:G.provider,name:String(G.name??"Container registry"),host:String(G.host??""),credential:G.token||G.password?{username:typeof G.username==="string"?G.username:void 0,password:typeof G.password==="string"?G.password:void 0,token:typeof G.token==="string"?G.token:void 0}:void 0,credentialExpiresAt:typeof G.credentialExpiresAt==="string"?G.credentialExpiresAt:void 0,actorId:X.actor.id});return T({registry:ue,requestId:Y},201,Y,Me)}else if(B.method==="PATCH"&&W.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(X,"applications:manage",{type:"organization"});let G=await Le(),ue=e.applications.registries.get(String(G.id??""));if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);if(G.action==="test")ae={registry:await e.applications.registries.test(ue.id,{image:typeof G.image==="string"?G.image:void 0}),requestId:Y};else if(G.action==="rotate")ae={registry:e.applications.registries.rotate(ue.id,{username:G.username,password:G.password,token:G.token},{expiresAt:G.expiresAt,actorId:X.actor.id}),requestId:Y};else throw new i("validation_error","action must be test or rotate.",422)}else if(B.method==="DELETE"&&W.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(X,"applications:manage",{type:"organization"});let G=await Le(),ue=e.applications.registries.get(String(G.id??""));if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);ae={registry:e.applications.registries.disconnect(ue.id,X.actor.id),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/application-artifacts"){if(!e.applications?.artifacts)throw new i("not_found","Application artifact storage is unavailable.",404);let G=B.headers.get("x-project-id")??"";t.authorize(X,"applications:manage",{type:"project",id:G});let ue=e.controlPlane.getProject(G);if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);if(Number(B.headers.get("content-length")??0)>104857600)throw new i("payload_too_large","Artifact exceeds 100 MB.",413);let De=e.applications.artifacts.create({organizationId:ue.organizationId,projectId:G,filename:B.headers.get("x-artifact-filename")??"application.zip",bytes:new Uint8Array(await B.arrayBuffer()),actorId:X.actor.id});return T({artifact:De,requestId:Y},201,Y,Me)}else if(B.method==="POST"&&W.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:manage",{type:"organization"});let G=await Le(),ue=String(G.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(ue))throw new i("validation_error","A supported provider is required.",422);let be=ue==="github"&&(G.privateKey||G.appId)?{appId:typeof G.appId==="string"?G.appId:void 0,installationId:typeof G.installationId==="string"?G.installationId:void 0,privateKey:typeof G.privateKey==="string"?G.privateKey:void 0}:ue!=="generic_ssh"&&G.token?{token:String(G.token),username:typeof G.username==="string"?G.username:void 0}:void 0,De,mt,_t;return e.controlPlane.database.transaction(()=>{if(De=e.sources.createConnection({organizationId:X.serviceAccount.organizationId,provider:ue,name:String(G.name??ue),host:String(G.host??""),owner:typeof G.owner==="string"?G.owner:void 0,authKind:G.authKind,credential:be,createdByActorId:X.actor.id}),typeof G.repositoryUrl==="string"&&typeof G.repositoryFullName==="string")mt=e.sources.upsertRepository({connectionId:De.id,providerRepositoryId:`manual:${G.repositoryFullName}`,fullName:G.repositoryFullName,cloneUrl:G.repositoryUrl,defaultBranch:String(G.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"api"}});if(ue==="generic_ssh")_t=e.sources.createDeployKey({connectionId:De.id,name:String(G.deployKeyName??"Repository deploy key"),publicKey:String(G.publicKey??""),privateKey:String(G.deployPrivateKey??""),host:String(G.sshHost??""),hostKey:String(G.hostKey??""),actorId:X.actor.id})})(),T({connection:De,repository:mt,deployKey:_t,requestId:Y},201,Y,Me)}else if(B.method==="POST"&&W.pathname==="/api/v1/source/bindings"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);let G=await Le(),ue=String(G.projectId??"");t.authorize(X,"sources:manage",{type:"project",id:ue});let be=e.sources.getConnection(String(G.connectionId??""));if(!be||be.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let De=e.sources.createBinding({projectId:ue,environmentId:typeof G.environmentId==="string"?G.environmentId:void 0,resourceId:typeof G.resourceId==="string"?G.resourceId:void 0,connectionId:be.id,repositoryId:typeof G.repositoryId==="string"?G.repositoryId:void 0,repositoryFullName:String(G.repositoryFullName??""),defaultBranch:String(G.defaultBranch??"main"),branchRule:typeof G.branchRule==="string"?G.branchRule:void 0,tagRule:typeof G.tagRule==="string"?G.tagRule:void 0,monorepoRoot:String(G.monorepoRoot??"."),includePaths:Array.isArray(G.includePaths)?G.includePaths.map(String):[],excludePaths:Array.isArray(G.excludePaths)?G.excludePaths.map(String):[],submodules:G.submodules===!0,cloneDepth:typeof G.cloneDepth==="number"?G.cloneDepth:void 0,deployKeyId:typeof G.deployKeyId==="string"&&G.deployKeyId?G.deployKeyId:void 0,autoDeploy:G.autoDeploy!==!1,pullRequestPreviews:G.pullRequestPreviews!==!1,actorId:X.actor.id});return T({binding:De,requestId:Y},201,Y,Me)}else if(B.method==="POST"&&W.pathname==="/api/v1/source/webhooks"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:manage",{type:"organization"});let G=await Le(),ue=e.sources.getConnection(String(G.connectionId??""));if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let be=typeof G.baseUrl==="string"?G.baseUrl:void 0;if(!be)throw new i("validation_error","baseUrl is required.",422);let De=e.sources.createWebhook({connectionId:ue.id,repositoryId:typeof G.repositoryId==="string"?G.repositoryId:void 0,repositoryFullName:String(G.repositoryFullName??""),events:Array.isArray(G.events)?G.events.map(String):void 0}),mt=Zt(be,De.webhook),_t=G.reconcile===!1?De.webhook:await Zr(e.sources,De.webhook.id,be);return T({webhook:_t,endpoint:mt,endpointRevealOnce:!0,requestId:Y},201,Y,Me)}else if(B.method==="DELETE"&&W.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:manage",{type:"organization"});let G=await Le(),ue=e.sources.getConnection(String(G.id??""));if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let be=e.sources.listBindings({connectionId:ue.id,status:"active"});if(G.preview===!0)return T({preview:!0,affectedBindings:be,requestId:Y},200,Y,Me);return T({...e.sources.disconnectConnection(ue.id,X.actor.id),requestId:Y},200,Y,Me)}else if(B.method==="GET"&&(W.pathname==="/api/v1/events"||W.pathname==="/api/v1/events/stream")){let G=t.listEvents(X,W.searchParams.get("projectId")??void 0,Number(W.searchParams.get("after"))||void 0);if(W.pathname.endsWith("/stream")){let ue=new TextEncoder,be=G.reduce((Ne,yt)=>Math.max(Ne,Number(yt.sequence)),Number(W.searchParams.get("after"))||0),De,mt=!1,_t=new ReadableStream({start(Ne){let yt=(ut)=>Ne.enqueue(ue.encode(`id: ${ut.sequence}
+${JSON.stringify(ue)}`).digest("hex"),mt=e.identities.getIdempotency(X.token.id,G);if(mt){if(mt.requestHash!==xe)throw new i("idempotency_conflict","Idempotency-Key was already used for another request.",409);let Ne=mt.operationId?e.controlPlane.getOperation(mt.operationId):void 0,yt=Ne?.resourceId?e.controlPlane.getResource(Ne.resourceId):void 0;if(!Ne||!yt)throw new i("idempotency_unavailable","The original application operation is no longer available.",409);return T({resource:yt,operation:t.operation(Ne),plan:qn(be.input,be.suppliedSecretNames),idempotentReplay:!0,requestId:Y},202,Y,{...Me,"idempotent-replayed":"true"})}let _t=Bc({controlPlane:e.controlPlane,drafts:e.applications.drafts,draftId:be.id,expectedVersion:Number(ue.version),confirmEnvironment:String(ue.confirmEnvironment??""),actorId:X.actor.id});return e.identities.saveIdempotency({tokenId:X.token.id,key:G,requestHash:xe,operationId:_t.operation.id,responseStatus:202,responseBody:{draftId:be.id}}),T({resource:_t.resource,operation:t.operation(_t.operation),plan:_t.plan,idempotentReplay:!1,requestId:Y},202,Y,Me)}else if(B.method==="GET"&&W.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(X,"applications:read",X.token.scope),ae=Qr(e.applications.registries.list(X.serviceAccount.organizationId),W,Y,["createdAt","id"])}else if(B.method==="POST"&&W.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(X,"applications:manage",{type:"organization"});let G=await Le(),ue=e.applications.registries.create({organizationId:X.serviceAccount.organizationId,provider:G.provider,name:String(G.name??"Container registry"),host:String(G.host??""),credential:G.token||G.password?{username:typeof G.username==="string"?G.username:void 0,password:typeof G.password==="string"?G.password:void 0,token:typeof G.token==="string"?G.token:void 0}:void 0,credentialExpiresAt:typeof G.credentialExpiresAt==="string"?G.credentialExpiresAt:void 0,actorId:X.actor.id});return T({registry:ue,requestId:Y},201,Y,Me)}else if(B.method==="PATCH"&&W.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(X,"applications:manage",{type:"organization"});let G=await Le(),ue=e.applications.registries.get(String(G.id??""));if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);if(G.action==="test")ae={registry:await e.applications.registries.test(ue.id,{image:typeof G.image==="string"?G.image:void 0}),requestId:Y};else if(G.action==="rotate")ae={registry:e.applications.registries.rotate(ue.id,{username:G.username,password:G.password,token:G.token},{expiresAt:G.expiresAt,actorId:X.actor.id}),requestId:Y};else throw new i("validation_error","action must be test or rotate.",422)}else if(B.method==="DELETE"&&W.pathname==="/api/v1/registry-connections"){if(!e.applications)throw new i("not_found","Application onboarding is unavailable.",404);t.authorize(X,"applications:manage",{type:"organization"});let G=await Le(),ue=e.applications.registries.get(String(G.id??""));if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Registry connection was not found.",404);ae={registry:e.applications.registries.disconnect(ue.id,X.actor.id),requestId:Y}}else if(B.method==="POST"&&W.pathname==="/api/v1/application-artifacts"){if(!e.applications?.artifacts)throw new i("not_found","Application artifact storage is unavailable.",404);let G=B.headers.get("x-project-id")??"";t.authorize(X,"applications:manage",{type:"project",id:G});let ue=e.controlPlane.getProject(G);if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);if(Number(B.headers.get("content-length")??0)>104857600)throw new i("payload_too_large","Artifact exceeds 100 MB.",413);let xe=e.applications.artifacts.create({organizationId:ue.organizationId,projectId:G,filename:B.headers.get("x-artifact-filename")??"application.zip",bytes:new Uint8Array(await B.arrayBuffer()),actorId:X.actor.id});return T({artifact:xe,requestId:Y},201,Y,Me)}else if(B.method==="POST"&&W.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:manage",{type:"organization"});let G=await Le(),ue=String(G.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(ue))throw new i("validation_error","A supported provider is required.",422);let be=ue==="github"&&(G.privateKey||G.appId)?{appId:typeof G.appId==="string"?G.appId:void 0,installationId:typeof G.installationId==="string"?G.installationId:void 0,privateKey:typeof G.privateKey==="string"?G.privateKey:void 0}:ue!=="generic_ssh"&&G.token?{token:String(G.token),username:typeof G.username==="string"?G.username:void 0}:void 0,xe,mt,_t;return e.controlPlane.database.transaction(()=>{if(xe=e.sources.createConnection({organizationId:X.serviceAccount.organizationId,provider:ue,name:String(G.name??ue),host:String(G.host??""),owner:typeof G.owner==="string"?G.owner:void 0,authKind:G.authKind,credential:be,createdByActorId:X.actor.id}),typeof G.repositoryUrl==="string"&&typeof G.repositoryFullName==="string")mt=e.sources.upsertRepository({connectionId:xe.id,providerRepositoryId:`manual:${G.repositoryFullName}`,fullName:G.repositoryFullName,cloneUrl:G.repositoryUrl,defaultBranch:String(G.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"api"}});if(ue==="generic_ssh")_t=e.sources.createDeployKey({connectionId:xe.id,name:String(G.deployKeyName??"Repository deploy key"),publicKey:String(G.publicKey??""),privateKey:String(G.deployPrivateKey??""),host:String(G.sshHost??""),hostKey:String(G.hostKey??""),actorId:X.actor.id})})(),T({connection:xe,repository:mt,deployKey:_t,requestId:Y},201,Y,Me)}else if(B.method==="POST"&&W.pathname==="/api/v1/source/bindings"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);let G=await Le(),ue=String(G.projectId??"");t.authorize(X,"sources:manage",{type:"project",id:ue});let be=e.sources.getConnection(String(G.connectionId??""));if(!be||be.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let xe=e.sources.createBinding({projectId:ue,environmentId:typeof G.environmentId==="string"?G.environmentId:void 0,resourceId:typeof G.resourceId==="string"?G.resourceId:void 0,connectionId:be.id,repositoryId:typeof G.repositoryId==="string"?G.repositoryId:void 0,repositoryFullName:String(G.repositoryFullName??""),defaultBranch:String(G.defaultBranch??"main"),branchRule:typeof G.branchRule==="string"?G.branchRule:void 0,tagRule:typeof G.tagRule==="string"?G.tagRule:void 0,monorepoRoot:String(G.monorepoRoot??"."),includePaths:Array.isArray(G.includePaths)?G.includePaths.map(String):[],excludePaths:Array.isArray(G.excludePaths)?G.excludePaths.map(String):[],submodules:G.submodules===!0,cloneDepth:typeof G.cloneDepth==="number"?G.cloneDepth:void 0,deployKeyId:typeof G.deployKeyId==="string"&&G.deployKeyId?G.deployKeyId:void 0,autoDeploy:G.autoDeploy!==!1,pullRequestPreviews:G.pullRequestPreviews!==!1,actorId:X.actor.id});return T({binding:xe,requestId:Y},201,Y,Me)}else if(B.method==="POST"&&W.pathname==="/api/v1/source/webhooks"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:manage",{type:"organization"});let G=await Le(),ue=e.sources.getConnection(String(G.connectionId??""));if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let be=typeof G.baseUrl==="string"?G.baseUrl:void 0;if(!be)throw new i("validation_error","baseUrl is required.",422);let xe=e.sources.createWebhook({connectionId:ue.id,repositoryId:typeof G.repositoryId==="string"?G.repositoryId:void 0,repositoryFullName:String(G.repositoryFullName??""),events:Array.isArray(G.events)?G.events.map(String):void 0}),mt=Zt(be,xe.webhook),_t=G.reconcile===!1?xe.webhook:await Zr(e.sources,xe.webhook.id,be);return T({webhook:_t,endpoint:mt,endpointRevealOnce:!0,requestId:Y},201,Y,Me)}else if(B.method==="DELETE"&&W.pathname==="/api/v1/source/connections"){if(!e.sources)throw new i("not_found","Source integrations are unavailable.",404);t.authorize(X,"sources:manage",{type:"organization"});let G=await Le(),ue=e.sources.getConnection(String(G.id??""));if(!ue||ue.organizationId!==X.serviceAccount.organizationId)throw new i("not_found","Source connection was not found.",404);let be=e.sources.listBindings({connectionId:ue.id,status:"active"});if(G.preview===!0)return T({preview:!0,affectedBindings:be,requestId:Y},200,Y,Me);return T({...e.sources.disconnectConnection(ue.id,X.actor.id),requestId:Y},200,Y,Me)}else if(B.method==="GET"&&(W.pathname==="/api/v1/events"||W.pathname==="/api/v1/events/stream")){let G=t.listEvents(X,W.searchParams.get("projectId")??void 0,Number(W.searchParams.get("after"))||void 0);if(W.pathname.endsWith("/stream")){let ue=new TextEncoder,be=G.reduce((Ne,yt)=>Math.max(Ne,Number(yt.sequence)),Number(W.searchParams.get("after"))||0),xe,mt=!1,_t=new ReadableStream({start(Ne){let yt=(ut)=>Ne.enqueue(ue.encode(`id: ${ut.sequence}
 event: ${ut.type}
 data: ${JSON.stringify(ut)}
 
 `));if(G.length)G.forEach(yt);else Ne.enqueue(ue.encode(`: connected
 
-`));De=setInterval(()=>{if(mt)return;let ut=e.identities.verifyToken(le,V);if(!ut){if(mt=!0,De)clearInterval(De);Ne.close();return}try{let Ke=t.listEvents(ut,W.searchParams.get("projectId")??void 0,be);for(let zr of Ke)yt(zr),be=Math.max(be,Number(zr.sequence));if(!Ke.length)Ne.enqueue(ue.encode(`: heartbeat ${Date.now()}
+`));xe=setInterval(()=>{if(mt)return;let ut=e.identities.verifyToken(le,V);if(!ut){if(mt=!0,xe)clearInterval(xe);Ne.close();return}try{let Ke=t.listEvents(ut,W.searchParams.get("projectId")??void 0,be);for(let zr of Ke)yt(zr),be=Math.max(be,Number(zr.sequence));if(!Ke.length)Ne.enqueue(ue.encode(`: heartbeat ${Date.now()}
 
-`))}catch{if(mt=!0,De)clearInterval(De);Ne.close()}},1000),B.signal.addEventListener("abort",()=>{if(mt=!0,De)clearInterval(De);try{Ne.close()}catch{}},{once:!0})},cancel(){if(mt=!0,De)clearInterval(De)}});return new Response(_t,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-store",connection:"keep-alive","x-accel-buffering":"no","x-request-id":Y,...Me}})}ae=Qr(G,W,Y,["sequence","id"])}else if(B.method==="POST"&&W.pathname==="/api/v1/deployments"){let G=B.headers.get("idempotency-key")??"";if(!G)throw new i("idempotency_required","Idempotency-Key is required for deployment requests.",428);let ue=await B.text();if(ue.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);let be;try{be=JSON.parse(ue)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}if(!be||typeof be.projectId!=="string"||typeof be.environmentId!=="string"||be.action!==void 0&&!["deploy","rollback"].includes(be.action))throw new i("validation_error","projectId, environmentId, and a valid action are required.",422);let De=t.createDeployment(X,be,G);return T({operation:De.operation,idempotentReplay:De.replay,requestId:Y},202,Y,{...Me,...De.replay?{"idempotent-replayed":"true"}:{}})}else{let G=await co({...S,authorization:t,now:y},X,{method:B.method,url:W,body:Le});if(G===void 0)throw new i("not_found","API resource was not found.",404);ae=G}return T(ae,200,Y,Me)}catch(ae){if(ae instanceof i)return j(ae.code,ae.message,ae.status,Y,ae.details,Me);if(W.pathname.startsWith("/api/v1/source/")||W.pathname.startsWith("/api/v1/application")||W.pathname.startsWith("/api/v1/compose-")||W.pathname==="/api/v1/registry-connections")return j("validation_error",ae instanceof Error?ae.message:"Integration request could not be completed.",422,Y,void 0,Me);return j("internal_error","The API request could not be completed.",500,Y,void 0,Me)}}}import{createCipheriv as cI,createDecipheriv as dI,createHash as Zf,randomBytes as ci}from"node:crypto";import{createHmac as sI,timingSafeEqual as aI}from"node:crypto";var wp="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Fi(e){let t=0,r=0,a="";for(let l of e){r=r<<8|l,t+=8;while(t>=5)a+=wp[r>>>t-5&31],t-=5}if(t>0)a+=wp[r<<5-t&31];return a}function ol(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,a=0,l=[];for(let m of t){let h=wp.indexOf(m);if(h<0)throw Error("Invalid base32 secret");if(a=a<<5|h,r+=5,r>=8)l.push(a>>>r-8&255),r-=8}return Buffer.from(l)}function xo(e,t,r=6){let a=Buffer.alloc(8);a.writeBigUInt64BE(BigInt(t));let l=sI("sha1",ol(e)).update(a).digest(),m=l[l.length-1]&15,h=(l[m]&127)<<24|(l[m+1]&255)<<16|(l[m+2]&255)<<8|l[m+3]&255;return String(h%10**r).padStart(r,"0")}function Vm(e,t=Date.now(),r=30){return xo(e,Math.floor(t/1000/r))}function jm(e,t,r=Date.now(),a=1){return Jr(e,t,r,a)!==void 0}function Jr(e,t,r=Date.now(),a=1){let l=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(l))return;let m=Buffer.from(l),h=Math.floor(r/1000/30);for(let S=-a;S<=a;S++){if(h+S<0)continue;let R=Buffer.from(xo(e,h+S));if(m.length===R.length&&aI(m,R))return h+S}return}function Oo(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var al=1800000,Xe=43200000,cl=3600000,dl=300000,ll=600000;function _n(e){return typeof e==="string"?e:void 0}function Xf(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function lI(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function kp(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function uI(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function pI(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function gI(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function mI(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function Vn(e){return Zf("sha256").update(e).digest("hex")}function ic(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:_n(e.email),emailVerifiedAt:_n(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:_n(e.disabled_at),lastLoginAt:_n(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Jf(e,t){let r=_n(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Xf(e.metadata),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function Ip(e,t){let r=_n(e.revoked_at),a=String(e.idle_expires_at),l=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:_n(e.user_agent),networkHint:_n(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:a,absoluteExpiresAt:l,recentAuthAt:String(e.recent_auth_at),mfaAt:_n(e.mfa_at),revokedAt:r,state:r?"revoked":a<=t||l<=t?"expired":"active"}}function Gf(e){let t=_n(e.verified_at),r=_n(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function Ep(e,t){let r=_n(e.consumed_at),a=String(e.expires_at),l=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:l,expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":l>=5?"locked":a<=t?"expired":"pending"}}function Qf(e){let t=Xf(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Fc(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Qf(e.scopes),allowedDomains:Qf(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Yf(e,t){let r=_n(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function fI(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Ui{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?Zf("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=ci(12),r=cI("aes-256-gcm",this.encryptionKey,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted authentication value is unavailable");let m=dI("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=lI(e.username),r=kp(e.email),a=e.id??this.idFn(),l=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
+`))}catch{if(mt=!0,xe)clearInterval(xe);Ne.close()}},1000),B.signal.addEventListener("abort",()=>{if(mt=!0,xe)clearInterval(xe);try{Ne.close()}catch{}},{once:!0})},cancel(){if(mt=!0,xe)clearInterval(xe)}});return new Response(_t,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-store",connection:"keep-alive","x-accel-buffering":"no","x-request-id":Y,...Me}})}ae=Qr(G,W,Y,["sequence","id"])}else if(B.method==="POST"&&W.pathname==="/api/v1/deployments"){let G=B.headers.get("idempotency-key")??"";if(!G)throw new i("idempotency_required","Idempotency-Key is required for deployment requests.",428);let ue=await B.text();if(ue.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);let be;try{be=JSON.parse(ue)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}if(!be||typeof be.projectId!=="string"||typeof be.environmentId!=="string"||be.action!==void 0&&!["deploy","rollback"].includes(be.action))throw new i("validation_error","projectId, environmentId, and a valid action are required.",422);let xe=t.createDeployment(X,be,G);return T({operation:xe.operation,idempotentReplay:xe.replay,requestId:Y},202,Y,{...Me,...xe.replay?{"idempotent-replayed":"true"}:{}})}else{let G=await co({...S,authorization:t,now:y},X,{method:B.method,url:W,body:Le});if(G===void 0)throw new i("not_found","API resource was not found.",404);ae=G}return T(ae,200,Y,Me)}catch(ae){if(ae instanceof i)return j(ae.code,ae.message,ae.status,Y,ae.details,Me);if(W.pathname.startsWith("/api/v1/source/")||W.pathname.startsWith("/api/v1/application")||W.pathname.startsWith("/api/v1/compose-")||W.pathname==="/api/v1/registry-connections")return j("validation_error",ae instanceof Error?ae.message:"Integration request could not be completed.",422,Y,void 0,Me);return j("internal_error","The API request could not be completed.",500,Y,void 0,Me)}}}import{createCipheriv as cI,createDecipheriv as dI,createHash as Zf,randomBytes as ci}from"node:crypto";import{createHmac as sI,timingSafeEqual as aI}from"node:crypto";var wp="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Fi(e){let t=0,r=0,a="";for(let l of e){r=r<<8|l,t+=8;while(t>=5)a+=wp[r>>>t-5&31],t-=5}if(t>0)a+=wp[r<<5-t&31];return a}function ol(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,a=0,l=[];for(let m of t){let h=wp.indexOf(m);if(h<0)throw Error("Invalid base32 secret");if(a=a<<5|h,r+=5,r>=8)l.push(a>>>r-8&255),r-=8}return Buffer.from(l)}function Oo(e,t,r=6){let a=Buffer.alloc(8);a.writeBigUInt64BE(BigInt(t));let l=sI("sha1",ol(e)).update(a).digest(),m=l[l.length-1]&15,h=(l[m]&127)<<24|(l[m+1]&255)<<16|(l[m+2]&255)<<8|l[m+3]&255;return String(h%10**r).padStart(r,"0")}function Vm(e,t=Date.now(),r=30){return Oo(e,Math.floor(t/1000/r))}function jm(e,t,r=Date.now(),a=1){return Jr(e,t,r,a)!==void 0}function Jr(e,t,r=Date.now(),a=1){let l=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(l))return;let m=Buffer.from(l),h=Math.floor(r/1000/30);for(let S=-a;S<=a;S++){if(h+S<0)continue;let R=Buffer.from(Oo(e,h+S));if(m.length===R.length&&aI(m,R))return h+S}return}function xo(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var al=1800000,Xe=43200000,cl=3600000,dl=300000,ll=600000;function _n(e){return typeof e==="string"?e:void 0}function Xf(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function lI(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function kp(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function uI(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function pI(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function gI(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function mI(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function Vn(e){return Zf("sha256").update(e).digest("hex")}function ic(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:_n(e.email),emailVerifiedAt:_n(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:_n(e.disabled_at),lastLoginAt:_n(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Jf(e,t){let r=_n(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Xf(e.metadata),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function Ip(e,t){let r=_n(e.revoked_at),a=String(e.idle_expires_at),l=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:_n(e.user_agent),networkHint:_n(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:a,absoluteExpiresAt:l,recentAuthAt:String(e.recent_auth_at),mfaAt:_n(e.mfa_at),revokedAt:r,state:r?"revoked":a<=t||l<=t?"expired":"active"}}function Gf(e){let t=_n(e.verified_at),r=_n(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function Ep(e,t){let r=_n(e.consumed_at),a=String(e.expires_at),l=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:l,expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":l>=5?"locked":a<=t?"expired":"pending"}}function Qf(e){let t=Xf(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Fc(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Qf(e.scopes),allowedDomains:Qf(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Yf(e,t){let r=_n(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function fI(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Ui{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?Zf("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=ci(12),r=cI("aes-256-gcm",this.encryptionKey,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted authentication value is unavailable");let m=dI("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=lI(e.username),r=kp(e.email),a=e.id??this.idFn(),l=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[a,e.actorId,t,r??null,e.emailVerified&&r?l:null,e.passwordHash,e.requiresPasswordUpgrade?1:0,l,l]),this.getIdentity(a)}getIdentity(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE id = ?").get(e);return t?ic(t):void 0}getIdentityByActor(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE actor_id = ?").get(e);return t?ic(t):void 0}getIdentityByUsername(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE username = ? COLLATE NOCASE").get(e.trim());return t?ic(t):void 0}getIdentityByEmail(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE email = ? COLLATE NOCASE").get(e.trim().toLowerCase());return t?ic(t):void 0}listIdentities(){return this.controlPlane.database.query("SELECT * FROM auth_identities ORDER BY username COLLATE NOCASE").all().map(ic)}updatePassword(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let l=this.now();return this.controlPlane.transaction(()=>{if(this.run(`UPDATE auth_identities SET password_hash = ?, credential_version = credential_version + 1,
         requires_password_upgrade = ?, updated_at = ? WHERE id = ?`,[t,r.requiresUpgrade?1:0,l,e]),r.revokeSessions!==!1)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[l,e])}),this.getIdentity(e)}rehashPassword(e,t){let r=this.now();this.run("UPDATE auth_identities SET password_hash = ?, requires_password_upgrade = 0, updated_at = ? WHERE id = ?",[t,r,e]);let a=this.getIdentity(e);if(!a)throw Error("Authentication identity was not found");return a}setVerifiedEmail(e,t){let r=kp(t),a=this.now();this.run("UPDATE auth_identities SET email = ?, email_verified_at = ?, updated_at = ? WHERE id = ?",[r,a,a,e]);let l=this.getIdentity(e);if(!l)throw Error("Authentication identity was not found");return l}recordLogin(e){let t=this.now();this.run("UPDATE auth_identities SET last_login_at = ?, updated_at = ? WHERE id = ?",[t,t,e]);let r=this.getIdentity(e);if(!r)throw Error("Authentication identity was not found");return r}setDisabled(e,t){let r=this.now();this.controlPlane.transaction(()=>{if(this.run("UPDATE auth_identities SET disabled_at = ?, credential_version = credential_version + 1, updated_at = ? WHERE id = ?",[t?r:null,r,e]),t)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[r,e])});let a=this.getIdentity(e);if(!a)throw Error("Authentication identity was not found");return a}createActionToken(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let a=ci(32).toString("base64url"),l=this.idFn(),m=this.now(),h=new Date(this.nowFn().getTime()+Math.min(86400000,Math.max(60000,r.ttlMs??cl))).toISOString();return this.run("INSERT INTO auth_action_tokens (id, identity_id, type, token_hash, metadata, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[l,e,t,Vn(a),JSON.stringify(r.metadata??{}),h,m]),{actionToken:this.getActionToken(l),token:a}}getActionToken(e){let t=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE id = ?").get(e);return t?Jf(t,this.now()):void 0}consumeActionToken(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE token_hash = ? AND type = ?").get(Vn(e),t);if(!r)throw Error("Action token is invalid");let a=Jf(r,this.now());if(a.state!=="pending")throw Error(`Action token is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("Action token is no longer available");return this.getActionToken(a.id)})}revokeActionTokens(e,t){return this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE identity_id = ? AND type = ? AND consumed_at IS NULL",[this.now(),e,t]).changes}createSession(e){let t=this.getIdentity(e.identityId);if(!t||t.disabledAt)throw Error("Authentication identity is unavailable");let r=this.idFn(),a=ci(32).toString("base64url"),l=`v2.${r}.${a}`,m=this.now(),h=Math.min(86400000,Math.max(60000,e.idleTtlMs??al)),S=Math.min(2592000000,Math.max(h,e.absoluteTtlMs??Xe));return this.run(`INSERT INTO auth_sessions (id, identity_id, token_hash, credential_version, auth_method, user_agent, network_hint,
       created_at, last_used_at, idle_expires_at, absolute_expires_at, recent_auth_at, mfa_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,t.id,Vn(l),t.credentialVersion,e.authMethod??"local",e.userAgent?.slice(0,256)??null,e.networkHint?.slice(0,128)??null,m,m,new Date(this.nowFn().getTime()+h).toISOString(),new Date(this.nowFn().getTime()+S).toISOString(),e.recentAuthAt??m,e.mfaAt??null]),{session:this.getSession(r),token:l}}getSession(e){let t=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ?").get(e);return t?Ip(t,this.now()):void 0}verifySessionToken(e){let t=/^v2\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!t)return;let r=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ? AND token_hash = ?").get(t[1],Vn(e));if(!r)return;let a=Ip(r,this.now()),l=this.getIdentity(a.identityId);if(!l||l.disabledAt||a.state!=="active"||a.credentialVersion!==l.credentialVersion)return;let m=this.now(),h=new Date(r.idle_expires_at).getTime()-new Date(r.last_used_at).getTime();return this.run("UPDATE auth_sessions SET last_used_at = ?, idle_expires_at = ? WHERE id = ?",[m,new Date(Math.min(this.nowFn().getTime()+h,new Date(a.absoluteExpiresAt).getTime())).toISOString(),a.id]),{identity:l,session:this.getSession(a.id)}}listSessions(e,t={}){let r=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE identity_id = ? ORDER BY last_used_at DESC").all(e).map((a)=>Ip(a,this.now()));return t.includeInactive?r:r.filter((a)=>a.state==="active")}revokeSession(e,t){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE id = ? AND identity_id = ? AND revoked_at IS NULL",[this.now(),t,e]).changes===1}revokeOtherSessions(e,t){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND id != ? AND revoked_at IS NULL",[this.now(),e,t]).changes}getMfaFactor(e){let t=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(e);return t?Gf(t):void 0}beginTotpEnrollment(e,t={}){let r=this.getIdentity(e);if(!r)throw Error("Authentication identity was not found");let a=this.getMfaFactor(e);if(a?.state==="active")throw Error("MFA is already enabled");let l=Fi(ci(20)),m=t.label?.trim().slice(0,80)||r.email||r.username,h=a?.id??this.idFn(),S=this.now();return this.controlPlane.transaction(()=>{if(a)this.run("UPDATE auth_mfa_factors SET label = ?, secret_ciphertext = ?, created_at = ?, verified_at = NULL, disabled_at = NULL WHERE id = ?",[m,this.encrypt(l),S,h]);else this.run("INSERT INTO auth_mfa_factors (id, identity_id, label, secret_ciphertext, created_at) VALUES (?, ?, ?, ?, ?)",[h,e,m,this.encrypt(l),S]);this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[e])}),{factor:this.getMfaFactor(e),secret:l,uri:Oo({secret:l,account:m,issuer:t.issuer})}}verifyTotpEnrollment(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(e);if(!r||Gf(r).state!=="pending")throw Error("MFA enrollment is not pending");let a=Jr(this.decrypt(String(r.secret_ciphertext)),t,this.nowFn().getTime());if(a===void 0)throw Error("Authenticator code is invalid");let l=Array.from({length:10},()=>{let h=Fi(ci(8)).slice(0,12);return`${h.slice(0,4)}-${h.slice(4,8)}-${h.slice(8)}`}),m=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET verified_at = ?, disabled_at = NULL, last_used_step = ? WHERE identity_id = ?",[m,a,e]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[e]);for(let h of l)this.run("INSERT INTO auth_recovery_codes (id, identity_id, code_hash, created_at) VALUES (?, ?, ?, ?)",[this.idFn(),e,Vn(`${e}:${h.replace(/-/g,"").toUpperCase()}`),m])}),{factor:this.getMfaFactor(e),recoveryCodes:l}}verifyMfaCode(e,t,r={}){let a=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ? AND verified_at IS NOT NULL AND disabled_at IS NULL").get(e);if(!a)return{valid:!1};let l=Jr(this.decrypt(String(a.secret_ciphertext)),t,this.nowFn().getTime());if(l!==void 0){if(this.controlPlane.database.run("UPDATE auth_mfa_factors SET last_used_step = ? WHERE identity_id = ? AND (last_used_step IS NULL OR last_used_step < ?)",[l,e,l]).changes===1)return{valid:!0,method:"totp"}}let m=t.replace(/[-\s]/g,"").toUpperCase();if(!/^[A-Z2-7]{12}$/.test(m))return{valid:!1};let h=Vn(`${e}:${m}`),S=this.controlPlane.database.query("SELECT * FROM auth_recovery_codes WHERE identity_id = ? AND code_hash = ? AND consumed_at IS NULL").get(e,h);if(!S)return{valid:!1};if(r.consumeRecovery!==!1){if(this.controlPlane.database.run("UPDATE auth_recovery_codes SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL",[this.now(),String(S.id)]).changes!==1)return{valid:!1}}return{valid:!0,method:"recovery"}}remainingRecoveryCodes(e){return Number(this.controlPlane.database.query("SELECT COUNT(*) AS count FROM auth_recovery_codes WHERE identity_id = ? AND consumed_at IS NULL").get(e)?.count??0)}disableMfa(e){let t=this.now();this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET disabled_at = ? WHERE identity_id = ? AND disabled_at IS NULL",[t,e]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[e]),this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND consumed_at IS NULL",[t,e])})}createMfaChallenge(e,t){if(this.getMfaFactor(e)?.state!=="active")throw Error("MFA is not enabled");let r=ci(32).toString("base64url"),a=this.idFn(),l=this.now(),m=new Date(this.nowFn().getTime()+dl).toISOString();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND purpose = ? AND consumed_at IS NULL",[l,e,t]),this.run("INSERT INTO auth_mfa_challenges (id, identity_id, purpose, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?)",[a,e,t,Vn(r),m,l])}),{challenge:this.getMfaChallenge(a),token:r}}getMfaChallenge(e){let t=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE id = ?").get(e);return t?Ep(t,this.now()):void 0}inspectMfaChallengeToken(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(Vn(e),t);return r?Ep(r,this.now()):void 0}completeMfaChallenge(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(Vn(e),r);if(!a)throw Error("MFA challenge is invalid");let l=Ep(a,this.now());if(l.state!=="pending")throw Error(`MFA challenge is ${l.state}`);let m=this.verifyMfaCode(l.identityId,t);if(!m.valid||!m.method)throw this.run("UPDATE auth_mfa_challenges SET attempts = attempts + 1 WHERE id = ?",[l.id]),Error("Authenticator or recovery code is invalid");if(this.controlPlane.database.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND attempts < 5 AND expires_at > ?",[this.now(),l.id,this.now()]).changes!==1)throw Error("MFA challenge is no longer available");return{identity:this.getIdentity(l.identityId),challenge:this.getMfaChallenge(l.id),method:m.method}}markSessionStepUp(e,t=!1){let r=this.now();this.run("UPDATE auth_sessions SET recent_auth_at = ?, mfa_at = CASE WHEN ? = 1 THEN ? ELSE mfa_at END WHERE id = ? AND revoked_at IS NULL",[r,t?1:0,r,e]);let a=this.getSession(e);if(!a)throw Error("Authentication session was not found");return a}isRecentlyAuthenticated(e,t=600000){return this.nowFn().getTime()-new Date(e.recentAuthAt).getTime()<=t}upsertOidcProvider(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("OIDC provider organization was not found");let t=uI(e.slug),r=e.name.trim().slice(0,80);if(!r)throw Error("OIDC provider name is required");let a=pI(e.issuer),l=e.clientId.trim();if(!l||l.length>512)throw Error("OIDC client ID is required");let m=mI(e.scopes),h=gI(e.allowedDomains),S=e.id?this.getOidcProvider(e.id):this.getOidcProviderBySlug(t),R=this.now();if(S){if(S.organizationId!==e.organizationId)throw Error("OIDC provider belongs to another organization");return this.run(`UPDATE auth_oidc_providers SET slug = ?, name = ?, issuer = ?, client_id = ?,
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,t.id,Vn(l),t.credentialVersion,e.authMethod??"local",e.userAgent?.slice(0,256)??null,e.networkHint?.slice(0,128)??null,m,m,new Date(this.nowFn().getTime()+h).toISOString(),new Date(this.nowFn().getTime()+S).toISOString(),e.recentAuthAt??m,e.mfaAt??null]),{session:this.getSession(r),token:l}}getSession(e){let t=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ?").get(e);return t?Ip(t,this.now()):void 0}verifySessionToken(e){let t=/^v2\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!t)return;let r=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE id = ? AND token_hash = ?").get(t[1],Vn(e));if(!r)return;let a=Ip(r,this.now()),l=this.getIdentity(a.identityId);if(!l||l.disabledAt||a.state!=="active"||a.credentialVersion!==l.credentialVersion)return;let m=this.now(),h=new Date(r.idle_expires_at).getTime()-new Date(r.last_used_at).getTime();return this.run("UPDATE auth_sessions SET last_used_at = ?, idle_expires_at = ? WHERE id = ?",[m,new Date(Math.min(this.nowFn().getTime()+h,new Date(a.absoluteExpiresAt).getTime())).toISOString(),a.id]),{identity:l,session:this.getSession(a.id)}}listSessions(e,t={}){let r=this.controlPlane.database.query("SELECT * FROM auth_sessions WHERE identity_id = ? ORDER BY last_used_at DESC").all(e).map((a)=>Ip(a,this.now()));return t.includeInactive?r:r.filter((a)=>a.state==="active")}revokeSession(e,t){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE id = ? AND identity_id = ? AND revoked_at IS NULL",[this.now(),t,e]).changes===1}revokeOtherSessions(e,t){return this.controlPlane.database.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND id != ? AND revoked_at IS NULL",[this.now(),e,t]).changes}getMfaFactor(e){let t=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(e);return t?Gf(t):void 0}beginTotpEnrollment(e,t={}){let r=this.getIdentity(e);if(!r)throw Error("Authentication identity was not found");let a=this.getMfaFactor(e);if(a?.state==="active")throw Error("MFA is already enabled");let l=Fi(ci(20)),m=t.label?.trim().slice(0,80)||r.email||r.username,h=a?.id??this.idFn(),S=this.now();return this.controlPlane.transaction(()=>{if(a)this.run("UPDATE auth_mfa_factors SET label = ?, secret_ciphertext = ?, created_at = ?, verified_at = NULL, disabled_at = NULL WHERE id = ?",[m,this.encrypt(l),S,h]);else this.run("INSERT INTO auth_mfa_factors (id, identity_id, label, secret_ciphertext, created_at) VALUES (?, ?, ?, ?, ?)",[h,e,m,this.encrypt(l),S]);this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[e])}),{factor:this.getMfaFactor(e),secret:l,uri:xo({secret:l,account:m,issuer:t.issuer})}}verifyTotpEnrollment(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ?").get(e);if(!r||Gf(r).state!=="pending")throw Error("MFA enrollment is not pending");let a=Jr(this.decrypt(String(r.secret_ciphertext)),t,this.nowFn().getTime());if(a===void 0)throw Error("Authenticator code is invalid");let l=Array.from({length:10},()=>{let h=Fi(ci(8)).slice(0,12);return`${h.slice(0,4)}-${h.slice(4,8)}-${h.slice(8)}`}),m=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET verified_at = ?, disabled_at = NULL, last_used_step = ? WHERE identity_id = ?",[m,a,e]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[e]);for(let h of l)this.run("INSERT INTO auth_recovery_codes (id, identity_id, code_hash, created_at) VALUES (?, ?, ?, ?)",[this.idFn(),e,Vn(`${e}:${h.replace(/-/g,"").toUpperCase()}`),m])}),{factor:this.getMfaFactor(e),recoveryCodes:l}}verifyMfaCode(e,t,r={}){let a=this.controlPlane.database.query("SELECT * FROM auth_mfa_factors WHERE identity_id = ? AND verified_at IS NOT NULL AND disabled_at IS NULL").get(e);if(!a)return{valid:!1};let l=Jr(this.decrypt(String(a.secret_ciphertext)),t,this.nowFn().getTime());if(l!==void 0){if(this.controlPlane.database.run("UPDATE auth_mfa_factors SET last_used_step = ? WHERE identity_id = ? AND (last_used_step IS NULL OR last_used_step < ?)",[l,e,l]).changes===1)return{valid:!0,method:"totp"}}let m=t.replace(/[-\s]/g,"").toUpperCase();if(!/^[A-Z2-7]{12}$/.test(m))return{valid:!1};let h=Vn(`${e}:${m}`),S=this.controlPlane.database.query("SELECT * FROM auth_recovery_codes WHERE identity_id = ? AND code_hash = ? AND consumed_at IS NULL").get(e,h);if(!S)return{valid:!1};if(r.consumeRecovery!==!1){if(this.controlPlane.database.run("UPDATE auth_recovery_codes SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL",[this.now(),String(S.id)]).changes!==1)return{valid:!1}}return{valid:!0,method:"recovery"}}remainingRecoveryCodes(e){return Number(this.controlPlane.database.query("SELECT COUNT(*) AS count FROM auth_recovery_codes WHERE identity_id = ? AND consumed_at IS NULL").get(e)?.count??0)}disableMfa(e){let t=this.now();this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_factors SET disabled_at = ? WHERE identity_id = ? AND disabled_at IS NULL",[t,e]),this.run("DELETE FROM auth_recovery_codes WHERE identity_id = ?",[e]),this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND consumed_at IS NULL",[t,e])})}createMfaChallenge(e,t){if(this.getMfaFactor(e)?.state!=="active")throw Error("MFA is not enabled");let r=ci(32).toString("base64url"),a=this.idFn(),l=this.now(),m=new Date(this.nowFn().getTime()+dl).toISOString();return this.controlPlane.transaction(()=>{this.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE identity_id = ? AND purpose = ? AND consumed_at IS NULL",[l,e,t]),this.run("INSERT INTO auth_mfa_challenges (id, identity_id, purpose, token_hash, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?)",[a,e,t,Vn(r),m,l])}),{challenge:this.getMfaChallenge(a),token:r}}getMfaChallenge(e){let t=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE id = ?").get(e);return t?Ep(t,this.now()):void 0}inspectMfaChallengeToken(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(Vn(e),t);return r?Ep(r,this.now()):void 0}completeMfaChallenge(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM auth_mfa_challenges WHERE token_hash = ? AND purpose = ?").get(Vn(e),r);if(!a)throw Error("MFA challenge is invalid");let l=Ep(a,this.now());if(l.state!=="pending")throw Error(`MFA challenge is ${l.state}`);let m=this.verifyMfaCode(l.identityId,t);if(!m.valid||!m.method)throw this.run("UPDATE auth_mfa_challenges SET attempts = attempts + 1 WHERE id = ?",[l.id]),Error("Authenticator or recovery code is invalid");if(this.controlPlane.database.run("UPDATE auth_mfa_challenges SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND attempts < 5 AND expires_at > ?",[this.now(),l.id,this.now()]).changes!==1)throw Error("MFA challenge is no longer available");return{identity:this.getIdentity(l.identityId),challenge:this.getMfaChallenge(l.id),method:m.method}}markSessionStepUp(e,t=!1){let r=this.now();this.run("UPDATE auth_sessions SET recent_auth_at = ?, mfa_at = CASE WHEN ? = 1 THEN ? ELSE mfa_at END WHERE id = ? AND revoked_at IS NULL",[r,t?1:0,r,e]);let a=this.getSession(e);if(!a)throw Error("Authentication session was not found");return a}isRecentlyAuthenticated(e,t=600000){return this.nowFn().getTime()-new Date(e.recentAuthAt).getTime()<=t}upsertOidcProvider(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("OIDC provider organization was not found");let t=uI(e.slug),r=e.name.trim().slice(0,80);if(!r)throw Error("OIDC provider name is required");let a=pI(e.issuer),l=e.clientId.trim();if(!l||l.length>512)throw Error("OIDC client ID is required");let m=mI(e.scopes),h=gI(e.allowedDomains),S=e.id?this.getOidcProvider(e.id):this.getOidcProviderBySlug(t),R=this.now();if(S){if(S.organizationId!==e.organizationId)throw Error("OIDC provider belongs to another organization");return this.run(`UPDATE auth_oidc_providers SET slug = ?, name = ?, issuer = ?, client_id = ?,
         client_secret_ciphertext = COALESCE(?, client_secret_ciphertext), scopes = ?, allowed_domains = ?,
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,a,l,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(m),JSON.stringify(h),e.defaultRole??S.defaultRole,e.enabled??S.enabled?1:0,e.enforceSso??S.enforceSso?1:0,R,S.id]),this.getOidcProvider(S.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let y=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[y,e.organizationId,t,r,a,l,this.encrypt(e.clientSecret),JSON.stringify(m),JSON.stringify(h),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,R,R]),this.getOidcProvider(y)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?Fc(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?Fc(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(Fc).filter((a)=>t.includeDisabled||a.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:Fc(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let l=this.idFn(),m=ci(32).toString("base64url"),h=ci(32).toString("base64url"),S=ci(64).toString("base64url"),R=this.now(),y=new Date(this.nowFn().getTime()+ll).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l,e,Vn(m),this.encrypt(h),this.encrypt(S),t,r,y,R]),{transaction:this.getOidcTransaction(l),state:m,nonce:h,verifier:S}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Yf(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Yf(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?fI(r):void 0}linkOidcSubject(e,t,r,a){let l=this.getOidcProvider(e),m=this.getIdentity(t);if(!l||!m)throw Error("OIDC provider or identity was not found");let h=kp(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let S=this.getOidcSubject(e,r);if(S&&S.identityId!==t)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(S)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[h,R,S.id]),this.getOidcSubject(e,r);let y=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[y,e,t,r,h,R,R]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function Xr(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-3kpnn06d.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as hI}from"node:crypto";import{chmodSync as yI,existsSync as vI,mkdirSync as bI,readFileSync as SI,writeFileSync as wI}from"node:fs";import{dirname as kI}from"node:path";function zm(){return L("auth-encryption-key")}function Ye(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(vI(r)){let l=SI(r,"utf8").trim();if(l)return l}}catch{}let a=hI(32).toString("base64url");try{bI(kI(r),{recursive:!0,mode:448}),wI(r,`${a}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l,e,Vn(m),this.encrypt(h),this.encrypt(S),t,r,y,R]),{transaction:this.getOidcTransaction(l),state:m,nonce:h,verifier:S}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Yf(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,Vn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Yf(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?fI(r):void 0}linkOidcSubject(e,t,r,a){let l=this.getOidcProvider(e),m=this.getIdentity(t);if(!l||!m)throw Error("OIDC provider or identity was not found");let h=kp(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let S=this.getOidcSubject(e,r);if(S&&S.identityId!==t)throw Error("OIDC subject is already linked to another identity");let R=this.now();if(S)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[h,R,S.id]),this.getOidcSubject(e,r);let y=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[y,e,t,r,h,R,R]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function Xr(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-983txhkg.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as hI}from"node:crypto";import{chmodSync as yI,existsSync as vI,mkdirSync as bI,readFileSync as SI,writeFileSync as wI}from"node:fs";import{dirname as kI}from"node:path";function zm(){return L("auth-encryption-key")}function Ye(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(vI(r)){let l=SI(r,"utf8").trim();if(l)return l}}catch{}let a=hI(32).toString("base64url");try{bI(kI(r),{recursive:!0,mode:448}),wI(r,`${a}
 `,{mode:384}),yI(r,384)}catch{}return a}import{constants as II,createHash as Rp,createPublicKey as EI,createVerify as RI,timingSafeEqual as AI}from"node:crypto";var kh=new Set(["RS256","PS256","ES256"]),wh=60;function Uc(e,t){let r=new URL(e),a=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&a))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function Ap(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function Cp(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let l=await e.text();if(l.length>1048576)throw Error(`${t} response is too large`);try{return Ap(JSON.parse(l),t)}catch(m){if(m instanceof Error&&m.message===`${t} is invalid`)throw m;throw Error(`${t} returned invalid JSON`)}}function CI(e,t){let r=Rp("sha256").update(e).digest(),a=Rp("sha256").update(t).digest();return AI(r,a)}function ul(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function Lo(e,t=fetch){let r=Uc(e.issuer,"OIDC issuer"),a=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),l=await Cp(await t(a,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(l.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let h of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof l[h]!=="string")throw Error(`OIDC discovery is missing ${h}`);Uc(l[h],`OIDC ${h}`)}if(Array.isArray(l.response_types_supported)&&!l.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(l.code_challenge_methods_supported)&&!l.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let m=Array.isArray(l.id_token_signing_alg_values_supported)?l.id_token_signing_alg_values_supported.filter((h)=>typeof h==="string"):[];if(m.length>0&&!m.some((h)=>kh.has(h)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return l}async function $o(e,t,r,a,l=fetch){let m=e.getOidcProviderBySlug(t);if(!m?.enabled)throw Error("OIDC provider is unavailable");let h=Uc(r,"Application origin").origin,S=await Lo(m,l),R=`${h}/auth/oidc/${encodeURIComponent(m.slug)}/callback`,y=e.beginOidcTransaction(m.id,R,ul(a)),C=new URL(S.authorization_endpoint);return C.searchParams.set("response_type","code"),C.searchParams.set("client_id",m.clientId),C.searchParams.set("redirect_uri",R),C.searchParams.set("scope",m.scopes.join(" ")),C.searchParams.set("state",y.state),C.searchParams.set("nonce",y.nonce),C.searchParams.set("code_challenge",Rp("sha256").update(y.verifier).digest("base64url")),C.searchParams.set("code_challenge_method","S256"),{authorizationUrl:C.href,expiresAt:y.transaction.expiresAt}}function PI(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:Ap(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:Ap(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function _I(e,t,r){let a=PI(e),l=typeof a.header.alg==="string"?a.header.alg:"",m=typeof a.header.kid==="string"?a.header.kid:"";if(!kh.has(l)||!m)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(l))throw Error("OIDC ID-token algorithm was not advertised by the provider");let h=await Cp(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(h.keys))throw Error("OIDC signing-key response is invalid");let S=h.keys.find((T)=>{if(!T||typeof T!=="object"||Array.isArray(T))return!1;let j=T;return j.kid===m&&(!j.alg||j.alg===l)&&(!j.use||j.use==="sig")});if(!S)throw Error("OIDC ID-token signing key was not found");let R=EI({key:S,format:"jwk"}),y=RI("SHA256").update(a.signingInput).end();if(!(l==="PS256"?y.verify({key:R,padding:II.RSA_PKCS1_PSS_PADDING,saltLength:32},a.signature):l==="ES256"?y.verify({key:R,dsaEncoding:"ieee-p1363"},a.signature):y.verify(R,a.signature)))throw Error("OIDC ID-token signature is invalid");return a.claims}function TI(e,t,r,a){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let l=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((R)=>typeof R==="string"):[];if(!l.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((l.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let m=Math.floor(a.getTime()/1000);if(typeof e.exp!=="number"||e.exp<m-wh)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>m+wh)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!CI(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let h=e.email.trim().toLowerCase();if(h.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(h))throw Error("OIDC provider returned an invalid email address");let S=h.split("@")[1];if(!S||!t.allowedDomains.includes(S))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:h,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function Mo(e,t,r=fetch){let a=e.getOidcProviderBySlug(t.providerSlug);if(!a?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let l=Uc(t.origin,"Application origin").origin,m=e.consumeOidcTransaction(a.id,t.state),h=`${l}/auth/oidc/${encodeURIComponent(a.slug)}/callback`;if(m.transaction.redirectUri!==h)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:S}=e.getOidcProviderCredentials(a.id),R=await Lo(a,r),y=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:m.transaction.redirectUri,code_verifier:m.verifier}),C={accept:"application/json","content-type":"application/x-www-form-urlencoded"},T=R.token_endpoint_auth_methods_supported??["client_secret_basic"];if(T.includes("client_secret_basic")){let V=(Y)=>new URLSearchParams({value:Y}).toString().slice(6),W=`${V(a.clientId)}:${V(S)}`;C.authorization=`Basic ${Buffer.from(W).toString("base64")}`}else if(T.includes("client_secret_post"))y.set("client_id",a.clientId),y.set("client_secret",S);else throw Error("OIDC provider does not support a configured client authentication method");let j=await Cp(await r(R.token_endpoint,{method:"POST",headers:C,body:y,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof j.id_token!=="string")throw Error("OIDC token response did not include an ID token");let B=await _I(j.id_token,R,r);return{identity:TI(B,a,m.nonce,t.now??new Date),returnPath:m.transaction.returnPath}}import{createHash as xI,randomBytes as DI}from"node:crypto";var Ph=new Set(pe),pl=7776000000,gl=31536000000,ml=86400000;function di(e){return typeof e==="string"?e:void 0}function Rh(e){return xI("sha256").update(e).digest("hex")}function OI(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&Ph.has(r)):[]}catch{return[]}}function $I(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function Pp(e){let t=di(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:di(e.description),createdByActorId:di(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function _p(e,t){let r=di(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:OI(e.capabilities),scope:$I(e),expiresAt:a,lastUsedAt:di(e.last_used_at),lastNetworkHint:di(e.last_network_hint),revokedAt:r,rotatedFromTokenId:di(e.rotated_from_token_id),createdByActorId:di(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":a<=t?"expired":"active"}}function NI(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:di(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class Qi{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let a=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),l=this.idFn(),m=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l,e.organizationId,a.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,m,m]);let h=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:a.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),S=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:l,roleTemplate:e.roleTemplate,scope:{type:S.type,id:S.id??null}}}),{serviceAccount:this.getServiceAccount(l),membership:h}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?Pp(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?Pp(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(Pp).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let a=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[a,a,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[a,a,e]);let l=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(l?.status==="active")this.controlPlane.revokeMembership(l.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let a=[...new Set(e.capabilities)];if(a.length===0||a.some((j)=>!Ph.has(j)))throw Error("API token requires valid explicit capabilities");let l=e.scope??r.scope,m=this.controlPlane.resolveAuthorizationTarget(t.organizationId,l);if(!m)throw Error("API token scope was not found in this organization");for(let j of a)if(!D({membership:r,grants:this.controlPlane.listGrants(r.id),capability:j,target:m}).allowed)throw Error(`Service-account membership does not grant ${j} at the token scope`);let h=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+pl);if(!Number.isFinite(h.getTime())||h.getTime()<=this.nowFn().getTime()+60000||h.getTime()>this.nowFn().getTime()+gl)throw Error("API token expiry must be between one minute and one year from now");let S=this.idFn(),R=DI(32).toString("base64url"),y=`tsc_v1.${S}.${R}`,C=`tsc_v1.${S.slice(0,8)}`,T=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[S,t.id,e.name.trim().slice(0,100)||"API token",Rh(y),C,JSON.stringify(a.sort()),l.type,l.type==="organization"?null:l.id??null,h.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,T,T]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:S,prefix:C,capabilities:a,scope:{type:l.type,id:l.id??null},expiresAt:h.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(S),secret:y}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?_p(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>_p(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let a=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],Rh(e));if(!a)return;let l=_p(a,this.now()),m=this.getServiceAccount(l.serviceAccountId);if(!m||m.state!=="active"||l.state!=="active")return;let h=this.controlPlane.getActor(m.actorId),S=this.controlPlane.getMembershipForActor(m.organizationId,m.actorId);if(!h||h.disabledAt||!S||S.status!=="active")return;let R=this.now(),y=!l.lastUsedAt||this.nowFn().getTime()-new Date(l.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[R,t?.slice(0,128)??null,R,l.id]),y)this.controlPlane.appendEvent({organizationId:m.organizationId,actorId:h.id,type:"api.token.used",payload:{serviceAccountId:m.id,tokenId:l.id,prefix:l.prefix}});return{serviceAccount:m,token:this.getToken(l.id),actor:h,membership:S}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let a=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),l=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:l?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:a.token.id}}),a}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let a=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[a,a,e]);let l=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:l?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?NI(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),a=this.now(),l=new Date(this.nowFn().getTime()+ml).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
@@ -98,12 +98,12 @@ requirepass ${t.replaceAll("\\","\\\\").replaceAll(`
 protected-mode yes
 requirepass ${a.replaceAll("\\","\\\\").replaceAll(`
 `,"")}
-`:a;if(await this.runtime.seedSecret(`${l}-secret`,C),S==="redis")await this.runtime.restart(l);return{status:S==="redis"?"restarting":"running",username:R}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let m=await this.backup(e,r);return await this.runtime.remove(l),await this.runtime.removeVolume(`${l}-secret`),await this.runtime.removeVolume(`${l}-data`),{status:"deleted",finalBackupId:m.backupId??null,backupPath:m.path??null}}if(t==="expose")throw Error("Direct container exposure is refused; use a reviewed firewall and proxy policy.");throw Error(`${t} requires a configured engine lifecycle runner.`)}}import{createCipheriv as tE,createDecipheriv as rE,createHash as Uh,randomBytes as nE}from"node:crypto";class la{controlPlane;now;key;constructor(e,t,r=()=>new Date){this.controlPlane=e;this.now=r;if(!t)throw Error("Data-service encryption key is required.");this.key=Uh("sha256").update(`ts-cloud:data-services:${t}`).digest()}encrypt(e){let t=nE(12),r=tE("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted data-service secret is unavailable.");try{let m=rE("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}catch{throw Error("Encrypted data-service secret could not be decrypted.")}}async put(e,t){if(!/^secret:\/\/data-services\/[A-Za-z0-9._/-]+$/.test(e))throw Error("Invalid data-service secret reference.");if(!t)throw Error("Data-service secret cannot be empty.");let r=this.now().toISOString();this.controlPlane.database.run("INSERT INTO data_service_secrets (reference,ciphertext,fingerprint,created_at,updated_at) VALUES (?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,updated_at=excluded.updated_at",[e,this.encrypt(t),Uh("sha256").update(t).digest("hex"),r,r])}async resolve(e){let t=this.controlPlane.database.query("SELECT ciphertext FROM data_service_secrets WHERE reference = ?").get(e);if(!t)throw Error("Data-service secret was not found.");return this.decrypt(t.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM data_service_secrets WHERE reference = ?",[e])}}import{existsSync as sc}from"node:fs";import{mkdir as rd,readdir as iE,rename as Bp,rm as Ns}from"node:fs/promises";import{relative as oE,resolve as hn,sep as nd}from"node:path";function wt(e,t){if(t==="gzip")return Buffer.from(Bun.gzipSync(Uint8Array.from(e)));if(t==="zstd")return Buffer.from(Bun.zstdCompressSync(Uint8Array.from(e)));return Buffer.from(e)}function xe(e,t){if(t==="gzip")return Buffer.from(Bun.gunzipSync(Uint8Array.from(e)));if(t==="zstd")return Buffer.from(Bun.zstdDecompressSync(Uint8Array.from(e)));return Buffer.from(e)}async function Mp(e,t){let r=Bun.spawn(["tar",...e],{stdin:t?Buffer.from(t):void 0,stdout:"pipe",stderr:"pipe"}),[a,l,m]=await Promise.all([r.exited,new Response(r.stdout).arrayBuffer(),new Response(r.stderr).text()]);if(a!==0)throw Error(m.trim()||`tar exited with status ${a}.`);return{stdout:Buffer.from(l),stderr:m}}function sE(e){let t=e.replaceAll("\\","/").replace(/^\.\//,"");return!!t&&!t.startsWith("/")&&!t.split("/").includes("..")}class yu{async create(e,t,r){return(await Mp(["-C",e,"-cf","-",...r.map((l)=>`--exclude=${l}`),"--",...t])).stdout}async extract(e,t){await rd(t,{recursive:!0,mode:448}),await Mp(["-C",t,"-xf","-"],e)}async inspect(e){let t=await Mp(["-tf","-"],e),r=t.stdout.toString().split(`
-`).filter(Boolean);if(r.some((a)=>!sE(a)))throw Error("Backup archive contains an unsafe path.");return{entries:r,bytes:e.byteLength}}}function qh(e,t){if(!t.trim())throw Error("File backup paths cannot be empty.");let r=hn(e,t),a=oE(e,r);if(a===".."||a.startsWith(`..${nd}`)||a==="")throw Error(`File backup path ${t} is outside the project root.`);return a}function td(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("File restores require a safe target name.");return t}class Ra{runtime;root;restoreRoot;constructor(e,t=new yu,r=d(e,"restores","files")){this.runtime=t;this.root=hn(e),this.restoreRoot=hn(r)}paths(e){let t=[...new Set(e.includePatterns.map((r)=>qh(this.root,r)))];if(!t.length)throw Error("File backup policies require at least one project-relative path.");for(let r of t)if(!sc(hn(this.root,r)))throw Error(`File backup path ${r} was not found.`);return t.filter((r)=>!t.some((a)=>a!==r&&r.startsWith(`${a}${nd}`)))}async create(e,t){let r=this.paths(e),a=await this.runtime.create(this.root,r,e.excludePatterns),l=await this.runtime.inspect(a),m=e.compression??"none",h=wt(a,m),S=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/files/${S}.tar${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:h,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/x-tar",manifest:{archive:"tar",compression:m,sourcePaths:r,excluded:e.excludePatterns,entries:l.entries.length},toolVersion:"system-tar"}}async restore(e,t,r,a){if(!t)throw Error("File restore requires an archive payload.");let l=xe(t,String(e.manifest.compression??"none"));if(await this.runtime.inspect(l),r.restoreMode==="in_place"){let h=hn(this.restoreRoot,`.staging-${td(r)}`),S=hn(this.restoreRoot,`.rollback-${td(r)}`),R=Array.isArray(e.manifest.sourcePaths)?e.manifest.sourcePaths.map(String):[];if(!R.length)throw Error("File recovery point has no source path manifest.");await Ns(h,{recursive:!0,force:!0}),await Ns(S,{recursive:!0,force:!0}),await this.runtime.extract(l,h),await rd(S,{recursive:!0,mode:448});let y=[];try{for(let C of R){let T=hn(this.root,qh(this.root,C)),j=hn(h,C),B=hn(S,C);if(await rd(hn(B,".."),{recursive:!0}),sc(T))await Bp(T,B);await rd(hn(T,".."),{recursive:!0}),await Bp(j,T),y.push(C)}}catch(C){for(let T of y.reverse()){let j=hn(this.root,T),B=hn(S,T);if(await Ns(j,{recursive:!0,force:!0}),sc(B))await Bp(B,j)}throw C}finally{await Ns(h,{recursive:!0,force:!0})}return await Ns(S,{recursive:!0,force:!0}),{path:this.root,restoredPaths:R,inPlace:!0}}let m=hn(this.restoreRoot,td(r));if(sc(m))throw Error("The isolated file restore target already exists.");return await this.runtime.extract(l,m),{path:m,isolated:!0}}async verify(e,t,r){let a=xe(t,String(e.manifest.compression??"none")),l=await this.runtime.inspect(a);return{archive:"tar",entries:l.entries.length,uncompressedBytes:l.bytes}}async validateHealth(e,t){let r=String(e.path??"");if(!r||!r.startsWith(`${this.restoreRoot}${nd}`)||!sc(r))throw Error("Isolated file restore target was not found.");let a=await iE(r);return{healthy:!0,path:r,topLevelEntries:a.length}}async cleanup(e,t){let r=td(e),a=hn(this.restoreRoot,r);if(!a.startsWith(`${this.restoreRoot}${nd}`))throw Error("Refusing to clean a file restore outside the restore root.");await Ns(a,{recursive:!0,force:!0})}}class Da{services;secrets;transport;constructor(e,t,r=new er){this.services=e;this.secrets=t;this.transport=r}async create(e,t){if(!e.dataServiceId)throw Error("Logical database backups require a data service.");let r=this.services.get(e.dataServiceId);if(!r)throw Error("Logical database service was not found.");if(!["container","server"].includes(r.provider))throw Error("Logical database backups require an on-box data service.");let a=await this.transport.exportLogicalBackup(r.id),l=e.compression??"none",m=wt(a.body,l),h=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/databases/${r.id}/${h}.sql${l==="none"?"":l==="gzip"?".gz":".zst"}`,body:m,contentType:l==="gzip"?"application/gzip":l==="zstd"?"application/zstd":"application/sql",engineVersion:a.engineVersion,toolVersion:"engine-native",manifest:{format:"logical-sql-v1",sourceDataServiceId:r.id,engine:a.engine,database:a.database,username:a.username,compression:l}}}async restore(e,t,r,a){if(!t)throw Error("Logical database backup body is unavailable.");let l=String(e.dataServiceId??e.manifest.sourceDataServiceId??""),m=String(r.dataServiceId??r.targetId??""),h=r.inPlace===!0;if(!l||!m)throw Error("Logical database restore requires source and target identifiers.");if(h&&m!==l)throw Error("An in-place restore must target the source data service.");let S=this.services.get(l);if(!S?.credentialRef)throw Error("Logical database credential reference was not found.");let R=await this.secrets.resolve(S.credentialRef);return this.transport.restoreLogicalBackup({sourceId:l,targetId:m,body:xe(t,String(e.manifest.compression??"none")),credential:R,inPlace:h})}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place database restores cannot be cleaned as drills.");let r=String(e.dataServiceId??e.targetId??"");if(!r)throw Error("Database cleanup requires a target identifier.");await this.transport.removeRestoredService(r)}}var Lp=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;async function ss(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t?"pipe":"ignore",stdout:"pipe",stderr:"pipe"}),l=new Response(a.stdout).arrayBuffer(),m=new Response(a.stderr).text();if(t)a.stdin.write(t),a.stdin.end();let[h,S,R]=await Promise.all([a.exited,l,m]);if(h!==0&&!r)throw Error(`Docker volume command failed (${h}): ${R.trim()}`);return{code:h,stdout:Buffer.from(S),stderr:R}}class Iu{async exists(e){return(await ss(["volume","inspect",e],void 0,!0)).code===0}async export(e){return(await ss(["run","--rm","-v",`${e}:/source:ro`,"alpine:3.21","tar","-C","/source","-czf","-","."])).stdout}async import(e,t,r=!1){if(!await this.exists(e))await ss(["volume","create",e]);try{if(r)await ss(["run","--rm","-v",`${e}:/target`,"alpine:3.21","sh","-c","find /target -mindepth 1 -delete"]);await ss(["run","--rm","-i","-v",`${e}:/target`,"alpine:3.21","tar","-C","/target","--no-same-owner","-xzf","-"],t)}catch(a){throw await this.remove(e),a}}async remove(e){await ss(["volume","rm",e],void 0,!0)}async probe(e){let t=(await ss(["run","--rm","-v",`${e}:/target:ro`,"alpine:3.21","sh","-c",`find /target -mindepth 1 -printf '%s\\n' | awk '{n+=1;b+=$1} END {print n ":" b}'`])).stdout.toString(),[r,a]=t.trim().split(":").map(Number);if(!Number.isFinite(r)||!Number.isFinite(a))throw Error("Restored volume health probe returned invalid output.");return{entries:r,bytes:a}}}class Pa{runtime;constructor(e=new Iu){this.runtime=e}async create(e,t){let r=String(e.includePatterns?.[0]??e.resourceId??"");if(!Lp.test(r))throw Error("Volume backups require a valid named-volume resource identifier.");if(!await this.runtime.exists(r))throw Error(`Volume ${r} was not found.`);let a=await this.runtime.export(r),l=Buffer.from(Bun.gunzipSync(Uint8Array.from(a))),m=e.compression??"gzip",h=m==="gzip"?a:wt(l,m),S=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/volumes/${r}/${S}.tar${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:h,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/x-tar",toolVersion:"alpine-tar",manifest:{format:"docker-volume-tar-v1",archive:"tar",compression:m,sourceVolume:r}}}async restore(e,t,r,a){if(!t)throw Error("Volume backup body is unavailable.");let l=String(e.manifest.sourceVolume??e.resourceId??""),m=String(r.volumeName??r.targetId??"");if(!Lp.test(m))throw Error("Volume restore requires a valid target volume name.");if(m===l&&r.inPlace!==!0)throw Error("An isolated volume restore requires a distinct target.");let h=await this.runtime.exists(m);if(!r.inPlace&&h)throw Error(`Restore target volume ${m} already exists.`);if(r.inPlace===!0&&m!==l)throw Error("An in-place volume restore must target the source volume.");if(r.inPlace===!0&&!h)throw Error("The in-place target volume was not found.");let S=String(e.manifest.compression??"gzip"),R=S==="gzip"?Buffer.from(t):Buffer.from(Bun.gzipSync(Uint8Array.from(xe(t,S))));await this.runtime.import(m,R,r.inPlace===!0);let y=await this.runtime.probe(m);return{volumeName:m,healthy:!0,...y}}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place volume restores cannot be cleaned as drills.");let r=String(e.volumeName??e.targetId??"");if(!Lp.test(r))throw Error("Volume cleanup requires a valid target volume name.");await this.runtime.remove(r)}}import{existsSync as Fp}from"node:fs";import{mkdir as aE,readFile as Vh,rm as cE,writeFile as Wh}from"node:fs/promises";import{basename as Qh,resolve as so,sep as Hh}from"node:path";import{Database as dE}from"bun:sqlite";function Kh(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("Control-plane restores require a safe target name.");return t}function Jh(e){let t=JSON.parse(Buffer.from(e).toString());if(t.format!=="ts-cloud-control-plane-v1"||!t.database)throw Error("Control-plane backup archive is invalid.");if(!Array.isArray(t.config)||t.config.some((r)=>Qh(r.name)!==r.name))throw Error("Control-plane backup contains an unsafe config path.");return t}function Gh(e){let t=dE.deserialize(Uint8Array.from(e));try{let r=t.query("PRAGMA integrity_check").get()?.integrity_check??"unknown",a=t.query("SELECT count(*) AS count FROM sqlite_master WHERE type='table'").get()?.count??0;if(r!=="ok")throw Error(`Restored control-plane integrity check failed: ${r}.`);return{integrity:r,tables:a}}finally{t.close()}}class Na{controlPlane;root;restoreRoot;constructor(e,t,r=d(t,"restores","control-plane")){this.controlPlane=e;this.root=so(t),this.restoreRoot=so(r)}async create(e,t){let r=e.includePatterns.length?e.includePatterns:["cloud.config.ts"],a=[];for(let R of r){let y=Qh(R),C=so(this.root,y);if(y!==R&&R!==`./${y}`)throw Error("Control-plane config paths must be project-root files.");if(Fp(C))a.push({name:y,body:(await Vh(C)).toString("base64")})}let l={format:"ts-cloud-control-plane-v1",createdAt:new Date().toISOString(),database:Buffer.from(this.controlPlane.database.serialize()).toString("base64"),config:a},m=e.compression??"none",h=wt(Buffer.from(JSON.stringify(l)),m),S=String(t.operation?.id??l.createdAt).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/control-plane/${S}.json${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:h,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/vnd.ts-cloud.control-plane+json",manifest:{format:l.format,configFiles:a.map((R)=>R.name),sensitive:!0,compression:m},toolVersion:"bun-sqlite-serialize"}}async restore(e,t,r,a){if(!t)throw Error("Control-plane restore requires an archive payload.");if(r.restoreMode==="in_place")throw Error("A live control plane can only be restored into an isolated recovery target.");let l=Jh(xe(t,String(e.manifest.compression??"none"))),m=so(this.restoreRoot,Kh(r));if(Fp(m))throw Error("The isolated control-plane restore target already exists.");await aE(m,{recursive:!0,mode:448}),await Wh(so(m,"control-plane.sqlite"),Buffer.from(l.database,"base64"),{mode:384});for(let h of l.config)await Wh(so(m,h.name),Buffer.from(h.body,"base64"),{mode:384});return{path:m,isolated:!0,configFiles:l.config.length}}async verify(e,t,r){let a=Jh(xe(t,String(e.manifest.compression??"none")));return{...Gh(Buffer.from(a.database,"base64")),configFiles:a.config.length}}async validateHealth(e,t){let r=String(e.path??""),a=so(r,"control-plane.sqlite");if(!r.startsWith(`${this.restoreRoot}${Hh}`)||!Fp(a))throw Error("Isolated control-plane database was not found.");return{healthy:!0,...Gh(await Vh(a))}}async cleanup(e,t){let r=so(this.restoreRoot,Kh(e));if(!r.startsWith(`${this.restoreRoot}${Hh}`))throw Error("Refusing to clean a control-plane restore outside the restore root.");await cE(r,{recursive:!0,force:!0})}}import{createHash as lE}from"node:crypto";function zp(e,t){return e.find((r)=>r.startsWith(`${t}:`))?.slice(t.length+1)}function uE(e){let t=zp(e.includePatterns,"resource")??e.includePatterns.find((l)=>l.startsWith("arn:")),r=zp(e.includePatterns,"role"),a=zp(e.includePatterns,"vault")??"Default";if(!t?.startsWith("arn:"))throw Error("Infrastructure backups require resource:<arn> in include patterns.");if(!r?.startsWith("arn:"))throw Error("Infrastructure backups require role:<iam-role-arn> in include patterns.");if(!/^[A-Za-z0-9_.-]{2,50}$/.test(a))throw Error("Infrastructure backup vault name is invalid.");return{resourceArn:t,roleArn:r,vaultName:a}}async function pE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeBackupJob(t),l=String(a.State??"");if(r.checkpoint("provider_backup",`AWS Backup job ${t} is ${l||"pending"}.`),l==="COMPLETED"&&a.RecoveryPointArn)return{recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??0)};if(["ABORTED","EXPIRED","FAILED"].includes(l))throw Error(`AWS Backup job ${t} failed: ${a.StatusMessage??l}.`);await Bun.sleep(5000)}}async function gE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeRestoreJob(t),l=String(a.Status??"");if(r.checkpoint("provider_restore",`AWS Backup restore ${t} is ${l||"pending"}.`),l==="COMPLETED"&&a.CreatedResourceArn)return a.CreatedResourceArn;if(["ABORTED","FAILED"].includes(l))throw Error(`AWS Backup restore ${t} failed: ${a.StatusMessage??l}.`);await Bun.sleep(5000)}}class ka{client;constructor(e=new ir){this.client=e}async create(e,t){let r=uE(e),a=String(t.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64),l=await this.client.startBackupJob({BackupVaultName:r.vaultName,ResourceArn:r.resourceArn,IamRoleArn:r.roleArn,IdempotencyToken:a}),m=await pE(this.client,l.BackupJobId,t),h=`sha256:${lE("sha256").update(m.recoveryPointArn).digest("hex")}`;return{mode:"external",uri:m.recoveryPointArn,checksum:h,sizeBytes:m.sizeBytes,toolVersion:"aws-backup-api",manifest:{provider:"aws_backup",resourceArn:r.resourceArn,roleArn:r.roleArn,vaultName:r.vaultName,providerBackupJobId:l.BackupJobId,recoveryPointArn:m.recoveryPointArn}}}async verifyExternal(e,t){let r=String(e.manifest.providerBackupJobId??""),a=await this.client.describeBackupJob(r);if(a.State!=="COMPLETED"||a.RecoveryPointArn!==e.uri)throw Error(`AWS Backup recovery point verification failed: ${a.StatusMessage??a.State??"unknown"}.`);return{state:a.State,recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??e.sizeBytes)}}async restore(e,t,r,a){if(r.inPlace===!0)throw Error("AWS Backup infrastructure restores must create isolated resources.");let l=String(r.roleArn??e.manifest.roleArn??""),m=r.metadata&&typeof r.metadata==="object"&&!Array.isArray(r.metadata)?Object.fromEntries(Object.entries(r.metadata).map(([R,y])=>[R,String(y)])):{};if(!l.startsWith("arn:"))throw Error("AWS Backup restore requires an IAM role ARN.");if(!Object.keys(m).length)throw Error("AWS Backup restore requires provider restore metadata.");let h=await this.client.startRestoreJob({RecoveryPointArn:e.uri,IamRoleArn:l,Metadata:m,IdempotencyToken:String(a.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64)}),S=await gE(this.client,h.RestoreJobId,a);return{providerRestoreJobId:h.RestoreJobId,createdResourceArn:S,isolated:!0,healthy:!0}}async validateHealth(e,t){let r=String(e.createdResourceArn??"");return{healthy:r.startsWith("arn:"),createdResourceArn:r}}async deleteExternal(e,t){await this.client.deleteRecoveryPoint(String(e.manifest.vaultName??""),e.uri)}}import{existsSync as RA}from"node:fs";import{join as Fv}from"node:path";import{pathToFileURL as AA}from"node:url";import{existsSync as Yh,statSync as Zh}from"fs";import{resolve as cc}from"path";import mE from"process";import{existsSync as yE,mkdirSync as m$,readdirSync as f$,readFileSync as vE,writeFileSync as h$}from"fs";import{homedir as Bs}from"os";import{dirname as b$,resolve as ti}from"path";import Wd from"process";import{existsSync as Xh,statSync as ey}from"fs";import{existsSync as ag,mkdirSync as bE,readdirSync as SE,writeFileSync as wE}from"fs";import{homedir as Ms}from"os";import{dirname as ty,resolve as vn}from"path";import cs from"process";import{join as kE,relative as IE,resolve as ry}from"path";import Rd from"process";import{existsSync as ov,mkdirSync as _$,readdirSync as T$,writeFileSync as x$}from"fs";import{homedir as Up}from"os";import{dirname as $$,resolve as yn}from"path";import lc from"process";import{join as EE,relative as RE,resolve as ny}from"path";import Cd from"process";import{existsSync as sv,mkdirSync as L$,readdirSync as F$,writeFileSync as z$}from"fs";import{dirname as q$,resolve as Pd}from"path";import cg from"process";import{Buffer as ao}from"buffer";import{createCipheriv as AE,createDecipheriv as CE,randomBytes as qp}from"crypto";import{closeSync as Vp,createReadStream as iy,createWriteStream as PE,existsSync as Wp,fsyncSync as oy,openSync as sy,writeFileSync as _E}from"fs";import{access as TE,constants as ay,mkdir as xE,readdir as id,rename as cy,stat as Ls,unlink as od,writeFile as Hp}from"fs/promises";import{join as Fs}from"path";import jr from"process";import{pipeline as DE}from"stream/promises";import{createGzip as dy}from"zlib";import Us from"process";import gi from"process";import{Buffer as ui}from"buffer";import{createCipheriv as OE,createDecipheriv as $E,randomBytes as Kp}from"crypto";import{closeSync as Jp,createReadStream as ly,createWriteStream as NE,existsSync as sd,fsyncSync as uy,openSync as py,writeFileSync as jE}from"fs";import{access as BE,constants as gy,mkdir as ME,readdir as ad,rename as my,stat as Vs,unlink as cd,writeFile as Gp}from"fs/promises";import{isAbsolute as LE,join as Ws,resolve as FE}from"path";import jt from"process";import{pipeline as zE}from"stream/promises";import{createGzip as _y}from"zlib";import Hs from"process";import mi from"process";import dd from"process";import{existsSync as ld}from"fs";import{resolve as Qp}from"path";import{existsSync as UE}from"fs";import{existsSync as qE,readdirSync as VE}from"fs";import{extname as Yp,resolve as xy}from"path";import WE from"process";import{join as HE,relative as KE,resolve as Oy}from"path";import _d from"process";import{Buffer as pi}from"buffer";import{createCipheriv as JE,createDecipheriv as GE,randomBytes as Zp}from"crypto";import{closeSync as Xp,createReadStream as $y,createWriteStream as QE,existsSync as ud,fsyncSync as jy,openSync as By,writeFileSync as YE}from"fs";import{access as ZE,constants as My,mkdir as XE,readdir as pd,rename as Ly,stat as Ks,unlink as gd,writeFile as eg}from"fs/promises";import{isAbsolute as eR,join as Js,resolve as tR}from"path";import Bt from"process";import{pipeline as rR}from"stream/promises";import{createGzip as Fy}from"zlib";import Gs from"process";import fi from"process";import hd from"process";import{existsSync as yd}from"fs";import{resolve as ev}from"path";import{existsSync as kA}from"fs";class tv{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let l=this.generateKey(e,r),m=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(l,{value:t,timestamp:new Date,ttl:m,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Yh(e))return!0;return Zh(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let l=Yh(r)?Zh(r):null,m=l?l.mtime:new Date;this.set(e,{value:t,fileTimestamp:m},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,l)=>a+l.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class rv{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),l=new Date;try{let m=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:l,...r}),m}catch(m){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:l,...r}),m}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((l)=>l.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((l)=>l.duration),a=r.reduce((l,m)=>l+m,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}var Ed=new tv,bg=new rv;var nv=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];function iv(e={}){let{name:t="",alias:r}=e,a=["config",".config"];if(t)a.push(t,`.${t}.config`,`${t}.config`,`.${t}`);let l=r===void 0?[]:Array.isArray(r)?r:[r];for(let m of l){if(!m)continue;if(a.push(m,`.${m}.config`,`${m}.config`,`.${m}`),t)a.push(`${t}.${m}.config`,`.${t}.${m}.config`)}return Array.from(new Set(a.filter(Boolean)))}function fE(e){return iv(e).flatMap((r)=>nv.map((a)=>cc(e.directory,`${r}${a}`)))}function hE(e={}){let t=cc(e.cwd||mE.cwd());return Array.from(new Set([t,cc(t,"config"),cc(t,".config"),e.configDir?cc(t,e.configDir):void 0].filter((r)=>Boolean(r))))}var nR=Object.defineProperty,iR=(e)=>e;function oR(e,t){this[e]=iR.bind(null,t)}var sR=(e,t)=>{for(var r in t)nR(e,r,{get:t[r],enumerable:!0,configurable:!0,set:oR.bind(t,r)})},aR=(e,t)=>()=>(e&&(t=e(e=0)),t),av={};sR(av,{withErrorRecovery:()=>lv,tryLoadConfig:()=>TR,loadConfigWithResult:()=>PR,loadConfig:()=>fv,isRetryableError:()=>kR,isConfigNotFoundError:()=>wR,isBunfigError:()=>uv,globalPerformanceMonitor:()=>gc,globalCache:()=>Ys,getEnvOrDefault:()=>IR,generateConfigTypes:()=>xR,defaultGeneratedDir:()=>Iv,defaultConfigDir:()=>kv,deepMergeWithArrayStrategy:()=>Eg,deepMerge:()=>pv,createLibraryConfig:()=>DR,config:()=>_R,bunfigPlugin:()=>OR,applyEnvVarsToConfig:()=>dc,TypeGenerationError:()=>fg,SchemaValidationError:()=>pc,PluginError:()=>yg,PerformanceMonitor:()=>wg,FileSystemError:()=>mg,ErrorFactory:()=>uo,EnvVarError:()=>Ld,EnvProcessor:()=>Kd,ConfigValidator:()=>Rg,ConfigValidationError:()=>pg,ConfigNotFoundError:()=>Bd,ConfigMergeError:()=>gg,ConfigLoader:()=>Ag,ConfigLoadError:()=>uc,ConfigFileLoader:()=>Jd,ConfigCache:()=>Sg,CacheUtils:()=>yv,BunfigError:()=>xn,BrowserConfigError:()=>hg,ArrayMergeStrategies:()=>Sv});class Sg{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let l=this.generateKey(e,r),m=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(l,{value:t,timestamp:new Date,ttl:m,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Xh(e))return!0;return ey(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let l=Xh(r)?ey(r):null,m=l?l.mtime:new Date;this.set(e,{value:t,fileTimestamp:m},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,l)=>a+l.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class wg{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),l=new Date;try{let m=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:l,...r}),m}catch(m){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:l,...r}),m}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((l)=>l.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((l)=>l.duration),a=r.reduce((l,m)=>l+m,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}function cR(e,t={}){let a=Object.keys(t).sort().map((l)=>`${l}:${t[l]}`).join("|");return a?`${e}:${a}`:e}function dR(e,t){try{return JSON.stringify(e)===JSON.stringify(t)}catch{return e===t}}function lR(e){return e.getStats().size*2}function kg(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&cr(t[0])&&"id"in t[0]&&t[0].id===3&&cr(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(cr(t)&&cr(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(cr(e)&&"arr"in e&&Array.isArray(e.arr)&&cr(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&cr(t[0])&&cr(e[0])){let a=[...t];for(let l of e)if(cr(l)&&"name"in l){if(!a.find((h)=>cr(h)&&("name"in h)&&h.name===l.name))a.push(l)}else if(cr(l)&&"path"in l){if(!a.find((h)=>cr(h)&&("path"in h)&&h.path===l.path))a.push(l)}else if(!a.some((m)=>xd(m,l)))a.push(l);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let l of e)if(!a.includes(l))a.push(l);return a}return t}if(!cr(t)||!cr(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let l=t[a];if(l===null||l===void 0)continue;else if(cr(l)&&cr(r[a]))r[a]=kg(r[a],l);else if(Array.isArray(l)&&Array.isArray(r[a]))if(l.length>0&&r[a].length>0&&cr(l[0])&&cr(r[a][0])){let m=[...l];for(let h of r[a])if(cr(h)&&"name"in h){if(!m.find((R)=>cr(R)&&("name"in R)&&R.name===h.name))m.push(h)}else if(cr(h)&&"path"in h){if(!m.find((R)=>cr(R)&&("path"in R)&&R.path===h.path))m.push(h)}else if(!m.some((S)=>xd(S,h)))m.push(h);r[a]=m}else if(l.every((m)=>typeof m==="string")&&r[a].every((m)=>typeof m==="string")){let m=[...l];for(let h of r[a])if(!m.includes(h))m.push(h);r[a]=m}else r[a]=l;else r[a]=l}return r}function xd(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!xd(e[r],t[r]))return!1;return!0}if(cr(e)&&cr(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let l of r){if(!Object.prototype.hasOwnProperty.call(t,l))return!1;if(!xd(e[l],t[l]))return!1}return!0}return!1}function cr(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function uR(e,t){if(!sv(e))return null;try{let r=await import(e),a=r.default||r;if(typeof a!=="object"||a===null||Array.isArray(a))return null;try{return kg(t,a)}catch{return null}}catch{return null}}async function pR({name:e="",cwd:t,defaultConfig:r}){let a=t||cg.cwd(),l=[".ts",".js",".mjs",".cjs",".json"],m=[`${e}.config`,`.${e}.config`,e,`.${e}`];for(let h of m)for(let S of l){let R=Pd(a,`${h}${S}`),y=await uR(R,r);if(y!==null)return y}try{let h=Pd(a,"package.json");if(sv(h)){let R=(await import(h))[e];if(R&&typeof R==="object"&&!Array.isArray(R))try{return kg(r,R)}catch{}}}catch{}return r}function gR(e,t={}){let r=Cd.cwd();while(r.includes("storage"))r=ny(r,"..");let a=ny(r,e||"");if(t?.relative)return RE(Cd.cwd(),a);return a}async function mR(){try{let e=await pR({name:"clarity",defaultConfig:Sd,cwd:Cd.cwd(),endpoint:"",headers:{}});return{...Sd,...e}}catch{return Sd}}function mr(){if(gi.env.NODE_ENV==="test"||gi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function fR(){if(gi.env.NODE_ENV==="test"||gi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof gi<"u"){let e=gi.type;if(e==="renderer"||e==="worker")return!1;return!!(gi.versions&&(gi.versions.node||gi.versions.bun))}return!1}class cv{async format(e){let t=await fR(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Us.pid,hostname:t(),environment:Us.env.NODE_ENV||"development",platform:Us.platform,version:Us.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Us.env.NODE_ENV||Us.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class Dd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...lg},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new cv,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??jr.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let l=this.generateKeyId(),m=this.generateKey();this.currentKeyId=l,this.keys.set(l,m),this.encryptionKeys.set(l,{key:m,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...wd,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...wd};return{...wd,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:lg.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}async writeToFile(e){let r=(async()=>{let l,m=0,h=3,S=1000;while(m<h)try{try{try{await TE(this.config.logDirectory,ay.F_OK|ay.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await xE(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let R=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:ao.from(e);try{if(!Wp(this.currentLogFile))await Hp(this.currentLogFile,"",{mode:420});if(l=sy(this.currentLogFile,"a",420),_E(l,R,{flag:"a"}),oy(l),l!==void 0)Vp(l),l=void 0;if((await Ls(this.currentLogFile)).size===0){if(await Hp(this.currentLogFile,R,{flag:"w",mode:420}),(await Ls(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let C=y;if(C.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(C.code)){if(m<h-1){let T=typeof C.message==="string"?C.message:"Unknown error";console.error(`Network error during write attempt ${m+1}/${h}:`,T);let j=S*2**m;await new Promise((B)=>setTimeout(B,j)),m++;continue}}if(C?.code&&["ENOSPC","EDQUOT"].includes(C.code))throw Error(`Disk quota exceeded or no space left on device: ${C.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",C),C}finally{if(l!==void 0)try{Vp(l)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(R){if(m===h-1){let C=R,T=typeof C.message==="string"?C.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",T),R}m++;let y=S*2**(m-1);await new Promise((C)=>setTimeout(C,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(l){throw console.error("Debug: [writeToFile] Error in operation:",l),l}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Fs(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Fs(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Fs(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(mr())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((l)=>{console.error("Error rotating keys:",l)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let l=Array.from(this.encryptionKeys.entries()).sort(([,S],[,R])=>R.createdAt.getTime()-S.createdAt.getTime()),m=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,m);if(l.length>h)for(let[S]of l.slice(h))this.encryptionKeys.delete(S),this.keys.delete(S)}generateKeyId(){return qp(16).toString("hex")}generateKey(){return qp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=qp(16),a=AE("aes-256-gcm",t,r),l=ao.concat([a.update(e,"utf8"),a.final()]),m=a.getAuthTag();return{encrypted:ao.concat([r,l,m]),iv:r}}async compressData(e){return new Promise((t,r)=>{let a=dy(),l=[];a.on("data",(m)=>l.push(m)),a.on("end",()=>t(ao.from(ao.concat(l)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(mr())return;let e=await Ls(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let l=await id(this.config.logDirectory),m=l.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,y)=>{let C=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-C}),h=m.length>0?Number.parseInt(m[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,S=`${r}.${h}`;if(await Ls(r).catch(()=>null))try{if(await cy(r,S),t.compress)try{let R=`${S}.gz`;await this.compressLogFile(S,R),await od(S)}catch(R){console.error("Error compressing rotated file:",R)}if(m.length===0&&!l.some((R)=>R.endsWith(".log.1")))try{let R=`${r}.1`;await Hp(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let l=new Date().toISOString().replace(/[:.]/g,"-"),m=r.replace(/\.log$/,`-${l}.log`);if(await Ls(r).catch(()=>null))await cy(r,m)}if(this.currentLogFile=a,t.maxFiles){let m=(await id(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,S)=>S.localeCompare(h));for(let h of m.slice(t.maxFiles))await od(Fs(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=iy(e),a=PE(t),l=dy();await DE(r,l,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);await this.writeToFile(a),console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(t),console.log(t);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:e,message:t,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(e)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(e){return{debug:0,info:1,success:2,warning:3,error:4}[e]}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),Wp(this.currentLogFile))try{let e=sy(this.currentLogFile,"r+");oy(e),Vp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!mr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await id(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await od(Fs(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.fancy?Kt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:l,level:m,showTimestamp:h=!0}=e,S=(B)=>B.replace(this.ANSI_PATTERN,"");if(!this.fancy){let B=[];if(h)B.push(t);if(m==="warning")B.push("WARN");else if(m==="error")B.push("ERROR");else if(r)B.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)B.push(a.replace(/[[\]]/g,""));return B.push(l),B.join(" ")}let R=jr.stdout.columns||120,y="";if(m==="warning"||m==="error")y=`${r} ${l}`;else if(m==="info"||m==="success")y=`${r} ${a} ${l}`;else y=`${r} ${a} ${Kt.cyan(l)}`;if(!h)return y.trim();let C=S(y).trim().length,T=S(t).length,j=Math.max(1,R-2-C-T);return`${y.trim()}${" ".repeat(j)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(m,h)=>{let S=Number.parseInt(h,10);return S<t[0].length?String(t[0][S]):m});let r=/%([sdijfo%])/g,a=0,l=e.replace(r,(m,h)=>{if(h==="%")return"%";if(a>=t.length)return m;let S=t[a++];switch(h){case"s":return String(S);case"d":case"i":return Number(S).toString();case"j":case"o":return JSON.stringify(S,null,2);default:return m}});if(a<t.length)l+=` ${t.slice(a).map((m)=>typeof m==="object"?JSON.stringify(m,null,2):String(m)).join(" ")}`;return l}async log(e,t,...r){let a=new Date,l=this.formatConsoleTimestamp(a),m=this.formatFileTimestamp(a),h,S;if(t instanceof Error)h=t.message,S=t.stack;else h=this.formatMessage(t,r);if(this.fancy&&!mr()){let y=vv[e],C=this.options.showTags!==!1&&this.name?Kt.gray(this.formatTag(this.name)):"",T;switch(e){case"debug":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:Kt.gray(h),level:e}),console.error(T);break;case"info":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:h,level:e}),console.error(T);break;case"success":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:Kt.green(h),level:e}),console.error(T);break;case"warning":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:h,level:e}),console.warn(T);break;case"error":if(T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:h,level:e}),console.error(T),S){let j=S.split(`
+`:a;if(await this.runtime.seedSecret(`${l}-secret`,C),S==="redis")await this.runtime.restart(l);return{status:S==="redis"?"restarting":"running",username:R}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let m=await this.backup(e,r);return await this.runtime.remove(l),await this.runtime.removeVolume(`${l}-secret`),await this.runtime.removeVolume(`${l}-data`),{status:"deleted",finalBackupId:m.backupId??null,backupPath:m.path??null}}if(t==="expose")throw Error("Direct container exposure is refused; use a reviewed firewall and proxy policy.");throw Error(`${t} requires a configured engine lifecycle runner.`)}}import{createCipheriv as tE,createDecipheriv as rE,createHash as Uh,randomBytes as nE}from"node:crypto";class la{controlPlane;now;key;constructor(e,t,r=()=>new Date){this.controlPlane=e;this.now=r;if(!t)throw Error("Data-service encryption key is required.");this.key=Uh("sha256").update(`ts-cloud:data-services:${t}`).digest()}encrypt(e){let t=nE(12),r=tE("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted data-service secret is unavailable.");try{let m=rE("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}catch{throw Error("Encrypted data-service secret could not be decrypted.")}}async put(e,t){if(!/^secret:\/\/data-services\/[A-Za-z0-9._/-]+$/.test(e))throw Error("Invalid data-service secret reference.");if(!t)throw Error("Data-service secret cannot be empty.");let r=this.now().toISOString();this.controlPlane.database.run("INSERT INTO data_service_secrets (reference,ciphertext,fingerprint,created_at,updated_at) VALUES (?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,updated_at=excluded.updated_at",[e,this.encrypt(t),Uh("sha256").update(t).digest("hex"),r,r])}async resolve(e){let t=this.controlPlane.database.query("SELECT ciphertext FROM data_service_secrets WHERE reference = ?").get(e);if(!t)throw Error("Data-service secret was not found.");return this.decrypt(t.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM data_service_secrets WHERE reference = ?",[e])}}import{existsSync as sc}from"node:fs";import{mkdir as rd,readdir as iE,rename as Bp,rm as Ns}from"node:fs/promises";import{relative as oE,resolve as hn,sep as nd}from"node:path";function wt(e,t){if(t==="gzip")return Buffer.from(Bun.gzipSync(Uint8Array.from(e)));if(t==="zstd")return Buffer.from(Bun.zstdCompressSync(Uint8Array.from(e)));return Buffer.from(e)}function Oe(e,t){if(t==="gzip")return Buffer.from(Bun.gunzipSync(Uint8Array.from(e)));if(t==="zstd")return Buffer.from(Bun.zstdDecompressSync(Uint8Array.from(e)));return Buffer.from(e)}async function Mp(e,t){let r=Bun.spawn(["tar",...e],{stdin:t?Buffer.from(t):void 0,stdout:"pipe",stderr:"pipe"}),[a,l,m]=await Promise.all([r.exited,new Response(r.stdout).arrayBuffer(),new Response(r.stderr).text()]);if(a!==0)throw Error(m.trim()||`tar exited with status ${a}.`);return{stdout:Buffer.from(l),stderr:m}}function sE(e){let t=e.replaceAll("\\","/").replace(/^\.\//,"");return!!t&&!t.startsWith("/")&&!t.split("/").includes("..")}class yu{async create(e,t,r){return(await Mp(["-C",e,"-cf","-",...r.map((l)=>`--exclude=${l}`),"--",...t])).stdout}async extract(e,t){await rd(t,{recursive:!0,mode:448}),await Mp(["-C",t,"-xf","-"],e)}async inspect(e){let t=await Mp(["-tf","-"],e),r=t.stdout.toString().split(`
+`).filter(Boolean);if(r.some((a)=>!sE(a)))throw Error("Backup archive contains an unsafe path.");return{entries:r,bytes:e.byteLength}}}function qh(e,t){if(!t.trim())throw Error("File backup paths cannot be empty.");let r=hn(e,t),a=oE(e,r);if(a===".."||a.startsWith(`..${nd}`)||a==="")throw Error(`File backup path ${t} is outside the project root.`);return a}function td(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("File restores require a safe target name.");return t}class Ra{runtime;root;restoreRoot;constructor(e,t=new yu,r=d(e,"restores","files")){this.runtime=t;this.root=hn(e),this.restoreRoot=hn(r)}paths(e){let t=[...new Set(e.includePatterns.map((r)=>qh(this.root,r)))];if(!t.length)throw Error("File backup policies require at least one project-relative path.");for(let r of t)if(!sc(hn(this.root,r)))throw Error(`File backup path ${r} was not found.`);return t.filter((r)=>!t.some((a)=>a!==r&&r.startsWith(`${a}${nd}`)))}async create(e,t){let r=this.paths(e),a=await this.runtime.create(this.root,r,e.excludePatterns),l=await this.runtime.inspect(a),m=e.compression??"none",h=wt(a,m),S=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/files/${S}.tar${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:h,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/x-tar",manifest:{archive:"tar",compression:m,sourcePaths:r,excluded:e.excludePatterns,entries:l.entries.length},toolVersion:"system-tar"}}async restore(e,t,r,a){if(!t)throw Error("File restore requires an archive payload.");let l=Oe(t,String(e.manifest.compression??"none"));if(await this.runtime.inspect(l),r.restoreMode==="in_place"){let h=hn(this.restoreRoot,`.staging-${td(r)}`),S=hn(this.restoreRoot,`.rollback-${td(r)}`),R=Array.isArray(e.manifest.sourcePaths)?e.manifest.sourcePaths.map(String):[];if(!R.length)throw Error("File recovery point has no source path manifest.");await Ns(h,{recursive:!0,force:!0}),await Ns(S,{recursive:!0,force:!0}),await this.runtime.extract(l,h),await rd(S,{recursive:!0,mode:448});let y=[];try{for(let C of R){let T=hn(this.root,qh(this.root,C)),j=hn(h,C),B=hn(S,C);if(await rd(hn(B,".."),{recursive:!0}),sc(T))await Bp(T,B);await rd(hn(T,".."),{recursive:!0}),await Bp(j,T),y.push(C)}}catch(C){for(let T of y.reverse()){let j=hn(this.root,T),B=hn(S,T);if(await Ns(j,{recursive:!0,force:!0}),sc(B))await Bp(B,j)}throw C}finally{await Ns(h,{recursive:!0,force:!0})}return await Ns(S,{recursive:!0,force:!0}),{path:this.root,restoredPaths:R,inPlace:!0}}let m=hn(this.restoreRoot,td(r));if(sc(m))throw Error("The isolated file restore target already exists.");return await this.runtime.extract(l,m),{path:m,isolated:!0}}async verify(e,t,r){let a=Oe(t,String(e.manifest.compression??"none")),l=await this.runtime.inspect(a);return{archive:"tar",entries:l.entries.length,uncompressedBytes:l.bytes}}async validateHealth(e,t){let r=String(e.path??"");if(!r||!r.startsWith(`${this.restoreRoot}${nd}`)||!sc(r))throw Error("Isolated file restore target was not found.");let a=await iE(r);return{healthy:!0,path:r,topLevelEntries:a.length}}async cleanup(e,t){let r=td(e),a=hn(this.restoreRoot,r);if(!a.startsWith(`${this.restoreRoot}${nd}`))throw Error("Refusing to clean a file restore outside the restore root.");await Ns(a,{recursive:!0,force:!0})}}class Da{services;secrets;transport;constructor(e,t,r=new er){this.services=e;this.secrets=t;this.transport=r}async create(e,t){if(!e.dataServiceId)throw Error("Logical database backups require a data service.");let r=this.services.get(e.dataServiceId);if(!r)throw Error("Logical database service was not found.");if(!["container","server"].includes(r.provider))throw Error("Logical database backups require an on-box data service.");let a=await this.transport.exportLogicalBackup(r.id),l=e.compression??"none",m=wt(a.body,l),h=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/databases/${r.id}/${h}.sql${l==="none"?"":l==="gzip"?".gz":".zst"}`,body:m,contentType:l==="gzip"?"application/gzip":l==="zstd"?"application/zstd":"application/sql",engineVersion:a.engineVersion,toolVersion:"engine-native",manifest:{format:"logical-sql-v1",sourceDataServiceId:r.id,engine:a.engine,database:a.database,username:a.username,compression:l}}}async restore(e,t,r,a){if(!t)throw Error("Logical database backup body is unavailable.");let l=String(e.dataServiceId??e.manifest.sourceDataServiceId??""),m=String(r.dataServiceId??r.targetId??""),h=r.inPlace===!0;if(!l||!m)throw Error("Logical database restore requires source and target identifiers.");if(h&&m!==l)throw Error("An in-place restore must target the source data service.");let S=this.services.get(l);if(!S?.credentialRef)throw Error("Logical database credential reference was not found.");let R=await this.secrets.resolve(S.credentialRef);return this.transport.restoreLogicalBackup({sourceId:l,targetId:m,body:Oe(t,String(e.manifest.compression??"none")),credential:R,inPlace:h})}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place database restores cannot be cleaned as drills.");let r=String(e.dataServiceId??e.targetId??"");if(!r)throw Error("Database cleanup requires a target identifier.");await this.transport.removeRestoredService(r)}}var Lp=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;async function ss(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t?"pipe":"ignore",stdout:"pipe",stderr:"pipe"}),l=new Response(a.stdout).arrayBuffer(),m=new Response(a.stderr).text();if(t)a.stdin.write(t),a.stdin.end();let[h,S,R]=await Promise.all([a.exited,l,m]);if(h!==0&&!r)throw Error(`Docker volume command failed (${h}): ${R.trim()}`);return{code:h,stdout:Buffer.from(S),stderr:R}}class Iu{async exists(e){return(await ss(["volume","inspect",e],void 0,!0)).code===0}async export(e){return(await ss(["run","--rm","-v",`${e}:/source:ro`,"alpine:3.21","tar","-C","/source","-czf","-","."])).stdout}async import(e,t,r=!1){if(!await this.exists(e))await ss(["volume","create",e]);try{if(r)await ss(["run","--rm","-v",`${e}:/target`,"alpine:3.21","sh","-c","find /target -mindepth 1 -delete"]);await ss(["run","--rm","-i","-v",`${e}:/target`,"alpine:3.21","tar","-C","/target","--no-same-owner","-xzf","-"],t)}catch(a){throw await this.remove(e),a}}async remove(e){await ss(["volume","rm",e],void 0,!0)}async probe(e){let t=(await ss(["run","--rm","-v",`${e}:/target:ro`,"alpine:3.21","sh","-c",`find /target -mindepth 1 -printf '%s\\n' | awk '{n+=1;b+=$1} END {print n ":" b}'`])).stdout.toString(),[r,a]=t.trim().split(":").map(Number);if(!Number.isFinite(r)||!Number.isFinite(a))throw Error("Restored volume health probe returned invalid output.");return{entries:r,bytes:a}}}class Pa{runtime;constructor(e=new Iu){this.runtime=e}async create(e,t){let r=String(e.includePatterns?.[0]??e.resourceId??"");if(!Lp.test(r))throw Error("Volume backups require a valid named-volume resource identifier.");if(!await this.runtime.exists(r))throw Error(`Volume ${r} was not found.`);let a=await this.runtime.export(r),l=Buffer.from(Bun.gunzipSync(Uint8Array.from(a))),m=e.compression??"gzip",h=m==="gzip"?a:wt(l,m),S=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/volumes/${r}/${S}.tar${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:h,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/x-tar",toolVersion:"alpine-tar",manifest:{format:"docker-volume-tar-v1",archive:"tar",compression:m,sourceVolume:r}}}async restore(e,t,r,a){if(!t)throw Error("Volume backup body is unavailable.");let l=String(e.manifest.sourceVolume??e.resourceId??""),m=String(r.volumeName??r.targetId??"");if(!Lp.test(m))throw Error("Volume restore requires a valid target volume name.");if(m===l&&r.inPlace!==!0)throw Error("An isolated volume restore requires a distinct target.");let h=await this.runtime.exists(m);if(!r.inPlace&&h)throw Error(`Restore target volume ${m} already exists.`);if(r.inPlace===!0&&m!==l)throw Error("An in-place volume restore must target the source volume.");if(r.inPlace===!0&&!h)throw Error("The in-place target volume was not found.");let S=String(e.manifest.compression??"gzip"),R=S==="gzip"?Buffer.from(t):Buffer.from(Bun.gzipSync(Uint8Array.from(Oe(t,S))));await this.runtime.import(m,R,r.inPlace===!0);let y=await this.runtime.probe(m);return{volumeName:m,healthy:!0,...y}}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place volume restores cannot be cleaned as drills.");let r=String(e.volumeName??e.targetId??"");if(!Lp.test(r))throw Error("Volume cleanup requires a valid target volume name.");await this.runtime.remove(r)}}import{existsSync as Fp}from"node:fs";import{mkdir as aE,readFile as Vh,rm as cE,writeFile as Wh}from"node:fs/promises";import{basename as Qh,resolve as so,sep as Hh}from"node:path";import{Database as dE}from"bun:sqlite";function Kh(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("Control-plane restores require a safe target name.");return t}function Jh(e){let t=JSON.parse(Buffer.from(e).toString());if(t.format!=="ts-cloud-control-plane-v1"||!t.database)throw Error("Control-plane backup archive is invalid.");if(!Array.isArray(t.config)||t.config.some((r)=>Qh(r.name)!==r.name))throw Error("Control-plane backup contains an unsafe config path.");return t}function Gh(e){let t=dE.deserialize(Uint8Array.from(e));try{let r=t.query("PRAGMA integrity_check").get()?.integrity_check??"unknown",a=t.query("SELECT count(*) AS count FROM sqlite_master WHERE type='table'").get()?.count??0;if(r!=="ok")throw Error(`Restored control-plane integrity check failed: ${r}.`);return{integrity:r,tables:a}}finally{t.close()}}class Na{controlPlane;root;restoreRoot;constructor(e,t,r=d(t,"restores","control-plane")){this.controlPlane=e;this.root=so(t),this.restoreRoot=so(r)}async create(e,t){let r=e.includePatterns.length?e.includePatterns:["cloud.config.ts"],a=[];for(let R of r){let y=Qh(R),C=so(this.root,y);if(y!==R&&R!==`./${y}`)throw Error("Control-plane config paths must be project-root files.");if(Fp(C))a.push({name:y,body:(await Vh(C)).toString("base64")})}let l={format:"ts-cloud-control-plane-v1",createdAt:new Date().toISOString(),database:Buffer.from(this.controlPlane.database.serialize()).toString("base64"),config:a},m=e.compression??"none",h=wt(Buffer.from(JSON.stringify(l)),m),S=String(t.operation?.id??l.createdAt).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/control-plane/${S}.json${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:h,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/vnd.ts-cloud.control-plane+json",manifest:{format:l.format,configFiles:a.map((R)=>R.name),sensitive:!0,compression:m},toolVersion:"bun-sqlite-serialize"}}async restore(e,t,r,a){if(!t)throw Error("Control-plane restore requires an archive payload.");if(r.restoreMode==="in_place")throw Error("A live control plane can only be restored into an isolated recovery target.");let l=Jh(Oe(t,String(e.manifest.compression??"none"))),m=so(this.restoreRoot,Kh(r));if(Fp(m))throw Error("The isolated control-plane restore target already exists.");await aE(m,{recursive:!0,mode:448}),await Wh(so(m,"control-plane.sqlite"),Buffer.from(l.database,"base64"),{mode:384});for(let h of l.config)await Wh(so(m,h.name),Buffer.from(h.body,"base64"),{mode:384});return{path:m,isolated:!0,configFiles:l.config.length}}async verify(e,t,r){let a=Jh(Oe(t,String(e.manifest.compression??"none")));return{...Gh(Buffer.from(a.database,"base64")),configFiles:a.config.length}}async validateHealth(e,t){let r=String(e.path??""),a=so(r,"control-plane.sqlite");if(!r.startsWith(`${this.restoreRoot}${Hh}`)||!Fp(a))throw Error("Isolated control-plane database was not found.");return{healthy:!0,...Gh(await Vh(a))}}async cleanup(e,t){let r=so(this.restoreRoot,Kh(e));if(!r.startsWith(`${this.restoreRoot}${Hh}`))throw Error("Refusing to clean a control-plane restore outside the restore root.");await cE(r,{recursive:!0,force:!0})}}import{createHash as lE}from"node:crypto";function zp(e,t){return e.find((r)=>r.startsWith(`${t}:`))?.slice(t.length+1)}function uE(e){let t=zp(e.includePatterns,"resource")??e.includePatterns.find((l)=>l.startsWith("arn:")),r=zp(e.includePatterns,"role"),a=zp(e.includePatterns,"vault")??"Default";if(!t?.startsWith("arn:"))throw Error("Infrastructure backups require resource:<arn> in include patterns.");if(!r?.startsWith("arn:"))throw Error("Infrastructure backups require role:<iam-role-arn> in include patterns.");if(!/^[A-Za-z0-9_.-]{2,50}$/.test(a))throw Error("Infrastructure backup vault name is invalid.");return{resourceArn:t,roleArn:r,vaultName:a}}async function pE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeBackupJob(t),l=String(a.State??"");if(r.checkpoint("provider_backup",`AWS Backup job ${t} is ${l||"pending"}.`),l==="COMPLETED"&&a.RecoveryPointArn)return{recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??0)};if(["ABORTED","EXPIRED","FAILED"].includes(l))throw Error(`AWS Backup job ${t} failed: ${a.StatusMessage??l}.`);await Bun.sleep(5000)}}async function gE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeRestoreJob(t),l=String(a.Status??"");if(r.checkpoint("provider_restore",`AWS Backup restore ${t} is ${l||"pending"}.`),l==="COMPLETED"&&a.CreatedResourceArn)return a.CreatedResourceArn;if(["ABORTED","FAILED"].includes(l))throw Error(`AWS Backup restore ${t} failed: ${a.StatusMessage??l}.`);await Bun.sleep(5000)}}class ka{client;constructor(e=new ir){this.client=e}async create(e,t){let r=uE(e),a=String(t.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64),l=await this.client.startBackupJob({BackupVaultName:r.vaultName,ResourceArn:r.resourceArn,IamRoleArn:r.roleArn,IdempotencyToken:a}),m=await pE(this.client,l.BackupJobId,t),h=`sha256:${lE("sha256").update(m.recoveryPointArn).digest("hex")}`;return{mode:"external",uri:m.recoveryPointArn,checksum:h,sizeBytes:m.sizeBytes,toolVersion:"aws-backup-api",manifest:{provider:"aws_backup",resourceArn:r.resourceArn,roleArn:r.roleArn,vaultName:r.vaultName,providerBackupJobId:l.BackupJobId,recoveryPointArn:m.recoveryPointArn}}}async verifyExternal(e,t){let r=String(e.manifest.providerBackupJobId??""),a=await this.client.describeBackupJob(r);if(a.State!=="COMPLETED"||a.RecoveryPointArn!==e.uri)throw Error(`AWS Backup recovery point verification failed: ${a.StatusMessage??a.State??"unknown"}.`);return{state:a.State,recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??e.sizeBytes)}}async restore(e,t,r,a){if(r.inPlace===!0)throw Error("AWS Backup infrastructure restores must create isolated resources.");let l=String(r.roleArn??e.manifest.roleArn??""),m=r.metadata&&typeof r.metadata==="object"&&!Array.isArray(r.metadata)?Object.fromEntries(Object.entries(r.metadata).map(([R,y])=>[R,String(y)])):{};if(!l.startsWith("arn:"))throw Error("AWS Backup restore requires an IAM role ARN.");if(!Object.keys(m).length)throw Error("AWS Backup restore requires provider restore metadata.");let h=await this.client.startRestoreJob({RecoveryPointArn:e.uri,IamRoleArn:l,Metadata:m,IdempotencyToken:String(a.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64)}),S=await gE(this.client,h.RestoreJobId,a);return{providerRestoreJobId:h.RestoreJobId,createdResourceArn:S,isolated:!0,healthy:!0}}async validateHealth(e,t){let r=String(e.createdResourceArn??"");return{healthy:r.startsWith("arn:"),createdResourceArn:r}}async deleteExternal(e,t){await this.client.deleteRecoveryPoint(String(e.manifest.vaultName??""),e.uri)}}import{existsSync as RA}from"node:fs";import{join as Fv}from"node:path";import{pathToFileURL as AA}from"node:url";import{existsSync as Yh,statSync as Zh}from"fs";import{resolve as cc}from"path";import mE from"process";import{existsSync as yE,mkdirSync as m$,readdirSync as f$,readFileSync as vE,writeFileSync as h$}from"fs";import{homedir as Bs}from"os";import{dirname as b$,resolve as ti}from"path";import Wd from"process";import{existsSync as Xh,statSync as ey}from"fs";import{existsSync as ag,mkdirSync as bE,readdirSync as SE,writeFileSync as wE}from"fs";import{homedir as Ms}from"os";import{dirname as ty,resolve as vn}from"path";import cs from"process";import{join as kE,relative as IE,resolve as ry}from"path";import Rd from"process";import{existsSync as ov,mkdirSync as _$,readdirSync as T$,writeFileSync as x$}from"fs";import{homedir as Up}from"os";import{dirname as $$,resolve as yn}from"path";import lc from"process";import{join as EE,relative as RE,resolve as ny}from"path";import Cd from"process";import{existsSync as sv,mkdirSync as L$,readdirSync as F$,writeFileSync as z$}from"fs";import{dirname as q$,resolve as Pd}from"path";import cg from"process";import{Buffer as ao}from"buffer";import{createCipheriv as AE,createDecipheriv as CE,randomBytes as qp}from"crypto";import{closeSync as Vp,createReadStream as iy,createWriteStream as PE,existsSync as Wp,fsyncSync as oy,openSync as sy,writeFileSync as _E}from"fs";import{access as TE,constants as ay,mkdir as xE,readdir as id,rename as cy,stat as Ls,unlink as od,writeFile as Hp}from"fs/promises";import{join as Fs}from"path";import jr from"process";import{pipeline as DE}from"stream/promises";import{createGzip as dy}from"zlib";import Us from"process";import gi from"process";import{Buffer as ui}from"buffer";import{createCipheriv as OE,createDecipheriv as $E,randomBytes as Kp}from"crypto";import{closeSync as Jp,createReadStream as ly,createWriteStream as NE,existsSync as sd,fsyncSync as uy,openSync as py,writeFileSync as jE}from"fs";import{access as BE,constants as gy,mkdir as ME,readdir as ad,rename as my,stat as Vs,unlink as cd,writeFile as Gp}from"fs/promises";import{isAbsolute as LE,join as Ws,resolve as FE}from"path";import jt from"process";import{pipeline as zE}from"stream/promises";import{createGzip as _y}from"zlib";import Hs from"process";import mi from"process";import dd from"process";import{existsSync as ld}from"fs";import{resolve as Qp}from"path";import{existsSync as UE}from"fs";import{existsSync as qE,readdirSync as VE}from"fs";import{extname as Yp,resolve as xy}from"path";import WE from"process";import{join as HE,relative as KE,resolve as Oy}from"path";import _d from"process";import{Buffer as pi}from"buffer";import{createCipheriv as JE,createDecipheriv as GE,randomBytes as Zp}from"crypto";import{closeSync as Xp,createReadStream as $y,createWriteStream as QE,existsSync as ud,fsyncSync as jy,openSync as By,writeFileSync as YE}from"fs";import{access as ZE,constants as My,mkdir as XE,readdir as pd,rename as Ly,stat as Ks,unlink as gd,writeFile as eg}from"fs/promises";import{isAbsolute as eR,join as Js,resolve as tR}from"path";import Bt from"process";import{pipeline as rR}from"stream/promises";import{createGzip as Fy}from"zlib";import Gs from"process";import fi from"process";import hd from"process";import{existsSync as yd}from"fs";import{resolve as ev}from"path";import{existsSync as kA}from"fs";class tv{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let l=this.generateKey(e,r),m=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(l,{value:t,timestamp:new Date,ttl:m,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Yh(e))return!0;return Zh(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let l=Yh(r)?Zh(r):null,m=l?l.mtime:new Date;this.set(e,{value:t,fileTimestamp:m},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,l)=>a+l.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class rv{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),l=new Date;try{let m=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:l,...r}),m}catch(m){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:l,...r}),m}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((l)=>l.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((l)=>l.duration),a=r.reduce((l,m)=>l+m,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}var Ed=new tv,bg=new rv;var nv=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];function iv(e={}){let{name:t="",alias:r}=e,a=["config",".config"];if(t)a.push(t,`.${t}.config`,`${t}.config`,`.${t}`);let l=r===void 0?[]:Array.isArray(r)?r:[r];for(let m of l){if(!m)continue;if(a.push(m,`.${m}.config`,`${m}.config`,`.${m}`),t)a.push(`${t}.${m}.config`,`.${t}.${m}.config`)}return Array.from(new Set(a.filter(Boolean)))}function fE(e){return iv(e).flatMap((r)=>nv.map((a)=>cc(e.directory,`${r}${a}`)))}function hE(e={}){let t=cc(e.cwd||mE.cwd());return Array.from(new Set([t,cc(t,"config"),cc(t,".config"),e.configDir?cc(t,e.configDir):void 0].filter((r)=>Boolean(r))))}var nR=Object.defineProperty,iR=(e)=>e;function oR(e,t){this[e]=iR.bind(null,t)}var sR=(e,t)=>{for(var r in t)nR(e,r,{get:t[r],enumerable:!0,configurable:!0,set:oR.bind(t,r)})},aR=(e,t)=>()=>(e&&(t=e(e=0)),t),av={};sR(av,{withErrorRecovery:()=>lv,tryLoadConfig:()=>TR,loadConfigWithResult:()=>PR,loadConfig:()=>fv,isRetryableError:()=>kR,isConfigNotFoundError:()=>wR,isBunfigError:()=>uv,globalPerformanceMonitor:()=>gc,globalCache:()=>Ys,getEnvOrDefault:()=>IR,generateConfigTypes:()=>xR,defaultGeneratedDir:()=>Iv,defaultConfigDir:()=>kv,deepMergeWithArrayStrategy:()=>Eg,deepMerge:()=>pv,createLibraryConfig:()=>DR,config:()=>_R,bunfigPlugin:()=>OR,applyEnvVarsToConfig:()=>dc,TypeGenerationError:()=>fg,SchemaValidationError:()=>pc,PluginError:()=>yg,PerformanceMonitor:()=>wg,FileSystemError:()=>mg,ErrorFactory:()=>uo,EnvVarError:()=>Ld,EnvProcessor:()=>Kd,ConfigValidator:()=>Rg,ConfigValidationError:()=>pg,ConfigNotFoundError:()=>Bd,ConfigMergeError:()=>gg,ConfigLoader:()=>Ag,ConfigLoadError:()=>uc,ConfigFileLoader:()=>Jd,ConfigCache:()=>Sg,CacheUtils:()=>yv,BunfigError:()=>xn,BrowserConfigError:()=>hg,ArrayMergeStrategies:()=>Sv});class Sg{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let l=this.generateKey(e,r),m=a??this.options.ttl,h=this.estimateSize(t);this.cache.set(l,{value:t,timestamp:new Date,ttl:m,hits:0,size:h}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Xh(e))return!0;return ey(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let l=Xh(r)?ey(r):null,m=l?l.mtime:new Date;this.set(e,{value:t,fileTimestamp:m},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,l)=>a+l.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class wg{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),l=new Date;try{let m=await t(),h=performance.now()-a;return this.recordMetric({operation:e,duration:h,timestamp:l,...r}),m}catch(m){let h=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:h,timestamp:l,...r}),m}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((l)=>l.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((l)=>l.duration),a=r.reduce((l,m)=>l+m,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}function cR(e,t={}){let a=Object.keys(t).sort().map((l)=>`${l}:${t[l]}`).join("|");return a?`${e}:${a}`:e}function dR(e,t){try{return JSON.stringify(e)===JSON.stringify(t)}catch{return e===t}}function lR(e){return e.getStats().size*2}function kg(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&cr(t[0])&&"id"in t[0]&&t[0].id===3&&cr(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(cr(t)&&cr(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(cr(e)&&"arr"in e&&Array.isArray(e.arr)&&cr(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&cr(t[0])&&cr(e[0])){let a=[...t];for(let l of e)if(cr(l)&&"name"in l){if(!a.find((h)=>cr(h)&&("name"in h)&&h.name===l.name))a.push(l)}else if(cr(l)&&"path"in l){if(!a.find((h)=>cr(h)&&("path"in h)&&h.path===l.path))a.push(l)}else if(!a.some((m)=>Dd(m,l)))a.push(l);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let l of e)if(!a.includes(l))a.push(l);return a}return t}if(!cr(t)||!cr(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let l=t[a];if(l===null||l===void 0)continue;else if(cr(l)&&cr(r[a]))r[a]=kg(r[a],l);else if(Array.isArray(l)&&Array.isArray(r[a]))if(l.length>0&&r[a].length>0&&cr(l[0])&&cr(r[a][0])){let m=[...l];for(let h of r[a])if(cr(h)&&"name"in h){if(!m.find((R)=>cr(R)&&("name"in R)&&R.name===h.name))m.push(h)}else if(cr(h)&&"path"in h){if(!m.find((R)=>cr(R)&&("path"in R)&&R.path===h.path))m.push(h)}else if(!m.some((S)=>Dd(S,h)))m.push(h);r[a]=m}else if(l.every((m)=>typeof m==="string")&&r[a].every((m)=>typeof m==="string")){let m=[...l];for(let h of r[a])if(!m.includes(h))m.push(h);r[a]=m}else r[a]=l;else r[a]=l}return r}function Dd(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!Dd(e[r],t[r]))return!1;return!0}if(cr(e)&&cr(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let l of r){if(!Object.prototype.hasOwnProperty.call(t,l))return!1;if(!Dd(e[l],t[l]))return!1}return!0}return!1}function cr(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function uR(e,t){if(!sv(e))return null;try{let r=await import(e),a=r.default||r;if(typeof a!=="object"||a===null||Array.isArray(a))return null;try{return kg(t,a)}catch{return null}}catch{return null}}async function pR({name:e="",cwd:t,defaultConfig:r}){let a=t||cg.cwd(),l=[".ts",".js",".mjs",".cjs",".json"],m=[`${e}.config`,`.${e}.config`,e,`.${e}`];for(let h of m)for(let S of l){let R=Pd(a,`${h}${S}`),y=await uR(R,r);if(y!==null)return y}try{let h=Pd(a,"package.json");if(sv(h)){let R=(await import(h))[e];if(R&&typeof R==="object"&&!Array.isArray(R))try{return kg(r,R)}catch{}}}catch{}return r}function gR(e,t={}){let r=Cd.cwd();while(r.includes("storage"))r=ny(r,"..");let a=ny(r,e||"");if(t?.relative)return RE(Cd.cwd(),a);return a}async function mR(){try{let e=await pR({name:"clarity",defaultConfig:Sd,cwd:Cd.cwd(),endpoint:"",headers:{}});return{...Sd,...e}}catch{return Sd}}function mr(){if(gi.env.NODE_ENV==="test"||gi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function fR(){if(gi.env.NODE_ENV==="test"||gi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof gi<"u"){let e=gi.type;if(e==="renderer"||e==="worker")return!1;return!!(gi.versions&&(gi.versions.node||gi.versions.bun))}return!1}class cv{async format(e){let t=await fR(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Us.pid,hostname:t(),environment:Us.env.NODE_ENV||"development",platform:Us.platform,version:Us.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Us.env.NODE_ENV||Us.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class Od{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...lg},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new cv,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??jr.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let l=this.generateKeyId(),m=this.generateKey();this.currentKeyId=l,this.keys.set(l,m),this.encryptionKeys.set(l,{key:m,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...wd,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...wd};return{...wd,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:lg.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}async writeToFile(e){let r=(async()=>{let l,m=0,h=3,S=1000;while(m<h)try{try{try{await TE(this.config.logDirectory,ay.F_OK|ay.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await xE(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let R=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:ao.from(e);try{if(!Wp(this.currentLogFile))await Hp(this.currentLogFile,"",{mode:420});if(l=sy(this.currentLogFile,"a",420),_E(l,R,{flag:"a"}),oy(l),l!==void 0)Vp(l),l=void 0;if((await Ls(this.currentLogFile)).size===0){if(await Hp(this.currentLogFile,R,{flag:"w",mode:420}),(await Ls(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let C=y;if(C.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(C.code)){if(m<h-1){let T=typeof C.message==="string"?C.message:"Unknown error";console.error(`Network error during write attempt ${m+1}/${h}:`,T);let j=S*2**m;await new Promise((B)=>setTimeout(B,j)),m++;continue}}if(C?.code&&["ENOSPC","EDQUOT"].includes(C.code))throw Error(`Disk quota exceeded or no space left on device: ${C.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",C),C}finally{if(l!==void 0)try{Vp(l)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(R){if(m===h-1){let C=R,T=typeof C.message==="string"?C.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",T),R}m++;let y=S*2**(m-1);await new Promise((C)=>setTimeout(C,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(l){throw console.error("Debug: [writeToFile] Error in operation:",l),l}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Fs(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Fs(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Fs(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(mr())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((l)=>{console.error("Error rotating keys:",l)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let l=Array.from(this.encryptionKeys.entries()).sort(([,S],[,R])=>R.createdAt.getTime()-S.createdAt.getTime()),m=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,m);if(l.length>h)for(let[S]of l.slice(h))this.encryptionKeys.delete(S),this.keys.delete(S)}generateKeyId(){return qp(16).toString("hex")}generateKey(){return qp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=qp(16),a=AE("aes-256-gcm",t,r),l=ao.concat([a.update(e,"utf8"),a.final()]),m=a.getAuthTag();return{encrypted:ao.concat([r,l,m]),iv:r}}async compressData(e){return new Promise((t,r)=>{let a=dy(),l=[];a.on("data",(m)=>l.push(m)),a.on("end",()=>t(ao.from(ao.concat(l)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(mr())return;let e=await Ls(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let l=await id(this.config.logDirectory),m=l.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,y)=>{let C=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-C}),h=m.length>0?Number.parseInt(m[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,S=`${r}.${h}`;if(await Ls(r).catch(()=>null))try{if(await cy(r,S),t.compress)try{let R=`${S}.gz`;await this.compressLogFile(S,R),await od(S)}catch(R){console.error("Error compressing rotated file:",R)}if(m.length===0&&!l.some((R)=>R.endsWith(".log.1")))try{let R=`${r}.1`;await Hp(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let l=new Date().toISOString().replace(/[:.]/g,"-"),m=r.replace(/\.log$/,`-${l}.log`);if(await Ls(r).catch(()=>null))await cy(r,m)}if(this.currentLogFile=a,t.maxFiles){let m=(await id(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,S)=>S.localeCompare(h));for(let h of m.slice(t.maxFiles))await od(Fs(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=iy(e),a=PE(t),l=dy();await DE(r,l,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);await this.writeToFile(a),console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(t),console.log(t);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:e,message:t,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(e)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(e){return{debug:0,info:1,success:2,warning:3,error:4}[e]}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),Wp(this.currentLogFile))try{let e=sy(this.currentLogFile,"r+");oy(e),Vp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!mr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await id(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await od(Fs(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.fancy?Kt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:l,level:m,showTimestamp:h=!0}=e,S=(B)=>B.replace(this.ANSI_PATTERN,"");if(!this.fancy){let B=[];if(h)B.push(t);if(m==="warning")B.push("WARN");else if(m==="error")B.push("ERROR");else if(r)B.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)B.push(a.replace(/[[\]]/g,""));return B.push(l),B.join(" ")}let R=jr.stdout.columns||120,y="";if(m==="warning"||m==="error")y=`${r} ${l}`;else if(m==="info"||m==="success")y=`${r} ${a} ${l}`;else y=`${r} ${a} ${Kt.cyan(l)}`;if(!h)return y.trim();let C=S(y).trim().length,T=S(t).length,j=Math.max(1,R-2-C-T);return`${y.trim()}${" ".repeat(j)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(m,h)=>{let S=Number.parseInt(h,10);return S<t[0].length?String(t[0][S]):m});let r=/%([sdijfo%])/g,a=0,l=e.replace(r,(m,h)=>{if(h==="%")return"%";if(a>=t.length)return m;let S=t[a++];switch(h){case"s":return String(S);case"d":case"i":return Number(S).toString();case"j":case"o":return JSON.stringify(S,null,2);default:return m}});if(a<t.length)l+=` ${t.slice(a).map((m)=>typeof m==="object"?JSON.stringify(m,null,2):String(m)).join(" ")}`;return l}async log(e,t,...r){let a=new Date,l=this.formatConsoleTimestamp(a),m=this.formatFileTimestamp(a),h,S;if(t instanceof Error)h=t.message,S=t.stack;else h=this.formatMessage(t,r);if(this.fancy&&!mr()){let y=vv[e],C=this.options.showTags!==!1&&this.name?Kt.gray(this.formatTag(this.name)):"",T;switch(e){case"debug":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:Kt.gray(h),level:e}),console.error(T);break;case"info":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:h,level:e}),console.error(T);break;case"success":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:Kt.green(h),level:e}),console.error(T);break;case"warning":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:h,level:e}),console.warn(T);break;case"error":if(T=this.formatConsoleMessage({timestamp:l,icon:y,tag:C,message:h,level:e}),console.error(T),S){let j=S.split(`
 `);for(let B of j)if(B.trim()&&!B.includes(h))console.error(this.formatConsoleMessage({timestamp:l,message:Kt.gray(`  ${B}`),level:e,showTimestamp:!1}))}break}}else if(!mr()){if(console.error(`${m} ${this.environment}.${e.toUpperCase()}: ${h}`),S)console.error(S)}if(!this.shouldLog(e))return;let R=`${m} ${this.environment}.${e.toUpperCase()}: ${h}
 `;if(S)R+=`${S}
 `;R=R.replace(this.ANSI_PATTERN,""),await this.writeToFile(R)}time(e){let t=performance.now();if(this.fancy&&!mr()){let r=this.options.showTags!==!1&&this.name?Kt.gray(this.formatTag(this.name)):"",a=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:a,icon:Kt.blue("◐"),tag:r,message:`${Kt.cyan(e)}...`}))}return async(r)=>{if(!this.enabled)return;let a=performance.now(),l=Math.round(a-t),m=`${e} completed in ${l}ms`,h=new Date,S=this.formatConsoleTimestamp(h),y=`${this.formatFileTimestamp(h)} ${this.environment}.INFO: ${m}`;if(r)y+=` ${JSON.stringify(r)}`;if(y+=`
-`,y=y.replace(this.ANSI_PATTERN,""),this.fancy&&!mr()){let C=this.options.showTags!==!1&&this.name?Kt.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:S,icon:Kt.green("✓"),tag:C,message:`${m}${r?` ${JSON.stringify(r)}`:""}`}))}else if(!mr())console.error(y.trim());await this.writeToFile(y)}}async debug(e,...t){await this.log("debug",e,...t)}async info(e,...t){await this.log("info",e,...t)}async success(e,...t){await this.log("success",e,...t)}async warn(e,...t){await this.log("warning",e,...t)}async error(e,...t){await this.log("error",e,...t)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let e=this.config.rotation,{encrypt:t}=e;return!!t}async only(e){if(!this.enabled)return;return await e()}isEnabled(){return this.enabled}setEnabled(e){this.enabled=e}extend(e){let t=`${this.name}:${e}`,r=new Dd(t,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(r),r}createReadStream(){if(mr())throw Error("createReadStream is not supported in browser environments");if(!Wp(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return iy(this.currentLogFile,{encoding:"utf8"})}async decrypt(e){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let t=this.config.rotation;if(!t.encrypt||typeof t.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let r=this.keys.get(this.currentKeyId);try{let a=ao.isBuffer(e)?e:ao.from(e,"base64"),l=a.slice(0,16),m=a.slice(-16),h=a.slice(16,-16),S=CE("aes-256-gcm",r,l);return S.setAuthTag(m),ao.concat([S.update(h),S.final()]).toString("utf8")}catch(a){throw Error(`Decryption failed: ${a instanceof Error?a.message:String(a)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return mr()}isServerMode(){return!mr()}setTestEncryptionKey(e,t){this.currentKeyId=e,this.keys.set(e,t)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(e){if(!this.enabled)return;let t=new Date,r=this.formatConsoleTimestamp(t),a=this.formatFileTimestamp(t);if(this.fancy&&!mr()){let m=e.split(`
+`,y=y.replace(this.ANSI_PATTERN,""),this.fancy&&!mr()){let C=this.options.showTags!==!1&&this.name?Kt.gray(this.formatTag(this.name)):"";console.error(this.formatConsoleMessage({timestamp:S,icon:Kt.green("✓"),tag:C,message:`${m}${r?` ${JSON.stringify(r)}`:""}`}))}else if(!mr())console.error(y.trim());await this.writeToFile(y)}}async debug(e,...t){await this.log("debug",e,...t)}async info(e,...t){await this.log("info",e,...t)}async success(e,...t){await this.log("success",e,...t)}async warn(e,...t){await this.log("warning",e,...t)}async error(e,...t){await this.log("error",e,...t)}validateEncryptionConfig(){if(!this.config.rotation)return!1;if(typeof this.config.rotation==="boolean")return!1;let e=this.config.rotation,{encrypt:t}=e;return!!t}async only(e){if(!this.enabled)return;return await e()}isEnabled(){return this.enabled}setEnabled(e){this.enabled=e}extend(e){let t=`${this.name}:${e}`,r=new Od(t,{...this.options,logDirectory:this.config.logDirectory,level:this.config.level,format:this.config.format,rotation:typeof this.config.rotation==="boolean"?void 0:this.config.rotation,timestamp:typeof this.config.timestamp==="boolean"?void 0:this.config.timestamp});return this.subLoggers.add(r),r}createReadStream(){if(mr())throw Error("createReadStream is not supported in browser environments");if(!Wp(this.currentLogFile))throw Error(`Log file does not exist: ${this.currentLogFile}`);return iy(this.currentLogFile,{encoding:"utf8"})}async decrypt(e){if(!this.validateEncryptionConfig())throw Error("Encryption is not configured");let t=this.config.rotation;if(!t.encrypt||typeof t.encrypt==="boolean")throw Error("Invalid encryption configuration");if(!this.currentKeyId||!this.keys.has(this.currentKeyId))throw Error("No valid encryption key available");let r=this.keys.get(this.currentKeyId);try{let a=ao.isBuffer(e)?e:ao.from(e,"base64"),l=a.slice(0,16),m=a.slice(-16),h=a.slice(16,-16),S=CE("aes-256-gcm",r,l);return S.setAuthTag(m),ao.concat([S.update(h),S.final()]).toString("utf8")}catch(a){throw Error(`Decryption failed: ${a instanceof Error?a.message:String(a)}`)}}getLevel(){return this.config.level}getLogDirectory(){return this.config.logDirectory}getFormat(){return this.config.format}getRotationConfig(){return this.config.rotation}isBrowserMode(){return mr()}isServerMode(){return!mr()}setTestEncryptionKey(e,t){this.currentKeyId=e,this.keys.set(e,t)}getTestCurrentKey(){if(!this.currentKeyId||!this.keys.has(this.currentKeyId))return null;return{id:this.currentKeyId,key:this.keys.get(this.currentKeyId)}}getConfig(){return this.config}async box(e){if(!this.enabled)return;let t=new Date,r=this.formatConsoleTimestamp(t),a=this.formatFileTimestamp(t);if(this.fancy&&!mr()){let m=e.split(`
 `),h=Math.max(...m.map((C)=>C.length))+2,S=`┌${"─".repeat(h)}┐`,R=`└${"─".repeat(h)}┘`,y=m.map((C)=>{let T=" ".repeat(h-C.length-2);return`│ ${C}${T} │`});if(this.options.showTags!==!1&&this.name)console.error(this.formatConsoleMessage({timestamp:r,message:Kt.gray(this.formatTag(this.name)),showTimestamp:!1}));console.error(this.formatConsoleMessage({timestamp:r,message:Kt.cyan(S)})),y.forEach((C)=>console.error(this.formatConsoleMessage({timestamp:r,message:Kt.cyan(C),showTimestamp:!1}))),console.error(this.formatConsoleMessage({timestamp:r,message:Kt.cyan(R),showTimestamp:!1}))}else if(!mr())console.error(`${a} ${this.environment}.INFO: [BOX] ${e}`);let l=`${a} ${this.environment}.INFO: [BOX] ${e}
 `.replace(this.ANSI_PATTERN,"");await this.writeToFile(l)}async prompt(e){if(mr())return Promise.resolve(!0);return new Promise((t)=>{console.error(`${Kt.cyan("?")} ${e} (y/n) `);let r=(a)=>{let l=a.toString().trim().toLowerCase();jr.stdin.removeListener("data",r);try{if(typeof jr.stdin.setRawMode==="function")jr.stdin.setRawMode(!1)}catch{}jr.stdin.pause(),console.error(""),t(l==="y"||l==="yes")};try{if(typeof jr.stdin.setRawMode==="function")jr.stdin.setRawMode(!0)}catch{}jr.stdin.resume(),jr.stdin.once("data",r)})}setFancy(e){this.fancy=e}isFancy(){return this.fancy}pause(){this.enabled=!1}resume(){this.enabled=!0}async start(e,...t){if(!this.enabled)return;let r=e;if(t&&t.length>0){let h=/%([sdijfo%])/g,S=0;if(r=e.replace(h,(R,y)=>{if(y==="%")return"%";if(S>=t.length)return R;let C=t[S++];switch(y){case"s":return String(C);case"d":case"i":return Number(C).toString();case"j":case"o":return JSON.stringify(C,null,2);default:return R}}),S<t.length)r+=` ${t.slice(S).map((R)=>typeof R==="object"?JSON.stringify(R,null,2):String(R)).join(" ")}`}if(this.fancy&&!mr()){let h=this.options.showTags!==!1&&this.name?Kt.gray(this.formatTag(this.name)):"",S=Kt.blue("◐");console.error(`${S} ${h} ${Kt.cyan(r)}`)}let m=`[${new Date().toISOString()}] ${this.environment}.INFO: [START] ${r}
 `.replace(this.ANSI_PATTERN,"");await this.writeToFile(m)}progress(e,t=""){if(!this.enabled||!this.fancy||mr()||e<=0)return{update:()=>{},finish:()=>{},interrupt:()=>{}};if(this.activeProgressBar)console.warn("Warning: Another progress bar is already active. Finishing the previous one."),this.finishProgressBar(this.activeProgressBar,"[Auto-finished]");let r=20;return this.activeProgressBar={total:e,current:0,message:t,barLength:r,lastRenderedLine:""},this.renderProgressBar(this.activeProgressBar),{update:(h,S)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||mr())return;if(this.activeProgressBar.current=Math.max(0,Math.min(e,h)),S!==void 0)this.activeProgressBar.message=S;let R=this.activeProgressBar.current===this.activeProgressBar.total;this.renderProgressBar(this.activeProgressBar,R)},finish:(h)=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||mr())return;if(this.activeProgressBar.current=this.activeProgressBar.total,h!==void 0)this.activeProgressBar.message=h;this.renderProgressBar(this.activeProgressBar,!0),this.finishProgressBar(this.activeProgressBar)},interrupt:(h,S="info")=>{if(!this.activeProgressBar||!this.enabled||!this.fancy||mr())return;jr.stdout.write(`${"\r".padEnd(jr.stdout.columns||80)}\r`),this.log(S,h),setTimeout(()=>{if(this.activeProgressBar)this.renderProgressBar(this.activeProgressBar)},50)}}}renderProgressBar(e,t=!1){if(!this.enabled||!this.fancy||mr()||!jr.stdout.isTTY)return;let r=Math.min(100,Math.max(0,Math.round(e.current/e.total*100))),a=Math.round(e.barLength*r/100),l=e.barLength-a,m=Kt.green("━".repeat(a)),h=Kt.gray("━".repeat(l)),S=`[${m}${h}]`,R=`${r}%`.padStart(4),y=e.message?` ${e.message}`:"",C=t||r===100?Kt.green("✓"):Kt.blue("▶"),T=this.options.showTags!==!1&&this.name?` ${Kt.gray(this.formatTag(this.name))}`:"",j=`\r${C}${T} ${S} ${R}${y}`,B=jr.stdout.columns||80,V=" ".repeat(Math.max(0,B-j.replace(this.ANSI_PATTERN,"").length));if(e.lastRenderedLine=`${j}${V}`,jr.stdout.write(e.lastRenderedLine),t)jr.stdout.write(`
@@ -137,7 +137,7 @@ ${l.map((y)=>{let C=xy(t,y.file).replace(/\\/g,"/");return`  '${y.base}': typeof
 export type ConfigByName = ${S}
 export type Config<N extends ConfigNames> = N extends keyof ConfigByName ? ConfigByName[N] : unknown
 export type ConfigOf = Config
-`}return{name:"bunfig-plugin",setup(l){l.onResolve({filter:/^virtual:bunfig-types$/},(m)=>({path:m.path,namespace:"bunfig-virtual"})),l.onLoad({filter:/^virtual:bunfig-types$/,namespace:"bunfig-virtual"},()=>({contents:a(),loader:"ts"}))}}}var hv,Ys,gc,yv,$R,NR,Uy,Sd,lg,Mr,Kt,jR,qy,BR,Vy,MR,LR,tg,FR,Wy,Hy,rg,zR,UR,qR,VR,wd,vv,WR,Lr,HR,KR,Ky,kd,ug,Ir,At,JR,Jy,GR,Gy,QR,YR,ng,ZR,Qy,Yy,XR,ig,eA,tA,rA,nA,iA,Id,bv,oA,sA="0.15.6",xn,Bd,uc,pg,gg,Ld,mg,fg,pc,hg,yg,uo,Sv,wv,Hn,vi,kv,Iv,aA=aR(async()=>{hv=import.meta.require,Ys=new Sg,gc=new wg,yv={createKey:cR,isEquivalent:dR,estimateMemoryUsage:lR},$R=Pd(cg.cwd(),"config"),NR=Pd(cg.cwd(),"src/generated"),Uy=Cd.env.CLARITY_LOG_DIR||EE(gR(),"logs"),Sd={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Uy,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1},lg=await mR(),Mr={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,reset:"\x1B[0m"},Kt=Mr,jR=Mr.red,qy=Mr.green,BR=Mr.yellow,Vy=Mr.blue,MR=Mr.magenta,LR=Mr.cyan,tg=Mr.white,FR=Mr.gray,Wy=Mr.bgRed,Hy=Mr.bgYellow,rg=Mr.bold,zR=Mr.dim,UR=Mr.italic,qR=Mr.underline,VR=Mr.reset,wd={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},vv={debug:"\uD83D\uDD0D",info:Vy("ℹ"),success:qy("✓"),warning:Hy(tg(rg(" WARN "))),error:Wy(tg(rg(" ERROR ")))},WR=new Dd("stacks"),Lr=new Dd("bunfig",{showTags:!0}),HR=yn(lc.cwd(),"config"),KR=yn(lc.cwd(),"src/generated"),Ky=Rd.env.CLARITY_LOG_DIR||kE(vR(),"logs"),kd={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Ky,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},ug=await bR(),Ir={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},At=Ir,JR=Ir.red,Jy=Ir.green,GR=Ir.yellow,Gy=Ir.blue,QR=Ir.magenta,YR=Ir.cyan,ng=Ir.white,ZR=Ir.gray,Qy=Ir.bgRed,Yy=Ir.bgYellow,XR=Ir.bgGray,ig=Ir.bold,eA=Ir.dim,tA=Ir.italic,rA=Ir.underline,nA=Ir.strikethrough,iA=Ir.reset,Id={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},bv={debug:"\uD83D\uDD0D",info:Gy("ℹ"),success:Jy("✓"),warning:Yy(ng(ig(" WARN "))),error:Qy(ng(ig(" ERROR ")))},oA=new jd("stacks"),xn=class extends Error{timestamp;context;constructor(t,r={}){super(t);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=r,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let t=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([r,a])=>`${r}: ${a}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${t}`}},Bd=class extends xn{code="CONFIG_NOT_FOUND";constructor(t,r,a){let l=a?` or alias "${a}"`:"";super(`Configuration "${t}"${l} not found`,{configName:t,alias:a,searchPaths:r,searchPathCount:r.length})}},uc=class extends xn{code="CONFIG_LOAD_ERROR";constructor(t,r,a){super(`Failed to load configuration from "${t}": ${r.message}`,{configPath:t,configName:a,originalError:r.name,originalMessage:r.message});this.cause=r}},pg=class extends xn{code="CONFIG_VALIDATION_ERROR";constructor(t,r,a){super(`Configuration validation failed for "${t}"`,{configPath:t,configName:a,validationErrors:r,errorCount:r.length})}},gg=class extends xn{code="CONFIG_MERGE_ERROR";constructor(t,r,a,l){super(`Failed to merge configuration from "${t}" with "${r}": ${a.message}`,{sourcePath:t,targetPath:r,configName:l,originalError:a.name,originalMessage:a.message});this.cause=a}},Ld=class extends xn{code="ENV_VAR_ERROR";constructor(t,r,a,l){super(`Failed to parse environment variable "${t}" with value "${r}" as ${a}`,{envKey:t,envValue:r,expectedType:a,configName:l})}},mg=class extends xn{code="FILE_SYSTEM_ERROR";constructor(t,r,a){super(`File system ${t} failed for "${r}": ${a.message}`,{operation:t,path:r,originalError:a.name,originalMessage:a.message});this.cause=a}},fg=class extends xn{code="TYPE_GENERATION_ERROR";constructor(t,r,a){super(`Failed to generate types from "${t}" to "${r}": ${a.message}`,{configDir:t,outputPath:r,originalError:a.name,originalMessage:a.message});this.cause=a}},pc=class extends xn{code="SCHEMA_VALIDATION_ERROR";constructor(t,r,a){super(`Schema validation failed${a?` for config "${a}"`:""}`,{schemaPath:t,configName:a,validationErrors:r,errorCount:r.length})}},hg=class extends xn{code="BROWSER_CONFIG_ERROR";constructor(t,r,a,l){super(`Failed to fetch configuration from "${t}": ${r} ${a}`,{endpoint:t,status:r,statusText:a,configName:l})}},yg=class extends xn{code="PLUGIN_ERROR";constructor(t,r,a){super(`Plugin "${t}" failed during ${r}: ${a.message}`,{pluginName:t,operation:r,originalError:a.name,originalMessage:a.message});this.cause=a}},uo={configNotFound(e,t,r){return new Bd(e,t,r)},configLoad(e,t,r){return new uc(e,t,r)},configValidation(e,t,r){return new pg(e,t,r)},configMerge(e,t,r,a){return new gg(e,t,r,a)},envVar(e,t,r,a){return new Ld(e,t,r,a)},fileSystem(e,t,r){return new mg(e,t,r)},typeGeneration(e,t,r){return new fg(e,t,r)},schemaValidation(e,t,r){return new pc(e,t,r)},browserConfig(e,t,r,a){return new hg(e,t,r,a)},plugin(e,t,r){return new yg(e,t,r)}},Sv={replace:"replace",concat:"concat",smart:"smart"},wv=/^https?:\/\//,Hn=new jd("bunfig",{showTags:!0}),vi=new Ag,kv=vn(cs.cwd(),"config"),Iv=vn(cs.cwd(),"src/generated")});function cA(e,t={}){let r=_d.cwd();while(r.includes("storage"))r=Oy(r,"..");let a=Oy(r,e||"");if(t?.relative)return KE(_d.cwd(),a);return a}var dA=_d.env.CLARITY_LOG_DIR||HE(cA(),"logs"),Ev={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:dA,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},zd={...Ev},TN=(async()=>{try{let{loadConfig:e}=await aA().then(()=>av),t=await e({name:"clarity",alias:"logging",defaultConfig:Ev,cwd:_d.cwd()});if(t)Object.assign(zd,t)}catch{}return zd})();function Er(){if(fi.env.NODE_ENV==="test"||fi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function lA(){if(fi.env.NODE_ENV==="test"||fi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof fi<"u"){let e=fi.type;if(e==="renderer"||e==="worker")return!1;return!!(fi.versions&&(fi.versions.node||fi.versions.bun))}return!1}class Rv{async format(e){let t=await lA(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Gs.pid,hostname:t(),environment:Gs.env.NODE_ENV||"development",platform:Gs.platform,version:Gs.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Gs.env.NODE_ENV||Gs.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}var Cr={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},Dt=Cr,{red:xN,green:uA,yellow:DN,blue:pA,magenta:ON,cyan:$N,white:Zy,gray:NN,bgRed:gA,bgYellow:mA,bgGray:jN,bold:Xy,dim:BN,italic:MN,underline:LN,strikethrough:FN,reset:zN}=Cr,og={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},fA={debug:"\uD83D\uDD0D",info:pA("ℹ"),success:uA("✓"),warning:mA(Zy(Xy(" WARN "))),error:gA(Zy(Xy(" ERROR ")))};class Qd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...zd},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Rv,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Bt.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp,level:this.options.level??"info"},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let l=this.generateKeyId(),m=this.generateKey();this.currentKeyId=l,this.keys.set(l,m),this.encryptionKeys.set(l,{key:m,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;let t={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return t[e]>=t[r]}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...og,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...og};return{...og,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:zd.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}shouldWriteToFile(){return!Er()&&this.config.writeToFile===!0}async writeToFile(e){let r=(async()=>{let l,m=0,h=3,S=1000;while(m<h)try{try{try{await ZE(this.config.logDirectory,My.F_OK|My.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await XE(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let R=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:pi.from(e);try{if(!ud(this.currentLogFile))await eg(this.currentLogFile,"",{mode:420});if(l=By(this.currentLogFile,"a",420),YE(l,R,{flag:"a"}),jy(l),l!==void 0)Xp(l),l=void 0;if((await Ks(this.currentLogFile)).size===0){if(await eg(this.currentLogFile,R,{flag:"w",mode:420}),(await Ks(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let C=y;if(C.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(C.code)){if(m<h-1){let T=typeof C.message==="string"?C.message:"Unknown error";console.error(`Network error during write attempt ${m+1}/${h}:`,T);let j=S*2**m;await new Promise((B)=>setTimeout(B,j)),m++;continue}}if(C?.code&&["ENOSPC","EDQUOT"].includes(C.code))throw Error(`Disk quota exceeded or no space left on device: ${C.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",C),C}finally{if(l!==void 0)try{Xp(l)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(R){if(m===h-1){let C=R,T=typeof C.message==="string"?C.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",T),R}m++;let y=S*2**(m-1);await new Promise((C)=>setTimeout(C,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(l){throw console.error("Debug: [writeToFile] Error in operation:",l),l}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Js(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Js(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Js(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Er())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((l)=>{console.error("Error rotating keys:",l)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let l=Array.from(this.encryptionKeys.entries()).sort(([,S],[,R])=>R.createdAt.getTime()-S.createdAt.getTime()),m=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,m);if(l.length>h)for(let[S]of l.slice(h))this.encryptionKeys.delete(S),this.keys.delete(S)}generateKeyId(){return Zp(16).toString("hex")}generateKey(){return Zp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Zp(16),a=JE("aes-256-gcm",t,r),l=pi.isBuffer(e)?e:pi.from(e,"utf8"),m=a.update(l),h=a.final(),S=m.length+h.length,R=a.getAuthTag(),y=pi.allocUnsafe(16+S+16);return r.copy(y,0),m.copy(y,16),h.copy(y,16+m.length),R.copy(y,16+S),{encrypted:y,iv:r}}async compressData(e){return new Promise((t,r)=>{let a=Fy(),l=[];a.on("data",(m)=>l.push(m)),a.on("end",()=>t(pi.from(pi.concat(l)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Er())return;if(!this.shouldWriteToFile())return;let e=await Ks(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let l=await pd(this.config.logDirectory),m=l.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,y)=>{let C=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-C}),h=m.length>0?Number.parseInt(m[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,S=`${r}.${h}`;if(await Ks(r).catch(()=>null))try{if(await Ly(r,S),t.compress)try{let R=`${S}.gz`;await this.compressLogFile(S,R),await gd(S)}catch(R){console.error("Error compressing rotated file:",R)}if(m.length===0&&!l.some((R)=>R.endsWith(".log.1")))try{let R=`${r}.1`;await eg(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let l=new Date().toISOString().replace(/[:.]/g,"-"),m=r.replace(/\.log$/,`-${l}.log`);if(await Ks(r).catch(()=>null))await Ly(r,m)}if(this.currentLogFile=a,t.maxFiles){let m=(await pd(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,S)=>S.localeCompare(h));for(let h of m.slice(t.maxFiles))await gd(Js(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=$y(e),a=QE(t),l=Fy();await rR(r,l,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(a);console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(t);console.log(t)}}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),ud(this.currentLogFile))try{let e=By(this.currentLogFile,"r+");jy(e),Xp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Er()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await pd(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await gd(Js(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.shouldStyleConsole()?Dt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||Er())return!1;let e=typeof Bt.env.NO_COLOR<"u",t=Bt.env.FORCE_COLOR==="0";if(e||t)return!1;return!!(typeof Bt.stderr<"u"&&Bt.stderr.isTTY||typeof Bt.stdout<"u"&&Bt.stdout.isTTY)}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:l,level:m,showTimestamp:h=!0}=e,S=(B)=>B.replace(this.ANSI_PATTERN,"");if(!this.fancy){let B=[];if(h)B.push(t);if(m==="warning")B.push("WARN");else if(m==="error")B.push("ERROR");else if(r)B.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)B.push(a.replace(/[[\]]/g,""));return B.push(l),B.join(" ")}let R=Bt.stdout.columns||120,y="";if(m==="warning"||m==="error")y=`${r} ${l}`;else if(m==="info"||m==="success")y=`${r} ${a} ${l}`;else y=`${r} ${a} ${Dt.cyan(l)}`;if(!h)return y.trim();let C=S(y).trim().length,T=S(t).length,j=Math.max(1,R-2-C-T);return`${y.trim()}${" ".repeat(j)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(m,h)=>{let S=Number.parseInt(h,10);return S<t[0].length?String(t[0][S]):m});let r=/%([sdijfo%])/g,a=0,l=e.replace(r,(m,h)=>{if(h==="%")return"%";if(a>=t.length)return m;let S=t[a++];switch(h){case"s":return String(S);case"d":case"i":return Number(S).toString();case"j":case"o":return JSON.stringify(S,null,2);default:return m}});if(a<t.length)l+=` ${t.slice(a).map((m)=>typeof m==="object"?JSON.stringify(m,null,2):String(m)).join(" ")}`;return l}formatMarkdown(e){if(!e)return e;let t=e;return t=t.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,a,l)=>{let m=Dt.underline(Dt.blue(a)),h=this.toAbsoluteFilePath(l);if(h&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let S=`file://${encodeURI(h)}`,R="\x1B]8;;",y="\x1B\\";return`\x1B]8;;${S}\x1B\\${m}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${l}\x1B\\${m}\x1B]8;;\x1B\\`;return m}),t=t.replace(/`([^`]+)`/g,(r,a)=>Dt.bgGray(a)),t=t.replace(/\*\*([^*]+)\*\*/g,(r,a)=>Dt.bold(a)),t=t.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,a)=>Dt.italic(a)),t=t.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,a)=>Dt.italic(a)),t=t.replace(/~([^~]+)~/g,(r,a)=>Dt.strikethrough(a)),t}supportsHyperlinks(){if(Er())return!1;let e=Bt.env;if(!e)return!1;if(e.TERM_PROGRAM==="iTerm.app"||e.TERM_PROGRAM==="vscode"||e.TERM_PROGRAM==="WezTerm")return!0;if(e.WT_SESSION)return!0;if(e.TERM==="xterm-kitty")return!0;let t=e.VTE_VERSION?Number.parseInt(e.VTE_VERSION,10):0;if(!Number.isNaN(t)&&t>=5000)return!0;return!1}toAbsoluteFilePath(e){try{let t=e;if(t.startsWith("file://"))t=t.replace(/^file:\/\//,"");if(t.startsWith("~")){let r=Bt.env.HOME||"";if(r)t=t.replace(/^~(?=$|\/)/,r)}if(eR(t)||t.startsWith("./")||t.startsWith("../"))t=tR(t);else return null;return ud(t)?t:null}catch{return null}}buildOutputTexts(e){let t=this.shouldStyleConsole()?this.formatMarkdown(e):e,r=e.replace(this.ANSI_PATTERN,"");return{consoleText:t,fileText:r}}async log(e,t,...r){if(!this.shouldLog(e))return;let a=new Date,l=this.formatConsoleTimestamp(a),m=this.formatFileTimestamp(a),h,S;if(t instanceof Error)h=t.message,S=t.stack;else h=this.formatMessage(t,r);let{consoleText:R,fileText:y}=this.buildOutputTexts(h);if(this.shouldStyleConsole()){let T=this.options.showIcons===!1?"":fA[e],j=this.options.showTags!==!1&&this.name?Dt.gray(this.formatTag(this.name)):"",B;switch(e){case"debug":B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:Dt.gray(R),level:e}),console.error(B);break;case"info":B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:R,level:e}),console.warn(B);break;case"success":B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:Dt.green(R),level:e}),console.error(B);break;case"warning":B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:R,level:e}),console.warn(B);break;case"error":if(B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:R,level:e}),console.error(B),S){let V=S.split(`
+`}return{name:"bunfig-plugin",setup(l){l.onResolve({filter:/^virtual:bunfig-types$/},(m)=>({path:m.path,namespace:"bunfig-virtual"})),l.onLoad({filter:/^virtual:bunfig-types$/,namespace:"bunfig-virtual"},()=>({contents:a(),loader:"ts"}))}}}var hv,Ys,gc,yv,$R,NR,Uy,Sd,lg,Mr,Kt,jR,qy,BR,Vy,MR,LR,tg,FR,Wy,Hy,rg,zR,UR,qR,VR,wd,vv,WR,Lr,HR,KR,Ky,kd,ug,Ir,At,JR,Jy,GR,Gy,QR,YR,ng,ZR,Qy,Yy,XR,ig,eA,tA,rA,nA,iA,Id,bv,oA,sA="0.15.6",xn,Bd,uc,pg,gg,Ld,mg,fg,pc,hg,yg,uo,Sv,wv,Hn,vi,kv,Iv,aA=aR(async()=>{hv=import.meta.require,Ys=new Sg,gc=new wg,yv={createKey:cR,isEquivalent:dR,estimateMemoryUsage:lR},$R=Pd(cg.cwd(),"config"),NR=Pd(cg.cwd(),"src/generated"),Uy=Cd.env.CLARITY_LOG_DIR||EE(gR(),"logs"),Sd={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Uy,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1},lg=await mR(),Mr={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,reset:"\x1B[0m"},Kt=Mr,jR=Mr.red,qy=Mr.green,BR=Mr.yellow,Vy=Mr.blue,MR=Mr.magenta,LR=Mr.cyan,tg=Mr.white,FR=Mr.gray,Wy=Mr.bgRed,Hy=Mr.bgYellow,rg=Mr.bold,zR=Mr.dim,UR=Mr.italic,qR=Mr.underline,VR=Mr.reset,wd={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},vv={debug:"\uD83D\uDD0D",info:Vy("ℹ"),success:qy("✓"),warning:Hy(tg(rg(" WARN "))),error:Wy(tg(rg(" ERROR ")))},WR=new Od("stacks"),Lr=new Od("bunfig",{showTags:!0}),HR=yn(lc.cwd(),"config"),KR=yn(lc.cwd(),"src/generated"),Ky=Rd.env.CLARITY_LOG_DIR||kE(vR(),"logs"),kd={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Ky,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},ug=await bR(),Ir={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},At=Ir,JR=Ir.red,Jy=Ir.green,GR=Ir.yellow,Gy=Ir.blue,QR=Ir.magenta,YR=Ir.cyan,ng=Ir.white,ZR=Ir.gray,Qy=Ir.bgRed,Yy=Ir.bgYellow,XR=Ir.bgGray,ig=Ir.bold,eA=Ir.dim,tA=Ir.italic,rA=Ir.underline,nA=Ir.strikethrough,iA=Ir.reset,Id={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},bv={debug:"\uD83D\uDD0D",info:Gy("ℹ"),success:Jy("✓"),warning:Yy(ng(ig(" WARN "))),error:Qy(ng(ig(" ERROR ")))},oA=new jd("stacks"),xn=class extends Error{timestamp;context;constructor(t,r={}){super(t);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=r,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let t=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([r,a])=>`${r}: ${a}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${t}`}},Bd=class extends xn{code="CONFIG_NOT_FOUND";constructor(t,r,a){let l=a?` or alias "${a}"`:"";super(`Configuration "${t}"${l} not found`,{configName:t,alias:a,searchPaths:r,searchPathCount:r.length})}},uc=class extends xn{code="CONFIG_LOAD_ERROR";constructor(t,r,a){super(`Failed to load configuration from "${t}": ${r.message}`,{configPath:t,configName:a,originalError:r.name,originalMessage:r.message});this.cause=r}},pg=class extends xn{code="CONFIG_VALIDATION_ERROR";constructor(t,r,a){super(`Configuration validation failed for "${t}"`,{configPath:t,configName:a,validationErrors:r,errorCount:r.length})}},gg=class extends xn{code="CONFIG_MERGE_ERROR";constructor(t,r,a,l){super(`Failed to merge configuration from "${t}" with "${r}": ${a.message}`,{sourcePath:t,targetPath:r,configName:l,originalError:a.name,originalMessage:a.message});this.cause=a}},Ld=class extends xn{code="ENV_VAR_ERROR";constructor(t,r,a,l){super(`Failed to parse environment variable "${t}" with value "${r}" as ${a}`,{envKey:t,envValue:r,expectedType:a,configName:l})}},mg=class extends xn{code="FILE_SYSTEM_ERROR";constructor(t,r,a){super(`File system ${t} failed for "${r}": ${a.message}`,{operation:t,path:r,originalError:a.name,originalMessage:a.message});this.cause=a}},fg=class extends xn{code="TYPE_GENERATION_ERROR";constructor(t,r,a){super(`Failed to generate types from "${t}" to "${r}": ${a.message}`,{configDir:t,outputPath:r,originalError:a.name,originalMessage:a.message});this.cause=a}},pc=class extends xn{code="SCHEMA_VALIDATION_ERROR";constructor(t,r,a){super(`Schema validation failed${a?` for config "${a}"`:""}`,{schemaPath:t,configName:a,validationErrors:r,errorCount:r.length})}},hg=class extends xn{code="BROWSER_CONFIG_ERROR";constructor(t,r,a,l){super(`Failed to fetch configuration from "${t}": ${r} ${a}`,{endpoint:t,status:r,statusText:a,configName:l})}},yg=class extends xn{code="PLUGIN_ERROR";constructor(t,r,a){super(`Plugin "${t}" failed during ${r}: ${a.message}`,{pluginName:t,operation:r,originalError:a.name,originalMessage:a.message});this.cause=a}},uo={configNotFound(e,t,r){return new Bd(e,t,r)},configLoad(e,t,r){return new uc(e,t,r)},configValidation(e,t,r){return new pg(e,t,r)},configMerge(e,t,r,a){return new gg(e,t,r,a)},envVar(e,t,r,a){return new Ld(e,t,r,a)},fileSystem(e,t,r){return new mg(e,t,r)},typeGeneration(e,t,r){return new fg(e,t,r)},schemaValidation(e,t,r){return new pc(e,t,r)},browserConfig(e,t,r,a){return new hg(e,t,r,a)},plugin(e,t,r){return new yg(e,t,r)}},Sv={replace:"replace",concat:"concat",smart:"smart"},wv=/^https?:\/\//,Hn=new jd("bunfig",{showTags:!0}),vi=new Ag,kv=vn(cs.cwd(),"config"),Iv=vn(cs.cwd(),"src/generated")});function cA(e,t={}){let r=_d.cwd();while(r.includes("storage"))r=Oy(r,"..");let a=Oy(r,e||"");if(t?.relative)return KE(_d.cwd(),a);return a}var dA=_d.env.CLARITY_LOG_DIR||HE(cA(),"logs"),Ev={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:dA,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},zd={...Ev},TN=(async()=>{try{let{loadConfig:e}=await aA().then(()=>av),t=await e({name:"clarity",alias:"logging",defaultConfig:Ev,cwd:_d.cwd()});if(t)Object.assign(zd,t)}catch{}return zd})();function Er(){if(fi.env.NODE_ENV==="test"||fi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function lA(){if(fi.env.NODE_ENV==="test"||fi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof fi<"u"){let e=fi.type;if(e==="renderer"||e==="worker")return!1;return!!(fi.versions&&(fi.versions.node||fi.versions.bun))}return!1}class Rv{async format(e){let t=await lA(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Gs.pid,hostname:t(),environment:Gs.env.NODE_ENV||"development",platform:Gs.platform,version:Gs.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Gs.env.NODE_ENV||Gs.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}var Cr={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},Dt=Cr,{red:xN,green:uA,yellow:DN,blue:pA,magenta:ON,cyan:$N,white:Zy,gray:NN,bgRed:gA,bgYellow:mA,bgGray:jN,bold:Xy,dim:BN,italic:MN,underline:LN,strikethrough:FN,reset:zN}=Cr,og={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},fA={debug:"\uD83D\uDD0D",info:pA("ℹ"),success:uA("✓"),warning:mA(Zy(Xy(" WARN "))),error:gA(Zy(Xy(" ERROR ")))};class Qd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...zd},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Rv,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Bt.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp,level:this.options.level??"info"},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let l=this.generateKeyId(),m=this.generateKey();this.currentKeyId=l,this.keys.set(l,m),this.encryptionKeys.set(l,{key:m,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;let t={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return t[e]>=t[r]}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...og,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...og};return{...og,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:zd.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}shouldWriteToFile(){return!Er()&&this.config.writeToFile===!0}async writeToFile(e){let r=(async()=>{let l,m=0,h=3,S=1000;while(m<h)try{try{try{await ZE(this.config.logDirectory,My.F_OK|My.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await XE(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let R=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:pi.from(e);try{if(!ud(this.currentLogFile))await eg(this.currentLogFile,"",{mode:420});if(l=By(this.currentLogFile,"a",420),YE(l,R,{flag:"a"}),jy(l),l!==void 0)Xp(l),l=void 0;if((await Ks(this.currentLogFile)).size===0){if(await eg(this.currentLogFile,R,{flag:"w",mode:420}),(await Ks(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let C=y;if(C.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(C.code)){if(m<h-1){let T=typeof C.message==="string"?C.message:"Unknown error";console.error(`Network error during write attempt ${m+1}/${h}:`,T);let j=S*2**m;await new Promise((B)=>setTimeout(B,j)),m++;continue}}if(C?.code&&["ENOSPC","EDQUOT"].includes(C.code))throw Error(`Disk quota exceeded or no space left on device: ${C.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",C),C}finally{if(l!==void 0)try{Xp(l)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(R){if(m===h-1){let C=R,T=typeof C.message==="string"?C.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",T),R}m++;let y=S*2**(m-1);await new Promise((C)=>setTimeout(C,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(l){throw console.error("Debug: [writeToFile] Error in operation:",l),l}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return Js(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return Js(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return Js(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Er())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((l)=>{console.error("Error rotating keys:",l)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let l=Array.from(this.encryptionKeys.entries()).sort(([,S],[,R])=>R.createdAt.getTime()-S.createdAt.getTime()),m=typeof t.maxKeys==="number"?t.maxKeys:1,h=Math.max(1,m);if(l.length>h)for(let[S]of l.slice(h))this.encryptionKeys.delete(S),this.keys.delete(S)}generateKeyId(){return Zp(16).toString("hex")}generateKey(){return Zp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Zp(16),a=JE("aes-256-gcm",t,r),l=pi.isBuffer(e)?e:pi.from(e,"utf8"),m=a.update(l),h=a.final(),S=m.length+h.length,R=a.getAuthTag(),y=pi.allocUnsafe(16+S+16);return r.copy(y,0),m.copy(y,16),h.copy(y,16+m.length),R.copy(y,16+S),{encrypted:y,iv:r}}async compressData(e){return new Promise((t,r)=>{let a=Fy(),l=[];a.on("data",(m)=>l.push(m)),a.on("end",()=>t(pi.from(pi.concat(l)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Er())return;if(!this.shouldWriteToFile())return;let e=await Ks(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let l=await pd(this.config.logDirectory),m=l.filter((R)=>R.startsWith(this.name)&&/\.log\.\d+$/.test(R)).sort((R,y)=>{let C=Number.parseInt(R.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-C}),h=m.length>0?Number.parseInt(m[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,S=`${r}.${h}`;if(await Ks(r).catch(()=>null))try{if(await Ly(r,S),t.compress)try{let R=`${S}.gz`;await this.compressLogFile(S,R),await gd(S)}catch(R){console.error("Error compressing rotated file:",R)}if(m.length===0&&!l.some((R)=>R.endsWith(".log.1")))try{let R=`${r}.1`;await eg(R,"")}catch(R){console.error("Error creating backup file:",R)}}catch(R){console.error(`Error during rotation: ${R instanceof Error?R.message:String(R)}`)}}else{let l=new Date().toISOString().replace(/[:.]/g,"-"),m=r.replace(/\.log$/,`-${l}.log`);if(await Ks(r).catch(()=>null))await Ly(r,m)}if(this.currentLogFile=a,t.maxFiles){let m=(await pd(this.config.logDirectory)).filter((h)=>h.startsWith(this.name)).sort((h,S)=>S.localeCompare(h));for(let h of m.slice(t.maxFiles))await gd(Js(this.config.logDirectory,h))}}}async compressLogFile(e,t){let r=$y(e),a=QE(t),l=Fy();await rR(r,l,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(a);console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(t);console.log(t)}}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),ud(this.currentLogFile))try{let e=By(this.currentLogFile,"r+");jy(e),Xp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Er()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await pd(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await gd(Js(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.shouldStyleConsole()?Dt.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||Er())return!1;let e=typeof Bt.env.NO_COLOR<"u",t=Bt.env.FORCE_COLOR==="0";if(e||t)return!1;return!!(typeof Bt.stderr<"u"&&Bt.stderr.isTTY||typeof Bt.stdout<"u"&&Bt.stdout.isTTY)}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:l,level:m,showTimestamp:h=!0}=e,S=(B)=>B.replace(this.ANSI_PATTERN,"");if(!this.fancy){let B=[];if(h)B.push(t);if(m==="warning")B.push("WARN");else if(m==="error")B.push("ERROR");else if(r)B.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)B.push(a.replace(/[[\]]/g,""));return B.push(l),B.join(" ")}let R=Bt.stdout.columns||120,y="";if(m==="warning"||m==="error")y=`${r} ${l}`;else if(m==="info"||m==="success")y=`${r} ${a} ${l}`;else y=`${r} ${a} ${Dt.cyan(l)}`;if(!h)return y.trim();let C=S(y).trim().length,T=S(t).length,j=Math.max(1,R-2-C-T);return`${y.trim()}${" ".repeat(j)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(m,h)=>{let S=Number.parseInt(h,10);return S<t[0].length?String(t[0][S]):m});let r=/%([sdijfo%])/g,a=0,l=e.replace(r,(m,h)=>{if(h==="%")return"%";if(a>=t.length)return m;let S=t[a++];switch(h){case"s":return String(S);case"d":case"i":return Number(S).toString();case"j":case"o":return JSON.stringify(S,null,2);default:return m}});if(a<t.length)l+=` ${t.slice(a).map((m)=>typeof m==="object"?JSON.stringify(m,null,2):String(m)).join(" ")}`;return l}formatMarkdown(e){if(!e)return e;let t=e;return t=t.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,a,l)=>{let m=Dt.underline(Dt.blue(a)),h=this.toAbsoluteFilePath(l);if(h&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let S=`file://${encodeURI(h)}`,R="\x1B]8;;",y="\x1B\\";return`\x1B]8;;${S}\x1B\\${m}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${l}\x1B\\${m}\x1B]8;;\x1B\\`;return m}),t=t.replace(/`([^`]+)`/g,(r,a)=>Dt.bgGray(a)),t=t.replace(/\*\*([^*]+)\*\*/g,(r,a)=>Dt.bold(a)),t=t.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,a)=>Dt.italic(a)),t=t.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,a)=>Dt.italic(a)),t=t.replace(/~([^~]+)~/g,(r,a)=>Dt.strikethrough(a)),t}supportsHyperlinks(){if(Er())return!1;let e=Bt.env;if(!e)return!1;if(e.TERM_PROGRAM==="iTerm.app"||e.TERM_PROGRAM==="vscode"||e.TERM_PROGRAM==="WezTerm")return!0;if(e.WT_SESSION)return!0;if(e.TERM==="xterm-kitty")return!0;let t=e.VTE_VERSION?Number.parseInt(e.VTE_VERSION,10):0;if(!Number.isNaN(t)&&t>=5000)return!0;return!1}toAbsoluteFilePath(e){try{let t=e;if(t.startsWith("file://"))t=t.replace(/^file:\/\//,"");if(t.startsWith("~")){let r=Bt.env.HOME||"";if(r)t=t.replace(/^~(?=$|\/)/,r)}if(eR(t)||t.startsWith("./")||t.startsWith("../"))t=tR(t);else return null;return ud(t)?t:null}catch{return null}}buildOutputTexts(e){let t=this.shouldStyleConsole()?this.formatMarkdown(e):e,r=e.replace(this.ANSI_PATTERN,"");return{consoleText:t,fileText:r}}async log(e,t,...r){if(!this.shouldLog(e))return;let a=new Date,l=this.formatConsoleTimestamp(a),m=this.formatFileTimestamp(a),h,S;if(t instanceof Error)h=t.message,S=t.stack;else h=this.formatMessage(t,r);let{consoleText:R,fileText:y}=this.buildOutputTexts(h);if(this.shouldStyleConsole()){let T=this.options.showIcons===!1?"":fA[e],j=this.options.showTags!==!1&&this.name?Dt.gray(this.formatTag(this.name)):"",B;switch(e){case"debug":B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:Dt.gray(R),level:e}),console.error(B);break;case"info":B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:R,level:e}),console.warn(B);break;case"success":B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:Dt.green(R),level:e}),console.error(B);break;case"warning":B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:R,level:e}),console.warn(B);break;case"error":if(B=this.formatConsoleMessage({timestamp:l,icon:T,tag:j,message:R,level:e}),console.error(B),S){let V=S.split(`
 `);for(let W of V)if(W.trim()&&!W.includes(h))console.error(this.formatConsoleMessage({timestamp:l,message:Dt.gray(`  ${W}`),level:e,showTimestamp:!1}))}break}}else if(!Er()){if(console.error(`${m} ${this.environment}.${e.toUpperCase()}: ${h}`),S)console.error(S)}let C=`${m} ${this.environment}.${e.toUpperCase()}: ${y}
 `;if(S)C+=`${S}
 `;if(C=C.replace(this.ANSI_PATTERN,""),this.shouldWriteToFile())await this.writeToFile(C)}progress(e,t=""){let r={update:(S,R)=>{},finish:(S)=>{},interrupt:(S,R)=>{}};if(!this.enabled)return r;let a=30;if(this.activeProgressBar={total:Math.max(1,e||1),current:0,message:t||"",barLength:a,lastRenderedLine:""},this.shouldStyleConsole()&&!Er()&&Bt.stdout.isTTY)this.renderProgressBar(this.activeProgressBar);return{update:(S,R)=>{if(!this.enabled||!this.activeProgressBar)return;if(this.activeProgressBar.current=Math.min(Math.max(0,S),this.activeProgressBar.total),R!==void 0)this.activeProgressBar.message=R;if(this.shouldStyleConsole()&&!Er()&&Bt.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)},finish:(S)=>{if(!this.activeProgressBar)return;this.finishProgressBar(this.activeProgressBar,S)},interrupt:(S,R="info")=>{if(!Er()&&Bt.stdout.isTTY)Bt.stdout.write(`
@@ -164,9 +164,9 @@ export type ConfigOf = Config
 `);for(let l=0;l<a.length;l++){let m=l+1,h=a[l];if(!h.trim()||h.trimStart().startsWith("#"))continue;if(/^\s*export\s+/.test(h))h=h.replace(/^\s*export\s+/,"");let S=h.match(/^\s*([^=\s]+)\s*=\s*(.*)$/);if(!S){r.push({line:m,severity:"error",code:"invalid_line",message:"Expected KEY=VALUE."});continue}let R=S[1],y=S[2];if(!qv.test(R)){r.push({line:m,key:R,severity:"error",code:"invalid_key",message:`Invalid environment variable name: ${R}`});continue}let C=y;if(y.startsWith('"')||y.startsWith("'")){let T=y[0],j=[y.slice(1)],B=!1;while(!0){let V=j[j.length-1],W=!1,Y=-1;for(let te=0;te<V.length;te++){if(T==='"'&&V[te]==="\\"&&!W){W=!0;continue}if(V[te]===T&&!W){Y=te;break}W=!1}if(Y>=0){j[j.length-1]=V.slice(0,Y),B=!0;break}if(++l>=a.length)break;j.push(a[l])}if(!B){r.push({line:m,key:R,severity:"error",code:"unterminated_quote",message:`Unterminated quoted value for ${R}.`});continue}if(C=j.join(`
 `),T==='"')C=_A(C)}else C=y.replace(/\s+#.*$/,"").trim();if(Object.hasOwn(t,R)){let T=t[R]!==C;if(r.push({line:m,key:R,severity:T?"error":"warning",code:T?"conflict":"duplicate",message:T?`${R} has conflicting values.`:`${R} is duplicated with the same value.`}),T)continue}t[R]=C}return{values:t,diagnostics:r,valid:!r.some((l)=>l.severity==="error")}}function Cu(e){return Object.entries(e).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>{if(!qv.test(t))throw Error(`Invalid environment variable name: ${t}`);return`${t}=${JSON.stringify(r)}`}).join(`
 `)+(Object.keys(e).length?`
-`:"")}import{createCipheriv as TA,createDecipheriv as xA,createHash as Vv,randomBytes as DA}from"node:crypto";class gn{controlPlane;now;kind="local_encrypted";key;constructor(e,t,r=()=>new Date){this.controlPlane=e;this.now=r;if(!t)throw Error("Configuration encryption key is required.");this.key=Vv("sha256").update(`ts-cloud:configuration:${t}`).digest()}encrypt(e){let t=DA(12),r=TA("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted configuration secret is unavailable.");try{let m=xA("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(e){if(!e.value)throw Error("Configuration secrets cannot be empty.");let t=e.reference??`secret://configuration/${e.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(t))throw Error("Invalid local configuration secret reference.");let a=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(t)?.version??0)+1,l=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[t,this.encrypt(e.value),Vv("sha256").update(e.value).digest("hex"),a,l,l]),{reference:t,version:String(a)}}async resolve(e){let t=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(e);if(!t)throw Error("Configuration secret was not found.");return this.decrypt(t.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[e])}async validate(e){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(e)}}class _a{client;region;kind="aws_secrets_manager";constructor(e,t){this.client=e;this.region=t}async put(e){if(e.reference){let r=this.id(e.reference),a=await this.client.putSecretValue({SecretId:r,SecretString:e.value,ClientRequestToken:e.idempotencyKey});return{reference:e.reference,version:a.VersionId??e.idempotencyKey}}let t=await this.client.createSecret({Name:e.name,SecretString:e.value,ClientRequestToken:e.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(t.ARN??t.Name??e.name)}`,version:t.VersionId??e.idempotencyKey}}async resolve(e){let t=await this.client.getSecretValue({SecretId:this.id(e)});if(t.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return t.SecretString}async remove(e){await this.client.deleteSecret({SecretId:this.id(e),RecoveryWindowInDays:7})}async validate(e){try{return await this.client.describeSecret(this.id(e)),!0}catch{return!1}}id(e){let t=new URL(e);if(t.protocol!=="aws-sm:"||t.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(t.pathname.slice(1))}}class xa{client;region;kind="aws_ssm";constructor(e,t){this.client=e;this.region=t}async put(e){let t=e.reference?this.name(e.reference):`/${e.name.replace(/^\/+/,"")}`,r=await this.client.putParameter({Name:t,Value:e.value,Type:"SecureString",Overwrite:!!e.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${t}`,version:String(r.Version??1)}}async resolve(e){let t=await this.client.getParameter({Name:this.name(e),WithDecryption:!0});if(t.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return t.Parameter.Value}async remove(e){await this.client.deleteParameter({Name:this.name(e)})}async validate(e){try{return!!(await this.client.getParameter({Name:this.name(e),WithDecryption:!1})).Parameter}catch{return!1}}name(e){let t=new URL(e);if(t.protocol!=="aws-ssm:"||t.hostname!==this.region||!t.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return t.pathname}}class Oa{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(e){return/^(?:vault|doppler|op|external):\/\//.test(e)}}import{createHmac as OA}from"node:crypto";var $A=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,NA=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/;function Rn(e){return[...new Set(e)].sort()}function Wv(e,t={}){let r=e.kind==="secret";return{id:e.id,key:e.key,kind:e.kind,scope:e.scope,inherited:!!t.inherited,overridden:!!t.overridden,required:e.required,backend:!r||t.canReadSecretMetadata?e.backend:void 0,backendVersion:!r||t.canReadSecretMetadata?e.backendVersion:void 0,reference:r&&t.canReadSecretMetadata?e.secretRef:void 0,value:!r?e.value:void 0,lastUsedAt:e.lastUsedAt,rotatedAt:e.rotatedAt,version:e.version,updatedAt:e.updatedAt}}class La{store;backends=new Map;fingerprintKey;now;constructor(e,t){if(this.store=e,this.fingerprintKey=t.fingerprintKey??t.encryptionKey,this.now=t.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let r=t.backends??[new gn(e.controlPlane,t.encryptionKey,this.now)];for(let a of r)this.backends.set(a.kind,a)}list(e){let t=e.search?.toLowerCase();return this.store.list(e).filter((r)=>!t||r.key.toLowerCase().includes(t)).map((r)=>Wv(r,{canReadSecretMetadata:e.canReadSecretMetadata}))}plan(e){let t=this.store.list({projectId:e.projectId,scope:e.scope}),r=new Map(t.map((R)=>[R.key,R])),a=[],l=[],m=[],h=[];for(let[R,y]of Object.entries(e.values)){a.push(...this.warnings(R,y));let C=r.get(R);if(!C)l.push(R);else if(C.valueFingerprint!==this.fingerprint(y))m.push(R);else h.push(R)}let S=e.removeMissing?t.filter((R)=>!Object.hasOwn(e.values,R.key)).map((R)=>R.key):[];return{added:Rn(l),changed:Rn(m),removed:Rn(S),unchanged:Rn(h),affectedResourceIds:this.affectedResources(e.projectId,e.scope,[...l,...m,...S]),warnings:a}}async set(e){let t=this.requestHash(e),r=e.idempotencyKey;if(r){let V=this.store.mutation(r);if(V){if(V.requestHash!==t)throw Error("Idempotency key was already used for a different configuration mutation.");let W=this.store.get(String(V.result.entryId??""));if(!W)throw Error("Idempotent configuration result is no longer available.");return{entry:W,mutation:V.result.mutation,warnings:[]}}}if(e.value!=null&&$A.test(e.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let a=this.store.find(e.projectId,e.scope,e.key),l=this.fingerprint(e.value??e.reference??"");if(a&&e.expectedVersion!=null&&a.version!==e.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(a&&a.kind!==e.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let m=e.kind==="variable"?"plaintext":e.backend??(e.reference?"external":"local_encrypted");if(!!a&&(a.valueFingerprint!==l||a.backend!==m||a.required!==!!e.required)&&(this.isProduction(a)||this.store.dependencies(a.id).length>0)&&!e.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let S=e.reference,R;if(e.kind==="secret"){let V=this.backend(m);if(e.reference&&e.value==null){if(!await V.validate(e.reference))throw Error("Secret backend reference is unavailable or invalid.");R=a?.backendVersion??"external"}else{if(e.value==null)throw Error("A secret value or external reference is required.");let W=await V.put({reference:a?.backend===m?a.secretRef:void 0,name:this.backendName(e),value:e.value,idempotencyKey:r??crypto.randomUUID()});S=W.reference,R=W.version}}let y=e.kind==="variable"?e.value:void 0;if(e.kind==="variable"&&y==null)throw Error("A variable value is required.");let C=!a||a.valueFingerprint!==l||a.backend!==m||a.secretRef!==S||a.backendVersion!==R||a.required!==!!e.required,T=a?C?this.store.update(a.id,a.version,{value:y,valueFingerprint:l,secretRef:S,backend:m,backendVersion:R,required:!!e.required,metadata:s(e.metadata??a.metadata),rotatedAt:e.kind==="secret"?this.now().toISOString():a.rotatedAt}):a:this.store.create({organizationId:e.organizationId,projectId:e.projectId,scope:e.scope,key:e.key,kind:e.kind,value:y,valueFingerprint:l,secretRef:S,backend:m,backendVersion:R,origin:e.origin??"managed",required:!!e.required,metadata:s(e.metadata??{}),rotatedAt:e.kind==="secret"?this.now().toISOString():void 0}),j=this.affectedResources(e.projectId,e.scope,[e.key]),B={added:a?[]:[e.key],changed:a&&C?[e.key]:[],removed:[],unchanged:a&&!C?[e.key]:[],affectedResourceIds:j,versions:{[e.key]:T.version}};if(r)this.store.recordMutation({projectId:e.projectId,idempotencyKey:r,requestHash:t,actorId:e.actorId,result:{entryId:T.id,mutation:B}});return this.audit(e.projectId,e.actorId,a&&C?"configuration.updated":a?"configuration.unchanged":"configuration.created",T,j),{entry:T,mutation:B,warnings:this.warnings(e.key,e.value??"")}}async importDotenv(e){let t=Su(e.source);if(!t.valid)return{document:t,warnings:[]};let r=new Set(e.secretKeys??[]),a={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},l=[];for(let[m,h]of Object.entries(t.values)){let S=await this.set({...e,source:void 0,key:m,value:h,kind:r.has(m)?"secret":"variable",idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:${m}`:void 0});a.added.push(...S.mutation.added),a.changed.push(...S.mutation.changed),a.unchanged.push(...S.mutation.unchanged),a.affectedResourceIds.push(...S.mutation.affectedResourceIds),Object.assign(a.versions,S.mutation.versions),l.push(...S.warnings)}return a.added=Rn(a.added),a.changed=Rn(a.changed),a.unchanged=Rn(a.unchanged),a.affectedResourceIds=Rn(a.affectedResourceIds),{document:t,mutation:a,warnings:l}}exportVariables(e){return Cu(Object.fromEntries(this.store.list({projectId:e.projectId,scope:e.scope,kind:"variable"}).map((t)=>[t.key,t.value??""])))}async transfer(e){let t=this.store.get(e.entryId);if(!t)throw Error("Configuration entry was not found.");if(t.scope.type===e.targetScope.type&&t.scope.id===e.targetScope.id)throw Error("Choose a different destination scope.");let r=t.kind==="variable"?t.value:t.backend==="external"?void 0:await this.backend(t.backend).resolve(t.secretRef),a=t.kind==="secret"?t.backend:void 0,l=await this.set({organizationId:t.organizationId,projectId:t.projectId,scope:e.targetScope,key:t.key,kind:t.kind,value:r,reference:t.backend==="external"?t.secretRef:void 0,backend:a,required:t.required,metadata:t.metadata,confirmed:e.confirmed,actorId:e.actorId,idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:copy`:void 0,origin:t.origin});if(e.mode==="move")await this.remove({entryId:t.id,expectedVersion:t.version,confirmed:e.confirmed,actorId:e.actorId});let m={added:l.mutation.added,changed:l.mutation.changed,removed:e.mode==="move"?[t.key]:[],unchanged:l.mutation.unchanged,affectedResourceIds:Rn([...l.mutation.affectedResourceIds,...this.affectedResources(t.projectId,t.scope,[t.key])]),versions:l.mutation.versions};return{entry:l.entry,mutation:m}}async resolve(e){let t=this.store.list({projectId:e.projectId}),r=t.filter((y)=>this.applies(y,e)).sort((y,C)=>this.rank(y.scope.type)-this.rank(C.scope.type)),a=new Map,l=new Set;for(let y of r){if(a.has(y.key))l.add(y.key);a.set(y.key,y)}let m={},h={},S=[],R=new Set(e.allowedPreviewSecrets??[]);for(let[y,C]of a){if(e.previewId&&C.kind==="secret"&&C.scope.type!=="preview"&&(!e.trustedPreview||!R.has(y)))continue;if(C.kind==="variable")m[y]=C.value??"";else if(e.nativeReferences)m[y]=C.secretRef;else{let T=this.backend(C.backend);if(!await T.validate(C.secretRef)){if(S.push({key:y,code:"stale_reference",message:`${y} points to an unavailable secret.`}),C.required)S.push({key:y,code:"missing_required",message:`${y} is required but unavailable.`});continue}m[y]=await T.resolve(C.secretRef)}h[y]=Wv(C,{inherited:C.scope.type!==(e.previewId?"preview":e.functionId?"function":e.resourceId?"service":e.environmentId?"environment":"project"),overridden:l.has(y),canReadSecretMetadata:e.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),C.id])}return{values:m,entries:h,warnings:S,configurationHash:this.fingerprint([...a.values()].map((y)=>`${y.key}:${y.valueFingerprint}:${y.version}`).sort().join(`
-`))}}async reveal(e){let t=this.store.get(e.entryId);if(!t||t.kind!=="secret")throw Error("Configuration secret was not found.");if(!e.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!e.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let r=await this.backend(t.backend).resolve(t.secretRef);return this.audit(t.projectId,e.actorId,"configuration.secret.revealed",t,[]),r}async remove(e){let t=this.store.get(e.entryId);if(!t)throw Error("Configuration entry was not found.");let r=this.store.dependencies(t.id);if(((t.scope.environmentId?this.store.controlPlane.listEnvironments(t.projectId).some((h)=>h.id===t.scope.environmentId&&h.kind==="production"):t.scope.type==="project")||r.length)&&!e.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(t.kind==="secret"&&t.backend!=="external")await this.backend(t.backend).remove(t.secretRef);this.store.remove(t.id,e.expectedVersion);let l=Rn(r.map((h)=>h.resourceId)),m={added:[],changed:[],removed:[t.key],unchanged:[],affectedResourceIds:l,versions:{}};return this.audit(t.projectId,e.actorId,"configuration.deleted",t,l),m}applies(e,t){if(e.scope.type==="project")return!0;if(e.scope.type==="environment")return e.scope.id===t.environmentId;if(e.scope.type==="service")return e.scope.id===t.resourceId;if(e.scope.type==="function")return e.scope.id===t.functionId;return e.scope.id===t.previewId}rank(e){return{project:0,environment:1,service:2,function:3,preview:4}[e]}fingerprint(e){return`hmac-sha256:${OA("sha256",this.fingerprintKey).update(e).digest("hex")}`}requestHash(e){return this.fingerprint(JSON.stringify({...e,idempotencyKey:void 0,actorId:void 0}))}backend(e){let t=this.backends.get(e);if(!t)throw Error(`Configuration secret backend is not configured: ${e}`);return t}backendName(e){return`ts-cloud/${e.projectId}/${e.scope.type}/${e.scope.id}/${e.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(e){return e.scope.type==="project"||!!e.scope.environmentId&&this.store.controlPlane.listEnvironments(e.projectId).some((t)=>t.id===e.scope.environmentId&&t.kind==="production")}warnings(e,t){let r=[];if(NA.test(e))r.push({key:e,code:"reserved",message:`${e} may be reserved by the runtime or provider.`});if(Buffer.byteLength(t)>65536)r.push({key:e,code:"limit",message:`${e} exceeds the portable 64 KiB value limit.`});return r}affectedResources(e,t,r){let a=this.store.list({projectId:e,scope:t}).filter((l)=>r.includes(l.key)).flatMap((l)=>this.store.dependencies(l.id).map((m)=>m.resourceId));if(t.type==="service"||t.type==="function")return Rn([...a,t.id]);if(t.type==="environment")return Rn([...a,...this.store.controlPlane.listResources(e,t.id).map((l)=>l.id)]);if(t.type==="preview"){let l=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(t.id);return Rn([...a,...l?[l.resource_id]:[]])}return Rn([...a,...this.store.controlPlane.listResources(e).map((l)=>l.id)])}audit(e,t,r,a,l){this.store.controlPlane.appendEvent({projectId:e,actorId:t,type:r,payload:{entryId:a.id,key:a.key,kind:a.kind,scopeType:a.scope.type,scopeId:a.scope.id,backend:a.backend,version:a.version,affectedResourceIds:l}})}}async function Eu(e,t,r,a){let l={added:0,changed:0,removed:0,overridden:0},m=async(h,S)=>{let R=e.store.list({projectId:t.project.id,scope:h,kind:"variable"}),y=new Set(Object.keys(S));for(let C of R.filter((T)=>T.origin==="config"&&!y.has(T.key)))await e.remove({entryId:C.id,expectedVersion:C.version,confirmed:!0,actorId:a}),l.removed++;for(let[C,T]of Object.entries(S)){let j=e.store.find(t.project.id,h,C);if(j?.origin!=="config"){if(j)l.overridden++;else await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:h,key:C,kind:"variable",value:String(T),origin:"config",confirmed:!0,actorId:a}),l.added++;continue}if(j.value===String(T))continue;await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:h,key:C,kind:"variable",value:String(T),origin:"config",confirmed:!0,actorId:a,expectedVersion:j.version}),l.changed++}};for(let[h,S]of Object.entries(r.environments??{})){let R=t.environments.get(h);if(!R)continue;let y=S,C={...y.variables??{},...y.app?.env??{}};await m({type:"environment",id:R.id,environmentId:R.id},C);for(let[T,j]of Object.entries(r.sites??{})){let B=t.store.listResources(t.project.id,R.id).find((V)=>V.kind==="application"&&V.slug===T);if(B)await m({type:"service",id:B.id,environmentId:R.id,resourceId:B.id},{...j.env??{}})}for(let[T,j]of Object.entries(r.infrastructure?.functions??{})){let B=t.store.listResources(t.project.id,R.id).find((V)=>V.kind==="function"&&V.slug===T);if(B)await m({type:"function",id:B.id,environmentId:R.id,resourceId:B.id},{...j.environment??{}})}}return l}var jA=async(e)=>{let t=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),[r,a,l]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:a,stderr:l}};class ql{async scan(e,t){return zn(e,t)}async exec(e,t){if(e.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return jA(["ssh","-p",String(e.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${e.sshUser}@${e.endpoint}`,t])}}var BA=dt,MA=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class on{provider;transport;discoverer;constructor(e,t=new ql,r){this.provider=e;this.transport=t;this.discoverer=r}discover(e){return this.discoverer?.(e)??Promise.resolve([])}async test(e){try{let t=await this.transport.scan(e.endpoint,e.sshPort);return{reachable:!0,hostKeyAlgorithm:t.algorithm,hostKeyFingerprint:BA(t.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(e){let t=await this.transport.exec(e,MA);if(t.code!==0)throw Error(`Fleet validation failed: ${t.stderr.trim()||t.code}`);try{return JSON.parse(t.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(e,t){let r=await this.transport.exec(e,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${t.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function Vl(e,t){return{"fleet.bootstrap":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.get(String(a.serverId??""));if(!l)throw Error("Queued fleet server was not found.");let m=t.find((R)=>R.provider===l.provider);if(!m)throw Error(`No ${l.provider} fleet driver is configured.`);let h=Array.isArray(a.steps)?a.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),l.trustState!=="pinned"||!l.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let S=await m.bootstrap(l,h);return e.update(l.id,{bootstrapVersion:S.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:l.id,bootstrapVersion:S.version,steps:h.length}}}}var ri=(e)=>e==null?void 0:String(e),ps=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},xg=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),resourceId:String(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:ri(e.provider_id),region:ri(e.region),zone:ri(e.zone),endpoint:String(e.endpoint),sshUser:String(e.ssh_user),sshPort:Number(e.ssh_port),credentialRef:String(e.credential_ref),hostKeyAlgorithm:ri(e.host_key_algorithm),hostKeyFingerprint:ri(e.host_key_fingerprint),pendingHostKey:ri(e.pending_host_key),roles:ps(e.roles,[]),labels:ps(e.labels,{}),taints:ps(e.taints,[]),capacity:ps(e.capacity,{}),usage:ps(e.usage,{}),capabilities:ps(e.capabilities,{}),status:String(e.status),trustState:String(e.trust_state),validation:ps(e.validation,void 0),bootstrapVersion:ri(e.bootstrap_version),heartbeatAt:ri(e.heartbeat_at),lastSeenAt:ri(e.last_seen_at),archivedAt:ri(e.archived_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class ua{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}get(e){let t=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(e);return t?xg(t):void 0}list(e,t=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(e).map(xg).filter((r)=>t||r.status!=="archived")}findProvider(e,t,r){let a=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(e,t,r);return a?xg(a):void 0}create(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.resourceId,e.name,e.provider,e.providerId??null,e.region??null,e.zone??null,e.endpoint,e.sshUser,e.sshPort,e.credentialRef,e.hostKeyAlgorithm??null,e.hostKeyFingerprint??null,e.pendingHostKey??null,JSON.stringify(e.roles),JSON.stringify(e.labels),JSON.stringify(e.taints),JSON.stringify(e.capacity),JSON.stringify(e.usage),JSON.stringify(e.capabilities),e.status,e.trustState,JSON.stringify(e.validation??{}),e.bootstrapVersion??null,e.heartbeatAt??null,e.lastSeenAt??null,e.archivedAt??null,r,r]),this.get(t)}update(e,t){let r=this.get(e);if(!r)throw Error("Server was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[a.name,a.providerId??null,a.region??null,a.zone??null,a.endpoint,a.sshUser,a.sshPort,a.credentialRef,a.hostKeyAlgorithm??null,a.hostKeyFingerprint??null,a.pendingHostKey??null,JSON.stringify(a.roles),JSON.stringify(a.labels),JSON.stringify(a.taints),JSON.stringify(a.capacity),JSON.stringify(a.usage),JSON.stringify(a.capabilities),a.status,a.trustState,JSON.stringify(a.validation??{}),a.bootstrapVersion??null,a.heartbeatAt??null,a.lastSeenAt??null,a.archivedAt??null,l,e]),this.get(e)}}var LA=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class pa{store;drivers;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.drivers=t;this.now=a;this.queue=r??new c(e.control)}driver(e){let t=this.drivers.find((r)=>r.provider===e);if(!t)throw Error(`No ${e} fleet driver is configured.`);return t}enroll(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Server name is invalid.");if(!LA.test(e.endpoint)||e.sshUser==="root"||!e.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let t=e.providerId?this.store.findProvider(e.organizationId,e.provider,e.providerId):void 0;if(t)return this.store.update(t.id,{endpoint:e.endpoint,region:e.region,zone:e.zone});let r=this.store.control.createResource({projectId:e.projectId,kind:"server",slug:e.name,name:e.name,provider:e.provider,providerId:e.providerId}),a=this.driver(e.provider);return this.store.create({...e,resourceId:r.id,sshPort:e.sshPort??22,labels:e.labels??{},taints:[],capacity:{},usage:{},capabilities:a.capabilities(),status:"pending",trustState:"unverified"})}async test(e){let t=this.store.get(e);if(!t)throw Error("Server was not found.");let r=await this.driver(t.provider).test(t);if(!r.reachable)return this.store.update(e,{status:"unreachable"});if(t.hostKeyFingerprint&&t.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(e,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(e,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(e,t){let r=this.store.get(e);if(!r||r.pendingHostKey!==t)throw Error("Pending host key does not match.");return this.store.update(e,{hostKeyFingerprint:t,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(e){let t=this.store.get(e);if(!t||t.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(t.provider).validate(t),a=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))a.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let h of["curl","tar"])if(!r.tools?.[h])a.push({code:`tool.${h}`,severity:"error",message:`${h} is missing.`,remediation:`Install ${h} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)a.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)a.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let l={valid:!a.some((h)=>h.severity==="error"),facts:r,findings:a,validatedAt:this.now().toISOString(),validatorVersion:"1"},m={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(e,{validation:l,capacity:m,status:l.valid?"ready":"degraded"})}bootstrap(e,t=!1){let r=this.store.get(e);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let a=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!t)return{preview:!0,steps:a};let l=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:e,steps:a},lockKey:`server:${e}`,providerKey:r.provider}).operation;return{preview:!1,steps:a,operation:l}}heartbeat(e,t){let r=this.store.get(e);if(!r)throw Error("Server was not found.");let a=this.now().toISOString();return this.store.update(e,{usage:t.usage,capabilities:t.capabilities??r.capabilities,heartbeatAt:a,lastSeenAt:a,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(e,t=!1){return this.store.update(e,{status:t?"drained":"draining"})}uncordon(e){return this.store.update(e,{status:"ready"})}archive(e,t){let r=this.store.get(e);if(!r||t!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(e,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as Dg,createPublicKey as Jv,verify as FA}from"node:crypto";function an(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(an).join(",")}]`;return`{${Object.keys(e).sort().map((t)=>`${JSON.stringify(t)}:${an(e[t])}`).join(",")}}`}var Kl=(e)=>Dg("sha256").update(an(e)).digest("hex"),Xi=(e)=>Dg("sha256").update(an(e)).digest("hex"),Wl=(e)=>Dg("sha256").update(Jv(e).export({type:"spki",format:"der"})).digest("hex");function Jl(e,t,r){try{return FA(null,Buffer.from(an(e)),Jv(r),Buffer.from(t,"base64"))}catch{return!1}}var Hv=(e)=>e.replace(/^v/,"").split(/[.-]/).slice(0,3).map((t)=>Number(t)||0),Kv=(e,t)=>{let r=Hv(e),a=Hv(t);for(let l=0;l<3;l++){let m=(r[l]??0)-(a[l]??0);if(m)return m}return 0};function Xl(e,t){let r=[];if(t.schemaVersion<e.minimumSchema)r.push(`schema ${t.schemaVersion} is below ${e.minimumSchema}`);if(t.schemaVersion>e.maximumSchema)r.push(`schema ${t.schemaVersion} is above ${e.maximumSchema}`);if(e.minimumVersion&&Kv(t.currentVersion,e.minimumVersion)<0)r.push(`platform ${t.currentVersion} is below ${e.minimumVersion}`);if(Kv(e.version,t.currentVersion)<=0)r.push(`version ${e.version} is not newer than ${t.currentVersion}`);if(!e.artifacts.some((a)=>a.platform===t.platform&&a.architecture===t.architecture))r.push(`no artifact for ${t.platform}/${t.architecture}`);return{compatible:r.length===0,reasons:r}}var Si=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Fr=(e)=>e==null?void 0:String(e),zA=(e)=>({id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),algorithm:"ed25519",publicKeyPem:String(e.public_key_pem),fingerprint:String(e.fingerprint),revokedAt:Fr(e.revoked_at),createdAt:String(e.created_at)}),Gv=(e)=>({id:String(e.id),organizationId:String(e.organization_id),version:String(e.version),channel:String(e.channel),publishedAt:String(e.published_at),keyId:String(e.key_id),digest:String(e.digest),document:Si(e.document,{}),signature:String(e.signature),verificationStatus:String(e.verification_status),compatibility:Si(e.compatibility,{compatible:!1,reasons:[]}),createdAt:String(e.created_at)}),Qv=(e)=>({id:String(e.id),projectId:String(e.project_id),name:String(e.name),schedule:String(e.schedule),timezone:String(e.timezone),durationMinutes:Number(e.duration_minutes),allowedOperations:Si(e.allowed_operations,[]),requireApproval:Number(e.require_approval)===1,enabled:Number(e.enabled)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Yv=(e)=>({id:String(e.id),projectId:String(e.project_id),manifestId:String(e.manifest_id),windowId:Fr(e.window_id),fromVersion:String(e.from_version),strategy:String(e.strategy),batchSize:Number(e.batch_size),healthGate:Si(e.health_gate,{}),status:String(e.status),currentStage:Fr(e.current_stage),backupId:Fr(e.backup_id),approvedBy:Fr(e.approved_by),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Og=(e)=>({id:String(e.id),campaignId:String(e.campaign_id),serverId:Fr(e.server_id),target:String(e.target),cohort:Number(e.cohort),previousVersion:String(e.previous_version),status:String(e.status),evidence:Si(e.evidence,{}),error:Fr(e.error),startedAt:Fr(e.started_at),finishedAt:Fr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Zv=(e)=>({id:String(e.id),projectId:String(e.project_id),kind:String(e.kind),criteria:Si(e.criteria,{}),candidates:Si(e.candidates,[]),candidateDigest:String(e.candidate_digest),estimatedBytes:Number(e.estimated_bytes),status:String(e.status),confirmation:Fr(e.confirmation),expiresAt:String(e.expires_at),result:Si(e.result,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Xv=(e)=>({id:String(e.id),projectId:String(e.project_id),backupPolicyId:Fr(e.backup_policy_id),recoveryPointId:Fr(e.recovery_point_id),topologyId:Fr(e.topology_id),scenario:String(e.scenario),isolatedTarget:String(e.isolated_target),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),status:String(e.status),operationId:Fr(e.operation_id),evidence:Si(e.evidence,{}),measuredRpoMinutes:e.measured_rpo_minutes==null?void 0:Number(e.measured_rpo_minutes),measuredRtoMinutes:e.measured_rto_minutes==null?void 0:Number(e.measured_rto_minutes),cleanupVerified:Number(e.cleanup_verified)===1,error:Fr(e.error),startedAt:Fr(e.started_at),finishedAt:Fr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class ya{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}addTrustedKey(e){let t=this.id(),r=this.now().toISOString(),a=Wl(e.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[t,e.organizationId,e.name,e.publicKeyPem,a,r]),this.key(t)}key(e){let t=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(e);return t?zA(t):void 0}revokeKey(e){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),e]),this.key(e)}importManifest(e){let t=this.key(e.keyId);if(!t||t.organizationId!==e.organizationId)throw Error("Trusted update key was not found.");if(t.revokedAt)throw Error("Update signing key is revoked.");if(!Jl(e.document,e.signature,t.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=Xl(e.document,e.current),a=Kl(e.document),l=this.id(),m=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[l,e.organizationId,e.document.version,e.document.channel,new Date(e.document.publishedAt).toISOString(),e.keyId,a,JSON.stringify(e.document),e.signature,JSON.stringify(r),m]),this.manifest(l)}manifest(e){let t=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(e);return t?Gv(t):void 0}manifests(e){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(e).map(Gv)}createWindow(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[t,e.projectId,e.name,e.schedule,e.timezone,e.durationMinutes,JSON.stringify(e.allowedOperations),e.requireApproval===!1?0:1,r,r]),this.window(t)}window(e){let t=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(e);return t?Qv(t):void 0}windows(e){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(e).map(Qv)}createCampaign(e){return this.control.transaction(()=>{let t=this.manifest(e.manifestId);if(!t?.compatibility.compatible||t.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!e.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),a=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,e.projectId,e.manifestId,e.windowId??null,e.fromVersion,e.strategy,e.batchSize,JSON.stringify(e.healthGate),e.backupId,e.approvedBy??null,a,a]),e.targets.forEach((l,m)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,l.serverId??null,l.target,e.strategy==="canary"?m===0?0:1+Math.floor((m-1)/e.batchSize):Math.floor(m/e.batchSize),l.previousVersion,a,a])),this.campaign(r)})}campaign(e){let t=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(e);return t?Yv(t):void 0}campaigns(e){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(e).map(Yv)}targets(e){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(e).map(Og)}updateCampaign(e,t){let r=this.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a={...r,...t};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[a.status,a.currentStage??null,this.now().toISOString(),e]),this.campaign(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e);if(!r)throw Error("Upgrade target was not found.");let a={...Og(r),...t};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.evidence),a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),Og(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e))}createCleanup(e){let t=[...e.candidates].sort((h,S)=>h.id.localeCompare(S.id)),r=Xi(t),a=this.id(),l=this.now().toISOString(),m=new Date(this.now().getTime()+(e.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[a,e.projectId,e.kind,JSON.stringify(e.criteria),JSON.stringify(t),r,t.reduce((h,S)=>h+S.bytes,0),m,l,l]),this.cleanup(a)}cleanup(e){let t=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(e);return t?Zv(t):void 0}cleanups(e){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(e).map(Zv)}updateCleanup(e,t){let r=this.cleanup(e);if(!r)throw Error("Cleanup plan was not found.");let a={...r,...t};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[a.status,a.confirmation??null,JSON.stringify(a.result),this.now().toISOString(),e]),this.cleanup(e)}createDrill(e){if(!/^isolated:\/\//.test(e.isolatedTarget))throw Error("DR drills require an isolated target.");let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[t,e.projectId,e.backupPolicyId??null,e.recoveryPointId??null,e.topologyId??null,e.scenario,e.isolatedTarget,e.expectedRpoMinutes,e.expectedRtoMinutes,r,r]),this.drill(t)}drill(e){let t=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(e);return t?Xv(t):void 0}drills(e){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(e).map(Xv)}updateDrill(e,t){let r=this.drill(e);if(!r)throw Error("DR drill was not found.");let a={...r,...t};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,JSON.stringify(a.evidence),a.measuredRpoMinutes??null,a.measuredRtoMinutes??null,a.cleanupVerified?1:0,a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),this.drill(e)}}function gh(e,t=new Date){if(!e.enabled)return!1;let r=new Date(e.schedule);if(!Number.isNaN(r.getTime()))return t>=r&&t.getTime()<=r.getTime()+e.durationMinutes*60000;let a=/^(\d{2}):(\d{2})$/.exec(e.schedule);if(!a)return!1;let l=new Intl.DateTimeFormat("en-US",{timeZone:e.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(t),m=Number(l.find((S)=>S.type==="hour")?.value)*60+Number(l.find((S)=>S.type==="minute")?.value),h=Number(a[1])*60+Number(a[2]);return m>=h&&m<h+e.durationMinutes}class Ia{store;now;queue;constructor(e,t,r=()=>new Date){this.store=e;this.now=r;this.queue=t??new c(e.control)}enqueueCampaign(e,t={}){let r=this.store.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a=r.windowId?this.store.window(r.windowId):void 0;if(a&&!a.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(a&&!t.overrideWindow&&!gh(a,this.now()))throw Error("Upgrade is outside its maintenance window.");if(a?.requireApproval&&!t.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let l=this.queue.enqueue({projectId:r.projectId,actorId:t.approvedBy,kind:"maintenance.upgrade",input:{campaignId:e},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(e,{status:"queued"}),operation:l}}async previewCleanup(e,t){let r=t.find((a)=>a.kind===e.kind);if(!r)throw Error(`No ${e.kind} cleanup driver is configured.`);return this.store.createCleanup({...e,candidates:await r.discover(e.criteria)})}enqueueCleanup(e,t){let r=this.store.cleanup(e);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let a=`DELETE ${r.candidates.length} ${r.kind}`;if(t!==a)throw Error(`Exact confirmation ${a} is required.`);let l=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:e},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(e,{status:"approved",confirmation:t}),operation:l}}enqueueDrill(e){let t=this.store.drill(e);if(!t||t.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.drill",input:{drillId:e},lockKey:`drill:${t.scenario}:${t.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(e,{status:"queued",operationId:r.id}),operation:r}}}var $g=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function Yl(e){return{"maintenance.upgrade":async(l)=>{let m=e.store.campaign(String($g(l.operation.input).campaignId??""));if(!m||!e.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let h=e.store.manifest(m.manifestId);if(!h?.compatibility.compatible||h.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let S=h.document.artifacts.find((y)=>y.platform===process.platform&&y.architecture===process.arch)??h.document.artifacts[0];if(!S)throw Error("No update artifact matches this platform.");e.store.updateCampaign(m.id,{status:"running",currentStage:"preflight"});let R=[];try{for(let y of[...new Set(e.store.targets(m.id).map((C)=>C.cohort))].sort((C,T)=>C-T)){e.store.updateCampaign(m.id,{currentStage:`cohort:${y}`});for(let C of e.store.targets(m.id).filter((T)=>T.cohort===y)){l.throwIfCancellationRequested(),l.checkpoint(`download:${C.target}`,"Downloading signed platform artifact."),e.store.updateTarget(C.id,{status:"downloading",startedAt:new Date().toISOString()});let T=await e.platform.download({target:C,artifact:S,signal:l.signal});if(T.sha256!==S.sha256)throw Error(`Artifact checksum mismatch for ${C.target}.`);l.checkpoint(`install:${C.target}`,"Installing verified artifact."),e.store.updateTarget(C.id,{status:"installing"}),await e.platform.install({target:C,path:T.path,version:h.version,signal:l.signal}),R.push(C);let j=await e.platform.health({target:C,gate:m.healthGate});if(!j.healthy)throw Error(`Upgrade health gate failed for ${C.target}.`);e.store.updateTarget(C.id,{status:"healthy",evidence:j.evidence,finishedAt:new Date().toISOString()})}}return e.store.updateCampaign(m.id,{status:"succeeded",currentStage:void 0}),{campaignId:m.id,version:h.version,targets:R.length}}catch(y){e.store.updateCampaign(m.id,{status:"rolling_back",currentStage:"rollback"});for(let C of R.reverse())e.store.updateTarget(C.id,{status:"rolling_back"}),await e.platform.rollback({target:C,version:C.previousVersion,signal:l.signal}),e.store.updateTarget(C.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw e.store.updateCampaign(m.id,{status:"rolled_back",currentStage:void 0}),y}},"maintenance.cleanup":async(l)=>{let m=e.store.cleanup(String($g(l.operation.input).planId??""));if(!m||m.status!=="approved")throw Error("Approved cleanup plan was not found.");if(Xi([...m.candidates].sort((C,T)=>C.id.localeCompare(T.id)))!==m.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let h=e.cleanup?.find((C)=>C.kind===m.kind);if(!h)throw Error(`No ${m.kind} cleanup driver is configured.`);e.store.updateCleanup(m.id,{status:"running"});let S=[],R=[];for(let C of m.candidates){l.throwIfCancellationRequested();try{await h.remove(C),S.push(C.id)}catch(T){R.push({id:C.id,error:T instanceof Error?T.message:String(T)})}}let y=R.length?S.length?"partial":"failed":"succeeded";if(e.store.updateCleanup(m.id,{status:y,result:{removed:S,failed:R,reclaimedBytes:m.candidates.filter((C)=>S.includes(C.id)).reduce((C,T)=>C+T.bytes,0)}}),R.length)throw Error(`Cleanup failed for ${R.length} candidate(s).`);return{planId:m.id,removed:S.length,reclaimedBytes:m.estimatedBytes}},"maintenance.drill":async(l)=>{let m=e.store.drill(String($g(l.operation.input).drillId??""));if(!m)throw Error("DR drill was not found.");let h=e.recovery?.find((T)=>T.scenario===m.scenario);if(!h)throw Error(`No ${m.scenario} recovery driver is configured.`);let S=new Date;e.store.updateDrill(m.id,{status:"restoring",startedAt:S.toISOString()});let R=m.isolatedTarget,y={},C={};try{l.checkpoint("restore","Restoring into isolated drill target.");let T=await h.restore({drill:m,signal:l.signal});if(!T.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");R=T.target,y=T.evidence;let j=(S.getTime()-new Date(T.recoveryPointAt).getTime())/60000;e.store.updateDrill(m.id,{status:"verifying",measuredRpoMinutes:j,evidence:{restore:y}}),l.checkpoint("verify","Running recovery health checks without production traffic.");let B=await h.verify({drill:m,target:R});C=B.evidence;let V=(Date.now()-S.getTime())/60000;if(!B.healthy||j>m.expectedRpoMinutes||V>m.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");e.store.updateDrill(m.id,{measuredRpoMinutes:j,measuredRtoMinutes:V,evidence:{restore:y,verify:C}})}catch(T){throw e.store.updateDrill(m.id,{status:"failed",error:T instanceof Error?T.message:String(T),evidence:{restore:y,verify:C}}),T}finally{e.store.updateDrill(m.id,{status:"cleaning"});try{await h.cleanup({drill:m,target:R});let T=e.store.drill(m.id);e.store.updateDrill(m.id,{status:T.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(T){e.store.updateDrill(m.id,{status:"cleanup_required",cleanupVerified:!1,error:T instanceof Error?T.message:String(T),finishedAt:new Date().toISOString()})}}return{drillId:m.id,status:e.store.drill(m.id).status}}}}class mh{transport;constructor(e){this.transport=e}download(e){return this.transport.download({target:e.target.target,url:e.artifact.url,signal:e.signal})}install(e){return this.transport.install({target:e.target.target,path:e.path,version:e.version,signal:e.signal})}health(e){return this.transport.health({target:e.target.target,gate:e.gate})}rollback(e){return this.transport.rollback({target:e.target.target,version:e.version,signal:e.signal})}}var eb={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class Sa{kind;control;projectId;organizationId;constructor(e,t,r,a){this.kind=e;this.control=t;this.projectId=r;this.organizationId=a}async discover(e){let t=Math.max(1,Math.min(3650,Number(e.olderThanDays??30))),r=new Date(Date.now()-t*86400000).toISOString(),a=eb[this.kind],l=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(a.select).all(l,r).map((h)=>({id:String(h.id),kind:this.kind,label:`${this.kind}:${String(h.id)}`,bytes:Number(h.bytes??0),metadata:{createdAt:String(h.created_at)}}))}async remove(e){if(this.control.database.run(eb[this.kind].remove,[e.id]).changes!==1)throw Error(`${e.label} changed or is no longer removable.`)}}class hh{scenario;transport;constructor(e,t){this.scenario=e;this.transport=t}restore(e){return this.transport.restore({scenario:this.scenario,...e})}verify(e){return this.transport.verify({scenario:this.scenario,...e})}cleanup(e){return this.transport.cleanup({scenario:this.scenario,...e})}}var Jn=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Cn=(e)=>e==null?void 0:String(e),jl=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),tr=(e={})=>({...jl(),...e});function tb(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),purpose:String(e.purpose),backend:String(e.backend),region:Cn(e.region),architecture:Cn(e.architecture),labels:Jn(e.labels,{}),requiredServerLabels:Jn(e.required_server_labels,{}),toleratedTaints:Jn(e.tolerated_taints,[]),capacity:tr(Jn(e.capacity,{})),reserved:Jn(e.reserved,{}),maxWorkloads:Number(e.max_workloads),costWeight:Number(e.cost_weight),spreadKey:Cn(e.spread_key),concurrency:Number(e.concurrency),ephemeralWorkspaces:Number(e.ephemeral_workspaces)===1,allowProductionSecrets:Number(e.allow_production_secrets)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function rb(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Cn(e.environment_id),resourceId:String(e.resource_id),releaseId:Cn(e.release_id),poolId:String(e.pool_id),serverId:Cn(e.server_id),purpose:String(e.purpose),requirements:Jn(e.requirements,{}),decision:Jn(e.decision,{}),stateful:Number(e.stateful)===1,autoReschedule:Number(e.auto_reschedule)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function UA(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:Cn(e.resource_id),poolId:String(e.pool_id),placementId:Cn(e.placement_id),operationId:Cn(e.operation_id),sourceSha:String(e.source_sha),buildSpec:Jn(e.build_spec,{}),credentialPolicy:Jn(e.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Cn(e.workspace),cacheKey:Cn(e.cache_key),artifactUri:Cn(e.artifact_uri),artifactDigest:Cn(e.artifact_digest),status:String(e.status),cleanupAt:Cn(e.cleanup_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class ga{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}createPool(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.purpose,e.backend,e.region??null,e.architecture??null,JSON.stringify(e.labels),JSON.stringify(e.requiredServerLabels),JSON.stringify(e.toleratedTaints),JSON.stringify(tr(e.capacity)),"{}",e.maxWorkloads,e.costWeight,e.spreadKey??null,e.concurrency,e.ephemeralWorkspaces?1:0,e.allowProductionSecrets?1:0,e.status,r,r]),this.getPool(t)}getPool(e){let t=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(e);return t?tb(t):void 0}listPools(e){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(e).map(tb)}updatePool(e,t){let r=this.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.reserved),JSON.stringify(a.capacity),a.concurrency,l,e]),this.getPool(e)}addMember(e,t,r={}){let a=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[e,t,JSON.stringify(r),a,a])}members(e){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(e).map((t)=>({serverId:String(t.server_id),status:String(t.status),capacityOverride:Jn(t.capacity_override,{})}))}memberStatus(e,t,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),e,t])}listPlacements(e,t){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(e).map(rb);return t?.length?r.filter((a)=>t.includes(a.status)):r}getPlacement(e){let t=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(e);return t?rb(t):void 0}activeUsage(e,t){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(e,this.now().toISOString()),a=t?r.filter((l)=>String(l.server_id)===t):r;return{resources:a.reduce((l,m)=>{let h=tr(Jn(m.resources,{}));for(let S of Object.keys(l))l[S]+=h[S];return l},jl()),count:a.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(e){return this.control.transaction(()=>{this.expireLeases();let t=this.id(),r=this.id(),a=this.now().toISOString(),l=new Date(this.now().getTime()+(e.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[t,e.projectId,e.environmentId??null,e.resourceId,e.releaseId??null,e.decision.poolId,e.decision.serverId??null,e.requirements.purpose,JSON.stringify(e.requirements),JSON.stringify(e.decision),e.requirements.stateful?1:0,e.requirements.autoReschedule&&!e.requirements.stateful?1:0,a,a]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,t,e.decision.poolId,e.decision.serverId??null,JSON.stringify(tr(e.requirements.resources)),l,a,a]),this.getPlacement(t)})}transitionPlacement(e,t){if(!this.getPlacement(e))throw Error("Placement was not found.");let a=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[t,a,e]),["released","failed","blocked"].includes(t))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[a,e]);return this.getPlacement(e)}createBuild(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[t,e.projectId,e.resourceId??null,e.poolId,e.placementId??null,e.operationId??null,e.sourceSha,JSON.stringify(e.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:e.tokenExpiresAt}),r,r]),this.getBuild(t)}getBuild(e){let t=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(e);return t?UA(t):void 0}updateBuild(e,t){let r=this.getBuild(e);if(!r)throw Error("Remote build was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[a.operationId??null,a.workspace??null,a.cacheKey??null,a.artifactUri??null,a.artifactDigest??null,a.status,a.cleanupAt??null,l,e]),this.getBuild(e)}}var Zd=["cpu","memoryBytes","diskBytes","gpu"],nb=(e,t={})=>Object.entries(t).every(([r,a])=>e[r]===a),qA=(e,t,r)=>Object.fromEntries(Zd.map((a)=>[a,Math.max(0,e[a]-t[a]-(r[a]??0))])),VA=(e,t)=>Zd.every((r)=>e[r]>=(t[r]??0)),WA=(e,t)=>Zd.reduce((r,a)=>r+(t[a]??0)/(e[a]||1),0);class ma{store;fleet;constructor(e,t){this.store=e;this.fleet=t}poolCandidates(e,t,r){let a=[];for(let l of this.store.listPools(e)){if(l.id===r)continue;let m=[];if(l.status!=="active")m.push(`pool is ${l.status}`);if(l.purpose!==t.purpose)m.push(`purpose is ${l.purpose}`);if(t.region&&l.region!==t.region)m.push(`region is ${l.region??"unset"}`);if(t.architecture&&l.architecture!==t.architecture)m.push(`architecture is ${l.architecture??"unset"}`);if(!nb(l.labels,t.labels))m.push("pool labels do not match");if(l.backend==="server"){let h=this.store.members(l.id);if(!h.length)a.push(this.decision(l,void 0,t,[...m,"pool has no servers"]));for(let S of h){let R=this.fleet.get(S.serverId),y=[...m];if(!R)y.push("server is missing");else this.serverReasons(l,R,S.status,t,y);a.push(this.decision(l,R,t,y,S.capacityOverride))}}else a.push(this.decision(l,void 0,t,m))}return a.sort((l,m)=>Number(m.eligible)-Number(l.eligible)||l.score.cost-m.score.cost||l.score.spread-m.score.spread||l.score.fit-m.score.fit||l.poolName.localeCompare(m.poolName)||(l.serverId??"").localeCompare(m.serverId??""))}serverReasons(e,t,r,a,l){if(r!=="active")l.push(`member is ${r}`);if(t.status!=="ready")l.push(`server is ${t.status}`);if(!t.roles.includes(a.purpose==="build"?"build":a.purpose))l.push(`server lacks ${a.purpose} role`);if(!nb(t.labels,e.requiredServerLabels))l.push("server labels do not match pool selector");for(let m of t.taints)if(!e.toleratedTaints.includes(m))l.push(`taint ${m} is not tolerated`)}decision(e,t,r,a,l={}){let m=tr({...t?.capacity,...l}),h=t?Object.fromEntries(Zd.map((y)=>[y,Math.min(e.capacity[y],m[y])])):e.capacity,S=this.store.activeUsage(e.id,t?.id),R=qA(h,S.resources,e.reserved);if(S.count>=e.maxWorkloads)a.push("workload limit reached");if(r.purpose==="build"&&S.count>=e.concurrency)a.push("build concurrency reached");if(!VA(R,r.resources))a.push("insufficient capacity");return{poolId:e.id,poolName:e.name,serverId:t?.id,eligible:a.length===0,reasons:a,available:R,score:{fit:WA(R,r.resources),spread:S.count,cost:e.costWeight}}}explain(e,t){return this.poolCandidates(e,t)}place(e){return this.store.control.transaction(()=>{let t=this.poolCandidates(e.projectId,e.requirements).find((r)=>r.eligible);if(!t)throw Error(`No eligible capacity: ${this.explain(e.projectId,e.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...e,decision:t})})}activate(e){return this.store.transitionPlacement(e,"active")}release(e){return this.store.transitionPlacement(e,"released")}drainPool(e){let t=this.store.updatePool(e,{status:"draining"}),r=[],a=[];for(let l of this.store.listPlacements(t.projectId,["reserved","active"]).filter((m)=>m.poolId===e)){if(l.stateful){a.push(this.store.transitionPlacement(l.id,"blocked"));continue}this.store.transitionPlacement(l.id,"moving");let m=this.place({projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,releaseId:l.releaseId,requirements:l.requirements});r.push(this.activate(m.id)),this.store.transitionPlacement(l.id,"released")}return{pool:t,moved:r,blocked:a}}drainServer(e,t){this.store.memberStatus(e,t,"draining");let r=this.store.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a=[],l=[];for(let m of this.store.listPlacements(r.projectId,["reserved","active"]).filter((h)=>h.poolId===e&&h.serverId===t)){if(m.stateful){l.push(this.store.transitionPlacement(m.id,"blocked"));continue}this.store.transitionPlacement(m.id,"moving");let h=this.poolCandidates(m.projectId,m.requirements).find((R)=>R.eligible);if(!h){l.push(this.store.transitionPlacement(m.id,"blocked"));continue}let S=this.store.reserve({projectId:m.projectId,environmentId:m.environmentId,resourceId:m.resourceId,releaseId:m.releaseId,requirements:m.requirements,decision:h});a.push(this.activate(S.id)),this.store.transitionPlacement(m.id,"released")}return{moved:a,blocked:l}}reconcileFailure(e){let t=this.fleet.get(e);if(!t)throw Error("Server was not found.");let r=[],a=[];for(let l of this.store.listPlacements(t.projectId,["active"]).filter((m)=>m.serverId===e)){if(l.stateful||!l.autoReschedule){a.push(this.store.transitionPlacement(l.id,"blocked"));continue}this.store.transitionPlacement(l.id,"failed");let m=this.place({projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,releaseId:l.releaseId,requirements:l.requirements});r.push(this.activate(m.id))}return{rescheduled:r,blocked:a}}}class uh{store;placement;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.placement=t;this.now=a;this.queue=r??new c(e.control)}enqueue(e){if(!/^[a-f0-9]{7,64}$/i.test(e.sourceSha))throw Error("A pinned source commit SHA is required.");let t={purpose:"build",resources:{cpu:1,memoryBytes:1073741824,diskBytes:5368709120},leaseSeconds:3600,...e.requirements},r=this.placement.place({projectId:e.projectId,resourceId:e.resourceId,requirements:t}),a=new Date(this.now().getTime()+900000).toISOString(),l=this.store.createBuild({projectId:e.projectId,resourceId:e.resourceId,poolId:r.poolId,placementId:r.id,sourceSha:e.sourceSha,buildSpec:e.buildSpec,tokenExpiresAt:a}),m=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"build.remote",input:{buildId:l.id},lockKey:`build:${l.id}`,providerKey:`pool:${r.poolId}`,buildSlot:!0,timeoutSeconds:3600,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return l=this.store.updateBuild(l.id,{operationId:m.id}),l}cancel(e){let t=this.store.getBuild(e);if(!t)throw Error("Remote build was not found.");if(t.operationId)this.queue.requestCancellation(t.operationId);return this.store.updateBuild(e,{status:"cancelled"})}}var HA=/^sha256:[a-f0-9]{64}$/,KA=/^(?:s3|https|oci):\/\//;function Cy(e,t){return{"build.remote":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.getBuild(String(a.buildId??""));if(!l)throw Error("Queued remote build was not found.");let m=e.getPool(l.poolId);if(!m||m.purpose!=="build"||m.status!=="active")throw Error("The selected build pool is unavailable.");if(!m.ephemeralWorkspaces)throw Error("Remote builds require an ephemeral workspace pool.");if(l.credentialPolicy.productionSecrets||m.allowProductionSecrets)throw Error("Production secrets are forbidden in remote build workers.");if(new Date(l.credentialPolicy.shortLivedTokenExpiresAt)<=new Date)throw Error("The short-lived build credential has expired.");let h=t.find((R)=>R.backend===m.backend);if(!h)throw Error(`No ${m.backend} remote build driver is configured.`);let S=`build://${m.id}/${l.id}`;e.updateBuild(l.id,{status:"running",workspace:S}),r.checkpoint("checkout",`Preparing isolated workspace for ${l.sourceSha}.`);try{r.throwIfCancellationRequested(),r.checkpoint("build","Executing resource-limited build.");let R=await h.run({build:e.getBuild(l.id),pool:m,signal:r.signal,log:(y)=>r.log(y,{stream:"stdout"})});if(r.throwIfCancellationRequested(),!HA.test(R.artifactDigest)||!KA.test(R.artifactUri))throw Error("Builder returned an unverified artifact reference.");return e.updateBuild(l.id,{status:"uploading",cacheKey:R.cacheKey,artifactUri:R.artifactUri,artifactDigest:R.artifactDigest}),r.checkpoint("verify","Verified content-addressed artifact upload."),await h.cleanup({build:e.getBuild(l.id),pool:m}),e.updateBuild(l.id,{status:"succeeded",workspace:void 0,cleanupAt:new Date().toISOString()}),{buildId:l.id,artifactUri:R.artifactUri,artifactDigest:R.artifactDigest,cacheKey:R.cacheKey??null}}catch(R){try{await h.cleanup({build:e.getBuild(l.id),pool:m}),e.updateBuild(l.id,{status:r.cancellationRequested()?"cancelled":"failed",workspace:void 0,cleanupAt:new Date().toISOString()})}catch{e.updateBuild(l.id,{status:"cleanup_required"})}throw R}}}}class Ji{backend;transport;handles=new Map;constructor(e,t){this.backend=e;this.transport=t}async run({build:e,pool:t,signal:r,log:a}){let l=await this.transport.provision({backend:this.backend,pool:t,build:e,tokenExpiresAt:e.credentialPolicy.shortLivedTokenExpiresAt});return this.handles.set(e.id,l.handle),a(`${this.backend} builder provisioned`),await this.transport.execute({handle:l.handle,spec:e.buildSpec,sourceSha:e.sourceSha,signal:r,onLog:a}),this.transport.publish({handle:l.handle,sourceSha:e.sourceSha})}async cleanup({build:e}){let t=this.handles.get(e.id);if(!t)return;await this.transport.destroy({handle:t}),this.handles.delete(e.id)}}var Ey=(e)=>new Ji("server",e),by=(e)=>new Ji("ecs",e),vy=(e)=>new Ji("asg",e);var ki=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Mn=(e)=>e==null?void 0:String(e),ib=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Mn(e.environment_id),name:String(e.name),hostname:String(e.hostname),homeRegion:String(e.home_region),regions:ki(e.regions,[]),trafficPolicy:String(e.traffic_policy),dataPolicy:ki(e.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(e.status),activeRegion:String(e.active_region),revision:Mn(e.revision),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Ng=(e)=>({id:String(e.id),topologyId:String(e.topology_id),region:String(e.region),role:String(e.role),provider:String(e.provider),stackId:Mn(e.stack_id),stackRevision:Mn(e.stack_revision),status:String(e.status),health:ki(e.health,{}),lastHealthyAt:Mn(e.last_healthy_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),jg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),kind:String(e.kind),sourceRegion:String(e.source_region),targetRegion:String(e.target_region),config:ki(e.config,{}),status:String(e.status),checkpoint:Mn(e.checkpoint),lagSeconds:e.lag_seconds==null?void 0:Number(e.lag_seconds),lastVerifiedAt:Mn(e.last_verified_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Bg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),hostname:String(e.hostname),dnsProvider:String(e.dns_provider),cdnEnabled:Number(e.cdn_enabled)===1,wafEnabled:Number(e.waf_enabled)===1,weights:ki(e.weights,{}),desiredWeights:ki(e.desired_weights,{}),status:String(e.status),providerState:ki(e.provider_state,{}),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),ob=(e)=>({id:String(e.id),topologyId:String(e.topology_id),operationId:Mn(e.operation_id),kind:String(e.kind),requestedRegion:Mn(e.requested_region),revision:Mn(e.revision),plan:ki(e.plan,[]),currentStep:Mn(e.current_step),completedSteps:ki(e.completed_steps,[]),status:String(e.status),error:Mn(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class ha{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}create(e){return this.control.transaction(()=>{if(e.regions.length<2||new Set(e.regions.map((m)=>m.region)).size!==e.regions.length||e.regions.filter((m)=>m.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let t=e.regions.find((m)=>m.role==="primary"),r=this.id(),a=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.name,e.hostname,t.region,JSON.stringify(e.regions),e.trafficPolicy,JSON.stringify(e.dataPolicy),t.region,a,a]);for(let m of e.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,m.region,m.role,m.provider,a,a]);for(let m of e.dataPolicy.replicate)for(let h of e.regions)for(let S of e.regions.filter((R)=>R.region!==h.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,m,h.region,S.region,"{}",a,a]);let l=Object.fromEntries(e.regions.map((m)=>[m.region,m.region===t.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,e.hostname,e.dnsProvider??"route53",e.cdnEnabled?1:0,e.wafEnabled?1:0,JSON.stringify(l),JSON.stringify(l),a,a]),this.get(r)})}get(e){let t=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(e);return t?ib(t):void 0}list(e){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(e).map(ib)}targets(e){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(e).map(Ng)}channels(e){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(e).map(jg)}route(e){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(e);return t?Bg(t):void 0}updateTopology(e,t){let r=this.get(e);if(!r)throw Error("Regional topology was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[a.status,a.activeRegion,a.revision??null,JSON.stringify(a.regions),l,e]),this.get(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e);if(!r)throw Error("Regional target was not found.");let a=Ng(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[l.role,l.stackId??null,l.stackRevision??null,l.status,JSON.stringify(l.health),l.lastHealthyAt??null,m,e]),Ng(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e))}updateChannel(e,t){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e);if(!r)throw Error("Replication channel was not found.");let a=jg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[l.status,l.checkpoint??null,l.lagSeconds??null,l.lastVerifiedAt??null,m,e]),jg(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e))}updateRoute(e,t){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e);if(!r)throw Error("Traffic route was not found.");let a=Bg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(l.weights),JSON.stringify(l.desiredWeights),l.status,JSON.stringify(l.providerState),m,e]),Bg(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e))}createExecution(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[t,e.topologyId,e.operationId??null,e.kind,e.requestedRegion??null,e.revision??null,JSON.stringify(e.plan),r,r]),this.execution(t)}execution(e){let t=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(e);return t?ob(t):void 0}executions(e){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(e).map(ob)}updateExecution(e,t){let r=this.execution(e);if(!r)throw Error("Regional execution was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[a.operationId??null,a.currentStep??null,JSON.stringify(a.completedSteps),a.status,a.error??null,l,e]),this.execution(e)}}class fa{store;queue;constructor(e,t){this.store=e;this.queue=t??new c(e.control)}create(e){return this.store.create(e)}plan(e,t,r){if(!this.store.get(e))throw Error("Regional topology was not found.");let l=this.store.targets(e),m=this.store.channels(e);if(t==="rollout")return[...l.filter((h)=>h.role==="secondary").map((h)=>`apply:${h.region}`),...l.filter((h)=>h.role==="primary").map((h)=>`apply:${h.region}`),...m.map((h)=>`replicate:${h.kind}:${h.targetRegion}`),"traffic:activate"];if(t==="failover"||t==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(t==="destroy")return["traffic:drain",...l.filter((h)=>h.role==="secondary").map((h)=>`delete:${h.region}`),...l.filter((h)=>h.role==="primary").map((h)=>`delete:${h.region}`),"complete"];return["observe","repair"]}enqueue(e){let t=this.store.get(e.topologyId);if(!t)throw Error("Regional topology was not found.");if(["failover","failback"].includes(e.kind)&&(!e.targetRegion||!t.regions.some((m)=>m.region===e.targetRegion)))throw Error("A topology target region is required.");if(e.kind==="failover"&&e.targetRegion===t.activeRegion)throw Error("Target region is already active.");if((e.kind==="destroy"||e.deleteData)&&e.confirmation!==t.name)throw Error("Exact topology name confirmation is required.");if(e.deleteData&&t.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(e.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(e.revision??""))throw Error("An immutable revision is required.");let r=this.plan(t.id,e.kind,e.targetRegion),a=this.store.createExecution({topologyId:t.id,kind:e.kind,requestedRegion:e.targetRegion,revision:e.revision,plan:r}),l=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,kind:`region.${e.kind}`,input:{executionId:a.id,manifest:e.manifest??{},deleteData:e.deleteData===!0},lockKey:`regional-topology:${t.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(a.id,{operationId:l.id}),{execution:this.store.execution(a.id),operation:l}}}var JA=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function zl(e,t){let r=(y)=>{let C=t.find((T)=>T.provider===y.provider);if(!C)throw Error(`No ${y.provider} regional driver is configured.`);return C},a=(y,C,T)=>{y.throwIfCancellationRequested(),y.checkpoint(T,T),e.updateExecution(C.id,{status:"running",currentStep:T,completedSteps:[...e.execution(C.id).completedSteps,T]})},l=async(y,C)=>{let T=e.route(y.id);if(!T)throw Error("Regional traffic route was not found.");let j=e.targets(y.id).find((V)=>V.region===y.activeRegion)??e.targets(y.id)[0];if(!j)throw Error("Regional traffic target was not found.");e.updateRoute(T.id,{status:"applying",desiredWeights:C});let B=await r(j).applyTraffic({route:e.route(y.id),topology:y,weights:C});e.updateRoute(T.id,{status:Object.values(C).every((V)=>V===0)?"drained":"in_sync",weights:C,providerState:B.providerState})},m=async(y,C,T,j)=>{e.updateTopology(T.id,{status:"provisioning"});let B=C.revision,V=j.manifest??{},W=e.targets(T.id).sort((te,le)=>Number(te.role==="primary")-Number(le.role==="primary"));for(let te of W){a(y,C,`apply:${te.region}`),e.updateTarget(te.id,{status:"provisioning"});let le=await r(te).applyStack({target:te,revision:B,manifest:V,signal:y.signal}),X=await r(te).health({target:e.updateTarget(te.id,{stackId:le.stackId,stackRevision:B})});if(!X.healthy)throw Error(`Regional health gate failed in ${te.region}.`);e.updateTarget(te.id,{status:"ready",health:X.evidence,lastHealthyAt:new Date().toISOString()})}for(let te of e.channels(T.id)){a(y,C,`replicate:${te.kind}:${te.targetRegion}`),e.updateChannel(te.id,{status:"configuring"});let le=W.find((Ee)=>Ee.region===te.sourceRegion),X=await r(le).configureReplication({channel:te,topology:T}),ce=await r(le).verifyReplication({channel:e.updateChannel(te.id,{checkpoint:X.checkpoint,lagSeconds:X.lagSeconds}),topology:T});if(!ce.healthy||ce.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${te.kind} replication to ${te.targetRegion} exceeds the RPO.`);e.updateChannel(te.id,{status:"in_sync",checkpoint:ce.checkpoint,lagSeconds:ce.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(y,C,"traffic:activate");let Y=Object.fromEntries(T.regions.map((te)=>[te.region,te.region===T.activeRegion?100:0]));return await l(T,Y),e.updateTopology(T.id,{status:"ready",revision:B}),{revision:B,activeRegion:T.activeRegion}},h=async(y,C,T)=>{let j=C.requestedRegion,B=e.targets(T.id).find((Y)=>Y.region===j);if(!B)throw Error("Requested regional target was not found.");e.updateTopology(T.id,{status:C.kind==="failover"?"failing_over":"failing_back"}),a(y,C,`health:${j}`);let V=await r(B).health({target:B});if(!V.healthy)throw Error(`Target region ${j} is unhealthy.`);e.updateTarget(B.id,{status:"ready",health:V.evidence,lastHealthyAt:new Date().toISOString()}),a(y,C,`replication:${j}`);for(let Y of e.channels(T.id).filter((te)=>te.targetRegion===j)){let te=await r(B).verifyReplication({channel:Y,topology:T});if(!te.healthy||te.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${Y.kind} replication is outside the failover RPO.`);e.updateChannel(Y.id,{status:"in_sync",checkpoint:te.checkpoint,lagSeconds:te.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(y,C,`traffic:${j}`),await l(T,Object.fromEntries(T.regions.map((Y)=>[Y.region,Y.region===j?100:0]))),a(y,C,`roles:${j}`);let W=T.regions.map((Y)=>({...Y,role:Y.region===j?"primary":"secondary"}));for(let Y of e.targets(T.id))e.updateTarget(Y.id,{role:Y.region===j?"primary":"secondary"});return e.updateTopology(T.id,{status:C.kind==="failover"?"failed_over":"ready",activeRegion:j,regions:W}),{activeRegion:j}},S=async(y,C,T,j)=>{e.updateTopology(T.id,{status:"destroying"}),a(y,C,"traffic:drain"),await l(T,Object.fromEntries(T.regions.map((V)=>[V.region,0])));let B=j.deleteData!==!0;for(let V of e.targets(T.id).sort((W,Y)=>Number(W.role==="primary")-Number(Y.role==="primary")))a(y,C,`delete:${V.region}`),e.updateTarget(V.id,{status:"deleting"}),await r(V).deleteStack({target:V,retainData:B,signal:y.signal}),e.updateTarget(V.id,{status:"deleted"});return a(y,C,"complete"),e.updateTopology(T.id,{status:"destroyed"}),{destroyed:!0,dataRetained:B}},R=async(y)=>{let C=JA(y.operation.input),T=e.execution(String(C.executionId??""));if(!T)throw Error("Regional execution was not found.");let j=e.get(T.topologyId);if(!j)throw Error("Regional topology was not found.");try{let B;if(T.kind==="rollout")B=await m(y,T,j,C);else if(T.kind==="failover"||T.kind==="failback")B=await h(y,T,j);else if(T.kind==="destroy")B=await S(y,T,j,C);else throw Error("Regional reconciliation is not configured.");return e.updateExecution(T.id,{status:"succeeded",currentStep:void 0}),{executionId:T.id,...B}}catch(B){if(e.updateExecution(T.id,{status:y.cancellationRequested()?"cancelled":"failed",error:B instanceof Error?B.message:String(B)}),e.get(j.id)?.status!=="destroyed")e.updateTopology(j.id,{status:"failed"});throw B}};return{"region.rollout":R,"region.failover":R,"region.failback":R,"region.destroy":R,"region.reconcile":R}}class ph{transport;provider="aws";constructor(e){this.transport=e}async applyStack({target:e,revision:t,manifest:r}){return this.transport.applyCloudFormation({region:e.region,stackId:e.stackId,revision:t,manifest:r})}async deleteStack({target:e,retainData:t}){if(!e.stackId)return;await this.transport.deleteCloudFormation({region:e.region,stackId:e.stackId,retainData:t})}async health({target:e}){if(!e.stackId)return{healthy:!1,evidence:{reason:"stack is not provisioned"}};return this.transport.stackHealth({region:e.region,stackId:e.stackId})}async configureReplication({channel:e}){let t={sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,config:e.config};if(e.kind==="s3")return this.transport.configureS3Replication(t);if(e.kind==="dynamodb")return this.transport.configureDynamoGlobalTable(t);return this.transport.replicateSecrets(t)}async verifyReplication({channel:e}){return this.transport.verifyReplication({kind:e.kind,sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,checkpoint:e.checkpoint})}async applyTraffic({route:e,weights:t}){return this.transport.applyEdge({hostname:e.hostname,weights:t,route53:e.dnsProvider==="route53",cloudFront:e.cdnEnabled,waf:e.wafEnabled})}}class Aa{provider;reason;constructor(e,t="Configure a regional provider transport before executing this operation."){this.provider=e;this.reason=t}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function he(e,t,r){return[e,t,r].map((a)=>encodeURIComponent(a)).join(":")}function eh(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function Ct(e,t,r=["exec","files"]){let a=eh(t);for(let l of e)a[l]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(l),requiresRecentAuth:r.includes(l)};return a}var GA=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function ke(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function Be(e){if(Array.isArray(e))return e.map((r)=>Be(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,a]of Object.entries(e))t[r]=GA.test(r)?"[REDACTED]":Be(a);return t}function Et(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function Bl(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function QA(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function _l(e,t={},r={}){let a=t.now??new Date,l=Math.max(100,r.timeoutMs??1e4),m=Math.max(1,r.staleAfterSeconds??60),h=await Promise.all(e.map(async(R)=>{try{let y=await Promise.race([R.discover({...t,now:a}),new Promise((C,T)=>setTimeout(()=>T(Error(`Runtime source ${R.id} timed out after ${l}ms`)),l))]);return{workloads:y,source:{id:R.id,provider:R.provider,status:"fresh",discoveredAt:a.toISOString(),staleAfterSeconds:m,itemCount:y.length}}}catch(y){return{workloads:[],source:{id:R.id,provider:R.provider,status:QA(y),discoveredAt:a.toISOString(),staleAfterSeconds:m,itemCount:0,message:String(y?.message??y).slice(0,500)}}}})),S=h.map((R)=>R.source);return{generatedAt:a.toISOString(),workloads:h.flatMap((R)=>R.workloads).sort((R,y)=>R.name.localeCompare(y.name)||R.id.localeCompare(y.id)),sources:S,degraded:S.some((R)=>R.status!=="fresh")}}function Zs(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function xl(e,t,r,a="ecs:aws",l=[]){let m=r.now??new Date;return e.map((h)=>{let S=h.serviceName??Zs(h.serviceArn),R=t.filter((te)=>!h.clusterArn||te.clusterArn===h.clusterArn),y=R.some((te)=>!!te.group)?R.filter((te)=>te.group===`service:${S}`):R,C=h.status==="ACTIVE"?(h.runningCount??0)<(h.desiredCount??0)?"degraded":"running":ke(h.status),T=l.find((te)=>te.taskDefinitionArn===h.taskDefinition),j=Array.isArray(T?.containerDefinitions)?T.containerDefinitions:[],B=[...new Set(j.map((te)=>te.logConfiguration?.options?.["awslogs-group"]).filter((te)=>typeof te==="string"))],V=j.flatMap((te)=>(te.mountPoints??[]).map((le)=>({source:le.sourceVolume,target:le.containerPath,type:"volume",readOnly:!!le.readOnly}))),W=j.flatMap((te)=>(te.portMappings??[]).map((le,X)=>({id:`${te.name??"container"}:${X}`,name:te.name,mode:T?.networkMode,ports:[{container:le.containerPort,host:le.hostPort,protocol:le.protocol}]}))),Y=r.project&&r.environment&&S.startsWith(`${r.project}-${r.environment}-`)?S.slice(`${r.project}-${r.environment}-`.length):S;return{id:he("ecs",a,h.serviceArn??S),provider:"ecs",kind:"service",name:S,status:C,rawStatus:h.status,health:C==="running"?"healthy":C==="failed"||C==="degraded"?"unhealthy":"unknown",desiredReplicas:h.desiredCount,runningReplicas:h.runningCount,image:j[0]?.image,runtime:h.launchType??"ECS",version:Zs(h.taskDefinition),ageSeconds:Et(h.deployments?.[0]?.createdAt,m),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:Y,release:Zs(h.taskDefinition),providerId:h.serviceArn},replicas:y.map((te)=>{let le=ke(te.lastStatus);return{id:he("ecs",a,te.taskArn??Zs(te.taskArn)),name:Zs(te.taskArn),status:le,rawStatus:te.lastStatus,createdAt:te.createdAt,startedAt:te.startedAt,stoppedAt:te.stoppedAt,host:te.containerInstanceArn,containers:(te.containers??[]).map((X)=>({id:X.containerArn??X.name??"container",name:X.name??"container",image:j.find((ce)=>ce.name===X.name)?.image,imageDigest:X.imageDigest,status:ke(X.lastStatus),rawStatus:X.lastStatus,exitCode:X.exitCode,reason:X.reason,runtime:"ecs"}))}}),networks:W,mounts:V,capabilities:Ct(["start","stop","restart","redeploy","scale","inspect",...B.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:Be({clusterArn:h.clusterArn,taskDefinition:h.taskDefinition,launchType:h.launchType,pendingCount:h.pendingCount,deployments:h.deployments,logGroups:B,executionRoleArn:T?.executionRoleArn,taskRoleArn:T?.taskRoleArn,cpu:T?.cpu,memory:T?.memory}),discoveredAt:m.toISOString(),sourceId:a}})}function Ol(e,t,r="lambda:aws"){let a=t.now??new Date;return e.map((l)=>{let m=l.FunctionName??Zs(l.FunctionArn),h=l.State==="Active"?"running":ke(l.State);return{id:he("lambda",r,l.FunctionArn??m),provider:"lambda",kind:"function",name:m,status:h,rawStatus:l.State,health:h==="running"?"healthy":h==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:l.Runtime,version:l.Version,architecture:l.Architectures?.join(", "),ageSeconds:Et(l.LastModified,a),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:m,providerId:l.FunctionArn},resources:{memoryLimitBytes:l.MemorySize==null?void 0:l.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:Ct(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:Be({handler:l.Handler,timeout:l.Timeout,codeSize:l.CodeSize,stateReason:l.StateReason,environmentKeys:Object.keys(l.Environment?.Variables??{})}),discoveredAt:a.toISOString(),sourceId:r}})}function th(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((a)=>a&&typeof a.Id==="string")}function YA(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,a])=>{let[l,m]=r.split("/");return(a??[]).map((h)=>({container:Number(l)||void 0,host:Number(h.HostPort)||void 0,protocol:m,address:h.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,a])=>({id:a.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[a.IPAddress,a.GlobalIPv6Address].filter(Boolean),ports:t}))}function ZA(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function rh(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((l)=>{let m=l.State?.OOMKilled?"oomkilled":l.State?.Restarting?"starting":l.State?.Status,h=ke(m),S=(l.Name??l.Id.slice(0,12)).replace(/^\//,""),R=l.Config?.Labels??{},y=ZA(l),C=YA(l),T={id:l.Id,name:S,image:l.Config?.Image,imageDigest:l.Image,runtime:"docker",status:h,rawStatus:m,exitCode:l.State?.ExitCode,reason:l.State?.Error,resources:{memoryLimitBytes:l.HostConfig?.Memory||void 0},networks:C,mounts:y};return{id:he("docker",r,l.Id),provider:"docker",kind:"container",name:S,status:h,rawStatus:m,health:h==="running"?"healthy":h==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:h==="running"?1:0,image:l.Config?.Image,runtime:"docker",ageSeconds:Et(l.State?.StartedAt,a),restartCount:l.RestartCount??0,tags:R,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:R["com.docker.compose.service"]??R["ts-cloud.service"]??S,release:R["ts-cloud.release"],providerId:l.Id},resources:T.resources,replicas:[{id:he("docker",r,`${l.Id}:0`),name:S,status:h,rawStatus:m,startedAt:l.State?.StartedAt,stoppedAt:l.State?.FinishedAt,restartCount:l.RestartCount,containers:[T],resources:T.resources}],networks:C,mounts:y,capabilities:Ct(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:Be({image:l.Config?.Image,labels:R,environmentKeys:(l.Config?.Env??[]).map((j)=>j.split("=",1)[0]),networkMode:l.HostConfig?.NetworkMode}),discoveredAt:a.toISOString(),sourceId:r}})}class Wo{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return rh(th(await this.inspect(e)),e,this.id)}}function nh(e){let t=[];for(let r of e.split(`
-`)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,a,l,m,h,S,R,y,C,T,j,B,V,W]=r.split("\t");if(!a||!/^[A-Za-z0-9_.@:-]+\.service$/.test(a))continue;t.push({unit:a,load:l,active:m,sub:h,description:S,enabled:R,pid:Number(y)||void 0,memoryBytes:Bl(C),restartCount:Number(T)||0,activeSince:j||void 0,fragmentPath:B||void 0,workingDirectory:V?.startsWith("/")?V:void 0,user:W||void 0})}return t}function ih(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((l)=>{let m=ke(l.active==="active"?l.sub||l.active:l.active),h=l.unit.replace(/\.service$/,""),S=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(l.description??"")?.[1]??(t.project&&h.startsWith(`${t.project}-`)?h.slice(t.project.length+1).split("@",1)[0]:void 0),R=h.includes("@")?h.slice(h.indexOf("@")+1):void 0,y=l.workingDirectory?[{target:l.workingDirectory,type:"working-directory"}]:[],C=["start","stop","restart","logs","exec","inspect",...y.length?["files"]:[]];return{id:he("systemd",r,l.unit),provider:"systemd",kind:"service",name:h,displayName:l.description||h,status:m,rawStatus:[l.load,l.active,l.sub].filter(Boolean).join("/"),health:m==="running"?"healthy":m==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:m==="running"?1:0,ageSeconds:Et(l.activeSince,a),restartCount:l.restartCount,tags:{enabled:l.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:S,release:R,providerId:l.unit},resources:{memoryBytes:l.memoryBytes},replicas:[{id:he("systemd",r,`${l.unit}:main`),name:"main",status:m,pid:l.pid,startedAt:l.activeSince,restartCount:l.restartCount,resources:{memoryBytes:l.memoryBytes}}],networks:[],mounts:y,capabilities:Ct(C,y.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:Be({fragmentPath:l.fragmentPath,workingDirectory:l.workingDirectory,user:l.user,environment:l.environment,enabled:l.enabled}),discoveredAt:a.toISOString(),sourceId:r}})}class Jo{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return ih(nh(await this.read(e)),e,this.id)}}function XA(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function eC(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function tC(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function sb(e,t,r,a,l){let m=`${e}:${r.id}`,h=async()=>XA(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?eC():tC(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:a.project.slug,Environment:l,Role:"app"}}),m);return e==="systemd"?new Jo(h,m):new Wo(h,m)}async function el(e,t=100){let r=[],a;for(let l=0;l<t;l++){let m=await e(a);if(r.push(...m.items),!m.nextToken)return r;a=m.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class Ll{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await el(async(m)=>{let h=await this.client.listClusters({nextToken:m,maxResults:100});return{items:h.clusterArns??[],nextToken:h.nextToken}}),r=[],a=[],l=[];for(let m of t){let h=(await el(async(S)=>{let R=await this.client.listServices(m,{nextToken:S,maxResults:100});return{items:R.serviceArns??[],nextToken:R.nextToken}})).filter((S)=>S.split("/").at(-1)?.startsWith(this.prefix));for(let S=0;S<h.length;S+=10){let R=await this.client.describeServices({cluster:m,services:h.slice(S,S+10)});r.push(...R.services??[])}for(let S of r.filter((R)=>R.clusterArn===m||!R.clusterArn)){let R=await el(async(y)=>{let C=await this.client.listTasks(m,S.serviceName,{nextToken:y,maxResults:100});return{items:C.taskArns??[],nextToken:C.nextToken}});for(let y=0;y<R.length;y+=100){let C=await this.client.describeTasks(m,R.slice(y,y+100));a.push(...C.tasks??[])}}}if(this.client.describeTaskDefinition)for(let m of[...new Set(r.map((h)=>h.taskDefinition).filter((h)=>!!h))]){let h=await this.client.describeTaskDefinition(m);if(h.taskDefinition)l.push(h.taskDefinition)}return xl(r,a,e,this.id,l)}}class $l{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await el(async(r)=>{let a=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:a.Functions??[],nextToken:a.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return Ol(t,e,this.id)}}async function sh(e,t,r={}){let a=[],l=M(e),m=ge(e),h=e.aws?.profile,S=e.aws?.region??e.project.region??"us-east-1",R=`${e.project.slug}-${t}`;if(l!=="serverless"){let y=r.driver??_({config:e}),C=await y.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let T of C)a.push(sb("systemd",y,T,e,t)),a.push(sb("docker",y,T,e,t))}if(m==="aws")a.push(new Ll(r.ecs??new rt(S,h),R)),a.push(new $l(r.lambda??new b(S,h),R));return a}async function ie(e,t,r={}){let a={project:e.project.slug,environment:t};try{return await _l(await sh(e,t,r),a)}catch(l){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:ge(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(l?.message??l).slice(0,500)}],degraded:!0}}}var ab=65536,fc=49152,rl=/^[A-Za-z0-9_.@:-]+\.service$/,nl=/^[a-fA-F0-9]{12,128}$/,rC=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function Xs(e){let t=Buffer.from(e);return t.byteLength<=ab?e:`${t.subarray(0,ab-24).toString("utf8")}
+`:"")}import{createCipheriv as TA,createDecipheriv as xA,createHash as Vv,randomBytes as DA}from"node:crypto";class gn{controlPlane;now;kind="local_encrypted";key;constructor(e,t,r=()=>new Date){this.controlPlane=e;this.now=r;if(!t)throw Error("Configuration encryption key is required.");this.key=Vv("sha256").update(`ts-cloud:configuration:${t}`).digest()}encrypt(e){let t=DA(12),r=TA("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted configuration secret is unavailable.");try{let m=xA("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(e){if(!e.value)throw Error("Configuration secrets cannot be empty.");let t=e.reference??`secret://configuration/${e.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(t))throw Error("Invalid local configuration secret reference.");let a=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(t)?.version??0)+1,l=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[t,this.encrypt(e.value),Vv("sha256").update(e.value).digest("hex"),a,l,l]),{reference:t,version:String(a)}}async resolve(e){let t=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(e);if(!t)throw Error("Configuration secret was not found.");return this.decrypt(t.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[e])}async validate(e){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(e)}}class _a{client;region;kind="aws_secrets_manager";constructor(e,t){this.client=e;this.region=t}async put(e){if(e.reference){let r=this.id(e.reference),a=await this.client.putSecretValue({SecretId:r,SecretString:e.value,ClientRequestToken:e.idempotencyKey});return{reference:e.reference,version:a.VersionId??e.idempotencyKey}}let t=await this.client.createSecret({Name:e.name,SecretString:e.value,ClientRequestToken:e.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(t.ARN??t.Name??e.name)}`,version:t.VersionId??e.idempotencyKey}}async resolve(e){let t=await this.client.getSecretValue({SecretId:this.id(e)});if(t.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return t.SecretString}async remove(e){await this.client.deleteSecret({SecretId:this.id(e),RecoveryWindowInDays:7})}async validate(e){try{return await this.client.describeSecret(this.id(e)),!0}catch{return!1}}id(e){let t=new URL(e);if(t.protocol!=="aws-sm:"||t.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(t.pathname.slice(1))}}class Oa{client;region;kind="aws_ssm";constructor(e,t){this.client=e;this.region=t}async put(e){let t=e.reference?this.name(e.reference):`/${e.name.replace(/^\/+/,"")}`,r=await this.client.putParameter({Name:t,Value:e.value,Type:"SecureString",Overwrite:!!e.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${t}`,version:String(r.Version??1)}}async resolve(e){let t=await this.client.getParameter({Name:this.name(e),WithDecryption:!0});if(t.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return t.Parameter.Value}async remove(e){await this.client.deleteParameter({Name:this.name(e)})}async validate(e){try{return!!(await this.client.getParameter({Name:this.name(e),WithDecryption:!1})).Parameter}catch{return!1}}name(e){let t=new URL(e);if(t.protocol!=="aws-ssm:"||t.hostname!==this.region||!t.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return t.pathname}}class xa{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(e){return/^(?:vault|doppler|op|external):\/\//.test(e)}}import{createHmac as OA}from"node:crypto";var $A=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,NA=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/;function Rn(e){return[...new Set(e)].sort()}function Wv(e,t={}){let r=e.kind==="secret";return{id:e.id,key:e.key,kind:e.kind,scope:e.scope,inherited:!!t.inherited,overridden:!!t.overridden,required:e.required,backend:!r||t.canReadSecretMetadata?e.backend:void 0,backendVersion:!r||t.canReadSecretMetadata?e.backendVersion:void 0,reference:r&&t.canReadSecretMetadata?e.secretRef:void 0,value:!r?e.value:void 0,lastUsedAt:e.lastUsedAt,rotatedAt:e.rotatedAt,version:e.version,updatedAt:e.updatedAt}}class La{store;backends=new Map;fingerprintKey;now;constructor(e,t){if(this.store=e,this.fingerprintKey=t.fingerprintKey??t.encryptionKey,this.now=t.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let r=t.backends??[new gn(e.controlPlane,t.encryptionKey,this.now)];for(let a of r)this.backends.set(a.kind,a)}list(e){let t=e.search?.toLowerCase();return this.store.list(e).filter((r)=>!t||r.key.toLowerCase().includes(t)).map((r)=>Wv(r,{canReadSecretMetadata:e.canReadSecretMetadata}))}plan(e){let t=this.store.list({projectId:e.projectId,scope:e.scope}),r=new Map(t.map((R)=>[R.key,R])),a=[],l=[],m=[],h=[];for(let[R,y]of Object.entries(e.values)){a.push(...this.warnings(R,y));let C=r.get(R);if(!C)l.push(R);else if(C.valueFingerprint!==this.fingerprint(y))m.push(R);else h.push(R)}let S=e.removeMissing?t.filter((R)=>!Object.hasOwn(e.values,R.key)).map((R)=>R.key):[];return{added:Rn(l),changed:Rn(m),removed:Rn(S),unchanged:Rn(h),affectedResourceIds:this.affectedResources(e.projectId,e.scope,[...l,...m,...S]),warnings:a}}async set(e){let t=this.requestHash(e),r=e.idempotencyKey;if(r){let V=this.store.mutation(r);if(V){if(V.requestHash!==t)throw Error("Idempotency key was already used for a different configuration mutation.");let W=this.store.get(String(V.result.entryId??""));if(!W)throw Error("Idempotent configuration result is no longer available.");return{entry:W,mutation:V.result.mutation,warnings:[]}}}if(e.value!=null&&$A.test(e.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let a=this.store.find(e.projectId,e.scope,e.key),l=this.fingerprint(e.value??e.reference??"");if(a&&e.expectedVersion!=null&&a.version!==e.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(a&&a.kind!==e.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let m=e.kind==="variable"?"plaintext":e.backend??(e.reference?"external":"local_encrypted");if(!!a&&(a.valueFingerprint!==l||a.backend!==m||a.required!==!!e.required)&&(this.isProduction(a)||this.store.dependencies(a.id).length>0)&&!e.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let S=e.reference,R;if(e.kind==="secret"){let V=this.backend(m);if(e.reference&&e.value==null){if(!await V.validate(e.reference))throw Error("Secret backend reference is unavailable or invalid.");R=a?.backendVersion??"external"}else{if(e.value==null)throw Error("A secret value or external reference is required.");let W=await V.put({reference:a?.backend===m?a.secretRef:void 0,name:this.backendName(e),value:e.value,idempotencyKey:r??crypto.randomUUID()});S=W.reference,R=W.version}}let y=e.kind==="variable"?e.value:void 0;if(e.kind==="variable"&&y==null)throw Error("A variable value is required.");let C=!a||a.valueFingerprint!==l||a.backend!==m||a.secretRef!==S||a.backendVersion!==R||a.required!==!!e.required,T=a?C?this.store.update(a.id,a.version,{value:y,valueFingerprint:l,secretRef:S,backend:m,backendVersion:R,required:!!e.required,metadata:s(e.metadata??a.metadata),rotatedAt:e.kind==="secret"?this.now().toISOString():a.rotatedAt}):a:this.store.create({organizationId:e.organizationId,projectId:e.projectId,scope:e.scope,key:e.key,kind:e.kind,value:y,valueFingerprint:l,secretRef:S,backend:m,backendVersion:R,origin:e.origin??"managed",required:!!e.required,metadata:s(e.metadata??{}),rotatedAt:e.kind==="secret"?this.now().toISOString():void 0}),j=this.affectedResources(e.projectId,e.scope,[e.key]),B={added:a?[]:[e.key],changed:a&&C?[e.key]:[],removed:[],unchanged:a&&!C?[e.key]:[],affectedResourceIds:j,versions:{[e.key]:T.version}};if(r)this.store.recordMutation({projectId:e.projectId,idempotencyKey:r,requestHash:t,actorId:e.actorId,result:{entryId:T.id,mutation:B}});return this.audit(e.projectId,e.actorId,a&&C?"configuration.updated":a?"configuration.unchanged":"configuration.created",T,j),{entry:T,mutation:B,warnings:this.warnings(e.key,e.value??"")}}async importDotenv(e){let t=Su(e.source);if(!t.valid)return{document:t,warnings:[]};let r=new Set(e.secretKeys??[]),a={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},l=[];for(let[m,h]of Object.entries(t.values)){let S=await this.set({...e,source:void 0,key:m,value:h,kind:r.has(m)?"secret":"variable",idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:${m}`:void 0});a.added.push(...S.mutation.added),a.changed.push(...S.mutation.changed),a.unchanged.push(...S.mutation.unchanged),a.affectedResourceIds.push(...S.mutation.affectedResourceIds),Object.assign(a.versions,S.mutation.versions),l.push(...S.warnings)}return a.added=Rn(a.added),a.changed=Rn(a.changed),a.unchanged=Rn(a.unchanged),a.affectedResourceIds=Rn(a.affectedResourceIds),{document:t,mutation:a,warnings:l}}exportVariables(e){return Cu(Object.fromEntries(this.store.list({projectId:e.projectId,scope:e.scope,kind:"variable"}).map((t)=>[t.key,t.value??""])))}async transfer(e){let t=this.store.get(e.entryId);if(!t)throw Error("Configuration entry was not found.");if(t.scope.type===e.targetScope.type&&t.scope.id===e.targetScope.id)throw Error("Choose a different destination scope.");let r=t.kind==="variable"?t.value:t.backend==="external"?void 0:await this.backend(t.backend).resolve(t.secretRef),a=t.kind==="secret"?t.backend:void 0,l=await this.set({organizationId:t.organizationId,projectId:t.projectId,scope:e.targetScope,key:t.key,kind:t.kind,value:r,reference:t.backend==="external"?t.secretRef:void 0,backend:a,required:t.required,metadata:t.metadata,confirmed:e.confirmed,actorId:e.actorId,idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:copy`:void 0,origin:t.origin});if(e.mode==="move")await this.remove({entryId:t.id,expectedVersion:t.version,confirmed:e.confirmed,actorId:e.actorId});let m={added:l.mutation.added,changed:l.mutation.changed,removed:e.mode==="move"?[t.key]:[],unchanged:l.mutation.unchanged,affectedResourceIds:Rn([...l.mutation.affectedResourceIds,...this.affectedResources(t.projectId,t.scope,[t.key])]),versions:l.mutation.versions};return{entry:l.entry,mutation:m}}async resolve(e){let t=this.store.list({projectId:e.projectId}),r=t.filter((y)=>this.applies(y,e)).sort((y,C)=>this.rank(y.scope.type)-this.rank(C.scope.type)),a=new Map,l=new Set;for(let y of r){if(a.has(y.key))l.add(y.key);a.set(y.key,y)}let m={},h={},S=[],R=new Set(e.allowedPreviewSecrets??[]);for(let[y,C]of a){if(e.previewId&&C.kind==="secret"&&C.scope.type!=="preview"&&(!e.trustedPreview||!R.has(y)))continue;if(C.kind==="variable")m[y]=C.value??"";else if(e.nativeReferences)m[y]=C.secretRef;else{let T=this.backend(C.backend);if(!await T.validate(C.secretRef)){if(S.push({key:y,code:"stale_reference",message:`${y} points to an unavailable secret.`}),C.required)S.push({key:y,code:"missing_required",message:`${y} is required but unavailable.`});continue}m[y]=await T.resolve(C.secretRef)}h[y]=Wv(C,{inherited:C.scope.type!==(e.previewId?"preview":e.functionId?"function":e.resourceId?"service":e.environmentId?"environment":"project"),overridden:l.has(y),canReadSecretMetadata:e.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),C.id])}return{values:m,entries:h,warnings:S,configurationHash:this.fingerprint([...a.values()].map((y)=>`${y.key}:${y.valueFingerprint}:${y.version}`).sort().join(`
+`))}}async reveal(e){let t=this.store.get(e.entryId);if(!t||t.kind!=="secret")throw Error("Configuration secret was not found.");if(!e.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!e.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let r=await this.backend(t.backend).resolve(t.secretRef);return this.audit(t.projectId,e.actorId,"configuration.secret.revealed",t,[]),r}async remove(e){let t=this.store.get(e.entryId);if(!t)throw Error("Configuration entry was not found.");let r=this.store.dependencies(t.id);if(((t.scope.environmentId?this.store.controlPlane.listEnvironments(t.projectId).some((h)=>h.id===t.scope.environmentId&&h.kind==="production"):t.scope.type==="project")||r.length)&&!e.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(t.kind==="secret"&&t.backend!=="external")await this.backend(t.backend).remove(t.secretRef);this.store.remove(t.id,e.expectedVersion);let l=Rn(r.map((h)=>h.resourceId)),m={added:[],changed:[],removed:[t.key],unchanged:[],affectedResourceIds:l,versions:{}};return this.audit(t.projectId,e.actorId,"configuration.deleted",t,l),m}applies(e,t){if(e.scope.type==="project")return!0;if(e.scope.type==="environment")return e.scope.id===t.environmentId;if(e.scope.type==="service")return e.scope.id===t.resourceId;if(e.scope.type==="function")return e.scope.id===t.functionId;return e.scope.id===t.previewId}rank(e){return{project:0,environment:1,service:2,function:3,preview:4}[e]}fingerprint(e){return`hmac-sha256:${OA("sha256",this.fingerprintKey).update(e).digest("hex")}`}requestHash(e){return this.fingerprint(JSON.stringify({...e,idempotencyKey:void 0,actorId:void 0}))}backend(e){let t=this.backends.get(e);if(!t)throw Error(`Configuration secret backend is not configured: ${e}`);return t}backendName(e){return`ts-cloud/${e.projectId}/${e.scope.type}/${e.scope.id}/${e.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(e){return e.scope.type==="project"||!!e.scope.environmentId&&this.store.controlPlane.listEnvironments(e.projectId).some((t)=>t.id===e.scope.environmentId&&t.kind==="production")}warnings(e,t){let r=[];if(NA.test(e))r.push({key:e,code:"reserved",message:`${e} may be reserved by the runtime or provider.`});if(Buffer.byteLength(t)>65536)r.push({key:e,code:"limit",message:`${e} exceeds the portable 64 KiB value limit.`});return r}affectedResources(e,t,r){let a=this.store.list({projectId:e,scope:t}).filter((l)=>r.includes(l.key)).flatMap((l)=>this.store.dependencies(l.id).map((m)=>m.resourceId));if(t.type==="service"||t.type==="function")return Rn([...a,t.id]);if(t.type==="environment")return Rn([...a,...this.store.controlPlane.listResources(e,t.id).map((l)=>l.id)]);if(t.type==="preview"){let l=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(t.id);return Rn([...a,...l?[l.resource_id]:[]])}return Rn([...a,...this.store.controlPlane.listResources(e).map((l)=>l.id)])}audit(e,t,r,a,l){this.store.controlPlane.appendEvent({projectId:e,actorId:t,type:r,payload:{entryId:a.id,key:a.key,kind:a.kind,scopeType:a.scope.type,scopeId:a.scope.id,backend:a.backend,version:a.version,affectedResourceIds:l}})}}async function Eu(e,t,r,a){let l={added:0,changed:0,removed:0,overridden:0},m=async(h,S)=>{let R=e.store.list({projectId:t.project.id,scope:h,kind:"variable"}),y=new Set(Object.keys(S));for(let C of R.filter((T)=>T.origin==="config"&&!y.has(T.key)))await e.remove({entryId:C.id,expectedVersion:C.version,confirmed:!0,actorId:a}),l.removed++;for(let[C,T]of Object.entries(S)){let j=e.store.find(t.project.id,h,C);if(j?.origin!=="config"){if(j)l.overridden++;else await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:h,key:C,kind:"variable",value:String(T),origin:"config",confirmed:!0,actorId:a}),l.added++;continue}if(j.value===String(T))continue;await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:h,key:C,kind:"variable",value:String(T),origin:"config",confirmed:!0,actorId:a,expectedVersion:j.version}),l.changed++}};for(let[h,S]of Object.entries(r.environments??{})){let R=t.environments.get(h);if(!R)continue;let y=S,C={...y.variables??{},...y.app?.env??{}};await m({type:"environment",id:R.id,environmentId:R.id},C);for(let[T,j]of Object.entries(r.sites??{})){let B=t.store.listResources(t.project.id,R.id).find((V)=>V.kind==="application"&&V.slug===T);if(B)await m({type:"service",id:B.id,environmentId:R.id,resourceId:B.id},{...j.env??{}})}for(let[T,j]of Object.entries(r.infrastructure?.functions??{})){let B=t.store.listResources(t.project.id,R.id).find((V)=>V.kind==="function"&&V.slug===T);if(B)await m({type:"function",id:B.id,environmentId:R.id,resourceId:B.id},{...j.environment??{}})}}return l}var jA=async(e)=>{let t=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),[r,a,l]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:a,stderr:l}};class ql{async scan(e,t){return zn(e,t)}async exec(e,t){if(e.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return jA(["ssh","-p",String(e.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${e.sshUser}@${e.endpoint}`,t])}}var BA=dt,MA=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class on{provider;transport;discoverer;constructor(e,t=new ql,r){this.provider=e;this.transport=t;this.discoverer=r}discover(e){return this.discoverer?.(e)??Promise.resolve([])}async test(e){try{let t=await this.transport.scan(e.endpoint,e.sshPort);return{reachable:!0,hostKeyAlgorithm:t.algorithm,hostKeyFingerprint:BA(t.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(e){let t=await this.transport.exec(e,MA);if(t.code!==0)throw Error(`Fleet validation failed: ${t.stderr.trim()||t.code}`);try{return JSON.parse(t.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(e,t){let r=await this.transport.exec(e,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${t.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function Vl(e,t){return{"fleet.bootstrap":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.get(String(a.serverId??""));if(!l)throw Error("Queued fleet server was not found.");let m=t.find((R)=>R.provider===l.provider);if(!m)throw Error(`No ${l.provider} fleet driver is configured.`);let h=Array.isArray(a.steps)?a.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),l.trustState!=="pinned"||!l.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let S=await m.bootstrap(l,h);return e.update(l.id,{bootstrapVersion:S.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:l.id,bootstrapVersion:S.version,steps:h.length}}}}var ri=(e)=>e==null?void 0:String(e),ps=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},xg=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),resourceId:String(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:ri(e.provider_id),region:ri(e.region),zone:ri(e.zone),endpoint:String(e.endpoint),sshUser:String(e.ssh_user),sshPort:Number(e.ssh_port),credentialRef:String(e.credential_ref),hostKeyAlgorithm:ri(e.host_key_algorithm),hostKeyFingerprint:ri(e.host_key_fingerprint),pendingHostKey:ri(e.pending_host_key),roles:ps(e.roles,[]),labels:ps(e.labels,{}),taints:ps(e.taints,[]),capacity:ps(e.capacity,{}),usage:ps(e.usage,{}),capabilities:ps(e.capabilities,{}),status:String(e.status),trustState:String(e.trust_state),validation:ps(e.validation,void 0),bootstrapVersion:ri(e.bootstrap_version),heartbeatAt:ri(e.heartbeat_at),lastSeenAt:ri(e.last_seen_at),archivedAt:ri(e.archived_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class ua{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}get(e){let t=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(e);return t?xg(t):void 0}list(e,t=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(e).map(xg).filter((r)=>t||r.status!=="archived")}findProvider(e,t,r){let a=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(e,t,r);return a?xg(a):void 0}create(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.resourceId,e.name,e.provider,e.providerId??null,e.region??null,e.zone??null,e.endpoint,e.sshUser,e.sshPort,e.credentialRef,e.hostKeyAlgorithm??null,e.hostKeyFingerprint??null,e.pendingHostKey??null,JSON.stringify(e.roles),JSON.stringify(e.labels),JSON.stringify(e.taints),JSON.stringify(e.capacity),JSON.stringify(e.usage),JSON.stringify(e.capabilities),e.status,e.trustState,JSON.stringify(e.validation??{}),e.bootstrapVersion??null,e.heartbeatAt??null,e.lastSeenAt??null,e.archivedAt??null,r,r]),this.get(t)}update(e,t){let r=this.get(e);if(!r)throw Error("Server was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[a.name,a.providerId??null,a.region??null,a.zone??null,a.endpoint,a.sshUser,a.sshPort,a.credentialRef,a.hostKeyAlgorithm??null,a.hostKeyFingerprint??null,a.pendingHostKey??null,JSON.stringify(a.roles),JSON.stringify(a.labels),JSON.stringify(a.taints),JSON.stringify(a.capacity),JSON.stringify(a.usage),JSON.stringify(a.capabilities),a.status,a.trustState,JSON.stringify(a.validation??{}),a.bootstrapVersion??null,a.heartbeatAt??null,a.lastSeenAt??null,a.archivedAt??null,l,e]),this.get(e)}}var LA=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class pa{store;drivers;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.drivers=t;this.now=a;this.queue=r??new c(e.control)}driver(e){let t=this.drivers.find((r)=>r.provider===e);if(!t)throw Error(`No ${e} fleet driver is configured.`);return t}enroll(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Server name is invalid.");if(!LA.test(e.endpoint)||e.sshUser==="root"||!e.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let t=e.providerId?this.store.findProvider(e.organizationId,e.provider,e.providerId):void 0;if(t)return this.store.update(t.id,{endpoint:e.endpoint,region:e.region,zone:e.zone});let r=this.store.control.createResource({projectId:e.projectId,kind:"server",slug:e.name,name:e.name,provider:e.provider,providerId:e.providerId}),a=this.driver(e.provider);return this.store.create({...e,resourceId:r.id,sshPort:e.sshPort??22,labels:e.labels??{},taints:[],capacity:{},usage:{},capabilities:a.capabilities(),status:"pending",trustState:"unverified"})}async test(e){let t=this.store.get(e);if(!t)throw Error("Server was not found.");let r=await this.driver(t.provider).test(t);if(!r.reachable)return this.store.update(e,{status:"unreachable"});if(t.hostKeyFingerprint&&t.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(e,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(e,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(e,t){let r=this.store.get(e);if(!r||r.pendingHostKey!==t)throw Error("Pending host key does not match.");return this.store.update(e,{hostKeyFingerprint:t,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(e){let t=this.store.get(e);if(!t||t.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(t.provider).validate(t),a=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))a.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let h of["curl","tar"])if(!r.tools?.[h])a.push({code:`tool.${h}`,severity:"error",message:`${h} is missing.`,remediation:`Install ${h} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)a.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)a.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let l={valid:!a.some((h)=>h.severity==="error"),facts:r,findings:a,validatedAt:this.now().toISOString(),validatorVersion:"1"},m={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(e,{validation:l,capacity:m,status:l.valid?"ready":"degraded"})}bootstrap(e,t=!1){let r=this.store.get(e);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let a=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!t)return{preview:!0,steps:a};let l=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:e,steps:a},lockKey:`server:${e}`,providerKey:r.provider}).operation;return{preview:!1,steps:a,operation:l}}heartbeat(e,t){let r=this.store.get(e);if(!r)throw Error("Server was not found.");let a=this.now().toISOString();return this.store.update(e,{usage:t.usage,capabilities:t.capabilities??r.capabilities,heartbeatAt:a,lastSeenAt:a,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(e,t=!1){return this.store.update(e,{status:t?"drained":"draining"})}uncordon(e){return this.store.update(e,{status:"ready"})}archive(e,t){let r=this.store.get(e);if(!r||t!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(e,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as Dg,createPublicKey as Jv,verify as FA}from"node:crypto";function an(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(an).join(",")}]`;return`{${Object.keys(e).sort().map((t)=>`${JSON.stringify(t)}:${an(e[t])}`).join(",")}}`}var Kl=(e)=>Dg("sha256").update(an(e)).digest("hex"),Xi=(e)=>Dg("sha256").update(an(e)).digest("hex"),Wl=(e)=>Dg("sha256").update(Jv(e).export({type:"spki",format:"der"})).digest("hex");function Jl(e,t,r){try{return FA(null,Buffer.from(an(e)),Jv(r),Buffer.from(t,"base64"))}catch{return!1}}var Hv=(e)=>e.replace(/^v/,"").split(/[.-]/).slice(0,3).map((t)=>Number(t)||0),Kv=(e,t)=>{let r=Hv(e),a=Hv(t);for(let l=0;l<3;l++){let m=(r[l]??0)-(a[l]??0);if(m)return m}return 0};function Xl(e,t){let r=[];if(t.schemaVersion<e.minimumSchema)r.push(`schema ${t.schemaVersion} is below ${e.minimumSchema}`);if(t.schemaVersion>e.maximumSchema)r.push(`schema ${t.schemaVersion} is above ${e.maximumSchema}`);if(e.minimumVersion&&Kv(t.currentVersion,e.minimumVersion)<0)r.push(`platform ${t.currentVersion} is below ${e.minimumVersion}`);if(Kv(e.version,t.currentVersion)<=0)r.push(`version ${e.version} is not newer than ${t.currentVersion}`);if(!e.artifacts.some((a)=>a.platform===t.platform&&a.architecture===t.architecture))r.push(`no artifact for ${t.platform}/${t.architecture}`);return{compatible:r.length===0,reasons:r}}var Si=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Fr=(e)=>e==null?void 0:String(e),zA=(e)=>({id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),algorithm:"ed25519",publicKeyPem:String(e.public_key_pem),fingerprint:String(e.fingerprint),revokedAt:Fr(e.revoked_at),createdAt:String(e.created_at)}),Gv=(e)=>({id:String(e.id),organizationId:String(e.organization_id),version:String(e.version),channel:String(e.channel),publishedAt:String(e.published_at),keyId:String(e.key_id),digest:String(e.digest),document:Si(e.document,{}),signature:String(e.signature),verificationStatus:String(e.verification_status),compatibility:Si(e.compatibility,{compatible:!1,reasons:[]}),createdAt:String(e.created_at)}),Qv=(e)=>({id:String(e.id),projectId:String(e.project_id),name:String(e.name),schedule:String(e.schedule),timezone:String(e.timezone),durationMinutes:Number(e.duration_minutes),allowedOperations:Si(e.allowed_operations,[]),requireApproval:Number(e.require_approval)===1,enabled:Number(e.enabled)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Yv=(e)=>({id:String(e.id),projectId:String(e.project_id),manifestId:String(e.manifest_id),windowId:Fr(e.window_id),fromVersion:String(e.from_version),strategy:String(e.strategy),batchSize:Number(e.batch_size),healthGate:Si(e.health_gate,{}),status:String(e.status),currentStage:Fr(e.current_stage),backupId:Fr(e.backup_id),approvedBy:Fr(e.approved_by),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Og=(e)=>({id:String(e.id),campaignId:String(e.campaign_id),serverId:Fr(e.server_id),target:String(e.target),cohort:Number(e.cohort),previousVersion:String(e.previous_version),status:String(e.status),evidence:Si(e.evidence,{}),error:Fr(e.error),startedAt:Fr(e.started_at),finishedAt:Fr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Zv=(e)=>({id:String(e.id),projectId:String(e.project_id),kind:String(e.kind),criteria:Si(e.criteria,{}),candidates:Si(e.candidates,[]),candidateDigest:String(e.candidate_digest),estimatedBytes:Number(e.estimated_bytes),status:String(e.status),confirmation:Fr(e.confirmation),expiresAt:String(e.expires_at),result:Si(e.result,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Xv=(e)=>({id:String(e.id),projectId:String(e.project_id),backupPolicyId:Fr(e.backup_policy_id),recoveryPointId:Fr(e.recovery_point_id),topologyId:Fr(e.topology_id),scenario:String(e.scenario),isolatedTarget:String(e.isolated_target),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),status:String(e.status),operationId:Fr(e.operation_id),evidence:Si(e.evidence,{}),measuredRpoMinutes:e.measured_rpo_minutes==null?void 0:Number(e.measured_rpo_minutes),measuredRtoMinutes:e.measured_rto_minutes==null?void 0:Number(e.measured_rto_minutes),cleanupVerified:Number(e.cleanup_verified)===1,error:Fr(e.error),startedAt:Fr(e.started_at),finishedAt:Fr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class ya{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}addTrustedKey(e){let t=this.id(),r=this.now().toISOString(),a=Wl(e.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[t,e.organizationId,e.name,e.publicKeyPem,a,r]),this.key(t)}key(e){let t=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(e);return t?zA(t):void 0}revokeKey(e){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),e]),this.key(e)}importManifest(e){let t=this.key(e.keyId);if(!t||t.organizationId!==e.organizationId)throw Error("Trusted update key was not found.");if(t.revokedAt)throw Error("Update signing key is revoked.");if(!Jl(e.document,e.signature,t.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=Xl(e.document,e.current),a=Kl(e.document),l=this.id(),m=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[l,e.organizationId,e.document.version,e.document.channel,new Date(e.document.publishedAt).toISOString(),e.keyId,a,JSON.stringify(e.document),e.signature,JSON.stringify(r),m]),this.manifest(l)}manifest(e){let t=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(e);return t?Gv(t):void 0}manifests(e){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(e).map(Gv)}createWindow(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[t,e.projectId,e.name,e.schedule,e.timezone,e.durationMinutes,JSON.stringify(e.allowedOperations),e.requireApproval===!1?0:1,r,r]),this.window(t)}window(e){let t=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(e);return t?Qv(t):void 0}windows(e){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(e).map(Qv)}createCampaign(e){return this.control.transaction(()=>{let t=this.manifest(e.manifestId);if(!t?.compatibility.compatible||t.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!e.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),a=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,e.projectId,e.manifestId,e.windowId??null,e.fromVersion,e.strategy,e.batchSize,JSON.stringify(e.healthGate),e.backupId,e.approvedBy??null,a,a]),e.targets.forEach((l,m)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,l.serverId??null,l.target,e.strategy==="canary"?m===0?0:1+Math.floor((m-1)/e.batchSize):Math.floor(m/e.batchSize),l.previousVersion,a,a])),this.campaign(r)})}campaign(e){let t=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(e);return t?Yv(t):void 0}campaigns(e){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(e).map(Yv)}targets(e){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(e).map(Og)}updateCampaign(e,t){let r=this.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a={...r,...t};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[a.status,a.currentStage??null,this.now().toISOString(),e]),this.campaign(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e);if(!r)throw Error("Upgrade target was not found.");let a={...Og(r),...t};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.evidence),a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),Og(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e))}createCleanup(e){let t=[...e.candidates].sort((h,S)=>h.id.localeCompare(S.id)),r=Xi(t),a=this.id(),l=this.now().toISOString(),m=new Date(this.now().getTime()+(e.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[a,e.projectId,e.kind,JSON.stringify(e.criteria),JSON.stringify(t),r,t.reduce((h,S)=>h+S.bytes,0),m,l,l]),this.cleanup(a)}cleanup(e){let t=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(e);return t?Zv(t):void 0}cleanups(e){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(e).map(Zv)}updateCleanup(e,t){let r=this.cleanup(e);if(!r)throw Error("Cleanup plan was not found.");let a={...r,...t};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[a.status,a.confirmation??null,JSON.stringify(a.result),this.now().toISOString(),e]),this.cleanup(e)}createDrill(e){if(!/^isolated:\/\//.test(e.isolatedTarget))throw Error("DR drills require an isolated target.");let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[t,e.projectId,e.backupPolicyId??null,e.recoveryPointId??null,e.topologyId??null,e.scenario,e.isolatedTarget,e.expectedRpoMinutes,e.expectedRtoMinutes,r,r]),this.drill(t)}drill(e){let t=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(e);return t?Xv(t):void 0}drills(e){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(e).map(Xv)}updateDrill(e,t){let r=this.drill(e);if(!r)throw Error("DR drill was not found.");let a={...r,...t};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,JSON.stringify(a.evidence),a.measuredRpoMinutes??null,a.measuredRtoMinutes??null,a.cleanupVerified?1:0,a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),this.drill(e)}}function gh(e,t=new Date){if(!e.enabled)return!1;let r=new Date(e.schedule);if(!Number.isNaN(r.getTime()))return t>=r&&t.getTime()<=r.getTime()+e.durationMinutes*60000;let a=/^(\d{2}):(\d{2})$/.exec(e.schedule);if(!a)return!1;let l=new Intl.DateTimeFormat("en-US",{timeZone:e.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(t),m=Number(l.find((S)=>S.type==="hour")?.value)*60+Number(l.find((S)=>S.type==="minute")?.value),h=Number(a[1])*60+Number(a[2]);return m>=h&&m<h+e.durationMinutes}class Ia{store;now;queue;constructor(e,t,r=()=>new Date){this.store=e;this.now=r;this.queue=t??new c(e.control)}enqueueCampaign(e,t={}){let r=this.store.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a=r.windowId?this.store.window(r.windowId):void 0;if(a&&!a.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(a&&!t.overrideWindow&&!gh(a,this.now()))throw Error("Upgrade is outside its maintenance window.");if(a?.requireApproval&&!t.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let l=this.queue.enqueue({projectId:r.projectId,actorId:t.approvedBy,kind:"maintenance.upgrade",input:{campaignId:e},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(e,{status:"queued"}),operation:l}}async previewCleanup(e,t){let r=t.find((a)=>a.kind===e.kind);if(!r)throw Error(`No ${e.kind} cleanup driver is configured.`);return this.store.createCleanup({...e,candidates:await r.discover(e.criteria)})}enqueueCleanup(e,t){let r=this.store.cleanup(e);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let a=`DELETE ${r.candidates.length} ${r.kind}`;if(t!==a)throw Error(`Exact confirmation ${a} is required.`);let l=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:e},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(e,{status:"approved",confirmation:t}),operation:l}}enqueueDrill(e){let t=this.store.drill(e);if(!t||t.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.drill",input:{drillId:e},lockKey:`drill:${t.scenario}:${t.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(e,{status:"queued",operationId:r.id}),operation:r}}}var $g=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function Yl(e){return{"maintenance.upgrade":async(l)=>{let m=e.store.campaign(String($g(l.operation.input).campaignId??""));if(!m||!e.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let h=e.store.manifest(m.manifestId);if(!h?.compatibility.compatible||h.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let S=h.document.artifacts.find((y)=>y.platform===process.platform&&y.architecture===process.arch)??h.document.artifacts[0];if(!S)throw Error("No update artifact matches this platform.");e.store.updateCampaign(m.id,{status:"running",currentStage:"preflight"});let R=[];try{for(let y of[...new Set(e.store.targets(m.id).map((C)=>C.cohort))].sort((C,T)=>C-T)){e.store.updateCampaign(m.id,{currentStage:`cohort:${y}`});for(let C of e.store.targets(m.id).filter((T)=>T.cohort===y)){l.throwIfCancellationRequested(),l.checkpoint(`download:${C.target}`,"Downloading signed platform artifact."),e.store.updateTarget(C.id,{status:"downloading",startedAt:new Date().toISOString()});let T=await e.platform.download({target:C,artifact:S,signal:l.signal});if(T.sha256!==S.sha256)throw Error(`Artifact checksum mismatch for ${C.target}.`);l.checkpoint(`install:${C.target}`,"Installing verified artifact."),e.store.updateTarget(C.id,{status:"installing"}),await e.platform.install({target:C,path:T.path,version:h.version,signal:l.signal}),R.push(C);let j=await e.platform.health({target:C,gate:m.healthGate});if(!j.healthy)throw Error(`Upgrade health gate failed for ${C.target}.`);e.store.updateTarget(C.id,{status:"healthy",evidence:j.evidence,finishedAt:new Date().toISOString()})}}return e.store.updateCampaign(m.id,{status:"succeeded",currentStage:void 0}),{campaignId:m.id,version:h.version,targets:R.length}}catch(y){e.store.updateCampaign(m.id,{status:"rolling_back",currentStage:"rollback"});for(let C of R.reverse())e.store.updateTarget(C.id,{status:"rolling_back"}),await e.platform.rollback({target:C,version:C.previousVersion,signal:l.signal}),e.store.updateTarget(C.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw e.store.updateCampaign(m.id,{status:"rolled_back",currentStage:void 0}),y}},"maintenance.cleanup":async(l)=>{let m=e.store.cleanup(String($g(l.operation.input).planId??""));if(!m||m.status!=="approved")throw Error("Approved cleanup plan was not found.");if(Xi([...m.candidates].sort((C,T)=>C.id.localeCompare(T.id)))!==m.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let h=e.cleanup?.find((C)=>C.kind===m.kind);if(!h)throw Error(`No ${m.kind} cleanup driver is configured.`);e.store.updateCleanup(m.id,{status:"running"});let S=[],R=[];for(let C of m.candidates){l.throwIfCancellationRequested();try{await h.remove(C),S.push(C.id)}catch(T){R.push({id:C.id,error:T instanceof Error?T.message:String(T)})}}let y=R.length?S.length?"partial":"failed":"succeeded";if(e.store.updateCleanup(m.id,{status:y,result:{removed:S,failed:R,reclaimedBytes:m.candidates.filter((C)=>S.includes(C.id)).reduce((C,T)=>C+T.bytes,0)}}),R.length)throw Error(`Cleanup failed for ${R.length} candidate(s).`);return{planId:m.id,removed:S.length,reclaimedBytes:m.estimatedBytes}},"maintenance.drill":async(l)=>{let m=e.store.drill(String($g(l.operation.input).drillId??""));if(!m)throw Error("DR drill was not found.");let h=e.recovery?.find((T)=>T.scenario===m.scenario);if(!h)throw Error(`No ${m.scenario} recovery driver is configured.`);let S=new Date;e.store.updateDrill(m.id,{status:"restoring",startedAt:S.toISOString()});let R=m.isolatedTarget,y={},C={};try{l.checkpoint("restore","Restoring into isolated drill target.");let T=await h.restore({drill:m,signal:l.signal});if(!T.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");R=T.target,y=T.evidence;let j=(S.getTime()-new Date(T.recoveryPointAt).getTime())/60000;e.store.updateDrill(m.id,{status:"verifying",measuredRpoMinutes:j,evidence:{restore:y}}),l.checkpoint("verify","Running recovery health checks without production traffic.");let B=await h.verify({drill:m,target:R});C=B.evidence;let V=(Date.now()-S.getTime())/60000;if(!B.healthy||j>m.expectedRpoMinutes||V>m.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");e.store.updateDrill(m.id,{measuredRpoMinutes:j,measuredRtoMinutes:V,evidence:{restore:y,verify:C}})}catch(T){throw e.store.updateDrill(m.id,{status:"failed",error:T instanceof Error?T.message:String(T),evidence:{restore:y,verify:C}}),T}finally{e.store.updateDrill(m.id,{status:"cleaning"});try{await h.cleanup({drill:m,target:R});let T=e.store.drill(m.id);e.store.updateDrill(m.id,{status:T.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(T){e.store.updateDrill(m.id,{status:"cleanup_required",cleanupVerified:!1,error:T instanceof Error?T.message:String(T),finishedAt:new Date().toISOString()})}}return{drillId:m.id,status:e.store.drill(m.id).status}}}}class mh{transport;constructor(e){this.transport=e}download(e){return this.transport.download({target:e.target.target,url:e.artifact.url,signal:e.signal})}install(e){return this.transport.install({target:e.target.target,path:e.path,version:e.version,signal:e.signal})}health(e){return this.transport.health({target:e.target.target,gate:e.gate})}rollback(e){return this.transport.rollback({target:e.target.target,version:e.version,signal:e.signal})}}var eb={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class Sa{kind;control;projectId;organizationId;constructor(e,t,r,a){this.kind=e;this.control=t;this.projectId=r;this.organizationId=a}async discover(e){let t=Math.max(1,Math.min(3650,Number(e.olderThanDays??30))),r=new Date(Date.now()-t*86400000).toISOString(),a=eb[this.kind],l=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(a.select).all(l,r).map((h)=>({id:String(h.id),kind:this.kind,label:`${this.kind}:${String(h.id)}`,bytes:Number(h.bytes??0),metadata:{createdAt:String(h.created_at)}}))}async remove(e){if(this.control.database.run(eb[this.kind].remove,[e.id]).changes!==1)throw Error(`${e.label} changed or is no longer removable.`)}}class hh{scenario;transport;constructor(e,t){this.scenario=e;this.transport=t}restore(e){return this.transport.restore({scenario:this.scenario,...e})}verify(e){return this.transport.verify({scenario:this.scenario,...e})}cleanup(e){return this.transport.cleanup({scenario:this.scenario,...e})}}var Jn=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Cn=(e)=>e==null?void 0:String(e),jl=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),tr=(e={})=>({...jl(),...e});function tb(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),purpose:String(e.purpose),backend:String(e.backend),region:Cn(e.region),architecture:Cn(e.architecture),labels:Jn(e.labels,{}),requiredServerLabels:Jn(e.required_server_labels,{}),toleratedTaints:Jn(e.tolerated_taints,[]),capacity:tr(Jn(e.capacity,{})),reserved:Jn(e.reserved,{}),maxWorkloads:Number(e.max_workloads),costWeight:Number(e.cost_weight),spreadKey:Cn(e.spread_key),concurrency:Number(e.concurrency),ephemeralWorkspaces:Number(e.ephemeral_workspaces)===1,allowProductionSecrets:Number(e.allow_production_secrets)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function rb(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Cn(e.environment_id),resourceId:String(e.resource_id),releaseId:Cn(e.release_id),poolId:String(e.pool_id),serverId:Cn(e.server_id),purpose:String(e.purpose),requirements:Jn(e.requirements,{}),decision:Jn(e.decision,{}),stateful:Number(e.stateful)===1,autoReschedule:Number(e.auto_reschedule)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function UA(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:Cn(e.resource_id),poolId:String(e.pool_id),placementId:Cn(e.placement_id),operationId:Cn(e.operation_id),sourceSha:String(e.source_sha),buildSpec:Jn(e.build_spec,{}),credentialPolicy:Jn(e.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:Cn(e.workspace),cacheKey:Cn(e.cache_key),artifactUri:Cn(e.artifact_uri),artifactDigest:Cn(e.artifact_digest),status:String(e.status),cleanupAt:Cn(e.cleanup_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class ga{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}createPool(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.purpose,e.backend,e.region??null,e.architecture??null,JSON.stringify(e.labels),JSON.stringify(e.requiredServerLabels),JSON.stringify(e.toleratedTaints),JSON.stringify(tr(e.capacity)),"{}",e.maxWorkloads,e.costWeight,e.spreadKey??null,e.concurrency,e.ephemeralWorkspaces?1:0,e.allowProductionSecrets?1:0,e.status,r,r]),this.getPool(t)}getPool(e){let t=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(e);return t?tb(t):void 0}listPools(e){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(e).map(tb)}updatePool(e,t){let r=this.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.reserved),JSON.stringify(a.capacity),a.concurrency,l,e]),this.getPool(e)}addMember(e,t,r={}){let a=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[e,t,JSON.stringify(r),a,a])}members(e){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(e).map((t)=>({serverId:String(t.server_id),status:String(t.status),capacityOverride:Jn(t.capacity_override,{})}))}memberStatus(e,t,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),e,t])}listPlacements(e,t){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(e).map(rb);return t?.length?r.filter((a)=>t.includes(a.status)):r}getPlacement(e){let t=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(e);return t?rb(t):void 0}activeUsage(e,t){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(e,this.now().toISOString()),a=t?r.filter((l)=>String(l.server_id)===t):r;return{resources:a.reduce((l,m)=>{let h=tr(Jn(m.resources,{}));for(let S of Object.keys(l))l[S]+=h[S];return l},jl()),count:a.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(e){return this.control.transaction(()=>{this.expireLeases();let t=this.id(),r=this.id(),a=this.now().toISOString(),l=new Date(this.now().getTime()+(e.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[t,e.projectId,e.environmentId??null,e.resourceId,e.releaseId??null,e.decision.poolId,e.decision.serverId??null,e.requirements.purpose,JSON.stringify(e.requirements),JSON.stringify(e.decision),e.requirements.stateful?1:0,e.requirements.autoReschedule&&!e.requirements.stateful?1:0,a,a]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,t,e.decision.poolId,e.decision.serverId??null,JSON.stringify(tr(e.requirements.resources)),l,a,a]),this.getPlacement(t)})}transitionPlacement(e,t){if(!this.getPlacement(e))throw Error("Placement was not found.");let a=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[t,a,e]),["released","failed","blocked"].includes(t))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[a,e]);return this.getPlacement(e)}createBuild(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[t,e.projectId,e.resourceId??null,e.poolId,e.placementId??null,e.operationId??null,e.sourceSha,JSON.stringify(e.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:e.tokenExpiresAt}),r,r]),this.getBuild(t)}getBuild(e){let t=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(e);return t?UA(t):void 0}updateBuild(e,t){let r=this.getBuild(e);if(!r)throw Error("Remote build was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[a.operationId??null,a.workspace??null,a.cacheKey??null,a.artifactUri??null,a.artifactDigest??null,a.status,a.cleanupAt??null,l,e]),this.getBuild(e)}}var Zd=["cpu","memoryBytes","diskBytes","gpu"],nb=(e,t={})=>Object.entries(t).every(([r,a])=>e[r]===a),qA=(e,t,r)=>Object.fromEntries(Zd.map((a)=>[a,Math.max(0,e[a]-t[a]-(r[a]??0))])),VA=(e,t)=>Zd.every((r)=>e[r]>=(t[r]??0)),WA=(e,t)=>Zd.reduce((r,a)=>r+(t[a]??0)/(e[a]||1),0);class ma{store;fleet;constructor(e,t){this.store=e;this.fleet=t}poolCandidates(e,t,r){let a=[];for(let l of this.store.listPools(e)){if(l.id===r)continue;let m=[];if(l.status!=="active")m.push(`pool is ${l.status}`);if(l.purpose!==t.purpose)m.push(`purpose is ${l.purpose}`);if(t.region&&l.region!==t.region)m.push(`region is ${l.region??"unset"}`);if(t.architecture&&l.architecture!==t.architecture)m.push(`architecture is ${l.architecture??"unset"}`);if(!nb(l.labels,t.labels))m.push("pool labels do not match");if(l.backend==="server"){let h=this.store.members(l.id);if(!h.length)a.push(this.decision(l,void 0,t,[...m,"pool has no servers"]));for(let S of h){let R=this.fleet.get(S.serverId),y=[...m];if(!R)y.push("server is missing");else this.serverReasons(l,R,S.status,t,y);a.push(this.decision(l,R,t,y,S.capacityOverride))}}else a.push(this.decision(l,void 0,t,m))}return a.sort((l,m)=>Number(m.eligible)-Number(l.eligible)||l.score.cost-m.score.cost||l.score.spread-m.score.spread||l.score.fit-m.score.fit||l.poolName.localeCompare(m.poolName)||(l.serverId??"").localeCompare(m.serverId??""))}serverReasons(e,t,r,a,l){if(r!=="active")l.push(`member is ${r}`);if(t.status!=="ready")l.push(`server is ${t.status}`);if(!t.roles.includes(a.purpose==="build"?"build":a.purpose))l.push(`server lacks ${a.purpose} role`);if(!nb(t.labels,e.requiredServerLabels))l.push("server labels do not match pool selector");for(let m of t.taints)if(!e.toleratedTaints.includes(m))l.push(`taint ${m} is not tolerated`)}decision(e,t,r,a,l={}){let m=tr({...t?.capacity,...l}),h=t?Object.fromEntries(Zd.map((y)=>[y,Math.min(e.capacity[y],m[y])])):e.capacity,S=this.store.activeUsage(e.id,t?.id),R=qA(h,S.resources,e.reserved);if(S.count>=e.maxWorkloads)a.push("workload limit reached");if(r.purpose==="build"&&S.count>=e.concurrency)a.push("build concurrency reached");if(!VA(R,r.resources))a.push("insufficient capacity");return{poolId:e.id,poolName:e.name,serverId:t?.id,eligible:a.length===0,reasons:a,available:R,score:{fit:WA(R,r.resources),spread:S.count,cost:e.costWeight}}}explain(e,t){return this.poolCandidates(e,t)}place(e){return this.store.control.transaction(()=>{let t=this.poolCandidates(e.projectId,e.requirements).find((r)=>r.eligible);if(!t)throw Error(`No eligible capacity: ${this.explain(e.projectId,e.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...e,decision:t})})}activate(e){return this.store.transitionPlacement(e,"active")}release(e){return this.store.transitionPlacement(e,"released")}drainPool(e){let t=this.store.updatePool(e,{status:"draining"}),r=[],a=[];for(let l of this.store.listPlacements(t.projectId,["reserved","active"]).filter((m)=>m.poolId===e)){if(l.stateful){a.push(this.store.transitionPlacement(l.id,"blocked"));continue}this.store.transitionPlacement(l.id,"moving");let m=this.place({projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,releaseId:l.releaseId,requirements:l.requirements});r.push(this.activate(m.id)),this.store.transitionPlacement(l.id,"released")}return{pool:t,moved:r,blocked:a}}drainServer(e,t){this.store.memberStatus(e,t,"draining");let r=this.store.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a=[],l=[];for(let m of this.store.listPlacements(r.projectId,["reserved","active"]).filter((h)=>h.poolId===e&&h.serverId===t)){if(m.stateful){l.push(this.store.transitionPlacement(m.id,"blocked"));continue}this.store.transitionPlacement(m.id,"moving");let h=this.poolCandidates(m.projectId,m.requirements).find((R)=>R.eligible);if(!h){l.push(this.store.transitionPlacement(m.id,"blocked"));continue}let S=this.store.reserve({projectId:m.projectId,environmentId:m.environmentId,resourceId:m.resourceId,releaseId:m.releaseId,requirements:m.requirements,decision:h});a.push(this.activate(S.id)),this.store.transitionPlacement(m.id,"released")}return{moved:a,blocked:l}}reconcileFailure(e){let t=this.fleet.get(e);if(!t)throw Error("Server was not found.");let r=[],a=[];for(let l of this.store.listPlacements(t.projectId,["active"]).filter((m)=>m.serverId===e)){if(l.stateful||!l.autoReschedule){a.push(this.store.transitionPlacement(l.id,"blocked"));continue}this.store.transitionPlacement(l.id,"failed");let m=this.place({projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,releaseId:l.releaseId,requirements:l.requirements});r.push(this.activate(m.id))}return{rescheduled:r,blocked:a}}}class uh{store;placement;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.placement=t;this.now=a;this.queue=r??new c(e.control)}enqueue(e){if(!/^[a-f0-9]{7,64}$/i.test(e.sourceSha))throw Error("A pinned source commit SHA is required.");let t={purpose:"build",resources:{cpu:1,memoryBytes:1073741824,diskBytes:5368709120},leaseSeconds:3600,...e.requirements},r=this.placement.place({projectId:e.projectId,resourceId:e.resourceId,requirements:t}),a=new Date(this.now().getTime()+900000).toISOString(),l=this.store.createBuild({projectId:e.projectId,resourceId:e.resourceId,poolId:r.poolId,placementId:r.id,sourceSha:e.sourceSha,buildSpec:e.buildSpec,tokenExpiresAt:a}),m=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"build.remote",input:{buildId:l.id},lockKey:`build:${l.id}`,providerKey:`pool:${r.poolId}`,buildSlot:!0,timeoutSeconds:3600,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return l=this.store.updateBuild(l.id,{operationId:m.id}),l}cancel(e){let t=this.store.getBuild(e);if(!t)throw Error("Remote build was not found.");if(t.operationId)this.queue.requestCancellation(t.operationId);return this.store.updateBuild(e,{status:"cancelled"})}}var HA=/^sha256:[a-f0-9]{64}$/,KA=/^(?:s3|https|oci):\/\//;function Cy(e,t){return{"build.remote":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.getBuild(String(a.buildId??""));if(!l)throw Error("Queued remote build was not found.");let m=e.getPool(l.poolId);if(!m||m.purpose!=="build"||m.status!=="active")throw Error("The selected build pool is unavailable.");if(!m.ephemeralWorkspaces)throw Error("Remote builds require an ephemeral workspace pool.");if(l.credentialPolicy.productionSecrets||m.allowProductionSecrets)throw Error("Production secrets are forbidden in remote build workers.");if(new Date(l.credentialPolicy.shortLivedTokenExpiresAt)<=new Date)throw Error("The short-lived build credential has expired.");let h=t.find((R)=>R.backend===m.backend);if(!h)throw Error(`No ${m.backend} remote build driver is configured.`);let S=`build://${m.id}/${l.id}`;e.updateBuild(l.id,{status:"running",workspace:S}),r.checkpoint("checkout",`Preparing isolated workspace for ${l.sourceSha}.`);try{r.throwIfCancellationRequested(),r.checkpoint("build","Executing resource-limited build.");let R=await h.run({build:e.getBuild(l.id),pool:m,signal:r.signal,log:(y)=>r.log(y,{stream:"stdout"})});if(r.throwIfCancellationRequested(),!HA.test(R.artifactDigest)||!KA.test(R.artifactUri))throw Error("Builder returned an unverified artifact reference.");return e.updateBuild(l.id,{status:"uploading",cacheKey:R.cacheKey,artifactUri:R.artifactUri,artifactDigest:R.artifactDigest}),r.checkpoint("verify","Verified content-addressed artifact upload."),await h.cleanup({build:e.getBuild(l.id),pool:m}),e.updateBuild(l.id,{status:"succeeded",workspace:void 0,cleanupAt:new Date().toISOString()}),{buildId:l.id,artifactUri:R.artifactUri,artifactDigest:R.artifactDigest,cacheKey:R.cacheKey??null}}catch(R){try{await h.cleanup({build:e.getBuild(l.id),pool:m}),e.updateBuild(l.id,{status:r.cancellationRequested()?"cancelled":"failed",workspace:void 0,cleanupAt:new Date().toISOString()})}catch{e.updateBuild(l.id,{status:"cleanup_required"})}throw R}}}}class Ji{backend;transport;handles=new Map;constructor(e,t){this.backend=e;this.transport=t}async run({build:e,pool:t,signal:r,log:a}){let l=await this.transport.provision({backend:this.backend,pool:t,build:e,tokenExpiresAt:e.credentialPolicy.shortLivedTokenExpiresAt});return this.handles.set(e.id,l.handle),a(`${this.backend} builder provisioned`),await this.transport.execute({handle:l.handle,spec:e.buildSpec,sourceSha:e.sourceSha,signal:r,onLog:a}),this.transport.publish({handle:l.handle,sourceSha:e.sourceSha})}async cleanup({build:e}){let t=this.handles.get(e.id);if(!t)return;await this.transport.destroy({handle:t}),this.handles.delete(e.id)}}var Ey=(e)=>new Ji("server",e),by=(e)=>new Ji("ecs",e),vy=(e)=>new Ji("asg",e);var ki=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Mn=(e)=>e==null?void 0:String(e),ib=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Mn(e.environment_id),name:String(e.name),hostname:String(e.hostname),homeRegion:String(e.home_region),regions:ki(e.regions,[]),trafficPolicy:String(e.traffic_policy),dataPolicy:ki(e.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(e.status),activeRegion:String(e.active_region),revision:Mn(e.revision),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Ng=(e)=>({id:String(e.id),topologyId:String(e.topology_id),region:String(e.region),role:String(e.role),provider:String(e.provider),stackId:Mn(e.stack_id),stackRevision:Mn(e.stack_revision),status:String(e.status),health:ki(e.health,{}),lastHealthyAt:Mn(e.last_healthy_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),jg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),kind:String(e.kind),sourceRegion:String(e.source_region),targetRegion:String(e.target_region),config:ki(e.config,{}),status:String(e.status),checkpoint:Mn(e.checkpoint),lagSeconds:e.lag_seconds==null?void 0:Number(e.lag_seconds),lastVerifiedAt:Mn(e.last_verified_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Bg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),hostname:String(e.hostname),dnsProvider:String(e.dns_provider),cdnEnabled:Number(e.cdn_enabled)===1,wafEnabled:Number(e.waf_enabled)===1,weights:ki(e.weights,{}),desiredWeights:ki(e.desired_weights,{}),status:String(e.status),providerState:ki(e.provider_state,{}),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),ob=(e)=>({id:String(e.id),topologyId:String(e.topology_id),operationId:Mn(e.operation_id),kind:String(e.kind),requestedRegion:Mn(e.requested_region),revision:Mn(e.revision),plan:ki(e.plan,[]),currentStep:Mn(e.current_step),completedSteps:ki(e.completed_steps,[]),status:String(e.status),error:Mn(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class ha{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}create(e){return this.control.transaction(()=>{if(e.regions.length<2||new Set(e.regions.map((m)=>m.region)).size!==e.regions.length||e.regions.filter((m)=>m.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let t=e.regions.find((m)=>m.role==="primary"),r=this.id(),a=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.name,e.hostname,t.region,JSON.stringify(e.regions),e.trafficPolicy,JSON.stringify(e.dataPolicy),t.region,a,a]);for(let m of e.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,m.region,m.role,m.provider,a,a]);for(let m of e.dataPolicy.replicate)for(let h of e.regions)for(let S of e.regions.filter((R)=>R.region!==h.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,m,h.region,S.region,"{}",a,a]);let l=Object.fromEntries(e.regions.map((m)=>[m.region,m.region===t.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,e.hostname,e.dnsProvider??"route53",e.cdnEnabled?1:0,e.wafEnabled?1:0,JSON.stringify(l),JSON.stringify(l),a,a]),this.get(r)})}get(e){let t=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(e);return t?ib(t):void 0}list(e){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(e).map(ib)}targets(e){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(e).map(Ng)}channels(e){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(e).map(jg)}route(e){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(e);return t?Bg(t):void 0}updateTopology(e,t){let r=this.get(e);if(!r)throw Error("Regional topology was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[a.status,a.activeRegion,a.revision??null,JSON.stringify(a.regions),l,e]),this.get(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e);if(!r)throw Error("Regional target was not found.");let a=Ng(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[l.role,l.stackId??null,l.stackRevision??null,l.status,JSON.stringify(l.health),l.lastHealthyAt??null,m,e]),Ng(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e))}updateChannel(e,t){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e);if(!r)throw Error("Replication channel was not found.");let a=jg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[l.status,l.checkpoint??null,l.lagSeconds??null,l.lastVerifiedAt??null,m,e]),jg(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e))}updateRoute(e,t){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e);if(!r)throw Error("Traffic route was not found.");let a=Bg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(l.weights),JSON.stringify(l.desiredWeights),l.status,JSON.stringify(l.providerState),m,e]),Bg(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e))}createExecution(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[t,e.topologyId,e.operationId??null,e.kind,e.requestedRegion??null,e.revision??null,JSON.stringify(e.plan),r,r]),this.execution(t)}execution(e){let t=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(e);return t?ob(t):void 0}executions(e){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(e).map(ob)}updateExecution(e,t){let r=this.execution(e);if(!r)throw Error("Regional execution was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[a.operationId??null,a.currentStep??null,JSON.stringify(a.completedSteps),a.status,a.error??null,l,e]),this.execution(e)}}class fa{store;queue;constructor(e,t){this.store=e;this.queue=t??new c(e.control)}create(e){return this.store.create(e)}plan(e,t,r){if(!this.store.get(e))throw Error("Regional topology was not found.");let l=this.store.targets(e),m=this.store.channels(e);if(t==="rollout")return[...l.filter((h)=>h.role==="secondary").map((h)=>`apply:${h.region}`),...l.filter((h)=>h.role==="primary").map((h)=>`apply:${h.region}`),...m.map((h)=>`replicate:${h.kind}:${h.targetRegion}`),"traffic:activate"];if(t==="failover"||t==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(t==="destroy")return["traffic:drain",...l.filter((h)=>h.role==="secondary").map((h)=>`delete:${h.region}`),...l.filter((h)=>h.role==="primary").map((h)=>`delete:${h.region}`),"complete"];return["observe","repair"]}enqueue(e){let t=this.store.get(e.topologyId);if(!t)throw Error("Regional topology was not found.");if(["failover","failback"].includes(e.kind)&&(!e.targetRegion||!t.regions.some((m)=>m.region===e.targetRegion)))throw Error("A topology target region is required.");if(e.kind==="failover"&&e.targetRegion===t.activeRegion)throw Error("Target region is already active.");if((e.kind==="destroy"||e.deleteData)&&e.confirmation!==t.name)throw Error("Exact topology name confirmation is required.");if(e.deleteData&&t.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(e.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(e.revision??""))throw Error("An immutable revision is required.");let r=this.plan(t.id,e.kind,e.targetRegion),a=this.store.createExecution({topologyId:t.id,kind:e.kind,requestedRegion:e.targetRegion,revision:e.revision,plan:r}),l=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,kind:`region.${e.kind}`,input:{executionId:a.id,manifest:e.manifest??{},deleteData:e.deleteData===!0},lockKey:`regional-topology:${t.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(a.id,{operationId:l.id}),{execution:this.store.execution(a.id),operation:l}}}var JA=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function zl(e,t){let r=(y)=>{let C=t.find((T)=>T.provider===y.provider);if(!C)throw Error(`No ${y.provider} regional driver is configured.`);return C},a=(y,C,T)=>{y.throwIfCancellationRequested(),y.checkpoint(T,T),e.updateExecution(C.id,{status:"running",currentStep:T,completedSteps:[...e.execution(C.id).completedSteps,T]})},l=async(y,C)=>{let T=e.route(y.id);if(!T)throw Error("Regional traffic route was not found.");let j=e.targets(y.id).find((V)=>V.region===y.activeRegion)??e.targets(y.id)[0];if(!j)throw Error("Regional traffic target was not found.");e.updateRoute(T.id,{status:"applying",desiredWeights:C});let B=await r(j).applyTraffic({route:e.route(y.id),topology:y,weights:C});e.updateRoute(T.id,{status:Object.values(C).every((V)=>V===0)?"drained":"in_sync",weights:C,providerState:B.providerState})},m=async(y,C,T,j)=>{e.updateTopology(T.id,{status:"provisioning"});let B=C.revision,V=j.manifest??{},W=e.targets(T.id).sort((te,le)=>Number(te.role==="primary")-Number(le.role==="primary"));for(let te of W){a(y,C,`apply:${te.region}`),e.updateTarget(te.id,{status:"provisioning"});let le=await r(te).applyStack({target:te,revision:B,manifest:V,signal:y.signal}),X=await r(te).health({target:e.updateTarget(te.id,{stackId:le.stackId,stackRevision:B})});if(!X.healthy)throw Error(`Regional health gate failed in ${te.region}.`);e.updateTarget(te.id,{status:"ready",health:X.evidence,lastHealthyAt:new Date().toISOString()})}for(let te of e.channels(T.id)){a(y,C,`replicate:${te.kind}:${te.targetRegion}`),e.updateChannel(te.id,{status:"configuring"});let le=W.find((Ee)=>Ee.region===te.sourceRegion),X=await r(le).configureReplication({channel:te,topology:T}),ce=await r(le).verifyReplication({channel:e.updateChannel(te.id,{checkpoint:X.checkpoint,lagSeconds:X.lagSeconds}),topology:T});if(!ce.healthy||ce.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${te.kind} replication to ${te.targetRegion} exceeds the RPO.`);e.updateChannel(te.id,{status:"in_sync",checkpoint:ce.checkpoint,lagSeconds:ce.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(y,C,"traffic:activate");let Y=Object.fromEntries(T.regions.map((te)=>[te.region,te.region===T.activeRegion?100:0]));return await l(T,Y),e.updateTopology(T.id,{status:"ready",revision:B}),{revision:B,activeRegion:T.activeRegion}},h=async(y,C,T)=>{let j=C.requestedRegion,B=e.targets(T.id).find((Y)=>Y.region===j);if(!B)throw Error("Requested regional target was not found.");e.updateTopology(T.id,{status:C.kind==="failover"?"failing_over":"failing_back"}),a(y,C,`health:${j}`);let V=await r(B).health({target:B});if(!V.healthy)throw Error(`Target region ${j} is unhealthy.`);e.updateTarget(B.id,{status:"ready",health:V.evidence,lastHealthyAt:new Date().toISOString()}),a(y,C,`replication:${j}`);for(let Y of e.channels(T.id).filter((te)=>te.targetRegion===j)){let te=await r(B).verifyReplication({channel:Y,topology:T});if(!te.healthy||te.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${Y.kind} replication is outside the failover RPO.`);e.updateChannel(Y.id,{status:"in_sync",checkpoint:te.checkpoint,lagSeconds:te.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(y,C,`traffic:${j}`),await l(T,Object.fromEntries(T.regions.map((Y)=>[Y.region,Y.region===j?100:0]))),a(y,C,`roles:${j}`);let W=T.regions.map((Y)=>({...Y,role:Y.region===j?"primary":"secondary"}));for(let Y of e.targets(T.id))e.updateTarget(Y.id,{role:Y.region===j?"primary":"secondary"});return e.updateTopology(T.id,{status:C.kind==="failover"?"failed_over":"ready",activeRegion:j,regions:W}),{activeRegion:j}},S=async(y,C,T,j)=>{e.updateTopology(T.id,{status:"destroying"}),a(y,C,"traffic:drain"),await l(T,Object.fromEntries(T.regions.map((V)=>[V.region,0])));let B=j.deleteData!==!0;for(let V of e.targets(T.id).sort((W,Y)=>Number(W.role==="primary")-Number(Y.role==="primary")))a(y,C,`delete:${V.region}`),e.updateTarget(V.id,{status:"deleting"}),await r(V).deleteStack({target:V,retainData:B,signal:y.signal}),e.updateTarget(V.id,{status:"deleted"});return a(y,C,"complete"),e.updateTopology(T.id,{status:"destroyed"}),{destroyed:!0,dataRetained:B}},R=async(y)=>{let C=JA(y.operation.input),T=e.execution(String(C.executionId??""));if(!T)throw Error("Regional execution was not found.");let j=e.get(T.topologyId);if(!j)throw Error("Regional topology was not found.");try{let B;if(T.kind==="rollout")B=await m(y,T,j,C);else if(T.kind==="failover"||T.kind==="failback")B=await h(y,T,j);else if(T.kind==="destroy")B=await S(y,T,j,C);else throw Error("Regional reconciliation is not configured.");return e.updateExecution(T.id,{status:"succeeded",currentStep:void 0}),{executionId:T.id,...B}}catch(B){if(e.updateExecution(T.id,{status:y.cancellationRequested()?"cancelled":"failed",error:B instanceof Error?B.message:String(B)}),e.get(j.id)?.status!=="destroyed")e.updateTopology(j.id,{status:"failed"});throw B}};return{"region.rollout":R,"region.failover":R,"region.failback":R,"region.destroy":R,"region.reconcile":R}}class ph{transport;provider="aws";constructor(e){this.transport=e}async applyStack({target:e,revision:t,manifest:r}){return this.transport.applyCloudFormation({region:e.region,stackId:e.stackId,revision:t,manifest:r})}async deleteStack({target:e,retainData:t}){if(!e.stackId)return;await this.transport.deleteCloudFormation({region:e.region,stackId:e.stackId,retainData:t})}async health({target:e}){if(!e.stackId)return{healthy:!1,evidence:{reason:"stack is not provisioned"}};return this.transport.stackHealth({region:e.region,stackId:e.stackId})}async configureReplication({channel:e}){let t={sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,config:e.config};if(e.kind==="s3")return this.transport.configureS3Replication(t);if(e.kind==="dynamodb")return this.transport.configureDynamoGlobalTable(t);return this.transport.replicateSecrets(t)}async verifyReplication({channel:e}){return this.transport.verifyReplication({kind:e.kind,sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,checkpoint:e.checkpoint})}async applyTraffic({route:e,weights:t}){return this.transport.applyEdge({hostname:e.hostname,weights:t,route53:e.dnsProvider==="route53",cloudFront:e.cdnEnabled,waf:e.wafEnabled})}}class Aa{provider;reason;constructor(e,t="Configure a regional provider transport before executing this operation."){this.provider=e;this.reason=t}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function he(e,t,r){return[e,t,r].map((a)=>encodeURIComponent(a)).join(":")}function eh(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function Ct(e,t,r=["exec","files"]){let a=eh(t);for(let l of e)a[l]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(l),requiresRecentAuth:r.includes(l)};return a}var GA=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function ke(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function Be(e){if(Array.isArray(e))return e.map((r)=>Be(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,a]of Object.entries(e))t[r]=GA.test(r)?"[REDACTED]":Be(a);return t}function Et(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function Bl(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function QA(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function _l(e,t={},r={}){let a=t.now??new Date,l=Math.max(100,r.timeoutMs??1e4),m=Math.max(1,r.staleAfterSeconds??60),h=await Promise.all(e.map(async(R)=>{try{let y=await Promise.race([R.discover({...t,now:a}),new Promise((C,T)=>setTimeout(()=>T(Error(`Runtime source ${R.id} timed out after ${l}ms`)),l))]);return{workloads:y,source:{id:R.id,provider:R.provider,status:"fresh",discoveredAt:a.toISOString(),staleAfterSeconds:m,itemCount:y.length}}}catch(y){return{workloads:[],source:{id:R.id,provider:R.provider,status:QA(y),discoveredAt:a.toISOString(),staleAfterSeconds:m,itemCount:0,message:String(y?.message??y).slice(0,500)}}}})),S=h.map((R)=>R.source);return{generatedAt:a.toISOString(),workloads:h.flatMap((R)=>R.workloads).sort((R,y)=>R.name.localeCompare(y.name)||R.id.localeCompare(y.id)),sources:S,degraded:S.some((R)=>R.status!=="fresh")}}function Zs(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function Ol(e,t,r,a="ecs:aws",l=[]){let m=r.now??new Date;return e.map((h)=>{let S=h.serviceName??Zs(h.serviceArn),R=t.filter((te)=>!h.clusterArn||te.clusterArn===h.clusterArn),y=R.some((te)=>!!te.group)?R.filter((te)=>te.group===`service:${S}`):R,C=h.status==="ACTIVE"?(h.runningCount??0)<(h.desiredCount??0)?"degraded":"running":ke(h.status),T=l.find((te)=>te.taskDefinitionArn===h.taskDefinition),j=Array.isArray(T?.containerDefinitions)?T.containerDefinitions:[],B=[...new Set(j.map((te)=>te.logConfiguration?.options?.["awslogs-group"]).filter((te)=>typeof te==="string"))],V=j.flatMap((te)=>(te.mountPoints??[]).map((le)=>({source:le.sourceVolume,target:le.containerPath,type:"volume",readOnly:!!le.readOnly}))),W=j.flatMap((te)=>(te.portMappings??[]).map((le,X)=>({id:`${te.name??"container"}:${X}`,name:te.name,mode:T?.networkMode,ports:[{container:le.containerPort,host:le.hostPort,protocol:le.protocol}]}))),Y=r.project&&r.environment&&S.startsWith(`${r.project}-${r.environment}-`)?S.slice(`${r.project}-${r.environment}-`.length):S;return{id:he("ecs",a,h.serviceArn??S),provider:"ecs",kind:"service",name:S,status:C,rawStatus:h.status,health:C==="running"?"healthy":C==="failed"||C==="degraded"?"unhealthy":"unknown",desiredReplicas:h.desiredCount,runningReplicas:h.runningCount,image:j[0]?.image,runtime:h.launchType??"ECS",version:Zs(h.taskDefinition),ageSeconds:Et(h.deployments?.[0]?.createdAt,m),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:Y,release:Zs(h.taskDefinition),providerId:h.serviceArn},replicas:y.map((te)=>{let le=ke(te.lastStatus);return{id:he("ecs",a,te.taskArn??Zs(te.taskArn)),name:Zs(te.taskArn),status:le,rawStatus:te.lastStatus,createdAt:te.createdAt,startedAt:te.startedAt,stoppedAt:te.stoppedAt,host:te.containerInstanceArn,containers:(te.containers??[]).map((X)=>({id:X.containerArn??X.name??"container",name:X.name??"container",image:j.find((ce)=>ce.name===X.name)?.image,imageDigest:X.imageDigest,status:ke(X.lastStatus),rawStatus:X.lastStatus,exitCode:X.exitCode,reason:X.reason,runtime:"ecs"}))}}),networks:W,mounts:V,capabilities:Ct(["start","stop","restart","redeploy","scale","inspect",...B.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:Be({clusterArn:h.clusterArn,taskDefinition:h.taskDefinition,launchType:h.launchType,pendingCount:h.pendingCount,deployments:h.deployments,logGroups:B,executionRoleArn:T?.executionRoleArn,taskRoleArn:T?.taskRoleArn,cpu:T?.cpu,memory:T?.memory}),discoveredAt:m.toISOString(),sourceId:a}})}function xl(e,t,r="lambda:aws"){let a=t.now??new Date;return e.map((l)=>{let m=l.FunctionName??Zs(l.FunctionArn),h=l.State==="Active"?"running":ke(l.State);return{id:he("lambda",r,l.FunctionArn??m),provider:"lambda",kind:"function",name:m,status:h,rawStatus:l.State,health:h==="running"?"healthy":h==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:l.Runtime,version:l.Version,architecture:l.Architectures?.join(", "),ageSeconds:Et(l.LastModified,a),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:m,providerId:l.FunctionArn},resources:{memoryLimitBytes:l.MemorySize==null?void 0:l.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:Ct(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:Be({handler:l.Handler,timeout:l.Timeout,codeSize:l.CodeSize,stateReason:l.StateReason,environmentKeys:Object.keys(l.Environment?.Variables??{})}),discoveredAt:a.toISOString(),sourceId:r}})}function th(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((a)=>a&&typeof a.Id==="string")}function YA(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,a])=>{let[l,m]=r.split("/");return(a??[]).map((h)=>({container:Number(l)||void 0,host:Number(h.HostPort)||void 0,protocol:m,address:h.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,a])=>({id:a.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[a.IPAddress,a.GlobalIPv6Address].filter(Boolean),ports:t}))}function ZA(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function rh(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((l)=>{let m=l.State?.OOMKilled?"oomkilled":l.State?.Restarting?"starting":l.State?.Status,h=ke(m),S=(l.Name??l.Id.slice(0,12)).replace(/^\//,""),R=l.Config?.Labels??{},y=ZA(l),C=YA(l),T={id:l.Id,name:S,image:l.Config?.Image,imageDigest:l.Image,runtime:"docker",status:h,rawStatus:m,exitCode:l.State?.ExitCode,reason:l.State?.Error,resources:{memoryLimitBytes:l.HostConfig?.Memory||void 0},networks:C,mounts:y};return{id:he("docker",r,l.Id),provider:"docker",kind:"container",name:S,status:h,rawStatus:m,health:h==="running"?"healthy":h==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:h==="running"?1:0,image:l.Config?.Image,runtime:"docker",ageSeconds:Et(l.State?.StartedAt,a),restartCount:l.RestartCount??0,tags:R,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:R["com.docker.compose.service"]??R["ts-cloud.service"]??S,release:R["ts-cloud.release"],providerId:l.Id},resources:T.resources,replicas:[{id:he("docker",r,`${l.Id}:0`),name:S,status:h,rawStatus:m,startedAt:l.State?.StartedAt,stoppedAt:l.State?.FinishedAt,restartCount:l.RestartCount,containers:[T],resources:T.resources}],networks:C,mounts:y,capabilities:Ct(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:Be({image:l.Config?.Image,labels:R,environmentKeys:(l.Config?.Env??[]).map((j)=>j.split("=",1)[0]),networkMode:l.HostConfig?.NetworkMode}),discoveredAt:a.toISOString(),sourceId:r}})}class Wo{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return rh(th(await this.inspect(e)),e,this.id)}}function nh(e){let t=[];for(let r of e.split(`
+`)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,a,l,m,h,S,R,y,C,T,j,B,V,W]=r.split("\t");if(!a||!/^[A-Za-z0-9_.@:-]+\.service$/.test(a))continue;t.push({unit:a,load:l,active:m,sub:h,description:S,enabled:R,pid:Number(y)||void 0,memoryBytes:Bl(C),restartCount:Number(T)||0,activeSince:j||void 0,fragmentPath:B||void 0,workingDirectory:V?.startsWith("/")?V:void 0,user:W||void 0})}return t}function ih(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((l)=>{let m=ke(l.active==="active"?l.sub||l.active:l.active),h=l.unit.replace(/\.service$/,""),S=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(l.description??"")?.[1]??(t.project&&h.startsWith(`${t.project}-`)?h.slice(t.project.length+1).split("@",1)[0]:void 0),R=h.includes("@")?h.slice(h.indexOf("@")+1):void 0,y=l.workingDirectory?[{target:l.workingDirectory,type:"working-directory"}]:[],C=["start","stop","restart","logs","exec","inspect",...y.length?["files"]:[]];return{id:he("systemd",r,l.unit),provider:"systemd",kind:"service",name:h,displayName:l.description||h,status:m,rawStatus:[l.load,l.active,l.sub].filter(Boolean).join("/"),health:m==="running"?"healthy":m==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:m==="running"?1:0,ageSeconds:Et(l.activeSince,a),restartCount:l.restartCount,tags:{enabled:l.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:S,release:R,providerId:l.unit},resources:{memoryBytes:l.memoryBytes},replicas:[{id:he("systemd",r,`${l.unit}:main`),name:"main",status:m,pid:l.pid,startedAt:l.activeSince,restartCount:l.restartCount,resources:{memoryBytes:l.memoryBytes}}],networks:[],mounts:y,capabilities:Ct(C,y.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:Be({fragmentPath:l.fragmentPath,workingDirectory:l.workingDirectory,user:l.user,environment:l.environment,enabled:l.enabled}),discoveredAt:a.toISOString(),sourceId:r}})}class Jo{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return ih(nh(await this.read(e)),e,this.id)}}function XA(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function eC(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function tC(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function sb(e,t,r,a,l){let m=`${e}:${r.id}`,h=async()=>XA(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?eC():tC(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:a.project.slug,Environment:l,Role:"app"}}),m);return e==="systemd"?new Jo(h,m):new Wo(h,m)}async function el(e,t=100){let r=[],a;for(let l=0;l<t;l++){let m=await e(a);if(r.push(...m.items),!m.nextToken)return r;a=m.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class Ll{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await el(async(m)=>{let h=await this.client.listClusters({nextToken:m,maxResults:100});return{items:h.clusterArns??[],nextToken:h.nextToken}}),r=[],a=[],l=[];for(let m of t){let h=(await el(async(S)=>{let R=await this.client.listServices(m,{nextToken:S,maxResults:100});return{items:R.serviceArns??[],nextToken:R.nextToken}})).filter((S)=>S.split("/").at(-1)?.startsWith(this.prefix));for(let S=0;S<h.length;S+=10){let R=await this.client.describeServices({cluster:m,services:h.slice(S,S+10)});r.push(...R.services??[])}for(let S of r.filter((R)=>R.clusterArn===m||!R.clusterArn)){let R=await el(async(y)=>{let C=await this.client.listTasks(m,S.serviceName,{nextToken:y,maxResults:100});return{items:C.taskArns??[],nextToken:C.nextToken}});for(let y=0;y<R.length;y+=100){let C=await this.client.describeTasks(m,R.slice(y,y+100));a.push(...C.tasks??[])}}}if(this.client.describeTaskDefinition)for(let m of[...new Set(r.map((h)=>h.taskDefinition).filter((h)=>!!h))]){let h=await this.client.describeTaskDefinition(m);if(h.taskDefinition)l.push(h.taskDefinition)}return Ol(r,a,e,this.id,l)}}class $l{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await el(async(r)=>{let a=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:a.Functions??[],nextToken:a.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return xl(t,e,this.id)}}async function sh(e,t,r={}){let a=[],l=M(e),m=ge(e),h=e.aws?.profile,S=e.aws?.region??e.project.region??"us-east-1",R=`${e.project.slug}-${t}`;if(l!=="serverless"){let y=r.driver??_({config:e}),C=await y.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let T of C)a.push(sb("systemd",y,T,e,t)),a.push(sb("docker",y,T,e,t))}if(m==="aws")a.push(new Ll(r.ecs??new rt(S,h),R)),a.push(new $l(r.lambda??new b(S,h),R));return a}async function ie(e,t,r={}){let a={project:e.project.slug,environment:t};try{return await _l(await sh(e,t,r),a)}catch(l){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:ge(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(l?.message??l).slice(0,500)}],degraded:!0}}}var ab=65536,fc=49152,rl=/^[A-Za-z0-9_.@:-]+\.service$/,nl=/^[a-fA-F0-9]{12,128}$/,rC=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function Xs(e){let t=Buffer.from(e);return t.byteLength<=ab?e:`${t.subarray(0,ab-24).toString("utf8")}
 [output truncated]`}function tl(e){return{success:!1,instanceCount:0,perInstance:[],error:e instanceof Error?e.message:String(e)}}function Ln(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function nC(e,t){return Number.isFinite(e)?Math.min(1e4,Math.max(0,Math.floor(e))):t}function iC(e){let t=e.config,r=typeof t.clusterArn==="string"?t.clusterArn:void 0,a=e.links.providerId||e.name;return r&&a?{cluster:r,service:a}:void 0}function oC(e,t){return e.find((r)=>r.id===t.links.server)??(e.length===1?e[0]:void 0)}function sC(e,t){if(e.provider==="systemd"){let r=e.links.providerId;if(!r||!rl.test(r)||!["start","stop","restart"].includes(t))return;return[`systemctl ${t} ${r}`,`systemctl is-active ${r} 2>/dev/null || true`]}if(e.provider==="docker"){let r=e.links.providerId;if(!r||!nl.test(r)||!["start","stop","restart"].includes(t))return;return[`docker ${t} ${r}`,`docker inspect --format '{{.State.Status}}' ${r}`]}return}function oh(e,t){if(!t.startsWith("/")||t.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let r=[];for(let S of t.split("/")){if(!S||S===".")continue;if(S===".."){if(!r.length)return{ok:!1,error:"Path traversal is not allowed."};r.pop()}else r.push(S)}let a=`/${r.join("/")}`;if(rC.some((S)=>a===S||a.startsWith(`${S}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let l=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),m=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...l&&m?[`/var/www/${l}/${m}`,`/srv/${l}/${m}`]:[],...e.mounts.map((S)=>S.target).filter((S)=>S.startsWith("/"))].some((S)=>a===S||a.startsWith(`${S.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:a}}function aC(e,t){let r=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),a=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...r&&a?[`/var/www/${r}/${a}`,`/srv/${r}/${a}`]:[],...e.mounts.map((l)=>l.target).filter((l)=>l.startsWith("/"))].sort((l,m)=>m.length-l.length).find((l)=>t===l||t.startsWith(`${l.replace(/\/$/,"")}/`))}var Ml={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class fe{config;environment;dependencies;region;profile;constructor(e,t,r={}){this.config=e;this.environment=t;this.dependencies=r;this.region=e.aws?.region??e.project.region??"us-east-1",this.profile=e.aws?.profile}async inventory(){return this.dependencies.inventory?.()??ie(this.config,this.environment,{driver:this.dependencies.driver})}async workload(e){return(await this.inventory()).workloads.find((t)=>t.id===e)}async remote(e,t,r,a){let l=this.dependencies.driver??_({config:this.config}),m=await l.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),h=oC(m,e);if(!h)throw Error("The workload server is no longer reachable in this scope.");return l.runRemoteDeploy({targets:[h],commands:t,timeoutSeconds:r,comment:a,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(e){let t=await this.workload(e.workloadId),r={workloadId:e.workloadId,action:e.action};if(!t)return{...r,ok:!1,error:"Workload was not found in the current project and environment."};let a=t.capabilities[e.action];if(!a.supported)return{...r,ok:!1,error:a.reason??`${e.action} is unsupported for ${t.provider}.`};if(a.requiresConfirmation&&e.confirm!==t.name)return{...r,ok:!1,error:`Type "${t.name}" to ${e.action} this workload.`};if(a.requiresRecentAuth&&!e.recentAuth)return{...r,ok:!1,error:"Sign in again before using elevated runtime access."};if(e.action==="inspect")return{...r,ok:!0,workload:t};if(t.provider==="systemd"||t.provider==="docker"){let l=sC(t,e.action);if(!l)return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`};let m=await this.remote(t,["set -uo pipefail",...l],60,`ts-cloud runtime:${e.action}`).catch(tl);return{...r,ok:m.success,command:l[0],stdout:Xs(m.perInstance?.[0]?.output??""),stderr:Xs(m.perInstance?.[0]?.error??m.error??""),error:m.success?void 0:m.error??"Runtime operation failed."}}if(t.provider==="ecs"){let l=iC(t);if(!l)return{...r,ok:!1,error:"ECS cluster or service identity is unavailable."};let m=this.dependencies.ecs??new rt(this.region,this.profile);if(e.action==="scale"){let h=nC(e.replicas,t.desiredReplicas??1);return await m.scaleService(l.cluster,l.service,h),{...r,ok:!0,command:`ecs scale ${t.name} ${h}`}}if(e.action==="start"||e.action==="stop"){let h=e.action==="stop"?0:Math.max(1,t.desiredReplicas??1);return await m.scaleService(l.cluster,l.service,h),{...r,ok:!0,command:`ecs scale ${t.name} ${h}`}}if(e.action==="restart"||e.action==="redeploy")return await m.forceNewDeployment(l.cluster,l.service),{...r,ok:!0,command:`ecs redeploy ${t.name}`}}return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`}}async exec(e){let t={workloadId:e.workloadId,preset:e.preset},r=await this.workload(e.workloadId);if(!r)return{...t,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{...t,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!r.capabilities.exec.supported)return{...t,ok:!1,error:r.capabilities.exec.reason??"Exec is unsupported for this workload."};if(e.confirm!==r.name)return{...t,ok:!1,error:`Type "${r.name}" to open exec access.`};if(!e.recentAuth)return{...t,ok:!1,error:"Sign in again before using elevated runtime access."};let a=e.preset&&Ml[e.preset];if(!a&&!e.command?.trim())return{...t,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(e.command&&r.provider!=="docker")return{...t,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let l=r.links.providerId??"",m;if(r.provider==="docker"&&nl.test(l)){let S=e.command?.trim()||a.map(Ln).join(" ");m=`docker exec ${l} sh -lc ${Ln(S)}`}else if(r.provider==="systemd"&&rl.test(l)&&e.preset)m=e.preset==="process"?`systemctl status ${l} --no-pager --full`:Ml[e.preset].map(Ln).join(" ");if(!m)return{...t,ok:!1,error:"Exec target identity is invalid or unsupported."};let h=await this.remote(r,["set -uo pipefail",m],60,"ts-cloud runtime:exec").catch(tl);return{...t,ok:h.success,command:m,stdout:Xs(h.perInstance?.[0]?.output??""),stderr:Xs(h.perInstance?.[0]?.error??h.error??""),error:h.success?void 0:h.error??"Exec command failed."}}async readFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};let{workload:a,path:l,root:m,providerId:h}=r,R=`sh -c ${Ln('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${Ln(l)} ${fc} ${Ln(m)}`,y=a.provider==="docker"?`docker exec ${h} ${R}`:R,C=await this.remote(a,[y],30,"ts-cloud runtime:file-read").catch(tl);if(!C.success)return{...t,ok:!1,error:C.error??C.perInstance?.[0]?.error??"File read failed."};let T=C.perInstance?.[0]?.output??"",j=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(T);if(!j)return{...t,ok:!1,error:"The remote file response was invalid."};let B=Number(j[1]),V=T.slice((j.index??0)+j[0].length).replace(/\s+/g,"");if(Buffer.from(V,"base64").byteLength>fc)return{...t,ok:!1,error:"The remote file exceeded the transfer limit."};return{...t,ok:!0,contentBase64:V,size:B,truncated:B>fc}}async writeFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(e.contentBase64))return{...t,ok:!1,error:"File content must be valid base64."};let a=Buffer.from(e.contentBase64,"base64");if(a.toString("base64")!==e.contentBase64)return{...t,ok:!1,error:"File content must be canonical base64."};if(a.byteLength>fc)return{...t,ok:!1,error:`File uploads are limited to ${fc} bytes.`};let{workload:l,path:m,root:h,providerId:S}=r,y=`sh -c ${Ln('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${Ln(m)} ${Ln(h)}`,C=l.provider==="docker"?`printf %s ${Ln(e.contentBase64)} | docker exec -i ${S} ${y}`:`printf %s ${Ln(e.contentBase64)} | ${y}`,T=await this.remote(l,[C],30,"ts-cloud runtime:file-write").catch(tl);return{...t,ok:T.success,size:a.byteLength,truncated:!1,error:T.success?void 0:T.error??T.perInstance?.[0]?.error??"File write failed."}}async fileTarget(e){let t=await this.workload(e.workloadId);if(!t)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!t.capabilities.files.supported)return{error:t.capabilities.files.reason??"File access is unsupported for this workload."};if(e.confirm!==t.name)return{error:`Type "${t.name}" to access workload files.`};if(!e.recentAuth)return{error:"Sign in again before using elevated runtime access."};let r=oh(t,e.path);if(!r.ok)return{error:r.error};let a=aC(t,r.path),l=t.links.providerId??"";if(!a||t.provider==="systemd"&&!rl.test(l)||t.provider==="docker"&&!nl.test(l))return{error:"File target identity is invalid or unsupported."};return{workload:t,path:r.path,root:a,providerId:l}}async logs(e,t={}){let r=await this.workload(e);if(!r)throw Error("Workload was not found in the current project and environment.");if(!r.capabilities.logs.supported)throw Error(r.capabilities.logs.reason??"Logs are unsupported for this workload.");let a=Math.min(1000,Math.max(1,Math.floor(t.limit??200)));if(r.provider==="lambda"||r.provider==="ecs"){let C=this.dependencies.logs??new ye(this.region,this.profile),T=r.config.logGroups,j=r.provider==="lambda"?`/aws/lambda/${r.name}`:Array.isArray(T)&&typeof T[0]==="string"?T[0]:void 0;if(!j)throw Error("The ECS task definition does not declare an awslogs group.");let B=await C.filterLogEvents({logGroupName:j,startTime:t.since?.getTime(),limit:a}),V=(B.events??[]).slice(0,a).map((W)=>({timestamp:W.timestamp==null?void 0:new Date(W.timestamp).toISOString(),message:Xs(String(W.message??""))}));return{workloadId:e,provider:r.provider,lines:V,nextCursor:B.nextToken,truncated:(B.events?.length??0)>=a}}let l=r.links.providerId??"",m=t.since&&Number.isFinite(t.since.getTime())?t.since:void 0,h=r.provider==="systemd"&&rl.test(l)?`journalctl -u ${l} --no-pager -n ${a} -o short-iso${m?` --since ${Ln(m.toISOString())}`:""}`:r.provider==="docker"&&nl.test(l)?`docker logs --timestamps --tail ${a}${m?` --since ${Math.floor(m.getTime()/1000)}`:""} ${l} 2>&1`:void 0;if(!h)throw Error("Log target identity is invalid.");let S=await this.remote(r,[h],30,"ts-cloud runtime:logs");if(!S.success)throw Error(S.error??S.perInstance?.[0]?.error??"Log read failed.");let R=Xs(S.perInstance?.[0]?.output??""),y=R.split(`
 `).filter(Boolean).slice(-a).map((C)=>{let T=/^(\d{4}-\d{2}-\d{2}T\S+)\s+(.*)$/.exec(C);return{timestamp:T?.[1],message:T?.[2]??C}});return{workloadId:e,provider:r.provider,lines:y,truncated:R.includes("[output truncated]")||y.length>=a}}}import{randomUUID as cC}from"node:crypto";class Xo{records=new Map;maxBufferBytes;ttlMs;now;constructor(e={}){this.maxBufferBytes=Math.max(1024,e.maxBufferBytes??262144),this.ttlMs=Math.max(1000,e.ttlMs??900000),this.now=e.now??(()=>new Date)}create(e,t){this.sweep();let r=this.now().toISOString(),a={id:cC(),workloadId:t,kind:e,state:"open",chunks:[],cursor:0,droppedBytes:0,bufferedBytes:0,createdAt:r,updatedAt:r,abort:new AbortController,listeners:new Set};return this.records.set(a.id,a),this.snapshot(a,0)}signal(e){return this.records.get(e)?.abort.signal}append(e,t,r="stdout"){let a=this.records.get(e);if(!a||a.state!=="open"||!t)return a?this.snapshot(a,a.cursor):void 0;let l=Buffer.from(t),m=l.byteLength>this.maxBufferBytes?l.subarray(l.byteLength-this.maxBufferBytes).toString("utf8"):t,h={cursor:++a.cursor,stream:r,data:m,at:this.now().toISOString()};a.chunks.push(h),a.bufferedBytes+=Buffer.byteLength(m),a.updatedAt=h.at;while(a.bufferedBytes>this.maxBufferBytes&&a.chunks.length>1){let S=a.chunks.shift(),R=Buffer.byteLength(S.data);a.bufferedBytes-=R,a.droppedBytes+=R}return this.publish(a),this.snapshot(a,h.cursor-1)}read(e,t,r=0){let a=this.records.get(e);if(!a||a.workloadId!==t)return;return a.updatedAt=this.now().toISOString(),this.snapshot(a,Math.max(0,Math.floor(r)))}close(e,t="complete",r){let a=this.records.get(e);if(!a||a.state!=="open")return a?this.snapshot(a,a.cursor):void 0;if(a.state=t,a.error=r,a.updatedAt=this.now().toISOString(),t==="cancelled")a.abort.abort();return this.publish(a),this.snapshot(a,a.cursor)}cancel(e,t){let r=this.records.get(e);if(!r||r.workloadId!==t)return;return this.close(e,"cancelled")}subscribe(e,t,r){let a=this.records.get(e);if(!a||a.workloadId!==t)return;return a.listeners.add(r),()=>a.listeners.delete(r)}sweep(){let e=this.now().getTime()-this.ttlMs,t=0;for(let[r,a]of this.records){if(new Date(a.updatedAt).getTime()>e)continue;a.abort.abort(),this.records.delete(r),t++}return t}clear(){for(let e of this.records.values())e.abort.abort();this.records.clear()}snapshot(e,t){let r=e.chunks[0]?.cursor??e.cursor+1,a=t>0&&t<r-1;return{id:e.id,workloadId:e.workloadId,kind:e.kind,state:e.state,chunks:e.chunks.filter((l)=>a||l.cursor>t),cursor:e.cursor,reset:a,droppedBytes:e.droppedBytes,createdAt:e.createdAt,updatedAt:e.updatedAt,error:e.error}}publish(e){let t=this.snapshot(e,0);for(let r of e.listeners)r(t)}}import{createHash as dC}from"node:crypto";var zg={info:0,low:1,medium:2,high:3,critical:4},Ug={record:0,warn:1,block:2},cb=new Set(["skipped","unavailable","unsupported","stale"]);function gr(e){return typeof e==="string"?e:void 0}function fo(e,t){try{return JSON.parse(String(e))}catch{return t}}function Gn(e){return JSON.stringify(s(e))}function lC(e){if(!e)return;return String(s(e,2000))}function Mg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:gr(e.project_id),environmentId:gr(e.environment_id),resourceId:gr(e.resource_id),releaseId:gr(e.release_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),status:String(e.status),error:gr(e.error),metadata:fo(e.metadata,{}),findingsCount:Number(e.findings_count),startedAt:String(e.started_at),completedAt:String(e.completed_at),durationMs:Number(e.duration_ms)}}function db(e){return{id:String(e.id),fingerprint:String(e.fingerprint),organizationId:String(e.organization_id),projectId:gr(e.project_id),environmentId:gr(e.environment_id),resourceId:gr(e.resource_id),releaseId:gr(e.release_id),scanRunId:String(e.scan_run_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),ruleId:String(e.rule_id),severity:String(e.severity),title:String(e.title),description:String(e.description),evidence:fo(e.evidence,{}),remediation:gr(e.remediation),subject:String(e.subject),status:String(e.status),ownerActorId:gr(e.owner_actor_id),recurrenceCount:Number(e.recurrence_count),firstSeenAt:String(e.first_seen_at),lastSeenAt:String(e.last_seen_at),resolvedAt:gr(e.resolved_at),updatedAt:String(e.updated_at)}}function Lg(e){return{id:String(e.id),organizationId:String(e.organization_id),environmentId:gr(e.environment_id),name:String(e.name),rules:fo(e.rules,[]),requiredScanners:fo(e.required_scanners,[]),scannerFailMode:String(e.scanner_fail_mode),enabled:Number(e.enabled)===1,version:Number(e.version),createdByActorId:gr(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function lb(e,t){let r=gr(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),findingId:String(e.finding_id),policyId:gr(e.policy_id),reason:String(e.reason),referenceUrl:gr(e.reference_url),createdByActorId:String(e.created_by_actor_id),expiresAt:a,revokedAt:r,state:r?"revoked":a<=t?"expired":"active",createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Fg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:gr(e.environment_id),releaseId:String(e.release_id),kind:String(e.kind),format:String(e.format),digest:String(e.digest),summary:fo(e.summary,{}),content:gr(e.content),sensitive:Number(e.sensitive)===1,createdAt:String(e.created_at)}}function ub(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),operationId:gr(e.operation_id),policyId:String(e.policy_id),policyVersion:Number(e.policy_version),outcome:String(e.outcome),scannerVersions:fo(e.scanner_versions,{}),findingIds:fo(e.finding_ids,[]),waiverIds:fo(e.waiver_ids,[]),explanation:String(e.explanation),createdAt:String(e.created_at)}}function uC(e,t){let r=[e.trim().toLowerCase(),t.ruleId.trim().toLowerCase(),t.organizationId,t.projectId??"",t.environmentId??"",t.resourceId??"",t.releaseId??"",t.subject.trim().toLowerCase()].join("\x00");return dC("sha256").update(r).digest("hex")}function pb(e){if(!e)return;let t=new URL(e);if(t.protocol!=="https:"&&t.protocol!=="http:")throw Error("Security references must use HTTP or HTTPS");return t.toString()}function gb(e){if(!e.length)throw Error("A security policy needs at least one rule");return e.map((t)=>{if(!(t.minimumSeverity in zg))throw Error(`Unknown security severity: ${t.minimumSeverity}`);if(!(t.action in Ug))throw Error(`Unknown security policy action: ${t.action}`);return{minimumSeverity:t.minimumSeverity,action:t.action,...t.scannerId?{scannerId:t.scannerId.trim()}:{}}})}class en{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}recordScan(e){if(!e.organizationId||!e.scannerId.trim()||!e.scannerVersion.trim())throw Error("Organization, scanner id, and scanner version are required");let t=e.completedAt??this.now(),r=e.startedAt??t,a=e.durationMs??Math.max(0,new Date(t).getTime()-new Date(r).getTime()),l=e.findings??[],m=this.idFn(),h=new Set,S=[];return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_scan_runs
         (id, organization_id, project_id, environment_id, resource_id, release_id, scanner_id, scanner_version, status, error, metadata, findings_count, started_at, completed_at, duration_ms)
@@ -357,12 +357,12 @@ $(free -m 2>/dev/null | awk '/^Mem:/{total=$2; used=$3; available=$7; cache=$6}
 EOF`,'echo "MEMTOTAL=${MEMTOTAL:-0}"','echo "MEMUSED=${MEMUSED:-0}"','echo "MEMAVAILABLE=${MEMAVAILABLE:-0}"','echo "MEMCACHE=${MEMCACHE:-0}"','echo "SWAPTOTAL=${SWAPTOTAL:-0}"','echo "SWAPUSED=${SWAPUSED:-0}"',`read DISKTOTG DISKUSEDG DISKPCT <<EOF
 $(df -BG -P / 2>/dev/null | awk 'NR==2{gsub("G","",$2); gsub("G","",$3); gsub("%","",$5); print $2, $3, $5}')
 EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DISKTOTG=${DISKTOTG:-0}"',`echo "INODEPCT=$(df -Pi / 2>/dev/null | awk 'NR==2{gsub("%","",$5);print $5}')"`,`echo "NETRX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$3} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,`echo "NETTX=$(awk -F'[: ]+' 'NR>2 && $2!="lo"{sum+=$11} END{print sum+0}' /proc/net/dev 2>/dev/null)"`,". /var/lib/ts-cloud/bandwidth-state 2>/dev/null || true",'echo "NETRXRATE=${RX_RATE:-0}"','echo "NETTXRATE=${TX_RATE:-0}"','echo "NETRXTODAY=${DAY_RX:-0}"','echo "NETTXTODAY=${DAY_TX:-0}"','echo "NETRXMONTH=${MONTH_RX:-0}"','echo "NETTXMONTH=${MONTH_TX:-0}"','echo "NETMONTHKEY=${MONTH_KEY:-}"',`echo "PROCESSES=$(ps -e --no-headers 2>/dev/null | awk 'END{print NR+0}')"`,`echo "UPTIME=$(uptime -p 2>/dev/null | sed 's/^up //' || echo unknown)"`,`echo "UPTIME_SECONDS=$(cut -d' ' -f1 /proc/uptime 2>/dev/null || echo 0)"`,'echo "OS=$(. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME")"'];if(e.includeServices!==!1)t.push(`for s in ${VC.join(" ")}; do st=$(systemctl is-active "$s" 2>/dev/null); if [ -n "$st" ] && [ "$st" != "inactive" ] && [ "$st" != "unknown" ]; then mem=$(systemctl show "$s" -p MemoryCurrent --value 2>/dev/null); en=$(systemctl is-enabled "$s" 2>/dev/null); since=$(systemctl show "$s" -p ActiveEnterTimestamp --value 2>/dev/null); echo "SVC=$s=$st=$mem=$en=$since"; fi; done`);if(e.includeSites!==!1)t.push(WC(e.projectFilter));return t.push("true"),t}function KC(e){let t={services:[],discoveredSites:[]};for(let r of e.split(`
-`)){let a=r.trim();if(a.startsWith("DISCOVERED_SITE="))try{let l=JSON.parse(Buffer.from(a.slice(16),"base64").toString("utf8"));if(l?.domain&&l?.route)t.discoveredSites.push(l)}catch{}else if(a.startsWith("SVC=")){let[,l,m,h,S,R]=/^SVC=([^=]+)=([^=]+)(?:=([^=]*)(?:=([^=]*)(?:=(.*))?)?)?$/.exec(a)??[];if(l)t.services.push({name:l,status:m,memBytes:Number(h||0),enabled:S||bn,since:R||bn})}else{let l=a.indexOf("=");if(l>0)t[a.slice(0,l)]=a.slice(l+1)}}return t}function Eb(e){let t=e.infrastructure?.compute,r=[];if(t?.webServer==="rpx"||t?.proxy?.engine==="rpx")r.push({name:"rpx-gateway",status:"configured"});else if(t?.webServer==="nginx"||t?.webServer==null)r.push({name:"ts-cloud-nginx",status:"configured"});let a=t?.php?.versions??(t?.runtime==="php"?["8.3"]:[]);for(let h of a)r.push({name:`php${h}-fpm`,status:"configured"});let l=t?.managedServices??{},m=[["mysql","mysql"],["mariadb","mariadb"],["postgres","postgresql"],["redis","redis"],["memcached","memcached"],["meilisearch","meilisearch"]];for(let[h,S]of m)if(l[h])r.push({name:S,status:"configured"});return r}function JC(e){let t=e.infrastructure?.compute?.backups,r=!!t?.enabled,a=t?.schedule??"0 2 * * *";return{enabled:r,schedule:a,destination:r?t?.bucket??"local":"off",retention:r?t?.retentionCount??5:0,last:r?"pending first run":"not configured",size:r?bn:"0 MB"}}function Rb(e){return e.infrastructure?.compute?.provider??e.cloud?.provider??e.provider??"aws"}function GC(e){if(Rb(e)==="hetzner")return mc(e);return e.project.region??"us-east-1"}function QC(e){let t=e.infrastructure?.compute?.monitoring,r=Number(typeof t==="object"?t?.alerts?.bandwidthTb??0:0);return Number.isFinite(r)&&r>0?Math.round(r*1000000000000):0}function YC(e,t){let r=Qe(g(e,t));if(!UC(r))return null;try{return JSON.parse(qC(r,"utf8"))}catch{return null}}function ZC(e){let t=e.sites??{},r=[];for(let[a,l]of Object.entries(t)){let m=l.queues??l.workers;if(Array.isArray(m)){for(let h of m)if(typeof h==="string")r.push({name:`${a}:${h}`,site:a,processes:1,status:"configured"});else if(h?.name)r.push({name:`${a}:${h.name}`,site:a,processes:h.processes??1,status:"configured"})}}return r}function Ab(e){if(!e||e==="")return"/";return e.startsWith("/")?e:`/${e}`}function XC(e){let t=Ab(e.path);if(!e.domain)return{route:"internal"};return{route:t==="/"?e.domain:`${e.domain}${t}`,href:`https://${e.domain}${t==="/"?"":t}`}}function Ib(e,t){let r=u(t);if(r==="redirect")return"redirect";if(r==="proxy")return"proxy";let a=String(t.build??"").toLowerCase(),l=String(t.start??"").toLowerCase();if(e==="main"||l.includes("buddy/src/cli.ts serve"))return"stacks";if(e==="api"||l.includes("/serve/api"))return"api";if(a.includes("buildblog"))return"bunpress blog";if(a.includes("bunpress"))return"bunpress";if(a.includes("site:build")||a.includes("stx"))return"stx static";if(r==="server-static")return t.spa?"spa":"static";if(r==="server-app")return"app";if(r==="server-php")return t.type??"php";return"bucket"}function eP(e){let t=u(e);if(t==="redirect"||t==="proxy")return"—";let r=`${e.start??""} ${e.build??""}`.toLowerCase();if(t==="server-static")return r.includes("bunpress")||r.includes("bun ")||r.includes("bunx ")?"static/bun":"static";if(t==="server-app")return r.includes("bun")?"bun":"node";if(t==="server-php")return`php ${e.php??e.phpVersion??"8.3"}`;return"static"}function tP(e){let t=u(e);if(t==="redirect")return"redirect";if(t==="proxy")return"proxy";if(t==="server-app")return"service";if(t==="server-static")return"server static";if(t==="server-php")return"php release";return"bucket"}function rP(e){let t=new Map;return Object.entries(e.sites??{}).map(([r,a])=>{let l=Ab(a.path),{route:m,href:h}=XC(a),S=a.domain?`${a.domain}${l}`:"",R=S?t.get(S):void 0;if(S&&!R)t.set(S,r);return{name:r,route:m,href:h,domain:a.domain??"internal",path:l,kind:Ib(r,a),type:Ib(r,a),runtime:eP(a),deploy:tP(a),tls:a.domain?a.ssl===!1?"http":"https":"loopback",ssl:a.domain?a.ssl!==!1:!1,status:R?"shadowed":"live",shadowedBy:R,lastDeploy:bn}})}function nP(e,t,r){let a=new Map(e.map((l)=>[String(l.route),{...l,project:r,managedBy:"owner"}]));for(let l of t){let m=a.get(l.route),h=m?.name??`${l.project}:${l.name}`;a.set(l.route,{...m,...l,name:h,kind:m?.kind??l.kind,type:m?.type??l.kind,runtime:m?.runtime??l.runtime,deploy:m?.deploy??l.deploy,root:m?.root??l.root,branch:m?.branch??l.branch,managedBy:l.project===r?"owner":"attached"})}return[...a.values()].sort((l,m)=>{if(l.managedBy!==m.managedBy)return l.managedBy==="owner"?-1:1;return String(l.route).localeCompare(String(m.route))})}function Qg(e){return`'${e.replaceAll("'","'\\''")}'`}function Cb(e){return e.replace(/[\\&/]/g,"\\$&")}function iP(e,t){if(e.length===0)return["true"];return["set +e",...e.map((r)=>{let a=Qg(`${x(t,r)}/.ts-cloud/deploy-history.log`),l=Cb(r);return`TS_CLOUD_HISTORY=${a}; { [ -f "$TS_CLOUD_HISTORY" ] && tail -n 24 "$TS_CLOUD_HISTORY" | sed "s/^/DEPLOY=${l}\\t/"; } || true`}),"true"]}function Pb(e){return[...new Set(Object.values(e.sites??{}).map((t)=>t.domain).filter((t)=>typeof t==="string"&&t.length>0))]}function oP(e){return["set +e",'if command -v ss >/dev/null 2>&1; then ss -H -lntup 2>/dev/null | while read -r proto _state _recv _send local _peer rest; do [ -n "$proto" ] && [ -n "$local" ] && printf "PORT=%s\\t%s\\t%s\\n" "$proto" "$local" "$rest"; done; fi','if command -v ufw >/dev/null 2>&1; then ufw status numbered 2>/dev/null | sed "s/^/FIREWALL=/"; else echo "FIREWALL=ufw unavailable"; fi','journalctl _COMM=sshd --no-pager -n 30 -o short-iso 2>/dev/null | sed "s/^/AUTH=/" || true',...Pb(e).map((r)=>`TS_CLOUD_DOMAIN=${Qg(r)}; TS_CLOUD_EXPIRY=$(echo | timeout 8 openssl s_client -servername "$TS_CLOUD_DOMAIN" -connect "$TS_CLOUD_DOMAIN:443" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2-); [ -n "$TS_CLOUD_EXPIRY" ] && printf "CERT=%s\\t%s\\n" "$TS_CLOUD_DOMAIN" "$TS_CLOUD_EXPIRY" || printf "CERT=%s\\tunavailable\\n" "$TS_CLOUD_DOMAIN"`),"true"]}function sP(e){let t=new Map,r=(m,h)=>{if(m&&h&&!t.has(h))t.set(h,{pattern:m,label:h})},a=e.infrastructure?.compute,l=e.project.slug;if(a?.webServer==="rpx"||a?.proxy?.engine==="rpx")r("rpx-gateway","rpx-gateway");else r("nginx","nginx");for(let m of Eb(e))r(m.name,m.name);for(let[m,h]of Object.entries(e.sites??{})){if(u(h)!=="server-app")continue;if(r(`${l}-${m}`,`${l}-${m}`),Array.isArray(h.queues??h.workers)&&(h.queues??h.workers).length)r(`${l}-${m}-queue-*`,`${l}-${m}-queues`);if(Array.isArray(h.daemons)&&h.daemons.length)r(`${l}-${m}-daemon-*`,`${l}-${m}-daemons`)}return[...t.values()]}function aP(e){let t=sP(e);if(t.length===0)return["true"];return["set +e",...t.map((r)=>{let a=Qg(r.pattern),l=Cb(r.label);return`journalctl -u ${a} --no-pager -n 150 -o short-iso 2>/dev/null | sed "s/^/LOG=${l}\\t/" || true`}),'[ -f /var/log/ts-cloud-backup.log ] && tail -n 60 /var/log/ts-cloud-backup.log 2>/dev/null | sed "s/^/LOG=backups\\t/" || true',"true"]}function Yg(e){let t=new Date(e);if(Number.isNaN(t.getTime()))return e||bn;let r=Math.max(0,Math.round((Date.now()-t.getTime())/1000));if(r<60)return`${r}s ago`;let a=Math.round(r/60);if(a<60)return`${a}m ago`;let l=Math.round(a/60);if(l<48)return`${l}h ago`;return`${Math.round(l/24)}d ago`}function _b(e){if(/(?:error|failed|panic|fatal|exception|denied|unhealthy)/i.test(e))return"error";if(/(?:warn|warning|retry|restart|deprecated|timeout)/i.test(e))return"warn";return"info"}function cP(e){let t=[];for(let r of e.split(`
+`)){let a=r.trim();if(a.startsWith("DISCOVERED_SITE="))try{let l=JSON.parse(Buffer.from(a.slice(16),"base64").toString("utf8"));if(l?.domain&&l?.route)t.discoveredSites.push(l)}catch{}else if(a.startsWith("SVC=")){let[,l,m,h,S,R]=/^SVC=([^=]+)=([^=]+)(?:=([^=]*)(?:=([^=]*)(?:=(.*))?)?)?$/.exec(a)??[];if(l)t.services.push({name:l,status:m,memBytes:Number(h||0),enabled:S||bn,since:R||bn})}else{let l=a.indexOf("=");if(l>0)t[a.slice(0,l)]=a.slice(l+1)}}return t}function Eb(e){let t=e.infrastructure?.compute,r=[];if(t?.webServer==="rpx"||t?.proxy?.engine==="rpx")r.push({name:"rpx-gateway",status:"configured"});else if(t?.webServer==="nginx"||t?.webServer==null)r.push({name:"ts-cloud-nginx",status:"configured"});let a=t?.php?.versions??(t?.runtime==="php"?["8.3"]:[]);for(let h of a)r.push({name:`php${h}-fpm`,status:"configured"});let l=t?.managedServices??{},m=[["mysql","mysql"],["mariadb","mariadb"],["postgres","postgresql"],["redis","redis"],["memcached","memcached"],["meilisearch","meilisearch"]];for(let[h,S]of m)if(l[h])r.push({name:S,status:"configured"});return r}function JC(e){let t=e.infrastructure?.compute?.backups,r=!!t?.enabled,a=t?.schedule??"0 2 * * *";return{enabled:r,schedule:a,destination:r?t?.bucket??"local":"off",retention:r?t?.retentionCount??5:0,last:r?"pending first run":"not configured",size:r?bn:"0 MB"}}function Rb(e){return e.infrastructure?.compute?.provider??e.cloud?.provider??e.provider??"aws"}function GC(e){if(Rb(e)==="hetzner")return mc(e);return e.project.region??"us-east-1"}function QC(e){let t=e.infrastructure?.compute?.monitoring,r=Number(typeof t==="object"?t?.alerts?.bandwidthTb??0:0);return Number.isFinite(r)&&r>0?Math.round(r*1000000000000):0}function YC(e,t){let r=Qe(g(e,t));if(!UC(r))return null;try{return JSON.parse(qC(r,"utf8"))}catch{return null}}function ZC(e){let t=e.sites??{},r=[];for(let[a,l]of Object.entries(t)){let m=l.queues??l.workers;if(Array.isArray(m)){for(let h of m)if(typeof h==="string")r.push({name:`${a}:${h}`,site:a,processes:1,status:"configured"});else if(h?.name)r.push({name:`${a}:${h.name}`,site:a,processes:h.processes??1,status:"configured"})}}return r}function Ab(e){if(!e||e==="")return"/";return e.startsWith("/")?e:`/${e}`}function XC(e){let t=Ab(e.path);if(!e.domain)return{route:"internal"};return{route:t==="/"?e.domain:`${e.domain}${t}`,href:`https://${e.domain}${t==="/"?"":t}`}}function Ib(e,t){let r=u(t);if(r==="redirect")return"redirect";if(r==="proxy")return"proxy";let a=String(t.build??"").toLowerCase(),l=String(t.start??"").toLowerCase();if(e==="main"||l.includes("buddy/src/cli.ts serve"))return"stacks";if(e==="api"||l.includes("/serve/api"))return"api";if(a.includes("buildblog"))return"bunpress blog";if(a.includes("bunpress"))return"bunpress";if(a.includes("site:build")||a.includes("stx"))return"stx static";if(r==="server-static")return t.spa?"spa":"static";if(r==="server-app")return"app";if(r==="server-php")return t.type??"php";return"bucket"}function eP(e){let t=u(e);if(t==="redirect"||t==="proxy")return"—";let r=`${e.start??""} ${e.build??""}`.toLowerCase();if(t==="server-static")return r.includes("bunpress")||r.includes("bun ")||r.includes("bunx ")?"static/bun":"static";if(t==="server-app")return r.includes("bun")?"bun":"node";if(t==="server-php")return`php ${e.php??e.phpVersion??"8.3"}`;return"static"}function tP(e){let t=u(e);if(t==="redirect")return"redirect";if(t==="proxy")return"proxy";if(t==="server-app")return"service";if(t==="server-static")return"server static";if(t==="server-php")return"php release";return"bucket"}function rP(e){let t=new Map;return Object.entries(e.sites??{}).map(([r,a])=>{let l=Ab(a.path),{route:m,href:h}=XC(a),S=a.domain?`${a.domain}${l}`:"",R=S?t.get(S):void 0;if(S&&!R)t.set(S,r);return{name:r,route:m,href:h,domain:a.domain??"internal",path:l,kind:Ib(r,a),type:Ib(r,a),runtime:eP(a),deploy:tP(a),tls:a.domain?a.ssl===!1?"http":"https":"loopback",ssl:a.domain?a.ssl!==!1:!1,status:R?"shadowed":"live",shadowedBy:R,lastDeploy:bn}})}function nP(e,t,r){let a=new Map(e.map((l)=>[String(l.route),{...l,project:r,managedBy:"owner"}]));for(let l of t){let m=a.get(l.route),h=m?.name??`${l.project}:${l.name}`;a.set(l.route,{...m,...l,name:h,kind:m?.kind??l.kind,type:m?.type??l.kind,runtime:m?.runtime??l.runtime,deploy:m?.deploy??l.deploy,root:m?.root??l.root,branch:m?.branch??l.branch,managedBy:l.project===r?"owner":"attached"})}return[...a.values()].sort((l,m)=>{if(l.managedBy!==m.managedBy)return l.managedBy==="owner"?-1:1;return String(l.route).localeCompare(String(m.route))})}function Qg(e){return`'${e.replaceAll("'","'\\''")}'`}function Cb(e){return e.replace(/[\\&/]/g,"\\$&")}function iP(e,t){if(e.length===0)return["true"];return["set +e",...e.map((r)=>{let a=Qg(`${O(t,r)}/.ts-cloud/deploy-history.log`),l=Cb(r);return`TS_CLOUD_HISTORY=${a}; { [ -f "$TS_CLOUD_HISTORY" ] && tail -n 24 "$TS_CLOUD_HISTORY" | sed "s/^/DEPLOY=${l}\\t/"; } || true`}),"true"]}function Pb(e){return[...new Set(Object.values(e.sites??{}).map((t)=>t.domain).filter((t)=>typeof t==="string"&&t.length>0))]}function oP(e){return["set +e",'if command -v ss >/dev/null 2>&1; then ss -H -lntup 2>/dev/null | while read -r proto _state _recv _send local _peer rest; do [ -n "$proto" ] && [ -n "$local" ] && printf "PORT=%s\\t%s\\t%s\\n" "$proto" "$local" "$rest"; done; fi','if command -v ufw >/dev/null 2>&1; then ufw status numbered 2>/dev/null | sed "s/^/FIREWALL=/"; else echo "FIREWALL=ufw unavailable"; fi','journalctl _COMM=sshd --no-pager -n 30 -o short-iso 2>/dev/null | sed "s/^/AUTH=/" || true',...Pb(e).map((r)=>`TS_CLOUD_DOMAIN=${Qg(r)}; TS_CLOUD_EXPIRY=$(echo | timeout 8 openssl s_client -servername "$TS_CLOUD_DOMAIN" -connect "$TS_CLOUD_DOMAIN:443" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2-); [ -n "$TS_CLOUD_EXPIRY" ] && printf "CERT=%s\\t%s\\n" "$TS_CLOUD_DOMAIN" "$TS_CLOUD_EXPIRY" || printf "CERT=%s\\tunavailable\\n" "$TS_CLOUD_DOMAIN"`),"true"]}function sP(e){let t=new Map,r=(m,h)=>{if(m&&h&&!t.has(h))t.set(h,{pattern:m,label:h})},a=e.infrastructure?.compute,l=e.project.slug;if(a?.webServer==="rpx"||a?.proxy?.engine==="rpx")r("rpx-gateway","rpx-gateway");else r("nginx","nginx");for(let m of Eb(e))r(m.name,m.name);for(let[m,h]of Object.entries(e.sites??{})){if(u(h)!=="server-app")continue;if(r(`${l}-${m}`,`${l}-${m}`),Array.isArray(h.queues??h.workers)&&(h.queues??h.workers).length)r(`${l}-${m}-queue-*`,`${l}-${m}-queues`);if(Array.isArray(h.daemons)&&h.daemons.length)r(`${l}-${m}-daemon-*`,`${l}-${m}-daemons`)}return[...t.values()]}function aP(e){let t=sP(e);if(t.length===0)return["true"];return["set +e",...t.map((r)=>{let a=Qg(r.pattern),l=Cb(r.label);return`journalctl -u ${a} --no-pager -n 150 -o short-iso 2>/dev/null | sed "s/^/LOG=${l}\\t/" || true`}),'[ -f /var/log/ts-cloud-backup.log ] && tail -n 60 /var/log/ts-cloud-backup.log 2>/dev/null | sed "s/^/LOG=backups\\t/" || true',"true"]}function Yg(e){let t=new Date(e);if(Number.isNaN(t.getTime()))return e||bn;let r=Math.max(0,Math.round((Date.now()-t.getTime())/1000));if(r<60)return`${r}s ago`;let a=Math.round(r/60);if(a<60)return`${a}m ago`;let l=Math.round(a/60);if(l<48)return`${l}h ago`;return`${Math.round(l/24)}d ago`}function _b(e){if(/(?:error|failed|panic|fatal|exception|denied|unhealthy)/i.test(e))return"error";if(/(?:warn|warning|retry|restart|deprecated|timeout)/i.test(e))return"warn";return"info"}function cP(e){let t=[];for(let r of e.split(`
 `)){let a=r.trim();if(!a.startsWith("LOG="))continue;let l=a.indexOf("\t");if(l<0)continue;let m=a.slice(4,l),h=a.slice(l+1),S=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(h),R=S?.[1]??"",y=S?.[2]??"",C=(S?.[3]??h).trim();if(!C)continue;t.push({source:m,timestamp:R,when:R?Yg(R):bn,host:y,message:C,level:_b(C)})}return t.sort((r,a)=>String(a.timestamp).localeCompare(String(r.timestamp))).slice(0,600)}function Tb(e){if(/^(?:127\.|localhost:|\[?::1\]?)/.test(e))return"loopback";if(/^(?:10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|\[?f[cd][0-9a-f:])/i.test(e))return"private";return"public"}function dP(e){if(Tb(e)!=="public")return"ok";if(/:(?:22|80|443)$/.test(e)||/^\*:(?:22|80|443)$/.test(e))return"ok";return"warn"}function lP(e){if(e==null)return"warn";if(e<8)return"bad";if(e<30)return"warn";return"ok"}function uP(e){let t=[],r=[],a=[],l=[];for(let S of e.split(`
 `)){let R=S.trim();if(R.startsWith("PORT=")){let[y="",C="",T=""]=R.slice(5).split("\t");if(y&&C)t.push({proto:y,listen:C,processName:T||bn,exposure:Tb(C),tone:dP(C)})}else if(R.startsWith("FIREWALL=")){let y=R.slice(9).trim();if(y)r.push(y)}else if(R.startsWith("AUTH=")){let y=R.slice(5),C=/^(\d{4}-\d{2}-\d{2}T[^\s]+)\s+(\S+)\s+(.*)$/.exec(y),T=(C?.[3]??y).trim();if(T)a.push({timestamp:C?.[1]??"",when:C?.[1]?Yg(C[1]):bn,host:C?.[2]??"",message:T,level:_b(T)})}else if(R.startsWith("CERT=")){let[y="",C=""]=R.slice(5).split("\t");if(!y)continue;let T=new Date(C),j=Number.isNaN(T.getTime())?null:Math.ceil((T.getTime()-Date.now())/86400000);l.push({domain:y,expires:Number.isNaN(T.getTime())?C||bn:T.toISOString().slice(0,10),daysRemaining:j,status:lP(j)})}}let m=r.some((S)=>/Status:\s*active/i.test(S)),h=r.some((S)=>/unavailable/i.test(S));return{ports:t.slice(0,80),firewall:{status:m?"active":h?"unavailable":"inactive",summary:m?"ufw active":h?"ufw unavailable":"ufw inactive or not configured",rules:r.filter((S)=>S&&!/^Status:/i.test(S)).slice(0,60)},tlsCertificates:l,authEvents:a.sort((S,R)=>String(R.timestamp).localeCompare(String(S.timestamp))).slice(0,30)}}function Zg(e){let r=e.infrastructure?.compute?.firewall??{},a=[...new Set([22,80,443,...r.allowedPorts??[]])],l=Pb(e);return{ports:a.map((m)=>({proto:"tcp",listen:`0.0.0.0:${m}`,processName:"configured firewall",exposure:"public",tone:[22,80,443].includes(Number(m))?"ok":"warn"})),firewall:{status:r.enabled===!1?"disabled":"configured",summary:r.enabled===!1?"host firewall disabled in config":"host firewall configured declaratively",rules:a.map((m)=>`ALLOW ${m}/tcp`)},tlsCertificates:l.map((m)=>({domain:m,expires:bn,daysRemaining:null,status:"warn"})),authEvents:[]}}function xb(e,t){let r=t.security??Zg(e),a=!!t._serverReachable&&!t.metricsUnavailable,l=t.sites??[],m=l.filter((y)=>y.status==="shadowed"),h=(t.services??[]).filter((y)=>["failed","stopped"].includes(y.status)),S=(r.tlsCertificates??[]).filter((y)=>y.status!=="ok"),R=t.sshKeys??[];return[{name:"Live server probe",status:a?"pass":"warn",detail:a?"Metrics and remote checks are coming from the compute box.":"The dashboard is rendering config/state data until the box probe succeeds."},{name:"Managed services",status:h.length?"fail":"pass",detail:h.length?`${h.length} service(s) need attention.`:`${(t.services??[]).length} service(s) reported healthy or configured.`},{name:"Route conflicts",status:m.length?"warn":"pass",detail:m.length?`${m.map((y)=>y.name).join(", ")} is shadowed by an earlier route.`:`${l.length} site route(s) are unshadowed.`},{name:"SSH access",status:R.length?"pass":"warn",detail:R.length?`${R.length} declarative authorized key(s) configured.`:"No declarative SSH keys are configured."},{name:"Firewall",status:["active","configured"].includes(r.firewall?.status)?"pass":"warn",detail:r.firewall?.summary??"Firewall status unavailable."},{name:"TLS certificates",status:S.length?"warn":"pass",detail:S.length?`${S.length} certificate(s) need renewal visibility.`:`${(r.tlsCertificates??[]).length} certificate(s) look healthy.`}]}function Db(e){let t=[];for(let r of e.serverDeploymentsDetail??e.serverDeployments??[])t.push({type:"deploy",tone:r.status==="failed"?"bad":"ok",title:`${r.site} deployed ${r.sha}`,detail:`${r.branch} · ${r.status}`,when:r.when,timestamp:r.timestamp});for(let r of e.serverLogs??[])if(r.level==="error"||r.level==="warn")t.push({type:"log",tone:r.level==="error"?"bad":"warn",title:`${r.source} ${r.level}`,detail:r.message,when:r.when,timestamp:r.timestamp});for(let r of e.sshKeys??[])t.push({type:"ssh",tone:"ok",title:`${r.name} authorized`,detail:r.fingerprint,when:r.added??bn,timestamp:""});return t.sort((r,a)=>String(a.timestamp).localeCompare(String(r.timestamp))).slice(0,80)}function pP(e,t={}){let r=[];for(let a of e.split(`
-`)){let l=a.trim();if(!l.startsWith("DEPLOY="))continue;let m=l.split("\t"),h=m[0]?.replace(/^DEPLOY=/,"")??"",[S,R,y,C,T]=m.slice(1);if(!h||!S||!R)continue;let j=t[h]??{},B=u(j),V=(y||R).slice(0,7);r.push({sha:V,release:R,commit:y||R,site:h,branch:j.branch??(B==="server-static"?"build artifact":"main"),status:C||"unknown",when:Yg(S),timestamp:S,took:"-",by:"ts-cloud",rc:T?.replace(/^rc=/,"")??"",steps:B==="server-static"?["upload artifact","publish static files"]:["upload artifact","restart service"]})}return r.sort((a,l)=>String(l.timestamp).localeCompare(String(a.timestamp)))}function gP(e,t){let r=YC(e,t),a=Eb(e),l=rP(e),m=Math.max(1,Number(e.infrastructure?.compute?.disk?.size??1)),h={server:{name:r?.serverName??`${e.project.slug}-${t}-app`,provider:r?.provider??Rb(e),region:GC(e),ip:r?.publicIp??bn,os:"Linux",uptime:bn,probeStatus:"unavailable"},systemMetrics:{load:0,load5:0,load15:0,cpuUsedPct:0,cpus:Math.max(1,Number(e.infrastructure?.compute?.instances??1)),memUsedMb:0,memTotalMb:0,memAvailableMb:0,memCacheMb:0,swapUsedMb:0,swapTotalMb:0,diskUsedPct:0,diskUsedGb:0,diskTotalGb:m,inodeUsedPct:0,networkRxBytes:0,networkTxBytes:0,networkRxBytesPerSec:0,networkTxBytesPerSec:0,networkRxBytesToday:0,networkTxBytesToday:0,networkRxBytesMonth:0,networkTxBytesMonth:0,networkMonthKey:"",processes:0,uptimeSeconds:0},metricsUnavailable:!0,bandwidthBudgetBytes:QC(e),services:a,servicesDetail:a.map((S)=>({...S,since:bn,memMb:0,auto:!0})),backup:JC(e),backupHistory:[],workers:ZC(e),serverScheduler:{enabled:!1,lastRun:"not configured"},serverDeployments:[],serverDeploymentsDetail:[],deploymentsEmptyReason:"No deployment history has been recorded yet. Future server deploys will write /var/www/<site>/.ts-cloud/deploy-history.log.",serverLogs:[],serverLogsEmptyReason:"Live server logs are unavailable until the dashboard can reach the compute box.",security:Zg(e),securityEmptyReason:"Live security checks are unavailable until the dashboard can reach the compute box.",sites:l,sitesDetail:l.map((S)=>{let R=e.sites?.[S.name]??{},y=u(R);return{...S,root:y==="server-static"?x(e.project.slug,S.name):`${x(e.project.slug,S.name)}/current`,branch:y==="server-static"?"build artifact":"main",build:R.build,php:R.php??R.phpVersion,aliases:Array.isArray(R.aliases)?R.aliases:[],redirects:R.redirects&&typeof R.redirects==="object"?R.redirects:{},envKeys:Object.keys(R.env??R.environment??{})}}),siteHealth:[],sshKeys:yo(e.infrastructure?.compute?.sshKeys??[]),_serverReachable:!1,_metricsStatus:"unavailable"};return h.diagnostics=xb(e,h),h.activity=Db(h),h.topology=Tt(h,{project:e.project.name,environment:t}),h}async function il(e,t,r={}){if(!e.infrastructure?.compute)return null;let a=null;try{a=_({config:e})}catch{a=null}let l=null,m=0,h=[];if(a)try{if(h=await a.findComputeTargets({slug:e.project.slug,environment:t,role:"app"}),m=h.length,h.length){let T=(await a.runRemoteDeploy({targets:[h[0]],commands:HC({includeServices:!r.telemetryOnly,includeSites:r.includeSiteHealth!==!1,projectFilter:e.cloud?.attachTo?e.project.slug:void 0}),comment:`ts-cloud dashboard:build ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output;if(T)l=KC(T)}}catch{}let S=gP(e,t),R=(C,T=0)=>{let j=Number(C);return Number.isFinite(j)?j:T};if(S.server.os=l?.OS||S.server.os,S.server.uptime=l?.UPTIME||S.server.uptime,l){if(S.server.probeStatus="live",S.metricsUnavailable=!1,S._metricsStatus="live",S.systemMetrics={load:R(l.LOAD),load5:R(l.LOAD5),load15:R(l.LOAD15),cpuUsedPct:R(l.CPUUSED),cpus:R(l.CPUS,1),memUsedMb:R(l.MEMUSED),memTotalMb:R(l.MEMTOTAL,1),memAvailableMb:R(l.MEMAVAILABLE),memCacheMb:R(l.MEMCACHE),swapUsedMb:R(l.SWAPUSED),swapTotalMb:R(l.SWAPTOTAL),diskUsedPct:R(l.DISKPCT),diskUsedGb:R(l.DISKUSEDG),diskTotalGb:R(l.DISKTOTG,1),inodeUsedPct:R(l.INODEPCT),networkRxBytes:R(l.NETRX),networkTxBytes:R(l.NETTX),networkRxBytesPerSec:R(l.NETRXRATE),networkTxBytesPerSec:R(l.NETTXRATE),networkRxBytesToday:R(l.NETRXTODAY),networkTxBytesToday:R(l.NETTXTODAY),networkRxBytesMonth:R(l.NETRXMONTH),networkTxBytesMonth:R(l.NETTXMONTH),networkMonthKey:l.NETMONTHKEY||"",processes:R(l.PROCESSES),uptimeSeconds:R(l.UPTIME_SECONDS)},l.services.length){let C=[...new Map(l.services.map((T)=>[T.name,T])).values()];S.services=C.map((T)=>({name:T.name,status:T.status==="active"?"running":T.status})),S.servicesDetail=C.map((T)=>({name:T.name,status:T.status==="active"?"running":T.status,since:T.since&&T.since!==bn?T.since:S.server.uptime,memMb:Math.max(0,Math.round(Number(T.memBytes??0)/1024/1024)),auto:T.enabled?!["disabled","static","masked"].includes(T.enabled):!0}))}if(l.discoveredSites.length)S.sitesDetail=nP(S.sitesDetail,l.discoveredSites,e.project.slug),S.sites=S.sitesDetail.map((C)=>({name:C.name,project:C.project,managedBy:C.managedBy,route:C.route,href:C.href,domain:C.domain,path:C.path,kind:C.kind,type:C.type,runtime:C.runtime,deploy:C.deploy,tls:C.tls,status:C.status,httpStatus:C.httpStatus,responseMs:C.responseMs,tlsDaysRemaining:C.tlsDaysRemaining,checkedAt:C.checkedAt})),S.siteHealth=S.sitesDetail.map((C)=>({name:C.name,project:C.project,route:C.route,status:C.status,httpStatus:C.httpStatus,responseMs:C.responseMs,tlsDaysRemaining:C.tlsDaysRemaining,checkedAt:C.checkedAt}))}if(a&&h.length&&!r.telemetryOnly)await Promise.all([(async()=>{try{let C=Object.keys(e.sites??{}),j=(await a.runRemoteDeploy({targets:[h[0]],commands:iP(C,e.project.slug),comment:`ts-cloud dashboard:deploy-history ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output??"",B=pP(j,e.sites);S.serverDeployments=B.slice(0,5),S.serverDeploymentsDetail=B.slice(0,50),S.deploymentsEmptyReason=B.length?void 0:"No deployment history was found on the server yet. Deploy again to populate this timeline."}catch{S.deploymentsEmptyReason="Deployment history could not be read from the server."}})(),(async()=>{try{let T=(await a.runRemoteDeploy({targets:[h[0]],commands:aP(e),comment:`ts-cloud dashboard:server-logs ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output??"",j=cP(T);S.serverLogs=j,S.serverLogsEmptyReason=j.length?void 0:"No recent journal entries were found for the managed server units."}catch{S.serverLogsEmptyReason="Server logs could not be read from the box."}})(),(async()=>{try{let T=(await a.runRemoteDeploy({targets:[h[0]],commands:oP(e),comment:`ts-cloud dashboard:security ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output??"",j=uP(T),B=Zg(e);if(!j.ports.length)j.ports=B.ports;if(!j.tlsCertificates.length)j.tlsCertificates=B.tlsCertificates;S.security=j,S.securityEmptyReason=void 0}catch{S.securityEmptyReason="Server security checks could not be read from the box."}})()]);else if(a&&m===0)S.deploymentsEmptyReason="No app server target was found for this environment.";let y=e.infrastructure?.compute?.sshKeys??e.infrastructure?.ssh?.keys??e.infrastructure?.sshKeys;if(Array.isArray(y)&&y.length)S.sshKeys=yo(y);return S._serverReachable=m>0&&!!l,S.diagnostics=xb(e,S),S.activity=Db(S),S.topology=Tt(S,{project:e.project.name,environment:t}),S}var mP=new Set(["singlestore","vitess"]);function Ru(e){return mP.has(e)}var ku={mysql:"/var/lib/pantry/mysql/mysqld.sock",mariadb:"/var/lib/pantry/mariadb/mariadbd.sock"};function Ii(e){return/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(e)}function fP(e){if(e==="postgres"||e==="pgsql")return"postgres";if(e==="mariadb")return"mariadb";if(e==="singlestore")return"singlestore";if(e==="vitess")return"vitess";return"mysql"}function fs(e){let t=e.infrastructure?.compute,r=p(e)?.engine;if(r)return fP(r);let a=t?.managedServices??{};if(a.postgres)return"postgres";if(a.mariadb)return"mariadb";return"mysql"}var Xg=(e)=>e.replace(/`/g,"``"),ni=(e)=>e.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),gs=(e)=>`"${e.replace(/"/g,'""')}"`,wu=(e)=>`'${e.replace(/'/g,"''")}'`;function em(e,t){return[`mysql --socket=${e==="mariadb"?ku.mariadb:ku.mysql} -u root <<'TS_CLOUD_SQL_EOF'`,...t,"TS_CLOUD_SQL_EOF"]}function tm(e,t){return[`${xt(t)} -tA <<'TS_CLOUD_PG_EOF'`,...e,"TS_CLOUD_PG_EOF"]}function hP(e,t){if(e==="vitess")return yP(t);if(e==="postgres")return tm(["SELECT 'DB=' || datname FROM pg_database WHERE datistemplate = false;","SELECT 'USER=' || usename FROM pg_user;"],t);return em(e,["SELECT CONCAT('DB=', schema_name) FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys');","SELECT DISTINCT CONCAT('USER=', User) FROM mysql.user WHERE User NOT IN ('root', 'mysql.sys', 'mysql.session', 'mysql.infoschema', 'debian-sys-maint');"])}function Ma(e,t,r){let a=t?.host??"127.0.0.1",l=t?.username??"root",m=t?.password??"",h=t?.ssl===!1?"":" --ssl-mode=PREFERRED",S=(y)=>`'${String(y).replace(/'/g,"'\\''")}'`;return[`${m?`MYSQL_PWD=${S(m)} `:""}mysql -h ${S(a)} -P ${t?.port??r} -u ${S(l)}${h} --batch --skip-column-names <<'TS_CLOUD_SQL_EOF'`,...e,"TS_CLOUD_SQL_EOF"]}var Fa=15306;function yP(e){let t=Ma(["SHOW KEYSPACES;"],e,Fa);return t[0]=`${t[0]} | sed 's/^/DB=/'`,t}function vP(e){return Ma(["SHOW KEYSPACES;","SHOW VITESS_SHARDS;","SHOW VITESS_TABLETS;"],e,Fa)}function bP(e){let t=[],r=[],a=[];for(let l of e.split(`
+`)){let l=a.trim();if(!l.startsWith("DEPLOY="))continue;let m=l.split("\t"),h=m[0]?.replace(/^DEPLOY=/,"")??"",[S,R,y,C,T]=m.slice(1);if(!h||!S||!R)continue;let j=t[h]??{},B=u(j),V=(y||R).slice(0,7);r.push({sha:V,release:R,commit:y||R,site:h,branch:j.branch??(B==="server-static"?"build artifact":"main"),status:C||"unknown",when:Yg(S),timestamp:S,took:"-",by:"ts-cloud",rc:T?.replace(/^rc=/,"")??"",steps:B==="server-static"?["upload artifact","publish static files"]:["upload artifact","restart service"]})}return r.sort((a,l)=>String(l.timestamp).localeCompare(String(a.timestamp)))}function gP(e,t){let r=YC(e,t),a=Eb(e),l=rP(e),m=Math.max(1,Number(e.infrastructure?.compute?.disk?.size??1)),h={server:{name:r?.serverName??`${e.project.slug}-${t}-app`,provider:r?.provider??Rb(e),region:GC(e),ip:r?.publicIp??bn,os:"Linux",uptime:bn,probeStatus:"unavailable"},systemMetrics:{load:0,load5:0,load15:0,cpuUsedPct:0,cpus:Math.max(1,Number(e.infrastructure?.compute?.instances??1)),memUsedMb:0,memTotalMb:0,memAvailableMb:0,memCacheMb:0,swapUsedMb:0,swapTotalMb:0,diskUsedPct:0,diskUsedGb:0,diskTotalGb:m,inodeUsedPct:0,networkRxBytes:0,networkTxBytes:0,networkRxBytesPerSec:0,networkTxBytesPerSec:0,networkRxBytesToday:0,networkTxBytesToday:0,networkRxBytesMonth:0,networkTxBytesMonth:0,networkMonthKey:"",processes:0,uptimeSeconds:0},metricsUnavailable:!0,bandwidthBudgetBytes:QC(e),services:a,servicesDetail:a.map((S)=>({...S,since:bn,memMb:0,auto:!0})),backup:JC(e),backupHistory:[],workers:ZC(e),serverScheduler:{enabled:!1,lastRun:"not configured"},serverDeployments:[],serverDeploymentsDetail:[],deploymentsEmptyReason:"No deployment history has been recorded yet. Future server deploys will write /var/www/<site>/.ts-cloud/deploy-history.log.",serverLogs:[],serverLogsEmptyReason:"Live server logs are unavailable until the dashboard can reach the compute box.",security:Zg(e),securityEmptyReason:"Live security checks are unavailable until the dashboard can reach the compute box.",sites:l,sitesDetail:l.map((S)=>{let R=e.sites?.[S.name]??{},y=u(R);return{...S,root:y==="server-static"?O(e.project.slug,S.name):`${O(e.project.slug,S.name)}/current`,branch:y==="server-static"?"build artifact":"main",build:R.build,php:R.php??R.phpVersion,aliases:Array.isArray(R.aliases)?R.aliases:[],redirects:R.redirects&&typeof R.redirects==="object"?R.redirects:{},envKeys:Object.keys(R.env??R.environment??{})}}),siteHealth:[],sshKeys:yo(e.infrastructure?.compute?.sshKeys??[]),_serverReachable:!1,_metricsStatus:"unavailable"};return h.diagnostics=xb(e,h),h.activity=Db(h),h.topology=Tt(h,{project:e.project.name,environment:t}),h}async function il(e,t,r={}){if(!e.infrastructure?.compute)return null;let a=null;try{a=_({config:e})}catch{a=null}let l=null,m=0,h=[];if(a)try{if(h=await a.findComputeTargets({slug:e.project.slug,environment:t,role:"app"}),m=h.length,h.length){let T=(await a.runRemoteDeploy({targets:[h[0]],commands:HC({includeServices:!r.telemetryOnly,includeSites:r.includeSiteHealth!==!1,projectFilter:e.cloud?.attachTo?e.project.slug:void 0}),comment:`ts-cloud dashboard:build ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output;if(T)l=KC(T)}}catch{}let S=gP(e,t),R=(C,T=0)=>{let j=Number(C);return Number.isFinite(j)?j:T};if(S.server.os=l?.OS||S.server.os,S.server.uptime=l?.UPTIME||S.server.uptime,l){if(S.server.probeStatus="live",S.metricsUnavailable=!1,S._metricsStatus="live",S.systemMetrics={load:R(l.LOAD),load5:R(l.LOAD5),load15:R(l.LOAD15),cpuUsedPct:R(l.CPUUSED),cpus:R(l.CPUS,1),memUsedMb:R(l.MEMUSED),memTotalMb:R(l.MEMTOTAL,1),memAvailableMb:R(l.MEMAVAILABLE),memCacheMb:R(l.MEMCACHE),swapUsedMb:R(l.SWAPUSED),swapTotalMb:R(l.SWAPTOTAL),diskUsedPct:R(l.DISKPCT),diskUsedGb:R(l.DISKUSEDG),diskTotalGb:R(l.DISKTOTG,1),inodeUsedPct:R(l.INODEPCT),networkRxBytes:R(l.NETRX),networkTxBytes:R(l.NETTX),networkRxBytesPerSec:R(l.NETRXRATE),networkTxBytesPerSec:R(l.NETTXRATE),networkRxBytesToday:R(l.NETRXTODAY),networkTxBytesToday:R(l.NETTXTODAY),networkRxBytesMonth:R(l.NETRXMONTH),networkTxBytesMonth:R(l.NETTXMONTH),networkMonthKey:l.NETMONTHKEY||"",processes:R(l.PROCESSES),uptimeSeconds:R(l.UPTIME_SECONDS)},l.services.length){let C=[...new Map(l.services.map((T)=>[T.name,T])).values()];S.services=C.map((T)=>({name:T.name,status:T.status==="active"?"running":T.status})),S.servicesDetail=C.map((T)=>({name:T.name,status:T.status==="active"?"running":T.status,since:T.since&&T.since!==bn?T.since:S.server.uptime,memMb:Math.max(0,Math.round(Number(T.memBytes??0)/1024/1024)),auto:T.enabled?!["disabled","static","masked"].includes(T.enabled):!0}))}if(l.discoveredSites.length)S.sitesDetail=nP(S.sitesDetail,l.discoveredSites,e.project.slug),S.sites=S.sitesDetail.map((C)=>({name:C.name,project:C.project,managedBy:C.managedBy,route:C.route,href:C.href,domain:C.domain,path:C.path,kind:C.kind,type:C.type,runtime:C.runtime,deploy:C.deploy,tls:C.tls,status:C.status,httpStatus:C.httpStatus,responseMs:C.responseMs,tlsDaysRemaining:C.tlsDaysRemaining,checkedAt:C.checkedAt})),S.siteHealth=S.sitesDetail.map((C)=>({name:C.name,project:C.project,route:C.route,status:C.status,httpStatus:C.httpStatus,responseMs:C.responseMs,tlsDaysRemaining:C.tlsDaysRemaining,checkedAt:C.checkedAt}))}if(a&&h.length&&!r.telemetryOnly)await Promise.all([(async()=>{try{let C=Object.keys(e.sites??{}),j=(await a.runRemoteDeploy({targets:[h[0]],commands:iP(C,e.project.slug),comment:`ts-cloud dashboard:deploy-history ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output??"",B=pP(j,e.sites);S.serverDeployments=B.slice(0,5),S.serverDeploymentsDetail=B.slice(0,50),S.deploymentsEmptyReason=B.length?void 0:"No deployment history was found on the server yet. Deploy again to populate this timeline."}catch{S.deploymentsEmptyReason="Deployment history could not be read from the server."}})(),(async()=>{try{let T=(await a.runRemoteDeploy({targets:[h[0]],commands:aP(e),comment:`ts-cloud dashboard:server-logs ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output??"",j=cP(T);S.serverLogs=j,S.serverLogsEmptyReason=j.length?void 0:"No recent journal entries were found for the managed server units."}catch{S.serverLogsEmptyReason="Server logs could not be read from the box."}})(),(async()=>{try{let T=(await a.runRemoteDeploy({targets:[h[0]],commands:oP(e),comment:`ts-cloud dashboard:security ${e.project.slug}`,tags:{Project:e.project.slug,Environment:t,Role:"app"}})).perInstance?.[0]?.output??"",j=uP(T),B=Zg(e);if(!j.ports.length)j.ports=B.ports;if(!j.tlsCertificates.length)j.tlsCertificates=B.tlsCertificates;S.security=j,S.securityEmptyReason=void 0}catch{S.securityEmptyReason="Server security checks could not be read from the box."}})()]);else if(a&&m===0)S.deploymentsEmptyReason="No app server target was found for this environment.";let y=e.infrastructure?.compute?.sshKeys??e.infrastructure?.ssh?.keys??e.infrastructure?.sshKeys;if(Array.isArray(y)&&y.length)S.sshKeys=yo(y);return S._serverReachable=m>0&&!!l,S.diagnostics=xb(e,S),S.activity=Db(S),S.topology=Tt(S,{project:e.project.name,environment:t}),S}var mP=new Set(["singlestore","vitess"]);function Ru(e){return mP.has(e)}var ku={mysql:"/var/lib/pantry/mysql/mysqld.sock",mariadb:"/var/lib/pantry/mariadb/mariadbd.sock"};function Ii(e){return/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(e)}function fP(e){if(e==="postgres"||e==="pgsql")return"postgres";if(e==="mariadb")return"mariadb";if(e==="singlestore")return"singlestore";if(e==="vitess")return"vitess";return"mysql"}function fs(e){let t=e.infrastructure?.compute,r=p(e)?.engine;if(r)return fP(r);let a=t?.managedServices??{};if(a.postgres)return"postgres";if(a.mariadb)return"mariadb";return"mysql"}var Xg=(e)=>e.replace(/`/g,"``"),ni=(e)=>e.replace(/\\/g,"\\\\").replace(/'/g,"\\'"),gs=(e)=>`"${e.replace(/"/g,'""')}"`,wu=(e)=>`'${e.replace(/'/g,"''")}'`;function em(e,t){return[`mysql --socket=${e==="mariadb"?ku.mariadb:ku.mysql} -u root <<'TS_CLOUD_SQL_EOF'`,...t,"TS_CLOUD_SQL_EOF"]}function tm(e,t){return[`${Ot(t)} -tA <<'TS_CLOUD_PG_EOF'`,...e,"TS_CLOUD_PG_EOF"]}function hP(e,t){if(e==="vitess")return yP(t);if(e==="postgres")return tm(["SELECT 'DB=' || datname FROM pg_database WHERE datistemplate = false;","SELECT 'USER=' || usename FROM pg_user;"],t);return em(e,["SELECT CONCAT('DB=', schema_name) FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema', 'mysql', 'performance_schema', 'sys');","SELECT DISTINCT CONCAT('USER=', User) FROM mysql.user WHERE User NOT IN ('root', 'mysql.sys', 'mysql.session', 'mysql.infoschema', 'debian-sys-maint');"])}function Ma(e,t,r){let a=t?.host??"127.0.0.1",l=t?.username??"root",m=t?.password??"",h=t?.ssl===!1?"":" --ssl-mode=PREFERRED",S=(y)=>`'${String(y).replace(/'/g,"'\\''")}'`;return[`${m?`MYSQL_PWD=${S(m)} `:""}mysql -h ${S(a)} -P ${t?.port??r} -u ${S(l)}${h} --batch --skip-column-names <<'TS_CLOUD_SQL_EOF'`,...e,"TS_CLOUD_SQL_EOF"]}var Fa=15306;function yP(e){let t=Ma(["SHOW KEYSPACES;"],e,Fa);return t[0]=`${t[0]} | sed 's/^/DB=/'`,t}function vP(e){return Ma(["SHOW KEYSPACES;","SHOW VITESS_SHARDS;","SHOW VITESS_TABLETS;"],e,Fa)}function bP(e){let t=[],r=[],a=[];for(let l of e.split(`
 `)){let m=l.trim();if(!m)continue;let h=m.split("\t").map((S)=>S.trim()).filter(Boolean);if(h.length>=6){let[S,R,y,C,T,j,B]=h;a.push({cell:S??"",keyspace:R??"",shard:y??"",type:C??"",state:T??"",alias:j??"",hostname:B??""});continue}if(h.length===1){let S=h[0];if(S.includes("/")){let[R,y]=S.split("/");if(R&&y)r.push({keyspace:R,shard:y})}else t.push(S)}}return{keyspaces:[...new Set(t)].filter(Boolean).sort(),shards:r,tablets:a}}function SP(e,t,r){if(e==="postgres")return tm([`SELECT 'CREATE DATABASE ${gs(t)}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = ${wu(t)})\\gexec`],r);return em(e,[`CREATE DATABASE IF NOT EXISTS \`${Xg(t)}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`])}function wP(e,t,r){let{username:a,password:l,database:m,access:h}=t;if(e==="postgres"){let y=["DO $$ BEGIN",`  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ${wu(a)}) THEN CREATE ROLE ${gs(a)} LOGIN PASSWORD ${wu(l)};`,`  ELSE ALTER ROLE ${gs(a)} LOGIN PASSWORD ${wu(l)}; END IF;`,"END $$;"];if(m)y.push(h==="readonly"?`GRANT CONNECT ON DATABASE ${gs(m)} TO ${gs(a)};`:`GRANT ALL PRIVILEGES ON DATABASE ${gs(m)} TO ${gs(a)};`);return tm(y,r)}let S=h==="readonly"?"SELECT":"ALL PRIVILEGES",R=[`CREATE USER IF NOT EXISTS '${ni(a)}'@'%' IDENTIFIED BY '${ni(l)}';`,`CREATE USER IF NOT EXISTS '${ni(a)}'@'localhost' IDENTIFIED BY '${ni(l)}';`,`ALTER USER '${ni(a)}'@'%' IDENTIFIED BY '${ni(l)}';`,`ALTER USER '${ni(a)}'@'localhost' IDENTIFIED BY '${ni(l)}';`];if(m)R.push(`GRANT ${S} ON \`${Xg(m)}\`.* TO '${ni(a)}'@'%';`,`GRANT ${S} ON \`${Xg(m)}\`.* TO '${ni(a)}'@'localhost';`);return R.push("FLUSH PRIVILEGES;"),em(e,R)}function kP(e){let t=[],r=[];for(let a of e.split(`
-`)){let l=a.trim();if(l.startsWith("DB="))t.push(l.slice(3));else if(l.startsWith("USER="))r.push(l.slice(5))}return{databases:[...new Set(t)].filter(Boolean).sort(),users:[...new Set(r)].filter(Boolean).sort()}}async function Sn(e,t,r,a){let l;try{l=_({config:e})}catch(R){return{ok:!1,error:`Could not initialize the cloud driver: ${R?.message??R}`}}let m=e.project.slug,h=await l.findComputeTargets({slug:m,environment:t,role:"app"});if(!h.length)return{ok:!1,error:"No app server target was found for this environment."};let S=await l.runRemoteDeploy({targets:[h[0]],commands:["set -uo pipefail",...r],comment:a,tags:{Project:m,Environment:t,Role:"app"}});return{ok:S.success,stdout:S.perInstance?.[0]?.output??"",stderr:S.perInstance?.[0]?.error??S.error??""}}function Pu(e,t){return{ok:!1,error:`${t} is not available for ${e}: it is an external cluster, so this box has no engine to administer. ${e==="vitess"?"Create a keyspace with `vtctldclient CreateKeyspace`, and manage vtgate credentials on the cluster.":"Use the provider console or the cluster's own admin connection."}`}}async function Ob(e,t){let r=fs(e);if(Ru(r)&&r!=="vitess")return{...Pu(r,"Listing databases"),engine:r,databases:[],users:[]};let a=await Sn(e,t,hP(r,p(e)),"ts-cloud db:list"),l=a.ok&&a.stdout?kP(a.stdout):{databases:[],users:[]};return{...a,engine:r,...l}}async function $b(e,t,r){let a=fs(e);if(Ru(a))return Pu(a,"Creating a database");return Sn(e,t,SP(a,r,p(e)),`ts-cloud db:create ${r}`)}async function Nb(e,t,r){let a=fs(e);if(Ru(a))return Pu(a,"Creating a database user");return Sn(e,t,wP(a,r,p(e)),`ts-cloud db:user ${r.username}`)}var rm="/var/backups/ts-cloud/databases";function IP(e,t,r=rm,a){let m=`${r}/${t}-$TS_CLOUD_BACKUP_STAMP.sql.gz`,h=`mkdir -p ${r}`;if(e==="postgres")return[h,'TS_CLOUD_BACKUP_STAMP="$(date +%Y%m%d-%H%M%S)"',`${xt(a,"pg_dump")} ${t} | gzip > "${m}"`,`echo "BACKUP=${m}"`,`ls -l "${m}"`];let S=e==="mariadb"?ku.mariadb:ku.mysql;return[h,'TS_CLOUD_BACKUP_STAMP="$(date +%Y%m%d-%H%M%S)"',`mysqldump --socket=${S} -u root ${t} | gzip > "${m}"`,`echo "BACKUP=${m}"`,`ls -l "${m}"`]}function EP(e=rm){return[`ls -1t ${e}/*.sql.gz 2>/dev/null | head -50 | sed 's|^|BACKUP=|' || true`]}function RP(e){let t=[];for(let r of e.split(`
+`)){let l=a.trim();if(l.startsWith("DB="))t.push(l.slice(3));else if(l.startsWith("USER="))r.push(l.slice(5))}return{databases:[...new Set(t)].filter(Boolean).sort(),users:[...new Set(r)].filter(Boolean).sort()}}async function Sn(e,t,r,a){let l;try{l=_({config:e})}catch(R){return{ok:!1,error:`Could not initialize the cloud driver: ${R?.message??R}`}}let m=e.project.slug,h=await l.findComputeTargets({slug:m,environment:t,role:"app"});if(!h.length)return{ok:!1,error:"No app server target was found for this environment."};let S=await l.runRemoteDeploy({targets:[h[0]],commands:["set -uo pipefail",...r],comment:a,tags:{Project:m,Environment:t,Role:"app"}});return{ok:S.success,stdout:S.perInstance?.[0]?.output??"",stderr:S.perInstance?.[0]?.error??S.error??""}}function Pu(e,t){return{ok:!1,error:`${t} is not available for ${e}: it is an external cluster, so this box has no engine to administer. ${e==="vitess"?"Create a keyspace with `vtctldclient CreateKeyspace`, and manage vtgate credentials on the cluster.":"Use the provider console or the cluster's own admin connection."}`}}async function Ob(e,t){let r=fs(e);if(Ru(r)&&r!=="vitess")return{...Pu(r,"Listing databases"),engine:r,databases:[],users:[]};let a=await Sn(e,t,hP(r,p(e)),"ts-cloud db:list"),l=a.ok&&a.stdout?kP(a.stdout):{databases:[],users:[]};return{...a,engine:r,...l}}async function $b(e,t,r){let a=fs(e);if(Ru(a))return Pu(a,"Creating a database");return Sn(e,t,SP(a,r,p(e)),`ts-cloud db:create ${r}`)}async function Nb(e,t,r){let a=fs(e);if(Ru(a))return Pu(a,"Creating a database user");return Sn(e,t,wP(a,r,p(e)),`ts-cloud db:user ${r.username}`)}var rm="/var/backups/ts-cloud/databases";function IP(e,t,r=rm,a){let m=`${r}/${t}-$TS_CLOUD_BACKUP_STAMP.sql.gz`,h=`mkdir -p ${r}`;if(e==="postgres")return[h,'TS_CLOUD_BACKUP_STAMP="$(date +%Y%m%d-%H%M%S)"',`${Ot(a,"pg_dump")} ${t} | gzip > "${m}"`,`echo "BACKUP=${m}"`,`ls -l "${m}"`];let S=e==="mariadb"?ku.mariadb:ku.mysql;return[h,'TS_CLOUD_BACKUP_STAMP="$(date +%Y%m%d-%H%M%S)"',`mysqldump --socket=${S} -u root ${t} | gzip > "${m}"`,`echo "BACKUP=${m}"`,`ls -l "${m}"`]}function EP(e=rm){return[`ls -1t ${e}/*.sql.gz 2>/dev/null | head -50 | sed 's|^|BACKUP=|' || true`]}function RP(e){let t=[];for(let r of e.split(`
 `)){let a=r.trim();if(!a.startsWith("BACKUP="))continue;let l=a.slice(7),h=(l.split("/").pop()??l).replace(/-\d{8}-\d{6}\.sql\.gz$/,"");if(l)t.push({file:l,database:h})}return t}async function jb(e,t,r){if(!Ii(r))return{ok:!1,error:"Database name must be a valid identifier.",database:r};let a=fs(e);if(Ru(a))return{...Pu(a,"Backing up"),database:r};return{...await Sn(e,t,IP(a,r,rm,p(e)),`ts-cloud db:backup ${r}`),database:r}}async function Bb(e,t){let r=await Sn(e,t,EP(),"ts-cloud db:backups"),a=r.ok&&r.stdout?RP(r.stdout):[];return{...r,backups:a}}async function Mb(e,t){let r=fs(e),a={keyspaces:[],shards:[],tablets:[]};if(r!=="vitess")return{ok:!1,error:"The configured database engine is not Vitess.",engine:r,...a};let l=await Sn(e,t,vP(p(e)),"ts-cloud vitess:topology"),m=l.ok&&l.stdout?bP(l.stdout):a;return{...l,engine:r,...m}}function Lb(e){return e.filter((t)=>t.state.toUpperCase()!=="SERVING")}function Fb(e){let t=new Set(e.tablets.filter((r)=>r.type.toUpperCase()==="PRIMARY"&&r.state.toUpperCase()==="SERVING").map((r)=>`${r.keyspace}/${r.shard}`));return e.shards.filter((r)=>!t.has(`${r.keyspace}/${r.shard}`))}var nm="/usr/local/bin/vtctldclient",AP="21.0.0";function Tu(e){return`'${String(e).split("'").join("'\\''")}'`}function xu(e){return p(e)?.vitess??{}}function zb(e){return/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(e)}function CP(e){return/^[0-9a-f]{8}(?:_[0-9a-f]{4}){3}_[0-9a-f]{12}$/i.test(e)}function PP(e=AP){let t=Tu(e);return[`if ${nm} --version 2>/dev/null | grep -q ${t}; then echo "vtctldclient ${e} already installed"; else`,"  command -v curl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y curl ca-certificates)",'  if [ "$(uname -m)" != "x86_64" ]; then','    echo "vtctldclient: Vitess publishes only an x86_64 release tarball; this box is $(uname -m). Build from source or install via pantry." >&2',"    exit 1","  fi",'  tmp="$(mktemp -d)"',`  api="https://api.github.com/repos/vitessio/vitess/releases/tags/v${e}"`,`  url="$(curl -fsSL "$api" | grep -oE '"browser_download_url"[[:space:]]*:[[:space:]]*"[^"]+vitess-[0-9][^"]*\\.tar\\.gz"' | head -1 | sed -E 's/.*"(https[^"]+)"/\\1/')"`,'  if [ -z "$url" ]; then echo "vtctldclient: no release tarball found for v'+e+'" >&2; rm -rf "$tmp"; exit 1; fi',`  curl -fsSL "$url" | tar -xz -C "$tmp" --strip-components=2 --wildcards --occurrence=1 '*/bin/vtctldclient' || true`,'  if [ ! -s "$tmp/vtctldclient" ]; then','    echo "vtctldclient: could not extract the binary from $url" >&2','    rm -rf "$tmp"; exit 1',"  fi",`  install -m 0755 "$tmp/vtctldclient" ${nm}`,'  rm -rf "$tmp"',`  echo "installed vtctldclient ${e}"`,"fi"]}function Ub(e){if(!e.vtctldAddr)return null;return`${nm} --server ${Tu(e.vtctldAddr)}`}function _P(e,t,r={}){let a=Ub(e);if(!a)return null;let l=r.sharded?" --sharded":"";return[`${a} CreateKeyspace${l} ${Tu(t)}`]}function TP(e,t,r){let a=Ub(e);if(!a)return null;return['vschema_tmp="$(mktemp)"',`cat > "$vschema_tmp" <<'TS_CLOUD_VSCHEMA_EOF'`,r,"TS_CLOUD_VSCHEMA_EOF",`${a} ApplyVSchema --vschema-file "$vschema_tmp" ${Tu(t)}`,'rm -f "$vschema_tmp"']}function xP(e,t,r="vitess"){return Ma([`SET @@ddl_strategy='${r}';`,t.endsWith(";")?t:`${t};`],e,Fa)}function DP(e,t){let r=t?[`USE ${t.replace(/[^A-Z0-9_]/gi,"")};`,"SHOW VITESS_MIGRATIONS;"]:["SHOW VITESS_MIGRATIONS;"],a=Ma(r,e,Fa);return a[0]=a[0].replace(" --skip-column-names",""),a}function OP(e){let t=e.split(`
 `).map((h)=>h.trimEnd()).filter((h)=>h.trim().length>0);if(t.length===0)return[];let r=t[0].split("\t").map((h)=>h.trim()),a=(h)=>r.indexOf(h),l={uuid:a("migration_uuid"),keyspace:a("keyspace"),shard:a("shard"),table:a("mysql_table"),status:a("migration_status"),strategy:a("strategy"),added:a("added_timestamp"),completed:a("completed_timestamp"),progress:a("progress")};if(l.uuid===-1)return[];let m=[];for(let h of t.slice(1)){let S=h.split("\t"),R=(C)=>C>=0?(S[C]??"").trim():"",y=R(l.uuid);if(!y)continue;m.push({uuid:y,keyspace:R(l.keyspace),shard:R(l.shard),table:R(l.table),status:R(l.status),strategy:R(l.strategy),added:R(l.added),completed:R(l.completed),progress:R(l.progress)})}return m}function $P(e){return e.filter((t)=>t.status.toLowerCase()==="failed")}function NP(e){return e.filter((t)=>["running","queued","ready"].includes(t.status.toLowerCase()))}function jP(e,t,r){let a=r.toUpperCase();return Ma([`ALTER VITESS_MIGRATION '${t}' ${a};`],e,Fa)}function za(e){if(fs(e)!=="vitess")return{ok:!1,error:"The configured database engine is not Vitess."};return null}function _u(e){if(!e.vtctldAddr)return{ok:!1,error:"No vtctld address is configured. Creating keyspaces and applying a VSchema are topology operations that vtgate cannot perform. Set `infrastructure.appDatabase.vitess.vtctldAddr` (for example `vtctld.internal:15999`) and redeploy."};return null}async function qb(e,t){let r=za(e);if(r)return r;let a=xu(e);return Sn(e,t,PP(a.clientVersion),"ts-cloud vitess:install-client")}async function Vb(e,t,r,a={}){let l=za(e);if(l)return{...l,keyspace:r};if(!zb(r))return{ok:!1,error:"Keyspace name must be a valid identifier.",keyspace:r};let m=xu(e),h=_u(m);if(h)return{...h,keyspace:r};let S=_P(m,r,a);if(!S)return{..._u({}),keyspace:r};return{...await Sn(e,t,S,`ts-cloud vitess:create-keyspace ${r}`),keyspace:r}}async function Wb(e,t,r,a){let l=za(e);if(l)return{...l,keyspace:r};if(!zb(r))return{ok:!1,error:"Keyspace name must be a valid identifier.",keyspace:r};try{let y=JSON.parse(a);if(!y||typeof y!=="object")return{ok:!1,error:"The VSchema must be a JSON object.",keyspace:r}}catch(y){return{ok:!1,error:`The VSchema is not valid JSON: ${y?.message??y}`,keyspace:r}}let m=xu(e),h=_u(m);if(h)return{...h,keyspace:r};let S=TP(m,r,a);if(!S)return{..._u({}),keyspace:r};return{...await Sn(e,t,S,`ts-cloud vitess:apply-vschema ${r}`),keyspace:r}}async function Hb(e,t,r){let a=za(e);if(a)return a;if(!r.trim())return{ok:!1,error:"No SQL was provided."};let l=xu(e);return Sn(e,t,xP(p(e),r,l.ddlStrategy??"vitess"),"ts-cloud vitess:apply-schema")}async function Kb(e,t,r){let a=za(e);if(a)return{...a,migrations:[],failed:[],running:[]};let l=await Sn(e,t,DP(p(e),r),"ts-cloud vitess:migrations"),m=l.ok&&l.stdout?OP(l.stdout):[];return{...l,migrations:m,failed:$P(m),running:NP(m)}}async function Jb(e,t,r,a){let l=za(e);if(l)return{...l,uuid:r};if(!CP(r))return{ok:!1,error:"Migration UUID is not in the expected format.",uuid:r};return{...await Sn(e,t,jP(p(e),r,a),`ts-cloud vitess:migration ${a} ${r}`),uuid:r}}function BP(e){let t=e.infrastructure?.appDatabase;if(t?.engine&&t.engine!=="vitess")return`This project already declares ${t.engine} as its application database.`;let r=e.infrastructure?.compute?.managedServices,a=r?["mysql","mariadb","postgres"].find((l)=>Boolean(r[l])):void 0;if(a)return`This server already declares the ${a} database service.`;return}function MP(e,t){let r=t.keyspace.trim(),a=t.username.trim(),l=t.password,m=BP(e);if(m)throw Error(m);if(!Ii(r))throw Error("Keyspace must contain letters, numbers, or underscores and cannot start with a number.");if(!Ii(a))throw Error("Username must contain letters, numbers, or underscores and cannot start with a number.");if(l.length<16)throw Error("Password must contain at least 16 characters.");if(t.confirm!==r)throw Error(`Type "${r}" to confirm Vitess provisioning.`);let h={mode:"cluster",cell:"zone1",keyspaces:[{name:r,sharded:t.sharded===!0}],vtgatePort:15306,username:a,password:l,bindAddress:"127.0.0.1"};return{service:h,appDatabase:{engine:"vitess",name:r,username:a,host:"127.0.0.1",port:15306,ssl:!1},commands:[...hr(),...Ps(h)]}}async function Gb(e,t,r){let a=MP(e,r);return{...await Sn(e,t,a.commands,`ts-cloud vitess:provision ${a.appDatabase.name}`),database:a.appDatabase,service:Object.fromEntries(Object.entries(a.service).filter(([m])=>m!=="password"))}}var LP={capability:"runtime:terminal",scope:"organization"};var FP={"GET /api/health":{capability:"project:read",anyUser:!0},"GET /api/dashboard-data":{capability:"project:read",anyUser:!0},"GET /api/config":{capability:"config:read",anyUser:!0},"GET /api/me":{capability:"project:read",anyUser:!0},"GET /api/search":{capability:"project:read",anyUser:!0},"GET /api/search/preferences":{capability:"project:read",anyUser:!0},"POST /api/search/preferences":{capability:"project:read",anyUser:!0},"DELETE /api/search/preferences":{capability:"project:read",anyUser:!0},"GET /api/auth/security":{capability:"project:read",anyUser:!0},"GET /api/auth/sessions":{capability:"project:read",anyUser:!0},"DELETE /api/auth/sessions":{capability:"project:read",anyUser:!0},"POST /api/auth/sessions/revoke-others":{capability:"project:read",anyUser:!0},"POST /api/auth/password/change":{capability:"project:read",anyUser:!0},"POST /api/auth/mfa/enroll":{capability:"project:read",anyUser:!0},"POST /api/auth/mfa/verify":{capability:"project:read",anyUser:!0},"DELETE /api/auth/mfa":{capability:"project:read",anyUser:!0},"POST /api/auth/step-up":{capability:"project:read",anyUser:!0},"GET /api/auth/oidc/providers":{capability:"users:read",scope:"organization"},"POST /api/auth/oidc/providers":{capability:"users:manage",scope:"organization"},"PATCH /api/auth/oidc/providers":{capability:"users:manage",scope:"organization"},"GET /api/automation":{capability:"users:read",scope:"organization"},"POST /api/automation/service-accounts":{capability:"users:manage",scope:"organization"},"PATCH /api/automation/service-accounts":{capability:"users:manage",scope:"organization"},"POST /api/automation/tokens":{capability:"users:manage",scope:"organization"},"POST /api/automation/tokens/rotate":{capability:"users:manage",scope:"organization"},"DELETE /api/automation/tokens":{capability:"users:manage",scope:"organization"},"GET /api/security/posture":{capability:"security:read"},"GET /api/security/export":{capability:"security:read"},"POST /api/security/scan":{capability:"security:manage"},"POST /api/security/review":{capability:"deployments:create"},"POST /api/security/policies":{capability:"security:manage"},"PATCH /api/security/policies":{capability:"security:manage"},"POST /api/security/waivers":{capability:"security:waive"},"DELETE /api/security/waivers":{capability:"security:waive"},"PATCH /api/security/findings":{capability:"security:manage"},"POST /api/security/comments":{capability:"security:manage"},"GET /api/sources":{capability:"sources:read"},"POST /api/sources/connections":{capability:"sources:manage"},"PATCH /api/sources/connections":{capability:"sources:manage"},"DELETE /api/sources/connections":{capability:"sources:manage"},"POST /api/sources/deploy-keys":{capability:"sources:manage"},"DELETE /api/sources/deploy-keys":{capability:"sources:manage"},"POST /api/sources/repositories/sync":{capability:"sources:manage"},"GET /api/sources/references":{capability:"sources:read"},"POST /api/sources/bindings":{capability:"sources:manage"},"PATCH /api/sources/bindings":{capability:"sources:manage"},"POST /api/sources/webhooks":{capability:"sources:manage"},"PATCH /api/sources/webhooks":{capability:"sources:manage"},"DELETE /api/sources/webhooks":{capability:"sources:manage"},"GET /api/onboarding":{capability:"applications:read"},"POST /api/onboarding/detect":{capability:"applications:manage"},"POST /api/onboarding/plan":{capability:"applications:manage"},"POST /api/onboarding/drafts":{capability:"applications:manage"},"PATCH /api/onboarding/drafts":{capability:"applications:manage"},"POST /api/onboarding/artifacts":{capability:"applications:manage"},"POST /api/onboarding/registries":{capability:"applications:manage"},"PATCH /api/onboarding/registries":{capability:"applications:manage"},"DELETE /api/onboarding/registries":{capability:"applications:manage"},"POST /api/onboarding/apply":{capability:"applications:manage"},"GET /api/compose":{capability:"applications:read",anyUser:!0},"POST /api/compose/preview":{capability:"applications:manage",anyUser:!0},"POST /api/compose/import":{capability:"applications:manage",anyUser:!0},"POST /api/compose/template":{capability:"applications:manage",anyUser:!0},"POST /api/compose/action":{capability:"project:read",anyUser:!0},"POST /api/compose/logs":{capability:"runtime:logs",anyUser:!0},"POST /api/compose/shell":{capability:"runtime:terminal",scope:"organization"},"GET /api/compose/import":{capability:"applications:manage"},"GET /api/compose/template":{capability:"applications:manage"},"GET /api/compose/logs":{capability:"runtime:logs"},"GET /api/compose/shell":{capability:"runtime:terminal",scope:"organization"},"GET /api/organization":{capability:"users:read",scope:"organization"},"GET /api/organization/invitations":{capability:"users:read",scope:"organization"},"POST /api/organization/invitations":{capability:"users:manage",scope:"organization"},"DELETE /api/organization/invitations":{capability:"users:manage",scope:"organization"},"POST /api/organization/invitations/resend":{capability:"users:manage",scope:"organization"},"PATCH /api/organization/memberships":{capability:"users:manage",scope:"organization"},"DELETE /api/organization/memberships":{capability:"users:manage",scope:"organization"},"POST /api/organization/grants":{capability:"users:manage",scope:"organization"},"DELETE /api/organization/grants":{capability:"users:manage",scope:"organization"},"GET /api/control-plane/operations":{capability:"deployments:read"},"GET /api/control-plane/events":{capability:"audit:read"},"GET /api/queue":{capability:"deployments:read",anyUser:!0},"GET /api/queue/logs":{capability:"deployments:read",anyUser:!0},"GET /api/queue/stream":{capability:"deployments:read",anyUser:!0},"POST /api/queue/cancel":{capability:"deployments:cancel",anyUser:!0},"POST /api/queue/retry":{capability:"deployments:create",anyUser:!0},"GET /api/queue/settings":{capability:"deployments:read"},"PATCH /api/queue/settings":{capability:"automation:manage",scope:"organization"},"DELETE /api/queue/history":{capability:"automation:manage",scope:"organization"},"GET /api/previews":{capability:"deployments:read",anyUser:!0},"GET /api/releases":{capability:"deployments:read",anyUser:!0},"POST /api/releases/action":{capability:"deployments:create",anyUser:!0},"POST /api/previews/deploy":{capability:"deployments:create",anyUser:!0},"POST /api/previews/destroy":{capability:"deployments:cancel",anyUser:!0},"POST /api/previews/extend":{capability:"deployments:create",anyUser:!0},"POST /api/previews/rebuild":{capability:"deployments:create",anyUser:!0},"POST /api/previews/definitions":{capability:"config:write",anyUser:!0},"POST /api/previews/cleanup":{capability:"automation:manage",scope:"organization"},"GET /api/tags":{capability:"project:read"},"POST /api/tags":{capability:"tags:manage"},"DELETE /api/tags":{capability:"tags:manage"},"POST /api/sites/deploy":{capability:"deployments:create",scope:"site",siteFrom:"body"},"PATCH /api/sites":{capability:"config:write",scope:"site",siteFrom:"body"},"POST /api/sites":{capability:"config:write"},"DELETE /api/sites":{capability:"config:write"},"POST /api/env":{capability:"config:write"},"GET /api/ssh-keys":{capability:"fleet:read"},"POST /api/ssh-keys":{capability:"fleet:manage"},"DELETE /api/ssh-keys":{capability:"fleet:manage"},"GET /api/firewall":{capability:"fleet:read"},"POST /api/firewall":{capability:"fleet:manage"},"DELETE /api/firewall":{capability:"fleet:manage"},"GET /api/databases":{capability:"data:read"},"POST /api/databases":{capability:"data:admin"},"GET /api/databases/vitess":{capability:"data:read"},"GET /api/databases/vitess/migrations":{capability:"data:read"},"POST /api/databases/vitess/migrations/action":{capability:"data:admin"},"POST /api/databases/vitess/provision":{capability:"runtime:terminal",scope:"organization"},"POST /api/databases/vitess/keyspaces":{capability:"data:admin"},"POST /api/databases/vitess/vschema":{capability:"data:admin"},"POST /api/databases/vitess/schema":{capability:"data:admin"},"POST /api/databases/vitess/install-client":{capability:"data:admin"},"GET /api/databases/backups":{capability:"backups:read"},"POST /api/databases/backup":{capability:"backups:create"},"POST /api/databases/users":{capability:"data:admin"},"GET /api/data-services":{capability:"data:read"},"GET /api/data-services/capabilities":{capability:"data:read"},"GET /api/data-services/connections":{capability:"data:read"},"POST /api/data-services/preview":{capability:"data:read"},"POST /api/data-services":{capability:"data:admin"},"POST /api/data-services/action":{capability:"data:admin"},"POST /api/data-services/dependencies":{capability:"data:admin"},"POST /api/data-services/management":{capability:"data:admin"},"POST /api/data-services/reveal":{capability:"data:admin"},"GET /api/backups":{capability:"backups:read"},"POST /api/backups/destinations":{capability:"backups:create"},"POST /api/backups/destinations/test":{capability:"backups:create"},"POST /api/backups/policies":{capability:"backups:create"},"POST /api/backups/run":{capability:"backups:create"},"POST /api/backups/verify":{capability:"backups:create"},"POST /api/backups/restore":{capability:"backups:restore"},"POST /api/backups/recovery-points":{capability:"backups:create"},"POST /api/backups/retention":{capability:"backups:create"},"GET /api/configuration":{capability:"config:read"},"GET /api/configuration/export":{capability:"config:read"},"POST /api/configuration/plan":{capability:"config:read"},"POST /api/configuration":{capability:"config:write"},"POST /api/configuration/import":{capability:"config:write"},"POST /api/configuration/dependencies":{capability:"config:write"},"POST /api/configuration/transfer":{capability:"config:write"},"POST /api/configuration/bulk":{capability:"config:write"},"POST /api/configuration/reveal":{capability:"secrets:read"},"DELETE /api/configuration":{capability:"config:write"},"GET /api/volumes":{capability:"data:read"},"POST /api/volumes":{capability:"data:admin"},"POST /api/volumes/attach":{capability:"data:admin"},"POST /api/volumes/detach":{capability:"data:admin"},"POST /api/volumes/resize":{capability:"data:admin"},"POST /api/volumes/snapshot":{capability:"backups:create"},"POST /api/volumes/restore":{capability:"backups:restore"},"POST /api/volumes/adopt":{capability:"data:admin"},"POST /api/volumes/discover":{capability:"data:read"},"DELETE /api/volumes":{capability:"data:admin"},"GET /api/fleet":{capability:"fleet:read"},"POST /api/fleet":{capability:"fleet:manage"},"POST /api/fleet/action":{capability:"fleet:manage"},"GET /api/capacity":{capability:"fleet:read"},"POST /api/capacity":{capability:"fleet:manage"},"POST /api/capacity/member":{capability:"fleet:manage"},"POST /api/capacity/explain":{capability:"fleet:read"},"POST /api/capacity/action":{capability:"fleet:manage"},"GET /api/regions":{capability:"config:read"},"POST /api/regions":{capability:"config:write"},"POST /api/regions/action":{capability:"config:write"},"GET /api/maintenance":{capability:"automation:read"},"POST /api/maintenance/cleanup-preview":{capability:"automation:manage"},"POST /api/maintenance/cleanup-apply":{capability:"automation:manage"},"POST /api/maintenance/drill":{capability:"automation:manage"},"POST /api/maintenance/drill-run":{capability:"automation:manage"},"GET /api/actions":{capability:"runtime:read"},"GET /api/runtime/workloads":{capability:"runtime:read"},"GET /api/runtime/logs":{capability:"runtime:logs"},"POST /api/runtime/log-sessions":{capability:"runtime:logs"},"GET /api/runtime/log-sessions":{capability:"runtime:logs"},"GET /api/runtime/log-stream":{capability:"runtime:logs"},"DELETE /api/runtime/log-sessions":{capability:"runtime:logs"},"POST /api/runtime/exec-sessions":{capability:"runtime:terminal",scope:"organization"},"GET /api/runtime/exec-sessions":{capability:"runtime:terminal",scope:"organization"},"GET /api/runtime/exec-stream":{capability:"runtime:terminal",scope:"organization"},"DELETE /api/runtime/exec-sessions":{capability:"runtime:terminal",scope:"organization"},"POST /api/runtime/files/read":{capability:"runtime:terminal",scope:"organization"},"POST /api/runtime/files/write":{capability:"runtime:terminal",scope:"organization"},"POST /api/runtime/operations":{capability:"runtime:restart"},"GET /api/telemetry/status":{capability:"runtime:read"},"GET /api/telemetry/settings":{capability:"runtime:read"},"PATCH /api/telemetry/settings":{capability:"config:write",scope:"organization"},"GET /api/telemetry/query":{capability:"runtime:logs"},"GET /api/telemetry/tail":{capability:"runtime:logs"},"GET /api/telemetry/series":{capability:"runtime:read"},"POST /api/telemetry/refresh":{capability:"runtime:logs"},"POST /api/telemetry/export":{capability:"runtime:logs"},"GET /api/telemetry/saved-queries":{capability:"runtime:logs"},"POST /api/telemetry/saved-queries":{capability:"runtime:logs"},"DELETE /api/telemetry/saved-queries":{capability:"runtime:logs"},"GET /api/health/checks":{capability:"runtime:read"},"POST /api/health/checks":{capability:"config:write"},"PATCH /api/health/checks":{capability:"config:write"},"POST /api/health/checks/test":{capability:"runtime:read"},"POST /api/health/checks/run":{capability:"runtime:restart"},"GET /api/protection":{capability:"security:read"},"POST /api/protection/attack-mode":{capability:"security:manage"},"POST /api/protection/pause":{capability:"security:manage"},"GET /api/protection/ip-rules":{capability:"security:read"},"POST /api/protection/ip-rules":{capability:"security:manage"},"DELETE /api/protection/ip-rules":{capability:"security:manage"},"GET /api/usage":{capability:"billing:read"},"GET /api/spend/budgets":{capability:"billing:read"},"POST /api/spend/budgets":{capability:"billing:manage"},"PATCH /api/spend/budgets":{capability:"billing:manage"},"DELETE /api/spend/budgets":{capability:"billing:manage"},"POST /api/spend/check":{capability:"billing:manage"},"GET /api/spend/enforcement":{capability:"billing:read"},"POST /api/spend/release":{capability:"billing:manage"},"GET /api/spend/anomalies":{capability:"billing:read"},"POST /api/spend/anomalies/acknowledge":{capability:"billing:manage"},"GET /api/alerts":{capability:"runtime:read"},"GET /api/alerts/rules":{capability:"runtime:read"},"POST /api/alerts/rules":{capability:"config:write"},"PATCH /api/alerts/rules":{capability:"config:write"},"POST /api/alerts/evaluate":{capability:"runtime:restart"},"POST /api/alerts/action":{capability:"runtime:restart"},"POST /api/alerts/silences":{capability:"config:write"},"GET /api/notifications/channels":{capability:"automation:read",scope:"organization"},"POST /api/notifications/channels":{capability:"automation:manage",scope:"organization"},"PATCH /api/notifications/channels":{capability:"automation:manage",scope:"organization"},"POST /api/notifications/channels/test":{capability:"automation:manage",scope:"organization"},"GET /api/notifications/routes":{capability:"automation:read",scope:"organization"},"POST /api/notifications/routes":{capability:"automation:manage",scope:"organization"},"PATCH /api/notifications/routes":{capability:"automation:manage",scope:"organization"},"POST /api/notifications/routes/preview":{capability:"automation:read",scope:"organization"},"GET /api/notifications/deliveries":{capability:"automation:read",scope:"organization"},"POST /api/notifications/deliveries/retry":{capability:"automation:manage",scope:"organization"},"GET /api/jobs":{capability:"automation:read"},"POST /api/jobs":{capability:"automation:manage"},"PATCH /api/jobs":{capability:"automation:manage"},"POST /api/jobs/preview":{capability:"automation:read"},"POST /api/jobs/action":{capability:"automation:manage"},"POST /api/jobs/reconcile":{capability:"automation:manage"},"GET /api/jobs/history":{capability:"automation:read"},"GET /api/workers":{capability:"automation:read"},"POST /api/workers/action":{capability:"automation:manage"},"POST /api/actions/run":{capability:"fleet:manage"},"GET /api/server/operations":{capability:"fleet:read"},"POST /api/server/operations/run":{capability:"fleet:manage"},"POST /api/server/command":{capability:"runtime:terminal",scope:"organization"},"GET /api/terminal":{capability:"runtime:terminal",scope:"organization"},"GET /api/users":{capability:"users:read",scope:"organization"},"POST /api/users":{capability:"users:manage",scope:"organization"},"DELETE /api/users":{capability:"users:manage",scope:"organization"},"GET /api/serverless/operations":{capability:"deployments:read"},"POST /api/serverless/operations/run":{capability:"deployments:create"},"POST /api/serverless/command":{capability:"runtime:terminal",scope:"organization"},"GET /api/serverless/dlq":{capability:"data:read"},"POST /api/serverless/dlq/redrive":{capability:"data:write"},"POST /api/serverless/dlq/purge":{capability:"data:admin"},"GET /api/serverless/secrets":{capability:"secrets:read"},"POST /api/serverless/secrets":{capability:"secrets:write"},"DELETE /api/serverless/secrets":{capability:"secrets:write"},"POST /api/serverless/functions/config":{capability:"config:write"},"GET /api/serverless/alarms":{capability:"runtime:read"},"POST /api/serverless/alarms":{capability:"config:write"},"DELETE /api/serverless/alarms":{capability:"config:write"},"GET /api/serverless/traces":{capability:"runtime:read"},"POST /api/serverless/scheduler":{capability:"automation:manage"}};function im(e,t){return FP[`${e.toUpperCase()} ${t}`]??LP}import{createHmac as zP,randomBytes as UP,timingSafeEqual as qP}from"node:crypto";import{chmodSync as VP,existsSync as WP,mkdirSync as HP,readFileSync as KP,writeFileSync as JP}from"node:fs";import{dirname as GP}from"node:path";var yc="ts_cloud_session";var QP=28800000;function Qb(e){let t=process.env.TS_CLOUD_DASHBOARD_SECRET?.trim();if(t)return t;let r=d(e,"dashboard-secret");try{if(WP(r)){let l=KP(r,"utf8").trim();if(l)return l}}catch{}let a=UP(32).toString("base64url");try{HP(GP(r),{recursive:!0}),JP(r,`${a}
 `),VP(r,384)}catch{}return a}function YP(e,t){return zP("sha256",t).update(e).digest("base64url")}function Yb(e,t){if(!e)return null;let r=e.lastIndexOf(".");if(r<=0)return null;let a=e.slice(0,r),l=e.slice(r+1),m=YP(a,t),h=Buffer.from(l),S=Buffer.from(m);if(h.length!==S.length||!qP(h,S))return null;try{let R=JSON.parse(Buffer.from(a,"base64url").toString("utf8"));if(typeof R?.u!=="string"||typeof R?.exp!=="number")return null;if(R.mv!==void 0&&(!R.mv||typeof R.mv!=="object"||Array.isArray(R.mv)||Object.values(R.mv).some((y)=>!Number.isInteger(y)||y<1)))return null;if(Date.now()>=R.exp)return null;return R}catch{return null}}function om(e,t){if(!e)return;for(let r of e.split(";")){let a=r.indexOf("=");if(a<0)continue;if(r.slice(0,a).trim()===t)return decodeURIComponent(r.slice(a+1).trim())}return}function Ua(e,t={secure:!0}){let r=Math.floor((t.maxAgeMs??QP)/1000),a=[`${yc}=${encodeURIComponent(e)}`,"Path=/","HttpOnly","SameSite=Lax",`Max-Age=${r}`];if(t.secure)a.push("Secure");return a.join("; ")}function Du(e={secure:!0}){let t=[`${yc}=`,"Path=/","HttpOnly","SameSite=Lax","Max-Age=0"];if(e.secure)t.push("Secure");return t.join("; ")}import{chmodSync as ZP,existsSync as XP,mkdirSync as e_,readFileSync as t_,writeFileSync as r_}from"node:fs";import{dirname as n_}from"node:path";function Zb(){return L("dashboard-users.json")}function Ou(e){return/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(e)}function i_(e){if(!e||typeof e.username!=="string"||!Ou(e.username)||typeof e.passwordHash!=="string")return null;let t=e.role==="admin"?"admin":"member",r={};if(e.sites&&typeof e.sites==="object"){for(let[a,l]of Object.entries(e.sites))if(l==="owner"||l==="collaborator")r[a]=l}return{username:e.username,passwordHash:e.passwordHash,role:t,sites:r,name:typeof e.name==="string"?e.name:void 0,email:typeof e.email==="string"?e.email.trim().toLowerCase():void 0,createdAt:typeof e.createdAt==="string"?e.createdAt:void 0}}function o_(e){try{let t=JSON.parse(e);if(!Array.isArray(t?.users))return[];return t.users.map(i_).filter((r)=>r!==null)}catch{return[]}}function Xb(e){return d(e,"dashboard-users.json")}function wn(e){let t=Xb(e);if(!XP(t))return[];try{return o_(t_(t,"utf8"))}catch{return[]}}function $u(e,t){let r=Xb(e);e_(n_(r),{recursive:!0}),r_(r,`${JSON.stringify({users:t},null,2)}
@@ -643,9 +643,9 @@ EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DI
   })
 </script>
 </body>
-</html>`}var cS={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};async function dS(e){return await e.driver.findComputeTargets({slug:e.slug,environment:e.environment,role:e.role||"app"})}async function lS(e,t){let r=e.logger||cS,a=await dS(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};let l=x(e.slug,t.siteName),m=Ot(l,t.to||"unused"),h=["set -uo pipefail",...Mu(m,{...t.to?{to:t.to}:{},unitBase:`${e.slug}-${t.siteName}`}),`(cd ${v} && pantry restart php-fpm) 2>/dev/null || true`,`(cd ${m.current} && eval "$(cd ${v} && pantry env 2>/dev/null)" && php artisan queue:restart) 2>/dev/null || true`];r.step(`Rolling back ${t.siteName}${t.to?` to ${t.to}`:" to the previous release"} on ${a.length} server(s)...`);let S=await e.driver.runRemoteDeploy({targets:a,commands:h,comment:`ts-cloud rollback ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!S.success)r.error(`Rollback failed: ${S.error||"unknown error"}`);else r.success(`Rolled back ${t.siteName}.`);return{success:S.success,error:S.error,perInstance:S.perInstance}}async function uS(e,t){let r=e.logger||cS;if(!t.database?.name)return{success:!1,error:"No appDatabase configured to restore."};let a=await dS(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};r.step(`Restoring database '${t.database.name}'${t.from?` from ${t.from}`:" from the latest backup"} on ${a.length} server(s)...`);let l=await e.driver.runRemoteDeploy({targets:a,commands:Lu(t.database,{from:t.from}),comment:`ts-cloud db:restore ${e.slug}/${t.database.name}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!l.success)r.error(`Restore failed: ${l.error||"unknown error"}`);else r.success(`Restored ${t.database.name}.`);return{success:l.success,error:l.error,perInstance:l.perInstance}}var l_=["restart","reload","start","stop","enable","disable"],pS=65536;function Va(e){return e.length<=pS?e:`${e.slice(0,pS)}
+</html>`}var cS={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};async function dS(e){return await e.driver.findComputeTargets({slug:e.slug,environment:e.environment,role:e.role||"app"})}async function lS(e,t){let r=e.logger||cS,a=await dS(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};let l=O(e.slug,t.siteName),m=xt(l,t.to||"unused"),h=["set -uo pipefail",...Mu(m,{...t.to?{to:t.to}:{},unitBase:`${e.slug}-${t.siteName}`}),`(cd ${v} && pantry restart php-fpm) 2>/dev/null || true`,`(cd ${m.current} && eval "$(cd ${v} && pantry env 2>/dev/null)" && php artisan queue:restart) 2>/dev/null || true`];r.step(`Rolling back ${t.siteName}${t.to?` to ${t.to}`:" to the previous release"} on ${a.length} server(s)...`);let S=await e.driver.runRemoteDeploy({targets:a,commands:h,comment:`ts-cloud rollback ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!S.success)r.error(`Rollback failed: ${S.error||"unknown error"}`);else r.success(`Rolled back ${t.siteName}.`);return{success:S.success,error:S.error,perInstance:S.perInstance}}async function uS(e,t){let r=e.logger||cS;if(!t.database?.name)return{success:!1,error:"No appDatabase configured to restore."};let a=await dS(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};r.step(`Restoring database '${t.database.name}'${t.from?` from ${t.from}`:" from the latest backup"} on ${a.length} server(s)...`);let l=await e.driver.runRemoteDeploy({targets:a,commands:Lu(t.database,{from:t.from}),comment:`ts-cloud db:restore ${e.slug}/${t.database.name}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!l.success)r.error(`Restore failed: ${l.error||"unknown error"}`);else r.success(`Restored ${t.database.name}.`);return{success:l.success,error:l.error,perInstance:l.perInstance}}var l_=["restart","reload","start","stop","enable","disable"],pS=65536;function Va(e){return e.length<=pS?e:`${e.slice(0,pS)}
 
-[output truncated]`}function u_(e){return/^[A-Za-z0-9_.@:-]+$/.test(e)}function am(e){return/^[A-Za-z0-9_-]+$/.test(e)}function p_(e){return e.charAt(0).toUpperCase()+e.slice(1)}function ju(e,t){let r=[],a=t.servicesDetail??t.services??[];for(let h of a){let S=String(h?.name??"");if(!S||!u_(S))continue;for(let R of l_)r.push({id:`${R}:${S}`,label:`${p_(R)} ${S}`,group:"service",target:S,mutates:!0,confirm:S,danger:R==="stop"||R==="disable"})}for(let[h,S]of Object.entries(e.sites??{})){if(!S||!am(h))continue;let R=u(S);if(R==="server-app"||R==="server-php")r.push({id:`rollback:${h}`,label:`Rollback ${h}`,group:"deploy",target:h,mutates:!0,confirm:h,danger:!0})}let l=new Set;for(let h of t.workers??[]){let S=String(h?.name??"").split(":")[0];if(S&&am(S))l.add(S)}for(let h of l)r.push({id:`worker:restart:${h}`,label:`Restart workers (${h})`,group:"worker",target:h,mutates:!0,confirm:h});for(let[h,S]of Object.entries(e.sites??{})){if(!S||!am(h))continue;if(S.scheduler||S.schedule){let R=Tr(S)==="laravel";r.push({id:`scheduler:run:${h}`,label:`${R?"Run":"Restart"} scheduler (${h})`,group:"scheduler",target:h,mutates:!0,confirm:h})}}if(e.infrastructure?.compute?.backups?.enabled){if(r.push({id:"backup:run",label:"Run backup now",group:"backup",target:"backup",mutates:!0,confirm:"backup"}),p(e))r.push({id:"backup:restore",label:"Restore latest DB backup",group:"backup",target:"database",mutates:!0,confirm:"restore",danger:!0})}return r}function cm(e,t,r){return ju(t,r).find((a)=>a.id===e)}function g_(e,t){let r=e==="enable"||e==="disable"?`systemctl is-enabled ${t} 2>/dev/null || true`:`systemctl is-active ${t} 2>/dev/null || true`;return["set -o pipefail",`systemctl ${e} ${t}`,r]}function m_(){return`eval "$(cd ${v} && pantry env 2>/dev/null)"`}function mS(e,t,r){let a=`${x(e,t)}/current`;return["set -uo pipefail",`[ -d ${a} ] || { echo "site ${t} has no current release" >&2; exit 1; }`,`cd ${a} && ${m_()} && php artisan ${r}`]}function f_(e,t,r){if(e==="laravel")return mS(t,r,"queue:restart");let a=`${t}-${r}-queue-*.service`;return["set -uo pipefail",`units=$(systemctl list-units --type=service --all --no-legend '${a}' 2>/dev/null | awk '{print $1}')`,`[ -n "$units" ] || { echo "no queue-worker units found for ${r} (${a})" >&2; exit 1; }`,"systemctl restart $units",`systemctl --no-legend --type=service list-units '${a}' 2>/dev/null || true`]}function h_(e,t,r){if(e==="laravel")return mS(t,r,"schedule:run");let a=`${t}-${r}-scheduler.service`;return["set -uo pipefail",`systemctl restart ${a}`,`systemctl is-active ${a} 2>/dev/null || true`]}function y_(){return["set -uo pipefail",`[ -x ${fr} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,fr]}function gS(e,t,r){return{operation:e,command:t,ok:r.success,stdout:Va(r.perInstance?.[0]?.output??""),stderr:Va(r.perInstance?.[0]?.error??r.error??"")}}async function Bu(e,t,r,a={}){let l=e.project.slug,m;try{m=_({config:e})}catch(T){return{operation:r.id,ok:!1,error:`Could not initialize the cloud driver: ${T?.message??T}`}}let h={driver:m,slug:l,environment:t,role:"app"};if(r.group==="deploy"){let T=a.to&&/^[A-Za-z0-9._-]+$/.test(a.to)?a.to:void 0,j=await lS(h,{siteName:r.target,to:T});return gS(r.id,`rollback ${r.target}${T?` → ${T}`:""}`,j)}if(r.id==="backup:restore"){let T=await uS(h,{database:p(e)});return gS(r.id,"db restore",T)}let S=await m.findComputeTargets({slug:l,environment:t,role:"app"});if(!S.length)return{operation:r.id,ok:!1,error:"No app server target was found for this environment."};let R,y;if(r.group==="service"){let[T,...j]=r.id.split(":");R=g_(T,j.join(":")),y=`systemctl ${T} ${r.target}`}else if(r.group==="worker"){let T=Tr(e.sites?.[r.target]??{});R=f_(T,l,r.target),y=T==="laravel"?`queue:restart (${r.target})`:`restart queue units (${r.target})`}else if(r.group==="scheduler"){let T=Tr(e.sites?.[r.target]??{});R=h_(T,l,r.target),y=T==="laravel"?`schedule:run (${r.target})`:`restart scheduler (${r.target})`}else if(r.id==="backup:run")R=y_(),y="ts-cloud backup";else return{operation:r.id,ok:!1,error:"Unknown operation."};let C=await m.runRemoteDeploy({targets:[S[0]],commands:R,comment:`ts-cloud dashboard:${r.id}`,tags:{Project:l,Environment:t,Role:"app"}});return{operation:r.id,command:y,ok:C.success,stdout:Va(C.perInstance?.[0]?.output??""),stderr:Va(C.perInstance?.[0]?.error??C.error??"")}}async function bc(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};let l;try{l=_({config:e})}catch(R){return{operation:"command",ok:!1,error:`Could not initialize the cloud driver: ${R?.message??R}`}}let m=e.project.slug,h=await l.findComputeTargets({slug:m,environment:t,role:"app"});if(!h.length)return{operation:"command",ok:!1,error:"No app server target was found for this environment."};let S=await l.runRemoteDeploy({targets:[h[0]],commands:["set -o pipefail",a],comment:"ts-cloud dashboard:command",tags:{Project:m,Environment:t,Role:"app"}});return{operation:"command",command:a,ok:S.success,stdout:Va(S.perInstance?.[0]?.output??""),stderr:Va(S.perInstance?.[0]?.error??S.error??"")}}function v_(e,t){return[`${e}-${t}`,`${e}-${t}-queues`,`${e}-${t}-daemons`]}function fS(e,t,r){return r.some((a)=>v_(t,a).includes(e))}function dm(e,t){let{user:r,slug:a}=t;if(r.role==="admin")return e;let l=(e.sites??[]).map((V)=>V.name).filter(Boolean),m=Hg(r,l),h=new Set(m),S=(e.sites??[]).filter((V)=>h.has(V.name)),R=(e.sitesDetail??[]).filter((V)=>h.has(V.name)),y=new Set(R.map((V)=>V.domain).filter(Boolean)),C=(e.serverDeploymentsDetail??e.serverDeployments??[]).filter((V)=>h.has(V.site)),T=(e.serverLogs??[]).filter((V)=>fS(V.source,a,m)),j=(e.security?.tlsCertificates??[]).filter((V)=>y.has(V.domain)),B=(e.activity??[]).filter((V)=>{if(V.type==="deploy")return m.some((W)=>String(V.title??"").startsWith(`${W} `));if(V.type==="log")return fS(String(V.title??"").split(" ")[0],a,m);return!1});return{mode:e.mode,environment:e.environment,environments:e.environments,scoped:!0,server:{name:""},sites:S,sitesDetail:R,workers:(e.workers??[]).filter((V)=>h.has(V.site)),serverDeployments:C.slice(0,5),serverDeploymentsDetail:C.slice(0,50),deploymentsEmptyReason:C.length?void 0:"No deployments have been recorded for your sites yet.",serverLogs:T,serverLogsEmptyReason:T.length?void 0:"No recent log entries for your sites.",security:{tlsCertificates:j,ports:[],firewall:null,authEvents:[]},diagnostics:(e.diagnostics??[]).filter((V)=>["Route conflicts","TLS certificates"].includes(V.name)),activity:B}}function hS(e,t){if(t.role==="admin")return e;let r=new Set(Hg(t,Object.keys(e.sites??{})));return{project:{name:e.project?.name},environment:e.environment,environments:e.environments,sites:Object.fromEntries(Object.entries(e.sites??{}).filter(([a])=>r.has(a)))}}function yS(e){let t=new RegExp("[\\u007F-\\uFFFF]","g");return JSON.stringify(e).replace(t,(r)=>`\\u${r.charCodeAt(0).toString(16).padStart(4,"0")}`)}var b_=new Set(["name","ssl","env","redirects","aliases","domain","path"]),vS={build:"build runs as a shell command on the server",start:"start runs as a shell command on the server",root:"root is a filesystem path on the shared server",port:"ports are allocated by the server owner",type:"the deploy type is set by the server owner",php:"the PHP runtime is set by the server owner"};function SS(e){let t=Object.keys(e).filter((l)=>e[l]!==void 0),r=t.filter((l)=>(l in vS));if(r.length)return{ok:!1,error:`Only the server owner can change ${r.map((m)=>`${m} (${vS[m]})`).join(", ")}.`};let a=t.filter((l)=>!b_.has(l));if(a.length)return{ok:!1,error:`Only the server owner can change ${a.join(", ")}.`};return{ok:!0}}function Fu(e){return String(e??"").trim().toLowerCase().replace(/\.$/,"")}function bS(e){let t=String(e??"/").trim();if(!t||t==="/")return"/";return(t.startsWith("/")?t:`/${t}`).replace(/\/+$/,"")||"/"}function S_(e){let t=[Fu(e?.domain)];if(Array.isArray(e?.aliases))t.push(...e.aliases.map(Fu));return t.filter(Boolean)}function wS({siteName:e,body:t,sites:r,ownSites:a}){let l=r[e]??{},m=new Set(a),h=new Set;if(t.domain!==void 0)h.add(Fu(t.domain));if(Array.isArray(t.aliases))for(let R of t.aliases)h.add(Fu(R));if(h.delete(""),h.size===0)return{ok:!0};let S=bS(t.path!==void 0?t.path:l.path);for(let[R,y]of Object.entries(r)){if(R===e||m.has(R))continue;let C=bS(y?.path);for(let T of S_(y)){if(!h.has(T))continue;if(C===S)return{ok:!1,error:`${T}${S==="/"?"":S} is already served by another site on this server.`}}}return{ok:!0}}class Sc{maxAttempts;lockoutMs;windowMs;attempts=new Map;constructor(e=8,t=900000,r=900000){this.maxAttempts=e;this.lockoutMs=t;this.windowMs=r}key(e,t){return`${e.trim().toLowerCase()}\x00${t}`}check(e,t,r=Date.now()){let a=this.attempts.get(this.key(e,t));if(!a?.until)return{allowed:!0};if(r>=a.until)return this.attempts.delete(this.key(e,t)),{allowed:!0};return{allowed:!1,retryAfterSeconds:Math.ceil((a.until-r)/1000)}}recordFailure(e,t,r=Date.now()){let a=this.key(e,t),l=this.attempts.get(a),h=!l||r-l.last>this.windowMs?1:l.count+1,S={count:h,last:r};if(h>=this.maxAttempts)S.until=r+this.lockoutMs;this.attempts.set(a,S)}recordSuccess(e,t){this.attempts.delete(this.key(e,t))}prune(e=Date.now()){for(let[t,r]of this.attempts)if(r.until?e>=r.until:e-r.last>this.windowMs)this.attempts.delete(t)}get size(){return this.attempts.size}}var IS=new Set([22,80,443]);function wc(e){return Number.isInteger(e)&&e>=1&&e<=65535}function hs(e){return[...new Set(e.filter((t)=>wc(t)&&!IS.has(t)))].sort((t,r)=>t-r)}function ES(e,t,r=[]){if(!wc(t))throw Error("Port must be an integer between 1 and 65535.");if(IS.has(t))throw Error(`Port ${t} (SSH/HTTP/HTTPS) is always open and is not managed here.`);return AS({configText:e,ports:hs([...r,t])})}function RS(e,t,r=[]){return AS({configText:e,ports:hs(r.filter((a)=>a!==t))})}function kS(e,t,r,a,l){let m=e.slice(t,r),h=new RegExp(`\\b${a}\\s*:\\s*\\${l}`).exec(m);if(!h)return null;let S=t+h.index,R=e.indexOf(l,S);return{propStart:S,open:R,close:hc(e,R,l,l==="{"?"}":"]")}}function lm(e){return`allowedPorts: [${e.join(", ")}]`}function AS(e){let{configText:t}=e,r=hs(e.ports),a=/\bcompute\s*:\s*{/.exec(t);if(!a)throw Error("Could not find infrastructure.compute in the cloud config.");let l=t.indexOf("{",a.index),m=hc(t,l,"{","}"),h=kS(t,l+1,m,"firewall","{");if(h){let C=kS(t,h.open+1,h.close,"allowedPorts","[");if(C){let V=C.propStart;while(V>0&&t[V-1]!==`
+[output truncated]`}function u_(e){return/^[A-Za-z0-9_.@:-]+$/.test(e)}function am(e){return/^[A-Za-z0-9_-]+$/.test(e)}function p_(e){return e.charAt(0).toUpperCase()+e.slice(1)}function ju(e,t){let r=[],a=t.servicesDetail??t.services??[];for(let h of a){let S=String(h?.name??"");if(!S||!u_(S))continue;for(let R of l_)r.push({id:`${R}:${S}`,label:`${p_(R)} ${S}`,group:"service",target:S,mutates:!0,confirm:S,danger:R==="stop"||R==="disable"})}for(let[h,S]of Object.entries(e.sites??{})){if(!S||!am(h))continue;let R=u(S);if(R==="server-app"||R==="server-php")r.push({id:`rollback:${h}`,label:`Rollback ${h}`,group:"deploy",target:h,mutates:!0,confirm:h,danger:!0})}let l=new Set;for(let h of t.workers??[]){let S=String(h?.name??"").split(":")[0];if(S&&am(S))l.add(S)}for(let h of l)r.push({id:`worker:restart:${h}`,label:`Restart workers (${h})`,group:"worker",target:h,mutates:!0,confirm:h});for(let[h,S]of Object.entries(e.sites??{})){if(!S||!am(h))continue;if(S.scheduler||S.schedule){let R=Tr(S)==="laravel";r.push({id:`scheduler:run:${h}`,label:`${R?"Run":"Restart"} scheduler (${h})`,group:"scheduler",target:h,mutates:!0,confirm:h})}}if(e.infrastructure?.compute?.backups?.enabled){if(r.push({id:"backup:run",label:"Run backup now",group:"backup",target:"backup",mutates:!0,confirm:"backup"}),p(e))r.push({id:"backup:restore",label:"Restore latest DB backup",group:"backup",target:"database",mutates:!0,confirm:"restore",danger:!0})}return r}function cm(e,t,r){return ju(t,r).find((a)=>a.id===e)}function g_(e,t){let r=e==="enable"||e==="disable"?`systemctl is-enabled ${t} 2>/dev/null || true`:`systemctl is-active ${t} 2>/dev/null || true`;return["set -o pipefail",`systemctl ${e} ${t}`,r]}function m_(){return`eval "$(cd ${v} && pantry env 2>/dev/null)"`}function mS(e,t,r){let a=`${O(e,t)}/current`;return["set -uo pipefail",`[ -d ${a} ] || { echo "site ${t} has no current release" >&2; exit 1; }`,`cd ${a} && ${m_()} && php artisan ${r}`]}function f_(e,t,r){if(e==="laravel")return mS(t,r,"queue:restart");let a=`${t}-${r}-queue-*.service`;return["set -uo pipefail",`units=$(systemctl list-units --type=service --all --no-legend '${a}' 2>/dev/null | awk '{print $1}')`,`[ -n "$units" ] || { echo "no queue-worker units found for ${r} (${a})" >&2; exit 1; }`,"systemctl restart $units",`systemctl --no-legend --type=service list-units '${a}' 2>/dev/null || true`]}function h_(e,t,r){if(e==="laravel")return mS(t,r,"schedule:run");let a=`${t}-${r}-scheduler.service`;return["set -uo pipefail",`systemctl restart ${a}`,`systemctl is-active ${a} 2>/dev/null || true`]}function y_(){return["set -uo pipefail",`[ -x ${fr} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,fr]}function gS(e,t,r){return{operation:e,command:t,ok:r.success,stdout:Va(r.perInstance?.[0]?.output??""),stderr:Va(r.perInstance?.[0]?.error??r.error??"")}}async function Bu(e,t,r,a={}){let l=e.project.slug,m;try{m=_({config:e})}catch(T){return{operation:r.id,ok:!1,error:`Could not initialize the cloud driver: ${T?.message??T}`}}let h={driver:m,slug:l,environment:t,role:"app"};if(r.group==="deploy"){let T=a.to&&/^[A-Za-z0-9._-]+$/.test(a.to)?a.to:void 0,j=await lS(h,{siteName:r.target,to:T});return gS(r.id,`rollback ${r.target}${T?` → ${T}`:""}`,j)}if(r.id==="backup:restore"){let T=await uS(h,{database:p(e)});return gS(r.id,"db restore",T)}let S=await m.findComputeTargets({slug:l,environment:t,role:"app"});if(!S.length)return{operation:r.id,ok:!1,error:"No app server target was found for this environment."};let R,y;if(r.group==="service"){let[T,...j]=r.id.split(":");R=g_(T,j.join(":")),y=`systemctl ${T} ${r.target}`}else if(r.group==="worker"){let T=Tr(e.sites?.[r.target]??{});R=f_(T,l,r.target),y=T==="laravel"?`queue:restart (${r.target})`:`restart queue units (${r.target})`}else if(r.group==="scheduler"){let T=Tr(e.sites?.[r.target]??{});R=h_(T,l,r.target),y=T==="laravel"?`schedule:run (${r.target})`:`restart scheduler (${r.target})`}else if(r.id==="backup:run")R=y_(),y="ts-cloud backup";else return{operation:r.id,ok:!1,error:"Unknown operation."};let C=await m.runRemoteDeploy({targets:[S[0]],commands:R,comment:`ts-cloud dashboard:${r.id}`,tags:{Project:l,Environment:t,Role:"app"}});return{operation:r.id,command:y,ok:C.success,stdout:Va(C.perInstance?.[0]?.output??""),stderr:Va(C.perInstance?.[0]?.error??C.error??"")}}async function bc(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};let l;try{l=_({config:e})}catch(R){return{operation:"command",ok:!1,error:`Could not initialize the cloud driver: ${R?.message??R}`}}let m=e.project.slug,h=await l.findComputeTargets({slug:m,environment:t,role:"app"});if(!h.length)return{operation:"command",ok:!1,error:"No app server target was found for this environment."};let S=await l.runRemoteDeploy({targets:[h[0]],commands:["set -o pipefail",a],comment:"ts-cloud dashboard:command",tags:{Project:m,Environment:t,Role:"app"}});return{operation:"command",command:a,ok:S.success,stdout:Va(S.perInstance?.[0]?.output??""),stderr:Va(S.perInstance?.[0]?.error??S.error??"")}}function v_(e,t){return[`${e}-${t}`,`${e}-${t}-queues`,`${e}-${t}-daemons`]}function fS(e,t,r){return r.some((a)=>v_(t,a).includes(e))}function dm(e,t){let{user:r,slug:a}=t;if(r.role==="admin")return e;let l=(e.sites??[]).map((V)=>V.name).filter(Boolean),m=Hg(r,l),h=new Set(m),S=(e.sites??[]).filter((V)=>h.has(V.name)),R=(e.sitesDetail??[]).filter((V)=>h.has(V.name)),y=new Set(R.map((V)=>V.domain).filter(Boolean)),C=(e.serverDeploymentsDetail??e.serverDeployments??[]).filter((V)=>h.has(V.site)),T=(e.serverLogs??[]).filter((V)=>fS(V.source,a,m)),j=(e.security?.tlsCertificates??[]).filter((V)=>y.has(V.domain)),B=(e.activity??[]).filter((V)=>{if(V.type==="deploy")return m.some((W)=>String(V.title??"").startsWith(`${W} `));if(V.type==="log")return fS(String(V.title??"").split(" ")[0],a,m);return!1});return{mode:e.mode,environment:e.environment,environments:e.environments,scoped:!0,server:{name:""},sites:S,sitesDetail:R,workers:(e.workers??[]).filter((V)=>h.has(V.site)),serverDeployments:C.slice(0,5),serverDeploymentsDetail:C.slice(0,50),deploymentsEmptyReason:C.length?void 0:"No deployments have been recorded for your sites yet.",serverLogs:T,serverLogsEmptyReason:T.length?void 0:"No recent log entries for your sites.",security:{tlsCertificates:j,ports:[],firewall:null,authEvents:[]},diagnostics:(e.diagnostics??[]).filter((V)=>["Route conflicts","TLS certificates"].includes(V.name)),activity:B}}function hS(e,t){if(t.role==="admin")return e;let r=new Set(Hg(t,Object.keys(e.sites??{})));return{project:{name:e.project?.name},environment:e.environment,environments:e.environments,sites:Object.fromEntries(Object.entries(e.sites??{}).filter(([a])=>r.has(a)))}}function yS(e){let t=new RegExp("[\\u007F-\\uFFFF]","g");return JSON.stringify(e).replace(t,(r)=>`\\u${r.charCodeAt(0).toString(16).padStart(4,"0")}`)}var b_=new Set(["name","ssl","env","redirects","aliases","domain","path"]),vS={build:"build runs as a shell command on the server",start:"start runs as a shell command on the server",root:"root is a filesystem path on the shared server",port:"ports are allocated by the server owner",type:"the deploy type is set by the server owner",php:"the PHP runtime is set by the server owner"};function SS(e){let t=Object.keys(e).filter((l)=>e[l]!==void 0),r=t.filter((l)=>(l in vS));if(r.length)return{ok:!1,error:`Only the server owner can change ${r.map((m)=>`${m} (${vS[m]})`).join(", ")}.`};let a=t.filter((l)=>!b_.has(l));if(a.length)return{ok:!1,error:`Only the server owner can change ${a.join(", ")}.`};return{ok:!0}}function Fu(e){return String(e??"").trim().toLowerCase().replace(/\.$/,"")}function bS(e){let t=String(e??"/").trim();if(!t||t==="/")return"/";return(t.startsWith("/")?t:`/${t}`).replace(/\/+$/,"")||"/"}function S_(e){let t=[Fu(e?.domain)];if(Array.isArray(e?.aliases))t.push(...e.aliases.map(Fu));return t.filter(Boolean)}function wS({siteName:e,body:t,sites:r,ownSites:a}){let l=r[e]??{},m=new Set(a),h=new Set;if(t.domain!==void 0)h.add(Fu(t.domain));if(Array.isArray(t.aliases))for(let R of t.aliases)h.add(Fu(R));if(h.delete(""),h.size===0)return{ok:!0};let S=bS(t.path!==void 0?t.path:l.path);for(let[R,y]of Object.entries(r)){if(R===e||m.has(R))continue;let C=bS(y?.path);for(let T of S_(y)){if(!h.has(T))continue;if(C===S)return{ok:!1,error:`${T}${S==="/"?"":S} is already served by another site on this server.`}}}return{ok:!0}}class Sc{maxAttempts;lockoutMs;windowMs;attempts=new Map;constructor(e=8,t=900000,r=900000){this.maxAttempts=e;this.lockoutMs=t;this.windowMs=r}key(e,t){return`${e.trim().toLowerCase()}\x00${t}`}check(e,t,r=Date.now()){let a=this.attempts.get(this.key(e,t));if(!a?.until)return{allowed:!0};if(r>=a.until)return this.attempts.delete(this.key(e,t)),{allowed:!0};return{allowed:!1,retryAfterSeconds:Math.ceil((a.until-r)/1000)}}recordFailure(e,t,r=Date.now()){let a=this.key(e,t),l=this.attempts.get(a),h=!l||r-l.last>this.windowMs?1:l.count+1,S={count:h,last:r};if(h>=this.maxAttempts)S.until=r+this.lockoutMs;this.attempts.set(a,S)}recordSuccess(e,t){this.attempts.delete(this.key(e,t))}prune(e=Date.now()){for(let[t,r]of this.attempts)if(r.until?e>=r.until:e-r.last>this.windowMs)this.attempts.delete(t)}get size(){return this.attempts.size}}var IS=new Set([22,80,443]);function wc(e){return Number.isInteger(e)&&e>=1&&e<=65535}function hs(e){return[...new Set(e.filter((t)=>wc(t)&&!IS.has(t)))].sort((t,r)=>t-r)}function ES(e,t,r=[]){if(!wc(t))throw Error("Port must be an integer between 1 and 65535.");if(IS.has(t))throw Error(`Port ${t} (SSH/HTTP/HTTPS) is always open and is not managed here.`);return AS({configText:e,ports:hs([...r,t])})}function RS(e,t,r=[]){return AS({configText:e,ports:hs(r.filter((a)=>a!==t))})}function kS(e,t,r,a,l){let m=e.slice(t,r),h=new RegExp(`\\b${a}\\s*:\\s*\\${l}`).exec(m);if(!h)return null;let S=t+h.index,R=e.indexOf(l,S);return{propStart:S,open:R,close:hc(e,R,l,l==="{"?"}":"]")}}function lm(e){return`allowedPorts: [${e.join(", ")}]`}function AS(e){let{configText:t}=e,r=hs(e.ports),a=/\bcompute\s*:\s*{/.exec(t);if(!a)throw Error("Could not find infrastructure.compute in the cloud config.");let l=t.indexOf("{",a.index),m=hc(t,l,"{","}"),h=kS(t,l+1,m,"firewall","{");if(h){let C=kS(t,h.open+1,h.close,"allowedPorts","[");if(C){let V=C.propStart;while(V>0&&t[V-1]!==`
 `&&/\s/.test(t[V-1]))V--;let W=t.slice(V,C.propStart);return`${t.slice(0,V)}${W}${lm(r)}${t.slice(C.close+1)}`}let T=t.slice(0,h.close).trimEnd(),j=t.slice(h.close),B=T.endsWith(",")||T.endsWith("{")?"":",";return`${T}${B}
         ${lm(r)},
       ${j}`}let S=t.slice(0,m).trimEnd(),R=t.slice(m),y=S.endsWith(",")||S.endsWith("{")?"":",";return`${S}${y}
@@ -655,7 +655,7 @@ EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DI
       },
     ${R}`}class um{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async getTraceSummaries(e){let t={StartTime:Math.floor(e.startTime.getTime()/1000),EndTime:Math.floor(e.endTime.getTime()/1000),TimeRangeType:"Event",Sampling:!1};if(e.filterExpression)t.FilterExpression=e.filterExpression;if(e.nextToken)t.NextToken=e.nextToken;let r=await this.client.request({service:"xray",region:this.region,method:"POST",path:"/TraceSummaries",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)});return{summaries:r?.TraceSummaries??[],nextToken:r?.NextToken}}async batchGetTraces(e){if(!e.length)return[];return(await this.client.request({service:"xray",region:this.region,method:"POST",path:"/Traces",headers:{"Content-Type":"application/json"},body:JSON.stringify({TraceIds:e.slice(0,5)})}))?.Traces??[]}}var CS=65536;function Hr(e){return e.length<=CS?e:`${e.slice(0,CS)}
 
-[output truncated]`}function gm(e,t){return e.environments?.[t]?.app}function mm(e,t,r){let a=[],l=gm(e,t);a.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),a.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let m=r.maintenance?.enabled;if(m!==!0)a.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(m!==!1)a.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(l?.assets||r.assetsInfo)a.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(l?.database?.connection==="aurora-serverless")a.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(l.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(l.database.maxCapacity??4)}]});for(let h of r.queues??[]){let S=String(h?.name??"").trim();if(S&&/^[A-Za-z0-9_-]+$/.test(S))a.push({id:`queue:purge:${S}`,label:`Purge queue (${S})`,group:"queue",target:S,mutates:!0,confirm:S,danger:!0})}return a}function PS(e,t,r,a){return mm(t,r,a).find((l)=>l.id===e)}async function w_(e,t,r){try{let a=new f(r),{Stacks:l}=await a.describeStacks({stackName:qt(e,t)}),m={};for(let R of l?.[0]?.Outputs??[])if(R.OutputKey)m[R.OutputKey]=R.OutputValue??"";let h=m.AssetsCdnDomain;if(!h)return null;return(await new I(r).findDistributionByDomain(h))?.Id??null}catch{return null}}async function _S(e,t,r,a={}){try{if(r.id==="redeploy")return await ln(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await un(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await nr(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await nr(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let l=Number(a.min),m=Number(a.max);if(!Number.isFinite(l)||!Number.isFinite(m)||l<=0||m<l)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await mf(e,t,l,m),{operation:r.id,command:`db:scale ${l}-${m} ACU`,ok:!0,stdout:`Scaling applied (${l}-${m} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let l=await Ar(e,t),m=await w_(e,t,l.region);if(!m)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let S=await new I(l.region).invalidateAll(m);return{operation:r.id,command:`cloudfront invalidate ${m} /*`,ok:!0,stdout:`Invalidation ${S?.Id??"created"} for ${m} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let l=r.target,m=await Ar(e,t),h=new se(m.region),S=`${m.slug}-${t}-${l}`,{QueueUrl:R}=await h.getQueueUrl(S);return await h.purgeQueue(R),{operation:r.id,command:`sqs purge ${S}`,ok:!0,stdout:`Purged queue ${S}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(l){return{operation:r.id,ok:!1,error:Hr(l?.message??String(l))}}}async function TS(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};try{let l=await tt(e,t,a);return{operation:"command",command:a,ok:!0,stdout:Hr(l||"(no output)")}}catch(l){return{operation:"command",command:a,ok:!1,error:Hr(l?.message??String(l))}}}var fm="No dead-letter queue is provisioned for this environment.";async function hm(e,t,r){try{let{QueueUrl:a}=await e.getQueueUrl(`${t}-${r}-dlq`);return a}catch{return null}}async function xS(e,t,r=10){try{let a=await Ar(e,t),l=new se(a.region),m=await hm(l,a.slug,t);if(!m)return{ok:!1,messages:[],error:fm};return{ok:!0,messages:((await l.receiveMessages({queueUrl:m,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((R)=>({id:R.MessageId,receiptHandle:R.ReceiptHandle,body:Hr(String(R.Body??""))}))}}catch(a){return{ok:!1,messages:[],error:Hr(a?.message??String(a))}}}async function DS(e,t,r={}){try{let a=await Ar(e,t),l=gm(e,t),h=(l?Xt(l,a.slug,t):[]).map((B)=>B.name.replace(`${a.slug}-${t}-`,"")),S=r.targetQueue&&h.includes(r.targetQueue)?r.targetQueue:h[0];if(!S)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let R=new se(a.region),y=await hm(R,a.slug,t);if(!y)return{operation:"dlq:redrive",ok:!1,error:fm};let{QueueUrl:C}=await R.getQueueUrl(`${a.slug}-${t}-${S}`),T=Math.min(50,Math.max(1,r.max??10)),j=0;while(j<T){let V=(await R.receiveMessages({queueUrl:y,maxMessages:Math.min(10,T-j),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!V.length)break;for(let W of V)await R.sendMessage({queueUrl:C,messageBody:String(W.Body??"")}),await R.deleteMessage(y,W.ReceiptHandle),j++}return{operation:"dlq:redrive",command:`redrive → ${S}`,ok:!0,stdout:`Moved ${j} message(s) from the DLQ to ${S}.`}}catch(a){return{operation:"dlq:redrive",ok:!1,error:Hr(a?.message??String(a))}}}async function OS(e,t){try{let r=await Ar(e,t),a=new se(r.region),l=await hm(a,r.slug,t);if(!l)return{operation:"dlq:purge",ok:!1,error:fm};return await a.purgeQueue(l),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:Hr(r?.message??String(r))}}}function $S(e,t){let r=gm(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((a)=>({key:a.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:a})):Object.entries(r.secrets).map(([a,l])=>({key:a,secretId:String(l)}))}async function NS(e,t,r,a){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let l=await Ar(e,t),m=new z(l.region);try{await m.putSecretValue({SecretId:r,SecretString:a})}catch{await m.createSecret({Name:r,SecretString:a})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(l){return{operation:"secret:set",ok:!1,error:Hr(l?.message??String(l))}}}async function jS(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let a=await Ar(e,t);return await new z(a.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(a){return{operation:"secret:delete",ok:!1,error:Hr(a?.message??String(a))}}}var k_=new Set(["http","queue","cli"]);async function BS(e,t,r,a){if(!k_.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let l=a.memory==null?void 0:Number(a.memory),m=a.timeout==null?void 0:Number(a.timeout);if(l!=null&&(!Number.isInteger(l)||l<128||l>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(m!=null&&(!Number.isInteger(m)||m<1||m>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(l==null&&m==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let h=await Ar(e,t),S=new b(h.region),R=`${h.slug}-${t}-${r}`;await S.updateFunctionConfiguration({FunctionName:R,...l!=null?{MemorySize:l}:{},...m!=null?{Timeout:m}:{}});let y=[l!=null?`${l} MB`:"",m!=null?`${m}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${R} (${y})`,ok:!0,stdout:`Updated ${R}: ${y}.`}}catch(h){return{operation:"function:config",ok:!1,error:Hr(h?.message??String(h))}}}var pm=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function I_(e){return pm.find((t)=>t.key===e)}async function MS(e,t){try{let r=await Ar(e,t);return{ok:!0,alarms:await new oe(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:pm}}catch(r){return{ok:!1,alarms:[],presets:pm,error:Hr(r?.message??String(r))}}}async function LS(e,t,r,a){let l=I_(r);if(!l)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(a)||a<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let m=await Ar(e,t),h=new oe(m.region),S=`${m.slug}-${t}-${l.key}`,R=l.fnMode?[{Name:"FunctionName",Value:`${m.slug}-${t}-${l.fnMode}`}]:[];return await h.putMetricAlarm({AlarmName:S,Namespace:l.namespace,MetricName:l.metricName,ComparisonOperator:l.comparison,Threshold:a,EvaluationPeriods:1,Period:300,Statistic:l.statistic,Dimensions:R,AlarmDescription:`ts-cloud: ${l.label} > ${a} ${l.unit}`}),{operation:"alarm:create",command:`alarm ${S}`,ok:!0,stdout:`Alarm ${S} armed at ${a} ${l.unit}.`}}catch(m){return{operation:"alarm:create",ok:!1,error:Hr(m?.message??String(m))}}}async function FS(e,t,r){try{let a=await Ar(e,t);if(!r.startsWith(`${a.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new oe(a.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(a){return{operation:"alarm:delete",ok:!1,error:Hr(a?.message??String(a))}}}function E_(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function zu(e,t,r=30){try{let a=await Ar(e,t),l=new um(a.region),m=new Date,h=new Date(m.getTime()-Math.min(360,Math.max(1,r))*60000),S=`${a.slug}-${t}-http`,R=await l.getTraceSummaries({startTime:h,endTime:m,filterExpression:`service("${S}")`});if(!R.summaries.length)R=await l.getTraceSummaries({startTime:h,endTime:m});return{ok:!0,traces:R.summaries.slice(0,100).map(E_)}}catch(a){return{ok:!1,traces:[],error:Hr(a?.message??String(a))}}}async function ym(e,t,r){try{let a=await Ar(e,t),l=`${a.slug}-${t}-scheduler`;if(r==="run"){let h=await tt(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:Hr(h||"Scheduler run triggered.")}}let m=new ar(a.region);if(r==="enable")await m.enableRule({Name:l});else await m.disableRule({Name:l});return{operation:`scheduler:${r}`,command:`${r} ${l}`,ok:!0,stdout:`Scheduler rule ${l} ${r}d.`}}catch(a){return{operation:`scheduler:${r}`,ok:!1,error:Hr(a?.message??String(a))}}}function zS(e,t,r){let a=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!a.length){if(t)return;let m=e.map((h)=>h.id);return m.length?m:["__no_authorized_telemetry_resources__"]}let l=a.map((m)=>e.find((h)=>h.id===m||h.slug===m)?.id).filter((m)=>!!m);if(l.length!==a.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(l)]}import{createHash as qS}from"node:crypto";class VS{now;entries=new Map;constructor(e=Date.now){this.now=e}async getOrCreate(e,t,r,a){let l=this.entries.get(e);if(!r&&l&&l.expiresAt>this.now())return{value:await l.promise,cached:!0};let m=a().catch((h)=>{throw this.entries.delete(e),h});return this.entries.set(e,{expiresAt:this.now()+t,promise:m}),{value:await m,cached:!1}}invalidate(e){for(let t of this.entries.keys())if(t.startsWith(e))this.entries.delete(t)}}class WS{now;lastRun=new Map;constructor(e=Date.now){this.now=e}shouldRun(e,t,r=!1){let a=this.now(),l=this.lastRun.get(e);if(!r&&l!=null&&a-l<t)return!1;return this.lastRun.set(e,a),!0}}var HS=new VS,R_=new WS,A_=2000,C_=3600000;function P_(e,t){if(e.kind==="log"&&!t.collectLogs)return!1;if(e.kind==="trace"&&!t.collectTraces)return!1;if((e.kind==="request"||e.name.startsWith("request."))&&!t.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(e.kind)&&!e.name.startsWith("request."))return!0;let r=e.requestId??e.traceId??`${e.source}\x00${e.workloadId??""}\x00${e.timestamp}`;return Number.parseInt(qS("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=t.samplingRate}function Kr(...e){return`telemetry:${qS("sha256").update(e.map((t)=>String(t??"")).join("\x00")).digest("hex").slice(0,40)}`}function kc(e,t,r,a){if(!a)return;return e.listResources(t,r).find((l)=>l.slug===a)?.id}function __(e,t){let r=String(t??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(e)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(e)?"warning":"info"}function US(e){let t=e.timestamp&&Number.isFinite(new Date(e.timestamp).getTime())?new Date(e.timestamp).toISOString():new Date().toISOString(),r={};try{let W=JSON.parse(e.message);if(W&&typeof W==="object"&&!Array.isArray(W))r=W}catch{}let a=Object.fromEntries(Object.entries(r).filter(([W])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(W))),l=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,m=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,h=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),S=Number(r.statusCode??r.status_code??r.status),R=String(r.method??r.httpMethod??"")||void 0,y=Ti(String(r.pathTemplate??r.path??r.url??"")||void 0),C=String(r.releaseId??r.release_id??"")||void 0,T=String(r.deploymentId??r.deployment_id??"")||void 0,j={projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,source:e.source,timestamp:t,requestId:l,traceId:m,releaseId:C,deploymentId:T,workloadId:e.workloadId},B=Object.keys(r).length?JSON.stringify(a):e.message,V=[{...j,id:Kr(e.source,e.name,t,B),kind:"log",name:e.name,level:__(B,r.level),message:B,attributes:a}];if(R&&y&&Number.isFinite(S)){if(V.push({...j,id:Kr("request",l,t,R,y,S),kind:"request",name:"http.request",method:R,pathTemplate:y,host:r.host,statusCode:S,durationMs:Number.isFinite(h)?h:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(h))V.push({...j,id:Kr("request-duration",l,t),kind:"metric",name:"request.duration",value:h,unit:"ms",attributes:{method:R,pathTemplate:y,statusCode:S}});if(V.push({...j,id:Kr("request-count",l,t),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:R,pathTemplate:y,statusCode:S}}),S>=500)V.push({...j,id:Kr("request-error",l,t),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:R,pathTemplate:y,statusCode:S}})}return V}async function T_(e){let t=new ft(e.controlPlane),r=Gt(e.controlPlane,e.projectId),a=new Date,l=[],m=[],h={projectId:e.projectId,environmentId:e.environmentId},S=M(e.config);try{let j=(S==="serverless"?await pn(e.config,e.environment):await il(e.config,e.environment,{includeSiteHealth:e.includeSiteHealth,telemetryOnly:e.lightweight}))??{};if(S==="serverless"){for(let V of j.functionsDetail??[]){let W=kc(e.controlPlane,e.projectId,e.environmentId,V.key),Y={...h,resourceId:W,source:"cloudwatch",timestamp:a.toISOString(),workloadId:V.name,attributes:{provider:"aws",functionName:V.name,aggregationWindow:"24h"}};for(let[te,le,X]of[["snapshot.traffic.requests_24h",V.invocations,"count"],["snapshot.errors.count_24h",V.errors,"count"],["snapshot.latency.p50_24h",V.p50,"ms"],["snapshot.latency.p95_24h",V.p95,"ms"],["snapshot.latency.p99_24h",V.p99,"ms"],["snapshot.saturation.throttles_24h",V.throttles,"count"],["snapshot.memory.max_24h",V.maxMem,"MB"]])if(Number.isFinite(Number(le)))l.push({...Y,id:Kr("cloudwatch",V.name,te,a.toISOString()),kind:"metric",name:te,value:Number(le),unit:X})}try{let V=await Ar(e.config,e.environment),W=new oe(V.region),Y=new Date(a.getTime()-3600000),te=300;for(let le of V.functions){let X=[{Name:"FunctionName",Value:le.name}],[ce,Ee,Re,de,Me]=await Promise.all([W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:X,StartTime:Y,EndTime:a,Period:300,Statistics:["Sum"]}),W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:X,StartTime:Y,EndTime:a,Period:300,Statistics:["Sum"]}),W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:X,StartTime:Y,EndTime:a,Period:300,ExtendedStatistics:["p50","p95","p99"]}),W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:X,StartTime:Y,EndTime:a,Period:300,Statistics:["Sum"]}),W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:X,StartTime:Y,EndTime:a,Period:300,Statistics:["Maximum"]})]),ae=kc(e.controlPlane,e.projectId,e.environmentId,le.mode),Le=(Je,gt,Jt,ot)=>{for(let Pt of Je){let Qt=Pt.Timestamp&&Number.isFinite(new Date(Pt.Timestamp).getTime())?new Date(Pt.Timestamp).toISOString():void 0,lt=Jt(Pt);if(Qt&&lt!=null&&Number.isFinite(lt))l.push({...h,resourceId:ae,id:Kr("cloudwatch-series",le.name,gt,Qt),kind:"metric",source:"cloudwatch",name:gt,timestamp:Qt,value:lt,unit:ot,workloadId:le.name,region:V.region,attributes:{provider:"aws",functionName:le.name,aggregationWindow:"300s"}})}};Le(ce,"traffic.requests",(Je)=>Je.Sum,"count"),Le(Ee,"errors.count",(Je)=>Je.Sum,"count"),Le(Re,"latency.p50",(Je)=>Je.Percentiles?.p50,"ms"),Le(Re,"latency.p95",(Je)=>Je.Percentiles?.p95,"ms"),Le(Re,"latency.p99",(Je)=>Je.Percentiles?.p99,"ms"),Le(de,"saturation.throttles",(Je)=>Je.Sum,"count"),Le(Me,"saturation.concurrency",(Je)=>Je.Maximum,"count")}}catch(V){m.push({source:"cloudwatch:series",message:V instanceof Error?V.message:String(V)})}for(let V of(j.serverlessLogs??[]).slice(0,A_))l.push(...US({...h,source:`cloudwatch:${V.source}`,name:`${V.source}.log`,timestamp:V.timestamp,message:String(V.message),resourceId:kc(e.controlPlane,e.projectId,e.environmentId,V.source)}));for(let V of j.queuesDetail??[]){let W={...h,source:"cloudwatch",timestamp:a.toISOString(),attributes:{queue:V.name}};l.push({...W,id:Kr("queue-depth",V.name,a.toISOString()),kind:"metric",name:"queue.depth",value:Number(V.visible??V.depth??0),unit:"count"}),l.push({...W,id:Kr("queue-inflight",V.name,a.toISOString()),kind:"metric",name:"queue.inflight",value:Number(V.inFlight??0),unit:"count"})}let B=await zu(e.config,e.environment,30);if(!B.ok)m.push({source:"xray",message:B.error??"X-Ray traces are unavailable."});for(let V of B.traces)l.push({...h,id:Kr("xray",V.id),kind:"trace",source:"xray",name:"http.trace",timestamp:V.timestamp??a.toISOString(),traceId:V.id,durationMs:V.durationMs,statusCode:V.httpStatus,method:V.method,pathTemplate:V.url,attributes:{status:V.status,responseMs:V.responseMs}})}else{let B=j.systemMetrics;if(j.metricsUnavailable||!B)m.push({source:"host",message:"The host metrics probe is unavailable."});else{let V=Number(B.memTotalMb)>0?Number(B.memUsedMb)/Number(B.memTotalMb)*100:0,W=Number(B.swapTotalMb)>0?Number(B.swapUsedMb)/Number(B.swapTotalMb)*100:0,Y=[["host.load",Number(B.load),"load"],["host.load.5m",Number(B.load5),"load"],["host.load.15m",Number(B.load15),"load"],["host.cpu.capacity",Number(B.cpus),"count"],["host.cpu.used_percent",Number(B.cpuUsedPct),"percent"],["host.memory.used",Number(B.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(B.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(B.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(B.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",V,"percent"],["host.swap.used",Number(B.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(B.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",W,"percent"],["host.disk.used_percent",Number(B.diskUsedPct),"percent"],["host.disk.used",Number(B.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(B.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(B.inodeUsedPct),"percent"],["host.network.rx",Number(B.networkRxBytes),"bytes"],["host.network.tx",Number(B.networkTxBytes),"bytes"],["host.network.rx_rate",Number(B.networkRxBytesPerSec),"bytes_per_second"],["host.network.tx_rate",Number(B.networkTxBytesPerSec),"bytes_per_second"],["host.network.rx_today",Number(B.networkRxBytesToday),"bytes"],["host.network.tx_today",Number(B.networkTxBytesToday),"bytes"],["host.network.rx_month",Number(B.networkRxBytesMonth),"bytes"],["host.network.tx_month",Number(B.networkTxBytesMonth),"bytes"],["host.processes",Number(B.processes),"count"],["host.uptime",Number(B.uptimeSeconds),"seconds"]];for(let[te,le,X]of Y)if(Number.isFinite(le))l.push({...h,id:Kr("host",te,a.toISOString()),kind:"metric",source:"host",name:te,timestamp:a.toISOString(),value:le,unit:X});for(let te of j.siteHealth??[]){let le=String(te.project??e.config.project.slug),X=String(te.name),ce=X.startsWith(`${le}:`)?X.slice(le.length+1):X,Ee=`site:${le}:${ce}`,Re=kc(e.controlPlane,e.projectId,e.environmentId,X),de={...h,resourceId:Re,source:Ee,timestamp:te.checkedAt||a.toISOString(),host:te.route,attributes:{project:le,site:ce,route:String(te.route),status:String(te.status)}},Me=[["site.health.up",te.status==="live"?1:0,"boolean"],["site.http.status",Number(te.httpStatus),"status"],["site.response.time",Number(te.responseMs),"ms"]];if(te.tlsDaysRemaining!=null)Me.push(["site.tls.days_remaining",Number(te.tlsDaysRemaining),"days"]);for(let[ae,Le,Je]of Me)if(Number.isFinite(Le))l.push({...de,id:Kr(Ee,ae,de.timestamp),kind:"metric",name:ae,value:Le,unit:Je})}}}}catch(j){m.push({source:S==="serverless"?"aws":"host",message:j instanceof Error?j.message:String(j)})}{let j=e.config.infrastructure?.compute?.monitoring,B=typeof j==="object"?j?.egressEndpoints:void 0,V=await ba(B,{now:a.toISOString()});m.push(...V.errors);for(let W of V.metrics)l.push({...h,id:Kr(W.attributes.source,W.name,W.timestamp),kind:"metric",source:`egress:${W.attributes.source}`,name:W.name,timestamp:W.timestamp,value:W.value,unit:W.unit,attributes:W.attributes})}if(!e.lightweight)try{let j=await ie(e.config,e.environment),B=new fe(e.config,e.environment,{inventory:async()=>j});for(let V of j.workloads){let W=kc(e.controlPlane,e.projectId,e.environmentId,V.links.service),Y={...h,resourceId:W,source:`runtime:${V.provider}`,timestamp:a.toISOString(),workloadId:V.id,releaseId:V.links.release,attributes:{status:V.status,provider:V.provider,service:V.links.service??""}};if(l.push({...Y,id:Kr(V.id,"health",a.toISOString()),kind:"metric",name:"health.up",value:V.status==="running"?1:0,unit:"boolean"}),l.push({...Y,id:Kr(V.id,"restarts",a.toISOString()),kind:"metric",name:"saturation.restarts",value:V.restartCount??0,unit:"count"}),V.resources?.memoryBytes!=null)l.push({...Y,id:Kr(V.id,"memory",a.toISOString()),kind:"metric",name:"runtime.memory.used",value:V.resources.memoryBytes,unit:"bytes"});if(!V.capabilities.logs.supported)continue;try{let te=await B.logs(V.id,{limit:100,since:new Date(a.getTime()-300000)});for(let le of te.lines)l.push(...US({...h,resourceId:W,source:`runtime:${V.provider}`,name:`${V.links.service??V.name}.log`,timestamp:le.timestamp,message:le.message,workloadId:V.id}))}catch(te){m.push({source:`runtime:${V.provider}`,message:te instanceof Error?te.message:String(te)})}}for(let V of j.sources.filter((W)=>W.status!=="fresh"))m.push({source:V.id,message:V.message??`Runtime source is ${V.status}.`})}catch(j){m.push({source:"runtime",message:j instanceof Error?j.message:String(j)})}if(!e.lightweight)for(let j of e.controlPlane.listEvents({projectId:e.projectId,limit:1000})){let B=j.payload;l.push({...h,id:`telemetry:event:${j.id}`,resourceId:j.resourceId,kind:"event",source:"control-plane",name:j.type,timestamp:j.createdAt,level:j.level,message:j.type,deploymentId:j.operationId,releaseId:typeof B.releaseId==="string"?B.releaseId:void 0,traceId:j.correlationId,attributes:B})}let R=l.filter((j)=>P_(j,r)).map((j)=>({...j,sampled:r.samplingRate<1&&(j.kind==="log"||j.kind==="trace"||j.kind==="request"||j.name.startsWith("request."))})),y=t.appendMany(R).length;if(R_.shouldRun(e.projectId,C_,!e.lightweight))t.enforceRetention(r,e.projectId);let C=t.status(e.projectId,e.environmentId,r.rawDays,r.samplingRate);for(let j of m)if(!C.some((B)=>B.source===j.source))C.push({source:j.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:j.message});let T=a.toISOString();return e.controlPlane.setSetting(`telemetry.collection:${e.projectId}:${e.environmentId??"all"}`,{generatedAt:T,errors:m,statuses:C,policy:r}),{collected:y,cached:!1,generatedAt:T,statuses:C,errors:m,policy:r}}async function vm(e){let r=`${`${e.projectId}:${e.environmentId??"all"}:${e.environment}`}:${e.lightweight?"lightweight":"full"}`,a=M(e.config)==="serverless"?300000:60000,l=await HS.getOrCreate(r,a,!!e.force,()=>T_(e));return{...l.value,cached:l.cached}}function KS(e){HS.invalidate(`${e}:`)}function JS(e,t={}){let r=t.shell||(process.platform==="win32"?"powershell.exe":"bash"),a=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:t.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),l=new TextDecoder,m=async(h)=>{if(!h)return;let S=h.getReader();try{for(;;){let{done:R,value:y}=await S.read();if(R)break;if(y)e(l.decode(y))}}catch{}};if(m(a.stdout),m(a.stderr),t.onExit)a.exited.then((h)=>t.onExit(h)).catch(()=>{});return{write(h){try{a.stdin.write(h),a.stdin.flush()}catch{}},close(){try{a.stdin.end()}catch{}try{a.kill()}catch{}}}}var M_="127.0.0.1",L_=7676,QS=65536,aw="ts-cloud-dashboard-",Ha=D_(B_(import.meta.url));function F_(e){try{return process.kill(e,0),!0}catch(t){return t?.code!=="ESRCH"}}function z_(e=Vu(),t=F_){let r=0;for(let a of GS(e,{withFileTypes:!0})){if(!a.isDirectory()||!a.name.startsWith(aw))continue;let l=Ut(e,a.name),m=a.name.match(/^ts-cloud-dashboard-(\d+)-/);if(m){let h=Number(m[1]);if(h===process.pid||t(h))continue}else if(GS(l).length>0)continue;bs(l,{recursive:!0,force:!0}),r+=1}return r}var U_={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function O(e,t=200,r={}){return new Response(JSON.stringify(e,null,2),{status:t,headers:{"content-type":"application/json; charset=utf-8",...r}})}function q_(e,t,r,a){let l=new TextEncoder,m=Math.max(0,Math.floor(r)),h,S,R=!1,y=new ReadableStream({start(C){let T=()=>{if(R)return;if(R=!0,h?.(),S)clearInterval(S);a.removeEventListener("abort",T);try{C.close()}catch{}},j=(V)=>{if(R)return;if(V.reset)C.enqueue(l.encode(`event: reset
+[output truncated]`}function gm(e,t){return e.environments?.[t]?.app}function mm(e,t,r){let a=[],l=gm(e,t);a.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),a.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let m=r.maintenance?.enabled;if(m!==!0)a.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(m!==!1)a.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(l?.assets||r.assetsInfo)a.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(l?.database?.connection==="aurora-serverless")a.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(l.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(l.database.maxCapacity??4)}]});for(let h of r.queues??[]){let S=String(h?.name??"").trim();if(S&&/^[A-Za-z0-9_-]+$/.test(S))a.push({id:`queue:purge:${S}`,label:`Purge queue (${S})`,group:"queue",target:S,mutates:!0,confirm:S,danger:!0})}return a}function PS(e,t,r,a){return mm(t,r,a).find((l)=>l.id===e)}async function w_(e,t,r){try{let a=new f(r),{Stacks:l}=await a.describeStacks({stackName:qt(e,t)}),m={};for(let R of l?.[0]?.Outputs??[])if(R.OutputKey)m[R.OutputKey]=R.OutputValue??"";let h=m.AssetsCdnDomain;if(!h)return null;return(await new I(r).findDistributionByDomain(h))?.Id??null}catch{return null}}async function _S(e,t,r,a={}){try{if(r.id==="redeploy")return await ln(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await un(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await nr(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await nr(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let l=Number(a.min),m=Number(a.max);if(!Number.isFinite(l)||!Number.isFinite(m)||l<=0||m<l)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await mf(e,t,l,m),{operation:r.id,command:`db:scale ${l}-${m} ACU`,ok:!0,stdout:`Scaling applied (${l}-${m} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let l=await Ar(e,t),m=await w_(e,t,l.region);if(!m)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let S=await new I(l.region).invalidateAll(m);return{operation:r.id,command:`cloudfront invalidate ${m} /*`,ok:!0,stdout:`Invalidation ${S?.Id??"created"} for ${m} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let l=r.target,m=await Ar(e,t),h=new se(m.region),S=`${m.slug}-${t}-${l}`,{QueueUrl:R}=await h.getQueueUrl(S);return await h.purgeQueue(R),{operation:r.id,command:`sqs purge ${S}`,ok:!0,stdout:`Purged queue ${S}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(l){return{operation:r.id,ok:!1,error:Hr(l?.message??String(l))}}}async function TS(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};try{let l=await tt(e,t,a);return{operation:"command",command:a,ok:!0,stdout:Hr(l||"(no output)")}}catch(l){return{operation:"command",command:a,ok:!1,error:Hr(l?.message??String(l))}}}var fm="No dead-letter queue is provisioned for this environment.";async function hm(e,t,r){try{let{QueueUrl:a}=await e.getQueueUrl(`${t}-${r}-dlq`);return a}catch{return null}}async function xS(e,t,r=10){try{let a=await Ar(e,t),l=new se(a.region),m=await hm(l,a.slug,t);if(!m)return{ok:!1,messages:[],error:fm};return{ok:!0,messages:((await l.receiveMessages({queueUrl:m,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((R)=>({id:R.MessageId,receiptHandle:R.ReceiptHandle,body:Hr(String(R.Body??""))}))}}catch(a){return{ok:!1,messages:[],error:Hr(a?.message??String(a))}}}async function DS(e,t,r={}){try{let a=await Ar(e,t),l=gm(e,t),h=(l?Xt(l,a.slug,t):[]).map((B)=>B.name.replace(`${a.slug}-${t}-`,"")),S=r.targetQueue&&h.includes(r.targetQueue)?r.targetQueue:h[0];if(!S)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let R=new se(a.region),y=await hm(R,a.slug,t);if(!y)return{operation:"dlq:redrive",ok:!1,error:fm};let{QueueUrl:C}=await R.getQueueUrl(`${a.slug}-${t}-${S}`),T=Math.min(50,Math.max(1,r.max??10)),j=0;while(j<T){let V=(await R.receiveMessages({queueUrl:y,maxMessages:Math.min(10,T-j),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!V.length)break;for(let W of V)await R.sendMessage({queueUrl:C,messageBody:String(W.Body??"")}),await R.deleteMessage(y,W.ReceiptHandle),j++}return{operation:"dlq:redrive",command:`redrive → ${S}`,ok:!0,stdout:`Moved ${j} message(s) from the DLQ to ${S}.`}}catch(a){return{operation:"dlq:redrive",ok:!1,error:Hr(a?.message??String(a))}}}async function OS(e,t){try{let r=await Ar(e,t),a=new se(r.region),l=await hm(a,r.slug,t);if(!l)return{operation:"dlq:purge",ok:!1,error:fm};return await a.purgeQueue(l),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:Hr(r?.message??String(r))}}}function $S(e,t){let r=gm(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((a)=>({key:a.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:a})):Object.entries(r.secrets).map(([a,l])=>({key:a,secretId:String(l)}))}async function NS(e,t,r,a){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let l=await Ar(e,t),m=new z(l.region);try{await m.putSecretValue({SecretId:r,SecretString:a})}catch{await m.createSecret({Name:r,SecretString:a})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(l){return{operation:"secret:set",ok:!1,error:Hr(l?.message??String(l))}}}async function jS(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let a=await Ar(e,t);return await new z(a.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(a){return{operation:"secret:delete",ok:!1,error:Hr(a?.message??String(a))}}}var k_=new Set(["http","queue","cli"]);async function BS(e,t,r,a){if(!k_.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let l=a.memory==null?void 0:Number(a.memory),m=a.timeout==null?void 0:Number(a.timeout);if(l!=null&&(!Number.isInteger(l)||l<128||l>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(m!=null&&(!Number.isInteger(m)||m<1||m>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(l==null&&m==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let h=await Ar(e,t),S=new b(h.region),R=`${h.slug}-${t}-${r}`;await S.updateFunctionConfiguration({FunctionName:R,...l!=null?{MemorySize:l}:{},...m!=null?{Timeout:m}:{}});let y=[l!=null?`${l} MB`:"",m!=null?`${m}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${R} (${y})`,ok:!0,stdout:`Updated ${R}: ${y}.`}}catch(h){return{operation:"function:config",ok:!1,error:Hr(h?.message??String(h))}}}var pm=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function I_(e){return pm.find((t)=>t.key===e)}async function MS(e,t){try{let r=await Ar(e,t);return{ok:!0,alarms:await new oe(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:pm}}catch(r){return{ok:!1,alarms:[],presets:pm,error:Hr(r?.message??String(r))}}}async function LS(e,t,r,a){let l=I_(r);if(!l)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(a)||a<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let m=await Ar(e,t),h=new oe(m.region),S=`${m.slug}-${t}-${l.key}`,R=l.fnMode?[{Name:"FunctionName",Value:`${m.slug}-${t}-${l.fnMode}`}]:[];return await h.putMetricAlarm({AlarmName:S,Namespace:l.namespace,MetricName:l.metricName,ComparisonOperator:l.comparison,Threshold:a,EvaluationPeriods:1,Period:300,Statistic:l.statistic,Dimensions:R,AlarmDescription:`ts-cloud: ${l.label} > ${a} ${l.unit}`}),{operation:"alarm:create",command:`alarm ${S}`,ok:!0,stdout:`Alarm ${S} armed at ${a} ${l.unit}.`}}catch(m){return{operation:"alarm:create",ok:!1,error:Hr(m?.message??String(m))}}}async function FS(e,t,r){try{let a=await Ar(e,t);if(!r.startsWith(`${a.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new oe(a.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(a){return{operation:"alarm:delete",ok:!1,error:Hr(a?.message??String(a))}}}function E_(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function zu(e,t,r=30){try{let a=await Ar(e,t),l=new um(a.region),m=new Date,h=new Date(m.getTime()-Math.min(360,Math.max(1,r))*60000),S=`${a.slug}-${t}-http`,R=await l.getTraceSummaries({startTime:h,endTime:m,filterExpression:`service("${S}")`});if(!R.summaries.length)R=await l.getTraceSummaries({startTime:h,endTime:m});return{ok:!0,traces:R.summaries.slice(0,100).map(E_)}}catch(a){return{ok:!1,traces:[],error:Hr(a?.message??String(a))}}}async function ym(e,t,r){try{let a=await Ar(e,t),l=`${a.slug}-${t}-scheduler`;if(r==="run"){let h=await tt(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:Hr(h||"Scheduler run triggered.")}}let m=new ar(a.region);if(r==="enable")await m.enableRule({Name:l});else await m.disableRule({Name:l});return{operation:`scheduler:${r}`,command:`${r} ${l}`,ok:!0,stdout:`Scheduler rule ${l} ${r}d.`}}catch(a){return{operation:`scheduler:${r}`,ok:!1,error:Hr(a?.message??String(a))}}}function zS(e,t,r){let a=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!a.length){if(t)return;let m=e.map((h)=>h.id);return m.length?m:["__no_authorized_telemetry_resources__"]}let l=a.map((m)=>e.find((h)=>h.id===m||h.slug===m)?.id).filter((m)=>!!m);if(l.length!==a.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(l)]}import{createHash as qS}from"node:crypto";class VS{now;entries=new Map;constructor(e=Date.now){this.now=e}async getOrCreate(e,t,r,a){let l=this.entries.get(e);if(!r&&l&&l.expiresAt>this.now())return{value:await l.promise,cached:!0};let m=a().catch((h)=>{throw this.entries.delete(e),h});return this.entries.set(e,{expiresAt:this.now()+t,promise:m}),{value:await m,cached:!1}}invalidate(e){for(let t of this.entries.keys())if(t.startsWith(e))this.entries.delete(t)}}class WS{now;lastRun=new Map;constructor(e=Date.now){this.now=e}shouldRun(e,t,r=!1){let a=this.now(),l=this.lastRun.get(e);if(!r&&l!=null&&a-l<t)return!1;return this.lastRun.set(e,a),!0}}var HS=new VS,R_=new WS,A_=2000,C_=3600000;function P_(e,t){if(e.kind==="log"&&!t.collectLogs)return!1;if(e.kind==="trace"&&!t.collectTraces)return!1;if((e.kind==="request"||e.name.startsWith("request."))&&!t.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(e.kind)&&!e.name.startsWith("request."))return!0;let r=e.requestId??e.traceId??`${e.source}\x00${e.workloadId??""}\x00${e.timestamp}`;return Number.parseInt(qS("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=t.samplingRate}function Kr(...e){return`telemetry:${qS("sha256").update(e.map((t)=>String(t??"")).join("\x00")).digest("hex").slice(0,40)}`}function kc(e,t,r,a){if(!a)return;return e.listResources(t,r).find((l)=>l.slug===a)?.id}function __(e,t){let r=String(t??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(e)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(e)?"warning":"info"}function US(e){let t=e.timestamp&&Number.isFinite(new Date(e.timestamp).getTime())?new Date(e.timestamp).toISOString():new Date().toISOString(),r={};try{let W=JSON.parse(e.message);if(W&&typeof W==="object"&&!Array.isArray(W))r=W}catch{}let a=Object.fromEntries(Object.entries(r).filter(([W])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(W))),l=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,m=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,h=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),S=Number(r.statusCode??r.status_code??r.status),R=String(r.method??r.httpMethod??"")||void 0,y=Ti(String(r.pathTemplate??r.path??r.url??"")||void 0),C=String(r.releaseId??r.release_id??"")||void 0,T=String(r.deploymentId??r.deployment_id??"")||void 0,j={projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,source:e.source,timestamp:t,requestId:l,traceId:m,releaseId:C,deploymentId:T,workloadId:e.workloadId},B=Object.keys(r).length?JSON.stringify(a):e.message,V=[{...j,id:Kr(e.source,e.name,t,B),kind:"log",name:e.name,level:__(B,r.level),message:B,attributes:a}];if(R&&y&&Number.isFinite(S)){if(V.push({...j,id:Kr("request",l,t,R,y,S),kind:"request",name:"http.request",method:R,pathTemplate:y,host:r.host,statusCode:S,durationMs:Number.isFinite(h)?h:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(h))V.push({...j,id:Kr("request-duration",l,t),kind:"metric",name:"request.duration",value:h,unit:"ms",attributes:{method:R,pathTemplate:y,statusCode:S}});if(V.push({...j,id:Kr("request-count",l,t),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:R,pathTemplate:y,statusCode:S}}),S>=500)V.push({...j,id:Kr("request-error",l,t),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:R,pathTemplate:y,statusCode:S}})}return V}async function T_(e){let t=new ft(e.controlPlane),r=Gt(e.controlPlane,e.projectId),a=new Date,l=[],m=[],h={projectId:e.projectId,environmentId:e.environmentId},S=M(e.config);try{let j=(S==="serverless"?await pn(e.config,e.environment):await il(e.config,e.environment,{includeSiteHealth:e.includeSiteHealth,telemetryOnly:e.lightweight}))??{};if(S==="serverless"){for(let V of j.functionsDetail??[]){let W=kc(e.controlPlane,e.projectId,e.environmentId,V.key),Y={...h,resourceId:W,source:"cloudwatch",timestamp:a.toISOString(),workloadId:V.name,attributes:{provider:"aws",functionName:V.name,aggregationWindow:"24h"}};for(let[te,le,X]of[["snapshot.traffic.requests_24h",V.invocations,"count"],["snapshot.errors.count_24h",V.errors,"count"],["snapshot.latency.p50_24h",V.p50,"ms"],["snapshot.latency.p95_24h",V.p95,"ms"],["snapshot.latency.p99_24h",V.p99,"ms"],["snapshot.saturation.throttles_24h",V.throttles,"count"],["snapshot.memory.max_24h",V.maxMem,"MB"]])if(Number.isFinite(Number(le)))l.push({...Y,id:Kr("cloudwatch",V.name,te,a.toISOString()),kind:"metric",name:te,value:Number(le),unit:X})}try{let V=await Ar(e.config,e.environment),W=new oe(V.region),Y=new Date(a.getTime()-3600000),te=300;for(let le of V.functions){let X=[{Name:"FunctionName",Value:le.name}],[ce,Ee,Re,de,Me]=await Promise.all([W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:X,StartTime:Y,EndTime:a,Period:300,Statistics:["Sum"]}),W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:X,StartTime:Y,EndTime:a,Period:300,Statistics:["Sum"]}),W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:X,StartTime:Y,EndTime:a,Period:300,ExtendedStatistics:["p50","p95","p99"]}),W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:X,StartTime:Y,EndTime:a,Period:300,Statistics:["Sum"]}),W.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:X,StartTime:Y,EndTime:a,Period:300,Statistics:["Maximum"]})]),ae=kc(e.controlPlane,e.projectId,e.environmentId,le.mode),Le=(Je,gt,Jt,ot)=>{for(let Pt of Je){let Qt=Pt.Timestamp&&Number.isFinite(new Date(Pt.Timestamp).getTime())?new Date(Pt.Timestamp).toISOString():void 0,lt=Jt(Pt);if(Qt&&lt!=null&&Number.isFinite(lt))l.push({...h,resourceId:ae,id:Kr("cloudwatch-series",le.name,gt,Qt),kind:"metric",source:"cloudwatch",name:gt,timestamp:Qt,value:lt,unit:ot,workloadId:le.name,region:V.region,attributes:{provider:"aws",functionName:le.name,aggregationWindow:"300s"}})}};Le(ce,"traffic.requests",(Je)=>Je.Sum,"count"),Le(Ee,"errors.count",(Je)=>Je.Sum,"count"),Le(Re,"latency.p50",(Je)=>Je.Percentiles?.p50,"ms"),Le(Re,"latency.p95",(Je)=>Je.Percentiles?.p95,"ms"),Le(Re,"latency.p99",(Je)=>Je.Percentiles?.p99,"ms"),Le(de,"saturation.throttles",(Je)=>Je.Sum,"count"),Le(Me,"saturation.concurrency",(Je)=>Je.Maximum,"count")}}catch(V){m.push({source:"cloudwatch:series",message:V instanceof Error?V.message:String(V)})}for(let V of(j.serverlessLogs??[]).slice(0,A_))l.push(...US({...h,source:`cloudwatch:${V.source}`,name:`${V.source}.log`,timestamp:V.timestamp,message:String(V.message),resourceId:kc(e.controlPlane,e.projectId,e.environmentId,V.source)}));for(let V of j.queuesDetail??[]){let W={...h,source:"cloudwatch",timestamp:a.toISOString(),attributes:{queue:V.name}};l.push({...W,id:Kr("queue-depth",V.name,a.toISOString()),kind:"metric",name:"queue.depth",value:Number(V.visible??V.depth??0),unit:"count"}),l.push({...W,id:Kr("queue-inflight",V.name,a.toISOString()),kind:"metric",name:"queue.inflight",value:Number(V.inFlight??0),unit:"count"})}let B=await zu(e.config,e.environment,30);if(!B.ok)m.push({source:"xray",message:B.error??"X-Ray traces are unavailable."});for(let V of B.traces)l.push({...h,id:Kr("xray",V.id),kind:"trace",source:"xray",name:"http.trace",timestamp:V.timestamp??a.toISOString(),traceId:V.id,durationMs:V.durationMs,statusCode:V.httpStatus,method:V.method,pathTemplate:V.url,attributes:{status:V.status,responseMs:V.responseMs}})}else{let B=j.systemMetrics;if(j.metricsUnavailable||!B)m.push({source:"host",message:"The host metrics probe is unavailable."});else{let V=Number(B.memTotalMb)>0?Number(B.memUsedMb)/Number(B.memTotalMb)*100:0,W=Number(B.swapTotalMb)>0?Number(B.swapUsedMb)/Number(B.swapTotalMb)*100:0,Y=[["host.load",Number(B.load),"load"],["host.load.5m",Number(B.load5),"load"],["host.load.15m",Number(B.load15),"load"],["host.cpu.capacity",Number(B.cpus),"count"],["host.cpu.used_percent",Number(B.cpuUsedPct),"percent"],["host.memory.used",Number(B.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(B.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(B.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(B.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",V,"percent"],["host.swap.used",Number(B.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(B.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",W,"percent"],["host.disk.used_percent",Number(B.diskUsedPct),"percent"],["host.disk.used",Number(B.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(B.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(B.inodeUsedPct),"percent"],["host.network.rx",Number(B.networkRxBytes),"bytes"],["host.network.tx",Number(B.networkTxBytes),"bytes"],["host.network.rx_rate",Number(B.networkRxBytesPerSec),"bytes_per_second"],["host.network.tx_rate",Number(B.networkTxBytesPerSec),"bytes_per_second"],["host.network.rx_today",Number(B.networkRxBytesToday),"bytes"],["host.network.tx_today",Number(B.networkTxBytesToday),"bytes"],["host.network.rx_month",Number(B.networkRxBytesMonth),"bytes"],["host.network.tx_month",Number(B.networkTxBytesMonth),"bytes"],["host.processes",Number(B.processes),"count"],["host.uptime",Number(B.uptimeSeconds),"seconds"]];for(let[te,le,X]of Y)if(Number.isFinite(le))l.push({...h,id:Kr("host",te,a.toISOString()),kind:"metric",source:"host",name:te,timestamp:a.toISOString(),value:le,unit:X});for(let te of j.siteHealth??[]){let le=String(te.project??e.config.project.slug),X=String(te.name),ce=X.startsWith(`${le}:`)?X.slice(le.length+1):X,Ee=`site:${le}:${ce}`,Re=kc(e.controlPlane,e.projectId,e.environmentId,X),de={...h,resourceId:Re,source:Ee,timestamp:te.checkedAt||a.toISOString(),host:te.route,attributes:{project:le,site:ce,route:String(te.route),status:String(te.status)}},Me=[["site.health.up",te.status==="live"?1:0,"boolean"],["site.http.status",Number(te.httpStatus),"status"],["site.response.time",Number(te.responseMs),"ms"]];if(te.tlsDaysRemaining!=null)Me.push(["site.tls.days_remaining",Number(te.tlsDaysRemaining),"days"]);for(let[ae,Le,Je]of Me)if(Number.isFinite(Le))l.push({...de,id:Kr(Ee,ae,de.timestamp),kind:"metric",name:ae,value:Le,unit:Je})}}}}catch(j){m.push({source:S==="serverless"?"aws":"host",message:j instanceof Error?j.message:String(j)})}{let j=e.config.infrastructure?.compute?.monitoring,B=typeof j==="object"?j?.egressEndpoints:void 0,V=await ba(B,{now:a.toISOString()});m.push(...V.errors);for(let W of V.metrics)l.push({...h,id:Kr(W.attributes.source,W.name,W.timestamp),kind:"metric",source:`egress:${W.attributes.source}`,name:W.name,timestamp:W.timestamp,value:W.value,unit:W.unit,attributes:W.attributes})}if(!e.lightweight)try{let j=await ie(e.config,e.environment),B=new fe(e.config,e.environment,{inventory:async()=>j});for(let V of j.workloads){let W=kc(e.controlPlane,e.projectId,e.environmentId,V.links.service),Y={...h,resourceId:W,source:`runtime:${V.provider}`,timestamp:a.toISOString(),workloadId:V.id,releaseId:V.links.release,attributes:{status:V.status,provider:V.provider,service:V.links.service??""}};if(l.push({...Y,id:Kr(V.id,"health",a.toISOString()),kind:"metric",name:"health.up",value:V.status==="running"?1:0,unit:"boolean"}),l.push({...Y,id:Kr(V.id,"restarts",a.toISOString()),kind:"metric",name:"saturation.restarts",value:V.restartCount??0,unit:"count"}),V.resources?.memoryBytes!=null)l.push({...Y,id:Kr(V.id,"memory",a.toISOString()),kind:"metric",name:"runtime.memory.used",value:V.resources.memoryBytes,unit:"bytes"});if(!V.capabilities.logs.supported)continue;try{let te=await B.logs(V.id,{limit:100,since:new Date(a.getTime()-300000)});for(let le of te.lines)l.push(...US({...h,resourceId:W,source:`runtime:${V.provider}`,name:`${V.links.service??V.name}.log`,timestamp:le.timestamp,message:le.message,workloadId:V.id}))}catch(te){m.push({source:`runtime:${V.provider}`,message:te instanceof Error?te.message:String(te)})}}for(let V of j.sources.filter((W)=>W.status!=="fresh"))m.push({source:V.id,message:V.message??`Runtime source is ${V.status}.`})}catch(j){m.push({source:"runtime",message:j instanceof Error?j.message:String(j)})}if(!e.lightweight)for(let j of e.controlPlane.listEvents({projectId:e.projectId,limit:1000})){let B=j.payload;l.push({...h,id:`telemetry:event:${j.id}`,resourceId:j.resourceId,kind:"event",source:"control-plane",name:j.type,timestamp:j.createdAt,level:j.level,message:j.type,deploymentId:j.operationId,releaseId:typeof B.releaseId==="string"?B.releaseId:void 0,traceId:j.correlationId,attributes:B})}let R=l.filter((j)=>P_(j,r)).map((j)=>({...j,sampled:r.samplingRate<1&&(j.kind==="log"||j.kind==="trace"||j.kind==="request"||j.name.startsWith("request."))})),y=t.appendMany(R).length;if(R_.shouldRun(e.projectId,C_,!e.lightweight))t.enforceRetention(r,e.projectId);let C=t.status(e.projectId,e.environmentId,r.rawDays,r.samplingRate);for(let j of m)if(!C.some((B)=>B.source===j.source))C.push({source:j.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:j.message});let T=a.toISOString();return e.controlPlane.setSetting(`telemetry.collection:${e.projectId}:${e.environmentId??"all"}`,{generatedAt:T,errors:m,statuses:C,policy:r}),{collected:y,cached:!1,generatedAt:T,statuses:C,errors:m,policy:r}}async function vm(e){let r=`${`${e.projectId}:${e.environmentId??"all"}:${e.environment}`}:${e.lightweight?"lightweight":"full"}`,a=M(e.config)==="serverless"?300000:60000,l=await HS.getOrCreate(r,a,!!e.force,()=>T_(e));return{...l.value,cached:l.cached}}function KS(e){HS.invalidate(`${e}:`)}function JS(e,t={}){let r=t.shell||(process.platform==="win32"?"powershell.exe":"bash"),a=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:t.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),l=new TextDecoder,m=async(h)=>{if(!h)return;let S=h.getReader();try{for(;;){let{done:R,value:y}=await S.read();if(R)break;if(y)e(l.decode(y))}}catch{}};if(m(a.stdout),m(a.stderr),t.onExit)a.exited.then((h)=>t.onExit(h)).catch(()=>{});return{write(h){try{a.stdin.write(h),a.stdin.flush()}catch{}},close(){try{a.stdin.end()}catch{}try{a.kill()}catch{}}}}var M_="127.0.0.1",L_=7676,QS=65536,aw="ts-cloud-dashboard-",Ha=D_(B_(import.meta.url));function F_(e){try{return process.kill(e,0),!0}catch(t){return t?.code!=="ESRCH"}}function z_(e=Vu(),t=F_){let r=0;for(let a of GS(e,{withFileTypes:!0})){if(!a.isDirectory()||!a.name.startsWith(aw))continue;let l=Ut(e,a.name),m=a.name.match(/^ts-cloud-dashboard-(\d+)-/);if(m){let h=Number(m[1]);if(h===process.pid||t(h))continue}else if(GS(l).length>0)continue;bs(l,{recursive:!0,force:!0}),r+=1}return r}var U_={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function x(e,t=200,r={}){return new Response(JSON.stringify(e,null,2),{status:t,headers:{"content-type":"application/json; charset=utf-8",...r}})}function q_(e,t,r,a){let l=new TextEncoder,m=Math.max(0,Math.floor(r)),h,S,R=!1,y=new ReadableStream({start(C){let T=()=>{if(R)return;if(R=!0,h?.(),S)clearInterval(S);a.removeEventListener("abort",T);try{C.close()}catch{}},j=(V)=>{if(R)return;if(V.reset)C.enqueue(l.encode(`event: reset
 data: ${JSON.stringify({cursor:V.cursor,droppedBytes:V.droppedBytes})}
 
 `));for(let W of V.chunks.filter((Y)=>Y.cursor>m))m=W.cursor,C.enqueue(l.encode(`id: ${W.cursor}
@@ -673,29 +673,29 @@ data: ${JSON.stringify({cursor:m,at:new Date().toISOString()})}
 ${S}
 ${R}`);return null}return a}catch(l){if(a)bs(a,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${l.message}`);return null}}function ns(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:yo(Ka(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,a])=>[r,{domain:a.domain,path:a.path,type:a.type,deploy:a.deploy,root:a.root,port:a.port,ssl:a.ssl}]))}}function mn(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function is(e,t){return mn(t).find((r)=>r.id===e)}function ew(e){if(e.length<=QS)return e;return`${e.slice(0,QS)}
 
-[output truncated]`}async function tw(e,t,r){let a=e.getReader(),l=new TextDecoder,m="";while(!0){let{done:S,value:R}=await a.read();if(S)break;let y=l.decode(R,{stream:!0});if(m+=y,y)r?.(t,y)}let h=l.decode();if(h)m+=h,r?.(t,h);return m}async function Sm(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[l,m,h]=await Promise.all([tw(r.stdout,"stdout",t.onOutput),tw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:h,ok:h===0,stdout:ew(l),stderr:ew(m)}}finally{t.signal?.removeEventListener("abort",a)}}function sT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var aT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function cT(e){let t=Ec(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!aT.has(r)}var dT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function rw(e,t){if(t.role==="admin")return!0;let r=Ec(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!cT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let l=dT[a];return!!l&&!!t.capabilities?.includes(l)}function lT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),l=O_(r===""?"index.html":r);if(l.startsWith("..")||l.includes("/../"))return null;let m=Ut(e,l);if(Ai(m)&&!sw(m).isDirectory())return m;if(!Ec(m)&&Ai(`${m}.html`))return`${m}.html`;if(!Ec(m)&&Ai(Ut(m,"index.html")))return Ut(m,"index.html");return null}async function nw(e,t){let r=lT(e,t);if(!r){let m=Ut(e,"404.html");if(Ai(m))return new Response(await ii(m),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Wu("Not found",404)}if(sw(r).isDirectory())return Wu("Not found",404);let a=await ii(r),l=U_[Ec(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":l}})}var qu=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],iw=new WeakMap;async function ow(e){let t=iw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),l={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return iw.set(e,l),l}async function $a(e={}){z_();let t=e.cwd??process.cwd(),r=e.host??M_,a=e.port??L_,l=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Q_(t);let m=e.config??await sl(),h=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,S=p(m);if(h&&S&&!S.password)S.password=h;let R=m.infrastructure?.compute?.managedServices?.vitess;if(h&&R&&typeof R==="object"&&!R.password)R.password=h;let y=ou(t,m);if(y.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${y.reconciliation.failed} orphaned operation(s) as failed after restart.`);let C=Object.keys(m.environments??{}),T=J_(m,e.environment),j=Y_(t),B=await vs(m,T),V=new Map([[T,B]]),W=new Map([[T,Date.now()]]),Y=new Map([[T,Date.now()]]),te=new Map,le=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),X=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=M(m)!=="serverless",Ee=(N)=>{let ze=V.get(N);if(ze&&!YS(W.get(N),Date.now(),le))return Promise.resolve(ze);let qe=te.get(N);if(qe)return qe;let Fe=!ce||YS(Y.get(N),Date.now(),X),Ge=vs(m,N,{includeSiteHealth:Fe}).then((Rt)=>{let q=V.get(N),Ur=Fe?Rt:nT(q,Rt);if(V.set(N,Ur),W.set(N,Date.now()),Fe)Y.set(N,Date.now());if(q?._serverReachable!==Ur._serverReachable||q?._metricsStatus!==Ur._metricsStatus||(q?.sitesDetail?.length??0)!==(Ur.sitesDetail?.length??0))ot();return Ur}).finally(()=>te.delete(N));return te.set(N,Ge),Ge},Re=Lt(t),de=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&de!=="0"&&(de==="1"||!m.cloud?.attachTo)){let N=!1,ze=Date.now()+300000,qe=async()=>{if(N)return;N=!0;try{let Ge=Date.now(),Rt=Ge>=ze;if(Rt)ze=Ge+300000;let q=y.environments.get(T);await vm({controlPlane:y.store,projectId:y.project.id,environmentId:q?.id,config:m,environment:T,force:!0,lightweight:!0,includeSiteHealth:Rt})}catch(Ge){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ge instanceof Error?Ge.message:String(Ge)}`)}finally{N=!1}};qe(),setInterval(()=>void qe(),60000).unref?.()}let ae=new Map,Le=new Map,Je=new Set,gt=0;function Jt(N,ze){if(N.role==="admin"&&!y.store.getActorByExternalId("user",`dashboard:${N.username.toLowerCase()}`))return N;let qe=y.store.getActorByExternalId("user",`dashboard:${N.username.toLowerCase()}`),Fe=qe?y.store.getMembershipForActor(y.organization.id,qe.id):void 0;if(!Fe||Fe.status!=="active")return{...N,role:"member",sites:{},capabilities:[]};let Ge=y.store.listGrants(Fe.id),Rt=y.store.resolveAuthorizationTarget(y.organization.id,Fe.scope)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),q=Mt({membership:Fe,grants:Ge,target:Rt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...N,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:q};let Ur=y.environments.get(ze),vr={};for(let at of y.store.listResources(y.project.id,Ur?.id).filter((pt)=>pt.kind==="application")){let pt=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:at.id});if(!pt||!D({membership:Fe,grants:Ge,capability:"project:read",target:pt}).allowed)continue;vr[at.slug]=D({membership:Fe,grants:Ge,capability:"config:write",target:pt}).allowed?"owner":"collaborator"}return{...N,role:"member",sites:vr,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:q}}function ot(){gt+=1,ae.clear();for(let N of Je)bs(N,{recursive:!0,force:!0});Je.clear()}let Pt=(N,ze)=>`${ze}:${N.role==="admin"?"admin":`member:${Object.entries(N.sites).sort(([qe],[Fe])=>qe.localeCompare(Fe)).map(([qe,Fe])=>`${qe}=${Fe}`).join(",")}`}:${[...N.capabilities??[]].sort().join(",")}`;async function Qt(N,ze){let qe=Jt(N,ze),Fe=Pt(qe,ze),Ge=ae.get(Fe);if(Ge)return Ge;let Rt=Le.get(Fe);if(Rt)return Rt;let q=gt,Ur=(async()=>{let vr=V.get(ze)??await vs(m,ze);V.set(ze,vr);let at={...dm(vr,{user:qe,slug:m.project.slug}),viewer:{role:qe.role,organizationRole:qe.organizationRole,organizationSource:qe.organizationSource,capabilities:qe.capabilities??[]}},pt=await oT(t,at);if(pt&&q!==gt)return bs(pt,{recursive:!0,force:!0}),Re?.uiRoot;if(pt)Je.add(pt);let $r=pt??Re?.uiRoot;if($r)ae.set(Fe,$r);return $r})();Le.set(Fe,Ur);try{return await Ur}finally{Le.delete(Fe)}}let lt=await Qt({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!lt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let G=new WeakMap,ue=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",be=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(be&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let De=!be,mt=Qb(t),_t=De?eS(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Ne=new Ui(y.store,{encryptionKey:Ye(t)}),yt=new Qi(y.store),ut=new en(y.store),Ke=new Qo(y.store,{encryptionKey:Ye(t)}),zr=new dp(y.store),Ss=new gp(y.store,{cwd:t}),Yn=new up(y.store,{encryptionKey:Ye(t)}),Vt=new c(y.store,{workerId:`dashboard:${process.pid}`}),or=new ta(y.store),oi=new la(y.store,Ye(t)),Ci=new Ba(y.store),Rc=new Wi(or,Vt,oi),Pi=m.project?.region??"us-east-1",km=Ye(t),kn=new La(Ci,{encryptionKey:km,backends:[new gn(y.store,km),new _a(new z(Pi),Pi),new xa(new we(Pi),Pi),new Oa]});await Eu(kn,y,m);let Hu=new K(Pi),cw={aws_rds:new ra(new aa(Hu)),aws_aurora:new na(new ca(Hu)),aws_elasticache:new ia(new da(new it(Pi))),server:new sa(new er),container:new oa(new er)},Im=(N)=>cw[N.provider],br=new va(y.store),vo=new rs(br,Vt),Em=new Ta(oi),dw={managed_database:new wa(or,Hu),logical_database:new Da(or,oi),volume:new Pa,files:new Ra(t),control_plane:new Na(y.store,t),infrastructure:new ka(new ir(Pi))},lw=(N)=>dw[N.resourceKind],uw=(N)=>N.provider==="aws_backup"?void 0:Em,Ku=new Ft(y.store),Ju=[new xr,new zs(d(t,"volumes"))],si=new js(Ku,Ju,Vt),Ja=new ua(y.store),Zn=new pa(Ja,[new on("aws"),new on("hetzner"),new on("ssh")],Vt),_i=new ga(y.store),Rm=new ma(_i,Ja),bo=new ha(y.store),Am=new fa(bo,Vt),ai=new ya(y.store),Gu=new Ia(ai,Vt),Cm=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((N)=>new Sa(N,y.store,y.project.id,y.organization.id)),Pr=new Yo(y.store),Pm=new ea(Pr,{queue:Vt}),yr=new _r(y.store),xi=new Or(y.store),Dn=new It(y.store),st=new Ei(y.store,{encryptionKey:Ye(t)}),pw=()=>ow(y.store);for(let N of y.environments.values())Zo(Pr,m,{organization:y.organization,project:y.project,environment:N,resources:y.store.listResources(y.project.id,N.id)});let On=new bi(st,{emailImpl:async(N)=>{let{email:ze}=await import("./chunk-3kpnn06d.js");return ze.send(N)}}),_m=async(N)=>{let ze=oo(st,y.project.id,N),qe=[];for(let Fe of ze.filter((Ge)=>Ge.notify&&Ge.alert))qe.push(...await On.deliverAll(On.enqueue(y.organization.id,Fe.alert,Fe.transition)));return qe.push(...await On.deliverAll(On.enqueueRemindersAndEscalations(y.organization.id,st.listAlerts(y.project.id,{environmentId:N,states:["firing"]})))),qe.push(...await On.retryDue()),{evaluations:ze,deliveries:qe}},Qu=!1,gw=async()=>{if(Qu)return;Qu=!0;try{for(let N of y.environments.values())for(let ze of st.listHealthChecks(y.project.id,N.id).filter((qe)=>qe.enabled)){let qe=st.listHealthResults(ze.id,1)[0];if(qe&&Date.now()-new Date(qe.checkedAt).getTime()<ze.intervalSeconds*1000)continue;let Fe=await new je(st).runAndEvaluate(ze);for(let Ge of Fe.evaluations.filter((Rt)=>Rt.notify&&Rt.alert))await On.deliverAll(On.enqueue(y.organization.id,Ge.alert,Ge.transition))}}finally{Qu=!1}},Tm=setInterval(()=>{for(let N of y.environments.values())_m(N.id).catch((ze)=>console.error("ts-cloud alert evaluation failed:",ze))},60000);Tm.unref?.();let xm=setInterval(()=>{gw().catch((N)=>console.error("ts-cloud health check evaluation failed:",N))},30000);xm.unref?.();let Dm=setInterval(()=>{try{Pm.tick()}catch(N){console.error("ts-cloud scheduled job evaluation failed:",N)}},30000);Dm.unref?.();let Om=setInterval(()=>{try{vo.enqueueDue(),vo.enqueueRetention()}catch(N){console.error("ts-cloud backup policy evaluation failed:",N)}},30000);Om.unref?.(),yr.cleanup();let $m=setInterval(()=>{try{yr.cleanup()}catch(N){console.error("ts-cloud preview cleanup failed:",N)}},3600000);$m.unref?.();let mw=e.queueWorker??!0,fw=sT(),hw=async(N,ze)=>{let Fe=(N.environmentId?y.store.listEnvironments(N.projectId).find((Ge)=>Ge.id===N.environmentId):void 0)?.slug??String(T);if(ze.kind==="dashboard_operation"&&ze.operationId){let Ge=V.get(Fe)??B,Rt=cm(ze.operationId,m,Ge);if(!Rt||Rt.danger||!["scheduler","backup","worker"].includes(Rt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let q=await Bu(m,Fe,Rt);return{ok:q.ok,stdout:q.stdout,stderr:q.stderr??q.error,retryable:/temporar|unavailable|timeout|network/i.test(q.stderr??q.error??""),output:{command:q.command??null,operation:q.operation}}}if(ze.kind==="serverless_scheduler"){let Ge=await ym(m,Fe,"run");return{ok:Ge.ok,stdout:Ge.stdout,stderr:Ge.error,retryable:/temporar|unavailable|timeout|network/i.test(Ge.error??""),output:{command:Ge.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${ze.kind}.`}},Ac=mw?new qs(Vt,{...Kc({store:y.store,execute:async(N,ze)=>{let qe=ze.operation.input&&typeof ze.operation.input==="object"&&!Array.isArray(ze.operation.input)?ze.operation.input:{},Fe=qe.source&&typeof qe.source==="object"?qe.source:void 0,Ge=t,Rt,q,Ur;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let at=Ke.getBinding(String(Fe.bindingId)),pt=Ke.getConnection(String(Fe.connectionId));if(!at||!pt||at.connectionId!==pt.id)throw Error("Queued source binding is no longer available");let Rr=(at.repositoryId?Ke.getRepository(at.repositoryId):Ke.listRepositories(pt.id).find((Is)=>Is.fullName.toLowerCase()===at.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Rr&&pt.provider==="generic_ssh")Rr=`git@${new URL(pt.host).hostname}:${at.repositoryFullName}.git`;if(!Rr)Rr=new URL(`/${at.repositoryFullName}.git`,pt.host.endsWith("/")?pt.host:`${pt.host}/`).href;let Ce=at.deployKeyId?Ke.getDeployKey(at.deployKeyId):void 0,sr=Ce&&at.deployKeyId?{...Ce,privateKey:Ke.getDeployPrivateKey(at.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(pt.provider)&&N.target.previewId){let Is=Ze(pt,Ke.getCredential(pt.id)),me=yr.previews.getInstance(N.target.previewId);Ur=async($n,xc)=>{try{await Is.setCommitStatus(at.repositoryFullName,String(Fe.commitSha),{state:$n,url:me?.url,description:xc})}catch(Es){ze.log(`Could not publish source status: ${Es instanceof Error?Es.message:String(Es)}`,{stream:"stderr"})}},await Ur("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}Rt=wm(Ut(Vu(),"ts-cloud-queued-source-")),ze.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),Ge=(await Go({remote:Rr,binding:at,destination:Ut(Rt,"checkout"),ref:String(Fe.branch??at.defaultBranch),commitSha:String(Fe.commitSha)},{credential:Ke.getCredential(pt.id),deployKey:sr})).directory}if(ze.operation.kind!=="preview.destroy"){let at=N.target.previewId?yr.previews.getInstance(N.target.previewId):void 0,pt=at?yr.previews.getDefinition(at.definitionId):void 0,$r=ze.operation.resourceId?y.store.getResource(ze.operation.resourceId):void 0;if(q=await kn.resolve({projectId:y.project.id,environmentId:ze.operation.environmentId,resourceId:ze.operation.resourceId,functionId:$r?.kind==="function"?$r.id:void 0,previewId:at?.id,trustedPreview:!!at&&!at.fork,allowedPreviewSecrets:pt?.inheritedSecrets}),q.warnings.some((Rr)=>Rr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${q.warnings.filter((Rr)=>Rr.code==="missing_required").map((Rr)=>Rr.key).join(", ")}`);if(ze.operation.resourceId)for(let Rr of Object.values(q.entries))Ci.setDependency({entryId:Rr.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:Rr.required,requiresRedeploy:!0});ze.log(`Resolved configuration ${q.configurationHash.slice(0,18)} for ${Object.keys(q.values).length} keys.`,{stream:"system"})}let vr=await Sm(N,{cwd:Ge,cliEntry:l,signal:ze.signal,env:q?.values,onOutput:(at,pt)=>ze.log(pt,{stream:at,step:"execute",secrets:[...fw,...Object.entries(q?.entries??{}).filter(([,$r])=>$r.kind==="secret").map(([$r])=>q.values[$r]).filter(Boolean)]})});if(vr.ok&&ze.operation.resourceId&&q)for(let at of Object.values(q.entries))Ci.setDependency({entryId:at.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:at.required,requiresRedeploy:!1,lastDeployedVersion:at.version});return await Ur?.(vr.ok?"success":"failure",vr.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),vr}catch(vr){throw await Ur?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),vr}finally{if(Rt)bs(Rt,{recursive:!0,force:!0})}}}),...Ul({store:Pr,executor:hw}),...Hl({store:or,secrets:oi,resolveAdapter:Im}),...Vl(Ja,Zn.drivers),...zl(bo,[new Aa("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Yl({store:ai,cleanup:Cm}),...Wc(Ku,Ju),...Au({store:br,queue:Vt,resolveSource:lw,resolveDestination:uw,validateHealth:async(N,ze)=>{if(!N.healthCheckId)return{healthy:!0,mode:"adapter"};let qe=st.getHealthCheck(N.healthCheckId);if(!qe||qe.projectId!==N.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new je(st).runAndEvaluate(qe);return{healthy:Fe.result.status==="healthy",healthCheckId:qe.id,healthResultId:Fe.result.id,target:ze}}}),...yl({store:y.store,resolveDriver:e.releaseDriver??((N)=>({name:`${y.store.getResource(N.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:N.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(N,ze)=>{let qe=st.listHealthChecks(ze.projectId,ze.environmentId).find((Ge)=>Ge.enabled&&Ge.name===N&&(!Ge.resourceId||Ge.resourceId===ze.resourceId));if(!qe)return{healthy:!1,message:`Named health gate ${N} was not found for this release.`};let Fe=await new je(st).runAndEvaluate(qe);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:qe.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(N)=>console.error("ts-cloud deployment queue worker failed:",N)}):void 0;if(kl(y),ji(ut,ne(y,String(T)),B),_t)Zi(y,_t.users),nS(Ne,y,_t.users);let lr=tS({cwd:t,enabled:De,secret:mt,authentication:Ne,authorization:{store:y.store,organizationId:y.organization.id,projectId:y.project.id,defaultEnvironment:String(T)}}),Sr=new Xo,Nm=setInterval(()=>Sr.sweep(),60000);Nm.unref?.();let Cc=new Sc,Yu=new Sc(3,900000,900000),Pc=new Sc(8,900000,900000),Bm=setInterval(()=>Cc.prune(),300000),Mm=setInterval(()=>Yu.prune(),300000),Lm=setInterval(()=>Pc.prune(),300000);if(Bm.unref?.(),Mm.unref?.(),Lm.unref?.(),De){if(_t?.generated)console.warn(`
+[output truncated]`}async function tw(e,t,r){let a=e.getReader(),l=new TextDecoder,m="";while(!0){let{done:S,value:R}=await a.read();if(S)break;let y=l.decode(R,{stream:!0});if(m+=y,y)r?.(t,y)}let h=l.decode();if(h)m+=h,r?.(t,h);return m}async function Sm(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[l,m,h]=await Promise.all([tw(r.stdout,"stdout",t.onOutput),tw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:h,ok:h===0,stdout:ew(l),stderr:ew(m)}}finally{t.signal?.removeEventListener("abort",a)}}function sT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var aT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function cT(e){let t=Ec(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!aT.has(r)}var dT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function rw(e,t){if(t.role==="admin")return!0;let r=Ec(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!cT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let l=dT[a];return!!l&&!!t.capabilities?.includes(l)}function lT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),l=O_(r===""?"index.html":r);if(l.startsWith("..")||l.includes("/../"))return null;let m=Ut(e,l);if(Ai(m)&&!sw(m).isDirectory())return m;if(!Ec(m)&&Ai(`${m}.html`))return`${m}.html`;if(!Ec(m)&&Ai(Ut(m,"index.html")))return Ut(m,"index.html");return null}async function nw(e,t){let r=lT(e,t);if(!r){let m=Ut(e,"404.html");if(Ai(m))return new Response(await ii(m),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Wu("Not found",404)}if(sw(r).isDirectory())return Wu("Not found",404);let a=await ii(r),l=U_[Ec(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":l}})}var qu=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],iw=new WeakMap;async function ow(e){let t=iw.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),l={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return iw.set(e,l),l}async function $a(e={}){z_();let t=e.cwd??process.cwd(),r=e.host??M_,a=e.port??L_,l=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Q_(t);let m=e.config??await sl(),h=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,S=p(m);if(h&&S&&!S.password)S.password=h;let R=m.infrastructure?.compute?.managedServices?.vitess;if(h&&R&&typeof R==="object"&&!R.password)R.password=h;let y=ou(t,m);if(y.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${y.reconciliation.failed} orphaned operation(s) as failed after restart.`);let C=Object.keys(m.environments??{}),T=J_(m,e.environment),j=Y_(t),B=await vs(m,T),V=new Map([[T,B]]),W=new Map([[T,Date.now()]]),Y=new Map([[T,Date.now()]]),te=new Map,le=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),X=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ce=M(m)!=="serverless",Ee=(N)=>{let ze=V.get(N);if(ze&&!YS(W.get(N),Date.now(),le))return Promise.resolve(ze);let qe=te.get(N);if(qe)return qe;let Fe=!ce||YS(Y.get(N),Date.now(),X),Ge=vs(m,N,{includeSiteHealth:Fe}).then((Rt)=>{let q=V.get(N),Ur=Fe?Rt:nT(q,Rt);if(V.set(N,Ur),W.set(N,Date.now()),Fe)Y.set(N,Date.now());if(q?._serverReachable!==Ur._serverReachable||q?._metricsStatus!==Ur._metricsStatus||(q?.sitesDetail?.length??0)!==(Ur.sitesDetail?.length??0))ot();return Ur}).finally(()=>te.delete(N));return te.set(N,Ge),Ge},Re=Lt(t),de=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&de!=="0"&&(de==="1"||!m.cloud?.attachTo)){let N=!1,ze=Date.now()+300000,qe=async()=>{if(N)return;N=!0;try{let Ge=Date.now(),Rt=Ge>=ze;if(Rt)ze=Ge+300000;let q=y.environments.get(T);await vm({controlPlane:y.store,projectId:y.project.id,environmentId:q?.id,config:m,environment:T,force:!0,lightweight:!0,includeSiteHealth:Rt})}catch(Ge){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ge instanceof Error?Ge.message:String(Ge)}`)}finally{N=!1}};qe(),setInterval(()=>void qe(),60000).unref?.()}let ae=new Map,Le=new Map,Je=new Set,gt=0;function Jt(N,ze){if(N.role==="admin"&&!y.store.getActorByExternalId("user",`dashboard:${N.username.toLowerCase()}`))return N;let qe=y.store.getActorByExternalId("user",`dashboard:${N.username.toLowerCase()}`),Fe=qe?y.store.getMembershipForActor(y.organization.id,qe.id):void 0;if(!Fe||Fe.status!=="active")return{...N,role:"member",sites:{},capabilities:[]};let Ge=y.store.listGrants(Fe.id),Rt=y.store.resolveAuthorizationTarget(y.organization.id,Fe.scope)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),q=Mt({membership:Fe,grants:Ge,target:Rt});if(Fe.roleTemplate==="owner"||Fe.roleTemplate==="admin")return{...N,role:"admin",sites:{},organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:q};let Ur=y.environments.get(ze),vr={};for(let at of y.store.listResources(y.project.id,Ur?.id).filter((pt)=>pt.kind==="application")){let pt=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:at.id});if(!pt||!D({membership:Fe,grants:Ge,capability:"project:read",target:pt}).allowed)continue;vr[at.slug]=D({membership:Fe,grants:Ge,capability:"config:write",target:pt}).allowed?"owner":"collaborator"}return{...N,role:"member",sites:vr,organizationRole:Fe.roleTemplate,organizationSource:Fe.source,capabilities:q}}function ot(){gt+=1,ae.clear();for(let N of Je)bs(N,{recursive:!0,force:!0});Je.clear()}let Pt=(N,ze)=>`${ze}:${N.role==="admin"?"admin":`member:${Object.entries(N.sites).sort(([qe],[Fe])=>qe.localeCompare(Fe)).map(([qe,Fe])=>`${qe}=${Fe}`).join(",")}`}:${[...N.capabilities??[]].sort().join(",")}`;async function Qt(N,ze){let qe=Jt(N,ze),Fe=Pt(qe,ze),Ge=ae.get(Fe);if(Ge)return Ge;let Rt=Le.get(Fe);if(Rt)return Rt;let q=gt,Ur=(async()=>{let vr=V.get(ze)??await vs(m,ze);V.set(ze,vr);let at={...dm(vr,{user:qe,slug:m.project.slug}),viewer:{role:qe.role,organizationRole:qe.organizationRole,organizationSource:qe.organizationSource,capabilities:qe.capabilities??[]}},pt=await oT(t,at);if(pt&&q!==gt)return bs(pt,{recursive:!0,force:!0}),Re?.uiRoot;if(pt)Je.add(pt);let $r=pt??Re?.uiRoot;if($r)ae.set(Fe,$r);return $r})();Le.set(Fe,Ur);try{return await Ur}finally{Le.delete(Fe)}}let lt=await Qt({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!lt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let G=new WeakMap,ue=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",be=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(be&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let xe=!be,mt=Qb(t),_t=xe?eS(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Ne=new Ui(y.store,{encryptionKey:Ye(t)}),yt=new Qi(y.store),ut=new en(y.store),Ke=new Qo(y.store,{encryptionKey:Ye(t)}),zr=new dp(y.store),Ss=new gp(y.store,{cwd:t}),Yn=new up(y.store,{encryptionKey:Ye(t)}),Vt=new c(y.store,{workerId:`dashboard:${process.pid}`}),or=new ta(y.store),oi=new la(y.store,Ye(t)),Ci=new Ba(y.store),Rc=new Wi(or,Vt,oi),Pi=m.project?.region??"us-east-1",km=Ye(t),kn=new La(Ci,{encryptionKey:km,backends:[new gn(y.store,km),new _a(new z(Pi),Pi),new Oa(new we(Pi),Pi),new xa]});await Eu(kn,y,m);let Hu=new K(Pi),cw={aws_rds:new ra(new aa(Hu)),aws_aurora:new na(new ca(Hu)),aws_elasticache:new ia(new da(new it(Pi))),server:new sa(new er),container:new oa(new er)},Im=(N)=>cw[N.provider],br=new va(y.store),vo=new rs(br,Vt),Em=new Ta(oi),dw={managed_database:new wa(or,Hu),logical_database:new Da(or,oi),volume:new Pa,files:new Ra(t),control_plane:new Na(y.store,t),infrastructure:new ka(new ir(Pi))},lw=(N)=>dw[N.resourceKind],uw=(N)=>N.provider==="aws_backup"?void 0:Em,Ku=new Ft(y.store),Ju=[new Or,new zs(d(t,"volumes"))],si=new js(Ku,Ju,Vt),Ja=new ua(y.store),Zn=new pa(Ja,[new on("aws"),new on("hetzner"),new on("ssh")],Vt),_i=new ga(y.store),Rm=new ma(_i,Ja),bo=new ha(y.store),Am=new fa(bo,Vt),ai=new ya(y.store),Gu=new Ia(ai,Vt),Cm=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((N)=>new Sa(N,y.store,y.project.id,y.organization.id)),Pr=new Yo(y.store),Pm=new ea(Pr,{queue:Vt}),yr=new _r(y.store),xi=new xr(y.store),Dn=new It(y.store),st=new Ei(y.store,{encryptionKey:Ye(t)}),pw=()=>ow(y.store);for(let N of y.environments.values())Zo(Pr,m,{organization:y.organization,project:y.project,environment:N,resources:y.store.listResources(y.project.id,N.id)});let On=new bi(st,{emailImpl:async(N)=>{let{email:ze}=await import("./chunk-983txhkg.js");return ze.send(N)}}),_m=async(N)=>{let ze=oo(st,y.project.id,N),qe=[];for(let Fe of ze.filter((Ge)=>Ge.notify&&Ge.alert))qe.push(...await On.deliverAll(On.enqueue(y.organization.id,Fe.alert,Fe.transition)));return qe.push(...await On.deliverAll(On.enqueueRemindersAndEscalations(y.organization.id,st.listAlerts(y.project.id,{environmentId:N,states:["firing"]})))),qe.push(...await On.retryDue()),{evaluations:ze,deliveries:qe}},Qu=!1,gw=async()=>{if(Qu)return;Qu=!0;try{for(let N of y.environments.values())for(let ze of st.listHealthChecks(y.project.id,N.id).filter((qe)=>qe.enabled)){let qe=st.listHealthResults(ze.id,1)[0];if(qe&&Date.now()-new Date(qe.checkedAt).getTime()<ze.intervalSeconds*1000)continue;let Fe=await new je(st).runAndEvaluate(ze);for(let Ge of Fe.evaluations.filter((Rt)=>Rt.notify&&Rt.alert))await On.deliverAll(On.enqueue(y.organization.id,Ge.alert,Ge.transition))}}finally{Qu=!1}},Tm=setInterval(()=>{for(let N of y.environments.values())_m(N.id).catch((ze)=>console.error("ts-cloud alert evaluation failed:",ze))},60000);Tm.unref?.();let xm=setInterval(()=>{gw().catch((N)=>console.error("ts-cloud health check evaluation failed:",N))},30000);xm.unref?.();let Dm=setInterval(()=>{try{Pm.tick()}catch(N){console.error("ts-cloud scheduled job evaluation failed:",N)}},30000);Dm.unref?.();let Om=setInterval(()=>{try{vo.enqueueDue(),vo.enqueueRetention()}catch(N){console.error("ts-cloud backup policy evaluation failed:",N)}},30000);Om.unref?.(),yr.cleanup();let $m=setInterval(()=>{try{yr.cleanup()}catch(N){console.error("ts-cloud preview cleanup failed:",N)}},3600000);$m.unref?.();let mw=e.queueWorker??!0,fw=sT(),hw=async(N,ze)=>{let Fe=(N.environmentId?y.store.listEnvironments(N.projectId).find((Ge)=>Ge.id===N.environmentId):void 0)?.slug??String(T);if(ze.kind==="dashboard_operation"&&ze.operationId){let Ge=V.get(Fe)??B,Rt=cm(ze.operationId,m,Ge);if(!Rt||Rt.danger||!["scheduler","backup","worker"].includes(Rt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let q=await Bu(m,Fe,Rt);return{ok:q.ok,stdout:q.stdout,stderr:q.stderr??q.error,retryable:/temporar|unavailable|timeout|network/i.test(q.stderr??q.error??""),output:{command:q.command??null,operation:q.operation}}}if(ze.kind==="serverless_scheduler"){let Ge=await ym(m,Fe,"run");return{ok:Ge.ok,stdout:Ge.stdout,stderr:Ge.error,retryable:/temporar|unavailable|timeout|network/i.test(Ge.error??""),output:{command:Ge.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${ze.kind}.`}},Ac=mw?new qs(Vt,{...Kc({store:y.store,execute:async(N,ze)=>{let qe=ze.operation.input&&typeof ze.operation.input==="object"&&!Array.isArray(ze.operation.input)?ze.operation.input:{},Fe=qe.source&&typeof qe.source==="object"?qe.source:void 0,Ge=t,Rt,q,Ur;try{if(Fe?.bindingId&&Fe?.connectionId&&Fe?.commitSha){let at=Ke.getBinding(String(Fe.bindingId)),pt=Ke.getConnection(String(Fe.connectionId));if(!at||!pt||at.connectionId!==pt.id)throw Error("Queued source binding is no longer available");let Rr=(at.repositoryId?Ke.getRepository(at.repositoryId):Ke.listRepositories(pt.id).find((Is)=>Is.fullName.toLowerCase()===at.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Rr&&pt.provider==="generic_ssh")Rr=`git@${new URL(pt.host).hostname}:${at.repositoryFullName}.git`;if(!Rr)Rr=new URL(`/${at.repositoryFullName}.git`,pt.host.endsWith("/")?pt.host:`${pt.host}/`).href;let Ce=at.deployKeyId?Ke.getDeployKey(at.deployKeyId):void 0,sr=Ce&&at.deployKeyId?{...Ce,privateKey:Ke.getDeployPrivateKey(at.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(pt.provider)&&N.target.previewId){let Is=Ze(pt,Ke.getCredential(pt.id)),me=yr.previews.getInstance(N.target.previewId);Ur=async($n,xc)=>{try{await Is.setCommitStatus(at.repositoryFullName,String(Fe.commitSha),{state:$n,url:me?.url,description:xc})}catch(Es){ze.log(`Could not publish source status: ${Es instanceof Error?Es.message:String(Es)}`,{stream:"stderr"})}},await Ur("pending",`Preview deployment started for ${String(Fe.commitSha).slice(0,12)}`)}Rt=wm(Ut(Vu(),"ts-cloud-queued-source-")),ze.log(`Checking out immutable source commit ${Fe.commitSha}.`,{stream:"system"}),Ge=(await Go({remote:Rr,binding:at,destination:Ut(Rt,"checkout"),ref:String(Fe.branch??at.defaultBranch),commitSha:String(Fe.commitSha)},{credential:Ke.getCredential(pt.id),deployKey:sr})).directory}if(ze.operation.kind!=="preview.destroy"){let at=N.target.previewId?yr.previews.getInstance(N.target.previewId):void 0,pt=at?yr.previews.getDefinition(at.definitionId):void 0,$r=ze.operation.resourceId?y.store.getResource(ze.operation.resourceId):void 0;if(q=await kn.resolve({projectId:y.project.id,environmentId:ze.operation.environmentId,resourceId:ze.operation.resourceId,functionId:$r?.kind==="function"?$r.id:void 0,previewId:at?.id,trustedPreview:!!at&&!at.fork,allowedPreviewSecrets:pt?.inheritedSecrets}),q.warnings.some((Rr)=>Rr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${q.warnings.filter((Rr)=>Rr.code==="missing_required").map((Rr)=>Rr.key).join(", ")}`);if(ze.operation.resourceId)for(let Rr of Object.values(q.entries))Ci.setDependency({entryId:Rr.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:Rr.required,requiresRedeploy:!0});ze.log(`Resolved configuration ${q.configurationHash.slice(0,18)} for ${Object.keys(q.values).length} keys.`,{stream:"system"})}let vr=await Sm(N,{cwd:Ge,cliEntry:l,signal:ze.signal,env:q?.values,onOutput:(at,pt)=>ze.log(pt,{stream:at,step:"execute",secrets:[...fw,...Object.entries(q?.entries??{}).filter(([,$r])=>$r.kind==="secret").map(([$r])=>q.values[$r]).filter(Boolean)]})});if(vr.ok&&ze.operation.resourceId&&q)for(let at of Object.values(q.entries))Ci.setDependency({entryId:at.id,resourceId:ze.operation.resourceId,injectionTarget:"environment",required:at.required,requiresRedeploy:!1,lastDeployedVersion:at.version});return await Ur?.(vr.ok?"success":"failure",vr.ok?`Preview is ready at ${String(Fe?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Fe?.commitSha).slice(0,12)}`),vr}catch(vr){throw await Ur?.("error",`Preview deployment could not complete at ${String(Fe?.commitSha).slice(0,12)}`),vr}finally{if(Rt)bs(Rt,{recursive:!0,force:!0})}}}),...Ul({store:Pr,executor:hw}),...Hl({store:or,secrets:oi,resolveAdapter:Im}),...Vl(Ja,Zn.drivers),...zl(bo,[new Aa("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Yl({store:ai,cleanup:Cm}),...Wc(Ku,Ju),...Au({store:br,queue:Vt,resolveSource:lw,resolveDestination:uw,validateHealth:async(N,ze)=>{if(!N.healthCheckId)return{healthy:!0,mode:"adapter"};let qe=st.getHealthCheck(N.healthCheckId);if(!qe||qe.projectId!==N.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Fe=await new je(st).runAndEvaluate(qe);return{healthy:Fe.result.status==="healthy",healthCheckId:qe.id,healthResultId:Fe.result.id,target:ze}}}),...yl({store:y.store,resolveDriver:e.releaseDriver??((N)=>({name:`${y.store.getResource(N.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:N.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(N,ze)=>{let qe=st.listHealthChecks(ze.projectId,ze.environmentId).find((Ge)=>Ge.enabled&&Ge.name===N&&(!Ge.resourceId||Ge.resourceId===ze.resourceId));if(!qe)return{healthy:!1,message:`Named health gate ${N} was not found for this release.`};let Fe=await new je(st).runAndEvaluate(qe);return{healthy:Fe.result.status==="healthy",evidence:{healthCheckId:qe.id,healthResultId:Fe.result.id,status:Fe.result.status,timings:Fe.result.timings},message:Fe.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(N)=>console.error("ts-cloud deployment queue worker failed:",N)}):void 0;if(kl(y),ji(ut,ne(y,String(T)),B),_t)Zi(y,_t.users),nS(Ne,y,_t.users);let lr=tS({cwd:t,enabled:xe,secret:mt,authentication:Ne,authorization:{store:y.store,organizationId:y.organization.id,projectId:y.project.id,defaultEnvironment:String(T)}}),Sr=new Xo,Nm=setInterval(()=>Sr.sweep(),60000);Nm.unref?.();let Cc=new Sc,Yu=new Sc(3,900000,900000),Pc=new Sc(8,900000,900000),Bm=setInterval(()=>Cc.prune(),300000),Mm=setInterval(()=>Yu.prune(),300000),Lm=setInterval(()=>Pc.prune(),300000);if(Bm.unref?.(),Mm.unref?.(),Lm.unref?.(),xe){if(_t?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${_t.generated.username}
     password: ${_t.generated.password}
   Saved (hashed) to ${Zb()}. This password is shown once.
 `)}else console.warn("  ts-cloud dashboard: authentication is DISABLED (TS_CLOUD_DASHBOARD_AUTH=0). Every request runs as an admin.");let Di=r!=="127.0.0.1"&&r!=="localhost",Zu=(N)=>x_("sha256").update(`${mt}:${N}`).digest("hex").slice(0,16),yw=jo({controlPlane:y.store,identities:yt,sources:Ke,applications:{drafts:zr,artifacts:Ss,registries:Yn}}),Fm=(N)=>N.headers.get("user-agent")?.trim().slice(0,256)||void 0,_c=(N,ze,qe,Fe="local")=>Ne.createSession({identityId:N,authMethod:Fe,userAgent:Fm(ze),networkHint:Zu(qe)}),We=(N)=>{let ze=y.store.getActorByExternalId("user",`dashboard:${N.username.toLowerCase()}`),qe=ze?y.store.getMembershipForActor(y.organization.id,ze.id):void 0;return{actor:ze,membership:qe,grants:qe?y.store.listGrants(qe.id):[]}},ws=(N,ze,qe)=>{if(N.role==="admin")return!0;let Fe=y.store.getOperation(ze),Ge=We(N);if(!Fe||!Ge.membership)return!1;let Rt=Fe.resourceId?{type:"resource",id:Fe.resourceId}:Fe.environmentId?{type:"environment",id:Fe.environmentId}:Fe.projectId?{type:"project",id:Fe.projectId}:{type:"organization"},q=y.store.resolveAuthorizationTarget(y.organization.id,Rt);return!!q&&D({membership:Ge.membership,grants:Ge.grants,capability:qe,target:q}).allowed},Dr=(N,ze,qe)=>{if(N.role==="admin")return!0;let Fe=We(N);if(!Fe.membership)return!1;let Ge=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:ze});return!!Ge&&D({membership:Fe.membership,grants:Fe.grants,capability:qe,target:Ge}).allowed},Ga=(N,ze,qe)=>{if(N.role==="admin")return!0;let Fe=We(N);if(!Fe.membership)return!1;let Ge=y.store.resolveAuthorizationTarget(y.organization.id,{type:"environment",id:ze});return!!Ge&&D({membership:Fe.membership,grants:Fe.grants,capability:qe,target:Ge}).allowed},Tc=(N,ze)=>{if(N.role==="admin")return!0;let qe=We(N);if(!qe.membership)return!1;let Fe=y.store.resolveAuthorizationTarget(y.organization.id,{type:"organization"});return!!Fe&&D({membership:qe.membership,grants:qe.grants,capability:ze,target:Fe}).allowed},ks=Bun.serve({hostname:r,port:a,idleTimeout:30,websocket:{open(N){if(!ue){N.send(`The web terminal is disabled (TS_CLOUD_DASHBOARD_TERMINAL=0).\r
 `),N.close();return}let ze=JS((qe)=>N.send(qe),{cwd:t,onExit:()=>{try{N.close()}catch{}}});G.set(N,ze),N.send(`Connected to ${r==="127.0.0.1"?"localhost":r} shell. This is a line-oriented shell (no full-screen apps).\r
-`)},message(N,ze){G.get(N)?.write(typeof ze==="string"?ze:new TextDecoder().decode(ze))},close(N){G.get(N)?.close(),G.delete(N)}},async fetch(N,ze){let qe=Date.now(),Fe=N.clone(),Ge=N.headers.get("x-request-id")?.slice(0,128)||crypto.randomUUID(),Rt=!["GET","HEAD","OPTIONS"].includes(N.method.toUpperCase()),q=new URL(N.url),vr=await(async()=>{let at=ze??ks,pt=K_(r,at.port??a),$r=await yw(N,Zu(at.requestIP(N)?.address??"unknown"));if($r)return $r;let Rr=q.searchParams.get("env"),Ce=G_(C,T,Rr),sr=V.get(Ce);if(!sr)sr=await Ee(Ce);try{if(!X_(N))return O({ok:!1,error:"Cross-site requests are not allowed."},403);let So=/^\/api\/source\/webhooks\/([A-Za-z0-9_-]{16,200})$/.exec(q.pathname);if(So&&N.method==="POST"){let A=await bl({sources:Ke,controlPlane:y.store,endpointToken:So[1],headers:N.headers,rawBody:new Uint8Array(await N.arrayBuffer())});return O({accepted:A.accepted,duplicate:A.duplicate,status:A.status,operationIds:A.operations.map((P)=>P.id),message:A.message},A.accepted?202:404)}let Is=/^\/auth\/oidc\/([a-z0-9-]+)\/(start|callback)$/.exec(q.pathname);if(Is&&N.method==="GET"){let[,A,P]=Is;if(!pt)return new Response(null,{status:302,headers:{location:"/login?sso_error=configuration"}});if(P==="start")try{let F=await $o(Ne,A,pt,q.searchParams.get("return")??void 0,e.oidcFetch);return new Response(null,{status:302,headers:{location:F.authorizationUrl,"cache-control":"no-store"}})}catch(F){return y.store.appendEvent({organizationId:y.organization.id,type:"auth.oidc.start_failed",level:"warning",payload:{provider:A,reason:F instanceof Error?F.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=start","cache-control":"no-store"}})}try{if(q.searchParams.has("error")){let Q=Ne.getOidcProviderBySlug(A),J=q.searchParams.get("state");if(Q&&J)Ne.consumeOidcTransaction(Q.id,J);throw Error("OIDC provider returned an authorization error")}let F=await Mo(Ne,{providerSlug:A,state:q.searchParams.get("state")??"",code:q.searchParams.get("code")??"",origin:pt},e.oidcFetch),U=iS(Ne,y,t,F.identity);Ne.recordLogin(U.identity.id);let H=_c(U.identity.id,N,at.requestIP(N)?.address??"unknown","oidc");return ot(),y.store.appendEvent({organizationId:y.organization.id,actorId:U.identity.actorId,type:"auth.login.succeeded",payload:{method:"oidc",provider:A,provisioned:U.provisioned}}),new Response(null,{status:302,headers:{location:F.returnPath,"cache-control":"no-store","set-cookie":Ua(H.token,{secure:Di,maxAgeMs:Xe})}})}catch(F){return y.store.appendEvent({organizationId:y.organization.id,type:"auth.oidc.callback_failed",level:"warning",payload:{provider:A,reason:F instanceof Error?F.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=callback","cache-control":"no-store"}})}}if(q.pathname==="/api/invitations/accept"&&N.method==="POST"){let A=await re(N),P=String(A.token??"").trim(),F=String(A.username??"").trim(),U=String(A.password??"");if(!P||!Ou(F)||U.length<12)return O({ok:!1,error:"Invitation token, valid username, and a password of at least 12 characters are required."},422);let H=y.store.inspectInvitationToken(P);if(!H||H.state!=="pending")return O({ok:!1,error:H?`Invitation is ${H.state}`:"Invitation is invalid"},H?409:404);let Q=Fn(wn(t),F),J=Ne.getIdentityByUsername(F);if(Q&&!Qn(U,J?.passwordHash??Q.passwordHash))return O({ok:!1,error:"That username already exists; enter its current password to continue."},401);let ee=Ne.getIdentityByEmail(H.email);if(ee&&ee.id!==J?.id)return O({ok:!1,error:"This invitation belongs to an existing account. Sign in with that account or ask an owner to resend it."},409);let Se=vc(t,{username:F,password:Q?void 0:U,name:typeof A.name==="string"?A.name:void 0,email:H.email,sites:Q?.sites??{}}),ve=E(y.store,Se.user);try{let nt=y.store.acceptInvitation(P,ve.id),Pe=J?Ne.setVerifiedEmail(J.id,nt.invitation.email):Ne.createIdentity({actorId:ve.id,username:Se.user.username,email:nt.invitation.email,emailVerified:!0,passwordHash:Se.user.passwordHash}),He=_c(Pe.id,N,at.requestIP(N)?.address??"unknown");return ot(),O({ok:!0,user:qa(Se.user),organization:y.organization,membership:nt.membership},200,{"set-cookie":Ua(He.token,{secure:Di,maxAgeMs:Xe})})}catch(nt){if(!Q)sm(t,Se.user.username);let Pe=nt instanceof Error?nt.message:"Invitation could not be accepted.";return O({ok:!1,error:Pe},Pe.includes("expired")||Pe.includes("revoked")||Pe.includes("accepted")?409:404)}}if(q.pathname==="/api/auth/password-reset/request"&&N.method==="POST"){let A=await re(N),P=String(A.identifier??"").trim().toLowerCase(),F=at.requestIP(N)?.address??"unknown",U=Yu.check(P,F),H=P.includes("@")?Ne.getIdentityByEmail(P):Ne.getIdentityByUsername(P);if(U.allowed)Yu.recordFailure(P,F);if(U.allowed&&H?.email&&H.emailVerifiedAt&&!H.disabledAt){Ne.revokeActionTokens(H.id,"password_reset");let Q=Ne.createActionToken(H.id,"password_reset"),J=`${q.origin}/reset-password?token=${encodeURIComponent(Q.token)}`,ee=await Xr(m,{to:H.email,subject:"Reset your ts-cloud password",text:`Reset your ts-cloud password: ${J}
+`)},message(N,ze){G.get(N)?.write(typeof ze==="string"?ze:new TextDecoder().decode(ze))},close(N){G.get(N)?.close(),G.delete(N)}},async fetch(N,ze){let qe=Date.now(),Fe=N.clone(),Ge=N.headers.get("x-request-id")?.slice(0,128)||crypto.randomUUID(),Rt=!["GET","HEAD","OPTIONS"].includes(N.method.toUpperCase()),q=new URL(N.url),vr=await(async()=>{let at=ze??ks,pt=K_(r,at.port??a),$r=await yw(N,Zu(at.requestIP(N)?.address??"unknown"));if($r)return $r;let Rr=q.searchParams.get("env"),Ce=G_(C,T,Rr),sr=V.get(Ce);if(!sr)sr=await Ee(Ce);try{if(!X_(N))return x({ok:!1,error:"Cross-site requests are not allowed."},403);let So=/^\/api\/source\/webhooks\/([A-Za-z0-9_-]{16,200})$/.exec(q.pathname);if(So&&N.method==="POST"){let A=await bl({sources:Ke,controlPlane:y.store,endpointToken:So[1],headers:N.headers,rawBody:new Uint8Array(await N.arrayBuffer())});return x({accepted:A.accepted,duplicate:A.duplicate,status:A.status,operationIds:A.operations.map((P)=>P.id),message:A.message},A.accepted?202:404)}let Is=/^\/auth\/oidc\/([a-z0-9-]+)\/(start|callback)$/.exec(q.pathname);if(Is&&N.method==="GET"){let[,A,P]=Is;if(!pt)return new Response(null,{status:302,headers:{location:"/login?sso_error=configuration"}});if(P==="start")try{let F=await $o(Ne,A,pt,q.searchParams.get("return")??void 0,e.oidcFetch);return new Response(null,{status:302,headers:{location:F.authorizationUrl,"cache-control":"no-store"}})}catch(F){return y.store.appendEvent({organizationId:y.organization.id,type:"auth.oidc.start_failed",level:"warning",payload:{provider:A,reason:F instanceof Error?F.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=start","cache-control":"no-store"}})}try{if(q.searchParams.has("error")){let Q=Ne.getOidcProviderBySlug(A),J=q.searchParams.get("state");if(Q&&J)Ne.consumeOidcTransaction(Q.id,J);throw Error("OIDC provider returned an authorization error")}let F=await Mo(Ne,{providerSlug:A,state:q.searchParams.get("state")??"",code:q.searchParams.get("code")??"",origin:pt},e.oidcFetch),U=iS(Ne,y,t,F.identity);Ne.recordLogin(U.identity.id);let H=_c(U.identity.id,N,at.requestIP(N)?.address??"unknown","oidc");return ot(),y.store.appendEvent({organizationId:y.organization.id,actorId:U.identity.actorId,type:"auth.login.succeeded",payload:{method:"oidc",provider:A,provisioned:U.provisioned}}),new Response(null,{status:302,headers:{location:F.returnPath,"cache-control":"no-store","set-cookie":Ua(H.token,{secure:Di,maxAgeMs:Xe})}})}catch(F){return y.store.appendEvent({organizationId:y.organization.id,type:"auth.oidc.callback_failed",level:"warning",payload:{provider:A,reason:F instanceof Error?F.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=callback","cache-control":"no-store"}})}}if(q.pathname==="/api/invitations/accept"&&N.method==="POST"){let A=await re(N),P=String(A.token??"").trim(),F=String(A.username??"").trim(),U=String(A.password??"");if(!P||!Ou(F)||U.length<12)return x({ok:!1,error:"Invitation token, valid username, and a password of at least 12 characters are required."},422);let H=y.store.inspectInvitationToken(P);if(!H||H.state!=="pending")return x({ok:!1,error:H?`Invitation is ${H.state}`:"Invitation is invalid"},H?409:404);let Q=Fn(wn(t),F),J=Ne.getIdentityByUsername(F);if(Q&&!Qn(U,J?.passwordHash??Q.passwordHash))return x({ok:!1,error:"That username already exists; enter its current password to continue."},401);let ee=Ne.getIdentityByEmail(H.email);if(ee&&ee.id!==J?.id)return x({ok:!1,error:"This invitation belongs to an existing account. Sign in with that account or ask an owner to resend it."},409);let Se=vc(t,{username:F,password:Q?void 0:U,name:typeof A.name==="string"?A.name:void 0,email:H.email,sites:Q?.sites??{}}),ve=E(y.store,Se.user);try{let nt=y.store.acceptInvitation(P,ve.id),Pe=J?Ne.setVerifiedEmail(J.id,nt.invitation.email):Ne.createIdentity({actorId:ve.id,username:Se.user.username,email:nt.invitation.email,emailVerified:!0,passwordHash:Se.user.passwordHash}),He=_c(Pe.id,N,at.requestIP(N)?.address??"unknown");return ot(),x({ok:!0,user:qa(Se.user),organization:y.organization,membership:nt.membership},200,{"set-cookie":Ua(He.token,{secure:Di,maxAgeMs:Xe})})}catch(nt){if(!Q)sm(t,Se.user.username);let Pe=nt instanceof Error?nt.message:"Invitation could not be accepted.";return x({ok:!1,error:Pe},Pe.includes("expired")||Pe.includes("revoked")||Pe.includes("accepted")?409:404)}}if(q.pathname==="/api/auth/password-reset/request"&&N.method==="POST"){let A=await re(N),P=String(A.identifier??"").trim().toLowerCase(),F=at.requestIP(N)?.address??"unknown",U=Yu.check(P,F),H=P.includes("@")?Ne.getIdentityByEmail(P):Ne.getIdentityByUsername(P);if(U.allowed)Yu.recordFailure(P,F);if(U.allowed&&H?.email&&H.emailVerifiedAt&&!H.disabledAt){Ne.revokeActionTokens(H.id,"password_reset");let Q=Ne.createActionToken(H.id,"password_reset"),J=`${q.origin}/reset-password?token=${encodeURIComponent(Q.token)}`,ee=await Xr(m,{to:H.email,subject:"Reset your ts-cloud password",text:`Reset your ts-cloud password: ${J}
 
-This link expires in one hour and can be used once.`});y.store.appendEvent({organizationId:y.organization.id,actorId:H.actorId,type:"auth.password_reset.requested",payload:{delivered:ee}})}return O({ok:!0,message:"If that account has a verified email, a reset link has been sent."},202)}if(q.pathname==="/api/auth/password-reset/complete"&&N.method==="POST"){let A=await re(N),P=String(A.token??"").trim(),F=String(A.password??"");if(!P||F.length<12)return O({ok:!1,error:"A valid reset token and password of at least 12 characters are required."},422);try{let U=Ne.consumeActionToken(P,"password_reset"),H=ho(F),Q=Ne.updatePassword(U.identityId,H);return Nu(t,Q.username,H),y.store.appendEvent({organizationId:y.organization.id,actorId:Q.actorId,type:"auth.password_reset.completed"}),O({ok:!0,message:"Password changed. Sign in again."},200,{"set-cookie":Du({secure:Di})})}catch(U){let H=U instanceof Error?U.message:"Password reset failed.";return O({ok:!1,error:H.replace("Action token","Reset link")},H.includes("consumed")||H.includes("expired")?409:404)}}if(q.pathname==="/api/login"&&N.method==="POST"){let A=await re(N),P=String(A.username??"").trim(),F=String(A.password??""),U=at.requestIP(N)?.address??"unknown",H=Cc.check(P,U);if(!H.allowed)return O({ok:!1,error:`Too many failed attempts. Try again in ${Math.ceil((H.retryAfterSeconds??0)/60)} minute(s).`},429,{"retry-after":String(H.retryAfterSeconds??60)});let Q=Fn(wn(t),P),J=Ne.getIdentityByUsername(P),ee=J?.passwordHash??Q?.passwordHash??H_;if(!(Qn(F,ee)&&!!Q&&!!J&&!J.disabledAt))return Cc.recordFailure(P,U),O({ok:!1,error:"Incorrect username or password."},401);if(oS(Ne,y,J))return O({ok:!1,error:"Single sign-on is required for this account."},403);Cc.recordSuccess(P,U);let ve=J,nt=ve.requiresPasswordUpgrade||vb(ve.passwordHash);if(nt){let He=ho(F);ve=Ne.rehashPassword(ve.id,He),Nu(t,ve.username,He)}if(Ne.recordLogin(ve.id),Ne.getMfaFactor(ve.id)?.state==="active"){let He=Ne.createMfaChallenge(ve.id,"login");return y.store.appendEvent({organizationId:y.organization.id,actorId:ve.actorId,type:"auth.mfa.challenge.created",payload:{purpose:"login"}}),O({ok:!0,mfaRequired:!0,challengeToken:He.token,passwordUpgraded:nt})}let Pe=_c(ve.id,N,U);return y.store.appendEvent({organizationId:y.organization.id,actorId:ve.actorId,type:"auth.login.succeeded",payload:{method:"local"}}),O({ok:!0,user:qa(Q),passwordUpgraded:nt},200,{"set-cookie":Ua(Pe.token,{secure:Di,maxAgeMs:Xe})})}if(q.pathname==="/api/auth/mfa/complete"&&N.method==="POST"){let A=await re(N),P=String(A.challengeToken??"").trim(),F=String(A.code??"").trim(),U=at.requestIP(N)?.address??"unknown",Q=Ne.inspectMfaChallengeToken(P,"login")?.identityId??"unknown-mfa",J=Pc.check(Q,U);if(!J.allowed)return O({ok:!1,error:"Too many MFA attempts. Try again later."},429,{"retry-after":String(J.retryAfterSeconds??60)});try{let ee=Ne.completeMfaChallenge(P,F,"login");Pc.recordSuccess(Q,U);let Se=new Date().toISOString(),ve=Ne.createSession({identityId:ee.identity.id,userAgent:Fm(N),networkHint:Zu(U),mfaAt:Se,recentAuthAt:Se});return y.store.appendEvent({organizationId:y.organization.id,actorId:ee.identity.actorId,type:"auth.mfa.succeeded",payload:{purpose:"login",method:ee.method}}),O({ok:!0},200,{"set-cookie":Ua(ve.token,{secure:Di,maxAgeMs:Xe})})}catch{return Pc.recordFailure(Q,U),O({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}}if(q.pathname==="/api/logout"&&N.method==="POST"){let A=lr.resolveSession(N);if(A)Ne.revokeSession(A.identityId,A.id);let P=Du({secure:Di});if(N.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login","set-cookie":P}});return O({ok:!0},200,{"set-cookie":P})}if(q.pathname==="/login"){let A=Ne.listOidcProviders(y.organization.id).map((P)=>({slug:P.slug,name:P.name}));return new Response(sS(B?.mode==="serverless",A),{headers:{"content-type":"text/html; charset=utf-8"}})}if(q.pathname==="/forgot-password"||q.pathname==="/reset-password")return new Response(aS(q.pathname==="/reset-password"?"reset":"request"),{headers:{"content-type":"text/html; charset=utf-8"}});if(q.pathname==="/accept-invitation")return nw(lt,q.pathname);let me=lr.resolveUser(N);if(!me){if(!q.pathname.startsWith("/api/")&&N.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login"}});return O({ok:!1,error:"Sign in to continue."},401)}let $n=Jt(me,Ce);if(q.pathname==="/api/me"){let A=y.store.getActorByExternalId("user",`dashboard:${me.username.toLowerCase()}`),P=A?y.store.getMembershipForActor(y.organization.id,A.id):void 0,F=y.store.resolveAuthorizationTarget(y.organization.id,P?.scope??{type:"project",id:y.project.id})??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id});return O({ok:!0,user:qa(me),authEnabled:De,organization:y.organization,membership:P,capabilities:Mt({membership:P,grants:P?y.store.listGrants(P.id):[],target:F})})}if(q.pathname.startsWith("/api/")){let A=await rS(N,q.pathname),P=lr.check(N,q.pathname,me,A);if(!P.ok)return O({ok:!1,error:P.error},P.status??403);if(De&&rT.has(`${N.method.toUpperCase()} ${q.pathname}`)){let F=lr.resolveSession(N);if(!F||!Ne.isRecentlyAuthenticated(F))return O({ok:!1,error:"Recent authentication is required for this change.",stepUpRequired:!0},401)}}if(q.pathname==="/api/auth/security"&&N.method==="GET"){let A=We(me),P=A.actor?Ne.getIdentityByActor(A.actor.id):void 0,F=lr.resolveSession(N);return O({identity:P?{username:P.username,email:P.email,emailVerifiedAt:P.emailVerifiedAt,requiresPasswordUpgrade:P.requiresPasswordUpgrade,lastLoginAt:P.lastLoginAt}:void 0,currentSessionId:F?.id,sessions:P?Ne.listSessions(P.id,{includeInactive:!0}):[],mfa:P?{factor:Ne.getMfaFactor(P.id),recoveryCodesRemaining:Ne.remainingRecoveryCodes(P.id)}:void 0})}if(q.pathname==="/api/auth/oidc/providers"&&N.method==="GET")return O({providers:Ne.listOidcProviders(y.organization.id,{includeDisabled:!0}),callbackOrigin:pt,callbackPattern:pt?`${pt}/auth/oidc/{slug}/callback`:void 0,localOwnerRecovery:!0});if(q.pathname==="/api/auth/oidc/providers"&&N.method==="POST"){let A=await re(N),P=We(me),F=P.actor?Ne.getIdentityByActor(P.actor.id):void 0,U=A.enforceSso===!0;if(U&&(!F?.emailVerifiedAt||Ne.remainingRecoveryCodes(F.id)<1))return O({ok:!1,error:"Verify the owner email and generate MFA recovery codes before enforcing SSO."},409);try{let H=Uu(A.defaultRole),Q=Ne.upsertOidcProvider({id:typeof A.id==="string"?A.id:void 0,organizationId:y.organization.id,slug:String(A.slug??""),name:String(A.name??""),issuer:String(A.issuer??""),clientId:String(A.clientId??""),clientSecret:typeof A.clientSecret==="string"&&A.clientSecret?A.clientSecret:void 0,scopes:Array.isArray(A.scopes)?A.scopes.map(String):void 0,allowedDomains:Array.isArray(A.allowedDomains)?A.allowedDomains.map(String):[],defaultRole:H&&H!=="owner"?H:void 0,enabled:A.enabled!==!1,enforceSso:U});return y.store.appendEvent({organizationId:y.organization.id,actorId:P.actor?.id,type:"auth.oidc.provider.configured",payload:{providerId:Q.id,issuer:Q.issuer,enabled:Q.enabled,enforceSso:Q.enforceSso}}),O({ok:!0,provider:Q})}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"OIDC provider could not be saved."},422)}}if(q.pathname==="/api/auth/oidc/providers"&&N.method==="PATCH"){let A=await re(N),P=Ne.getOidcProvider(String(A.id??""));if(!P||P.organizationId!==y.organization.id)return O({ok:!1,error:"OIDC provider was not found."},404);let F=We(me),U=Ne.setOidcProviderEnabled(P.id,A.enabled===!0);return y.store.appendEvent({organizationId:y.organization.id,actorId:F.actor?.id,type:U.enabled?"auth.oidc.provider.enabled":"auth.oidc.provider.disabled",payload:{providerId:P.id}}),O({ok:!0,provider:U})}if(q.pathname==="/api/automation"&&N.method==="GET"){let A=yt.listServiceAccounts(y.organization.id,{includeDisabled:!0}).map((P)=>{let F=y.store.getMembershipForActor(y.organization.id,P.actorId),U=P.createdByActorId?y.store.getActor(P.createdByActorId):void 0,H=yt.listTokens(P.id,{includeInactive:!0}).map((Q)=>({...Q,createdBy:Q.createdByActorId?y.store.getActor(Q.createdByActorId):void 0}));return{account:P,createdBy:U,membership:F,tokens:H}});return O({accounts:A,apiBaseUrl:`${q.origin}/api/v1`,openApiUrl:`${q.origin}/api/v1/openapi.json`,tokenEnvironmentVariable:"TS_CLOUD_API_TOKEN"})}if(q.pathname==="/api/automation/service-accounts"&&N.method==="POST"){let A=await re(N),P=We(me),F=Uu(A.roleTemplate),U=Ic(A);if(!P.actor||!F||F==="owner"||!U)return O({ok:!1,error:"A non-owner role and valid organization scope are required."},422);try{let H=yt.createServiceAccount({organizationId:y.organization.id,slug:String(A.slug??""),name:String(A.name??""),description:typeof A.description==="string"?A.description:void 0,roleTemplate:F,scope:U,createdByActorId:P.actor.id});return O({ok:!0,...H},201)}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"Service account could not be created."},422)}}if(q.pathname==="/api/automation/service-accounts"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=yt.getServiceAccount(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Service account was not found."},404);return O({ok:!0,account:yt.disableServiceAccount(F.id,P.actor?.id)})}if(q.pathname==="/api/automation/tokens"&&N.method==="POST"){let A=await re(N),P=We(me),F=yt.getServiceAccount(String(A.serviceAccountId??"")),U=Ic(A);if(!P.actor||!F||F.organizationId!==y.organization.id||!U||!Array.isArray(A.capabilities))return O({ok:!1,error:"Service account, explicit capabilities, and valid scope are required."},422);try{let H=yt.createToken({serviceAccountId:F.id,name:String(A.name??"API token"),capabilities:A.capabilities.map(String),scope:U,expiresAt:typeof A.expiresAt==="string"?A.expiresAt:void 0,createdByActorId:P.actor.id});return O({ok:!0,token:H.token,secret:H.secret,revealOnce:!0},201)}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"API token could not be created."},422)}}if(q.pathname==="/api/automation/tokens/rotate"&&N.method==="POST"){let A=await re(N),P=We(me),F=yt.getToken(String(A.id??"")),U=F?yt.getServiceAccount(F.serviceAccountId):void 0;if(!P.actor||!F||U?.organizationId!==y.organization.id)return O({ok:!1,error:"API token was not found."},404);try{let H=yt.rotateToken(F.id,P.actor.id);return O({ok:!0,token:H.token,secret:H.secret,revealOnce:!0,overlap:!0},201)}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"API token could not be rotated."},409)}}if(q.pathname==="/api/automation/tokens"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=yt.getToken(String(A.id??"")),U=F?yt.getServiceAccount(F.serviceAccountId):void 0;if(!F||U?.organizationId!==y.organization.id)return O({ok:!1,error:"API token was not found."},404);return O({ok:!0,token:yt.revokeToken(F.id,P.actor?.id)})}if(q.pathname==="/api/onboarding"&&N.method==="GET"){let A=Ke.listConnections(y.organization.id);return O({drafts:zr.list(y.project.id),artifacts:Ss.list(y.project.id),registries:Yn.list(y.organization.id),sourceConnections:A,repositories:A.flatMap((P)=>Ke.listRepositories(P.id)),project:{id:y.project.id,slug:y.project.slug,name:y.project.name},environments:[...y.environments.values()].map((P)=>({id:P.id,slug:P.slug,name:P.name,kind:P.kind,region:P.region})),resources:y.store.listResources(y.project.id).filter((P)=>P.kind==="application").map((P)=>({id:P.id,slug:P.slug,name:P.name,environmentId:P.environmentId}))})}if(q.pathname==="/api/onboarding/detect"&&N.method==="POST"){let A=await re(N);try{if(A.source?.kind==="git"){let U=Ke.getConnection(String(A.source.connectionId??"")),H=Ke.getRepository(String(A.source.repositoryId??""));if(!U||U.organizationId!==y.organization.id||!H||H.connectionId!==U.id)throw Error("Authorized Git repository was not found");let Q=typeof A.source.deployKeyId==="string"?Ke.getDeployKey(A.source.deployKeyId):void 0;if(Q&&Q.connectionId!==U.id)throw Error("Deploy key does not belong to this connection");let J=wm(Ut(Vu(),"ts-cloud-onboarding-git-"));try{let ee=await Go({remote:H.cloneUrl,destination:Ut(J,"checkout"),ref:String(A.source.ref??H.defaultBranch),sparsePaths:Array.isArray(A.source.sparsePaths)?A.source.sparsePaths.map(String):void 0,binding:{id:"detection",projectId:y.project.id,connectionId:U.id,repositoryId:H.id,repositoryFullName:H.fullName,defaultBranch:H.defaultBranch,monorepoRoot:String(A.source.monorepoRoot??"."),includePaths:[],excludePaths:[],submodules:A.source.submodules===!0,cloneDepth:1,deployKeyId:Q?.id,autoDeploy:!1,pullRequestPreviews:!1,status:"active",version:1,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()}},{credential:Ke.getCredential(U.id),deployKey:Q?{...Q,privateKey:Ke.getDeployPrivateKey(Q.id)}:void 0,timeoutMs:120000});return O({ok:!0,commitSha:ee.commitSha,candidates:_s(sp(ee.directory))})}finally{bs(J,{recursive:!0,force:!0})}}if(Array.isArray(A.files)){if(A.files.length>1e4)throw Error("Detection file-count limit exceeded");let U=A.files.map((H)=>({path:String(H.path??""),size:Number(H.size??0),content:typeof H.content==="string"?H.content.slice(0,262144):void 0}));return O({ok:!0,candidates:_s(U)})}let P=N_(t,String(A.root??".")),F=$_(t,P);if(F===".."||F.startsWith(`..${j_}`))throw Error("Detection root must stay inside the project");return O({ok:!0,candidates:_s(sp(P))})}catch(P){return O({ok:!1,error:P instanceof Error?P.message:"Application detection failed."},422)}}if(q.pathname==="/api/onboarding/plan"&&N.method==="POST"){let A=await re(N);try{return O({ok:!0,plan:qn(A.draft,Array.isArray(A.suppliedSecretNames)?A.suppliedSecretNames.map(String):[])})}catch(P){return O({ok:!1,error:P instanceof Error?P.message:"Application plan could not be generated."},422)}}if(q.pathname==="/api/onboarding/drafts"&&N.method==="POST"){let A=await re(N),P=We(me);try{return O({ok:!0,draft:zr.create({organizationId:y.organization.id,projectId:y.project.id,name:String(A.name??A.draft?.name??"Application draft"),draft:{...A.draft,projectId:y.project.id},step:A.step,suppliedSecretNames:Array.isArray(A.suppliedSecretNames)?A.suppliedSecretNames.map(String):[],actorId:P.actor?.id})},201)}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Application draft could not be saved."},422)}}if(q.pathname==="/api/onboarding/drafts"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=zr.get(String(A.id??""));if(!F||F.projectId!==y.project.id)return O({ok:!1,error:"Application draft was not found."},404);try{return O({ok:!0,draft:zr.update(F.id,Number(A.version),{draft:{...A.draft,projectId:y.project.id},step:A.step,suppliedSecretNames:Array.isArray(A.suppliedSecretNames)?A.suppliedSecretNames.map(String):void 0,actorId:P.actor?.id})})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Application draft could not be updated."},409)}}if(q.pathname==="/api/onboarding/artifacts"&&N.method==="POST"){let A=We(me);if(Number(N.headers.get("content-length")??0)>104857600)return O({ok:!1,error:"Artifact exceeds the 100 MB upload limit."},413);try{let F=new Uint8Array(await N.arrayBuffer());return O({ok:!0,artifact:Ss.create({organizationId:y.organization.id,projectId:y.project.id,filename:N.headers.get("x-artifact-filename")??"application.zip",bytes:F,actorId:A.actor?.id})},201)}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Artifact could not be inspected."},422)}}if(q.pathname==="/api/onboarding/registries"&&N.method==="POST"){let A=await re(N),P=We(me);try{return O({ok:!0,registry:Yn.create({organizationId:y.organization.id,provider:A.provider,name:String(A.name??"Container registry"),host:String(A.host??""),credential:A.token||A.password?{username:typeof A.username==="string"?A.username:void 0,password:typeof A.password==="string"?A.password:void 0,token:typeof A.token==="string"?A.token:void 0}:void 0,credentialExpiresAt:typeof A.credentialExpiresAt==="string"?A.credentialExpiresAt:void 0,actorId:P.actor?.id})},201)}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Registry connection could not be created."},422)}}if(q.pathname==="/api/onboarding/registries"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=Yn.get(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Registry connection was not found."},404);try{if(A.action==="test")return O({ok:!0,registry:await Yn.test(F.id,{image:typeof A.image==="string"?A.image:void 0})});if(A.action==="rotate")return O({ok:!0,registry:Yn.rotate(F.id,{username:typeof A.username==="string"?A.username:void 0,password:typeof A.password==="string"?A.password:void 0,token:typeof A.token==="string"?A.token:void 0},{expiresAt:typeof A.expiresAt==="string"?A.expiresAt:void 0,actorId:P.actor?.id})});return O({ok:!1,error:"Registry action must be test or rotate."},422)}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Registry connection could not be updated."},422)}}if(q.pathname==="/api/onboarding/registries"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=Yn.get(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Registry connection was not found."},404);let U=zr.list(y.project.id).filter((H)=>H.input.source.kind==="image"&&H.input.source.registryConnectionId===F.id||H.input.build.kind==="prebuilt_image"&&H.input.build.registryConnectionId===F.id);if(A.preview===!0)return O({ok:!0,preview:!0,affectedDrafts:U});return O({ok:!0,registry:Yn.disconnect(F.id,P.actor?.id),affectedDrafts:U})}if(q.pathname==="/api/onboarding/apply"&&N.method==="POST"){let A=await re(N),P=We(me);try{let F=Bc({controlPlane:y.store,drafts:zr,draftId:String(A.id??""),expectedVersion:Number(A.version),confirmEnvironment:String(A.confirmEnvironment??""),actorId:P.actor?.id});return O({ok:!0,resource:F.resource,operation:F.operation,plan:F.plan},202)}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Application plan could not be applied."},422)}}if(q.pathname==="/api/sources"&&N.method==="GET"){let A=Ke.listConnections(y.organization.id);return O({connections:A,bindings:Ke.listBindings({projectId:y.project.id}),repositories:A.flatMap((P)=>Ke.listRepositories(P.id)),deployKeys:A.flatMap((P)=>Ke.listDeployKeys(P.id)),webhooks:A.flatMap((P)=>Ke.listWebhooks(P.id)).map((P)=>({...P,deliveries:Ke.listDeliveries(P.id,20)})),project:{id:y.project.id,slug:y.project.slug},environment:ne(y,String(Ce)),resources:y.store.listResources(y.project.id,ne(y,String(Ce)).environmentId).filter((P)=>P.kind==="application").map((P)=>({id:P.id,slug:P.slug,name:P.name}))})}if(q.pathname==="/api/sources/connections"&&N.method==="POST"){let A=await re(N),P=We(me),F=String(A.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(F))return O({ok:!1,error:"A supported Git provider is required."},422);try{let U=F==="github"&&(A.privateKey||A.appId)?{appId:typeof A.appId==="string"?A.appId:void 0,installationId:typeof A.installationId==="string"?A.installationId:void 0,privateKey:typeof A.privateKey==="string"?A.privateKey:void 0}:F!=="generic_ssh"&&A.token?{token:typeof A.token==="string"?A.token:void 0,username:typeof A.username==="string"?A.username:void 0}:void 0,H={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"},Q,J,ee;if(y.store.database.transaction(()=>{if(Q=Ke.createConnection({organizationId:y.organization.id,provider:F,name:String(A.name??F),host:String(A.host??H[F]??""),owner:typeof A.owner==="string"?A.owner:void 0,authKind:A.authKind,credential:U,grantedScopes:Array.isArray(A.grantedScopes)?A.grantedScopes.map(String):[],credentialExpiresAt:typeof A.credentialExpiresAt==="string"?A.credentialExpiresAt:void 0,createdByActorId:P.actor?.id}),typeof A.repositoryUrl==="string"&&typeof A.repositoryFullName==="string")J=Ke.upsertRepository({connectionId:Q.id,providerRepositoryId:`manual:${A.repositoryFullName}`,fullName:A.repositoryFullName,cloneUrl:A.repositoryUrl,defaultBranch:String(A.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"manual"}});if(F==="generic_ssh")ee=Ke.createDeployKey({connectionId:Q.id,name:String(A.deployKeyName??"Repository deploy key"),publicKey:String(A.publicKey??""),privateKey:String(A.deployPrivateKey??""),host:String(A.sshHost??""),hostKey:String(A.hostKey??""),actorId:P.actor?.id})})(),A.test===!0)Q=await qo(Ke,Q.id,J?.id);return O({ok:!0,connection:Q,repository:J,deployKey:ee},201)}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Source connection could not be created."},422)}}if(q.pathname==="/api/sources/connections"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=Ke.getConnection(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{if(A.action==="test")return O({ok:!0,connection:await qo(Ke,F.id,typeof A.repositoryId==="string"?A.repositoryId:void 0)});if(A.action==="rotate")return O({ok:!0,connection:Ke.rotateCredential(F.id,{token:typeof A.token==="string"?A.token:void 0,username:typeof A.username==="string"?A.username:void 0,appId:typeof A.appId==="string"?A.appId:void 0,installationId:typeof A.installationId==="string"?A.installationId:void 0,privateKey:typeof A.privateKey==="string"?A.privateKey:void 0},{expiresAt:typeof A.expiresAt==="string"?A.expiresAt:void 0,actorId:P.actor?.id})});return O({ok:!1,error:"Connection action must be test or rotate."},422)}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Source connection could not be updated."},422)}}if(q.pathname==="/api/sources/connections"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=Ke.getConnection(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Source connection was not found."},404);let U=Ke.listBindings({connectionId:F.id,status:"active"});if(A.preview===!0)return O({ok:!0,preview:!0,affectedBindings:U});return O({ok:!0,...Ke.disconnectConnection(F.id,P.actor?.id)})}if(q.pathname==="/api/sources/deploy-keys"&&N.method==="POST"){let A=await re(N),P=We(me),F=Ke.getConnection(String(A.connectionId??""));if(!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{return O({ok:!0,deployKey:Ke.createDeployKey({connectionId:F.id,name:String(A.name??"Repository deploy key"),publicKey:String(A.publicKey??""),privateKey:String(A.privateKey??""),host:String(A.host??""),hostKey:String(A.hostKey??""),actorId:P.actor?.id})},201)}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Deploy key could not be stored."},422)}}if(q.pathname==="/api/sources/deploy-keys"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=Ke.getDeployKey(String(A.id??"")),U=F?Ke.getConnection(F.connectionId):void 0;if(!F||!U||U.organizationId!==y.organization.id)return O({ok:!1,error:"Deploy key was not found."},404);let H=Ke.listBindings({connectionId:U.id}).filter((Q)=>Q.deployKeyId===F.id);if(A.preview===!0)return O({ok:!0,preview:!0,affectedBindings:H});return O({ok:!0,...Ke.revokeDeployKey(F.id,P.actor?.id)})}if(q.pathname==="/api/sources/repositories/sync"&&N.method==="POST"){let A=await re(N),P=Ke.getConnection(String(A.connectionId??""));if(!P||P.organizationId!==y.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{return O({ok:!0,repositories:await Gi(Ke,String(A.connectionId??""),{search:typeof A.search==="string"?A.search:void 0})})}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Repositories could not be synchronized."},422)}}if(q.pathname==="/api/sources/references"&&N.method==="GET"){let A=Ke.getConnection(String(q.searchParams.get("connectionId")??""));if(!A||A.organizationId!==y.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{return O(await qi(Ke,{connectionId:String(q.searchParams.get("connectionId")??""),repository:String(q.searchParams.get("repository")??""),repositoryId:q.searchParams.get("repositoryId")??void 0,deployKeyId:q.searchParams.get("deployKeyId")??void 0,type:q.searchParams.get("type")==="tags"?"tags":"branches",cursor:q.searchParams.get("cursor")??void 0}))}catch(P){return O({ok:!1,error:P instanceof Error?P.message:"References could not be listed."},422)}}if(q.pathname==="/api/sources/bindings"&&N.method==="POST"){let A=await re(N),P=We(me),F=ne(y,String(Ce)),U=Ke.getConnection(String(A.connectionId??""));if(!U||U.organizationId!==y.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{return O({ok:!0,binding:Ke.createBinding({projectId:y.project.id,environmentId:F.environmentId,resourceId:typeof A.resourceId==="string"?A.resourceId:void 0,connectionId:String(A.connectionId??""),repositoryId:typeof A.repositoryId==="string"?A.repositoryId:void 0,repositoryFullName:String(A.repositoryFullName??""),defaultBranch:String(A.defaultBranch??"main"),branchRule:typeof A.branchRule==="string"?A.branchRule:void 0,tagRule:typeof A.tagRule==="string"?A.tagRule:void 0,monorepoRoot:String(A.monorepoRoot??"."),includePaths:Array.isArray(A.includePaths)?A.includePaths.map(String):[],excludePaths:Array.isArray(A.excludePaths)?A.excludePaths.map(String):[],submodules:A.submodules===!0,cloneDepth:A.cloneDepth?Number(A.cloneDepth):void 0,deployKeyId:typeof A.deployKeyId==="string"&&A.deployKeyId?A.deployKeyId:void 0,autoDeploy:A.autoDeploy!==!1,pullRequestPreviews:A.pullRequestPreviews!==!1,actorId:P.actor?.id})},201)}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"Source binding could not be created."},422)}}if(q.pathname==="/api/sources/bindings"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=Ke.getBinding(String(A.id??""));if(!F||F.projectId!==y.project.id)return O({ok:!1,error:"Source binding was not found."},404);try{return O({ok:!0,binding:Ke.updateBinding(F.id,Number(A.version),{defaultBranch:A.defaultBranch,branchRule:A.branchRule,tagRule:A.tagRule,monorepoRoot:A.monorepoRoot,includePaths:A.includePaths,excludePaths:A.excludePaths,submodules:A.submodules,cloneDepth:A.cloneDepth,deployKeyId:A.deployKeyId,autoDeploy:A.autoDeploy,pullRequestPreviews:A.pullRequestPreviews,status:A.status,disabledReason:A.disabledReason,actorId:P.actor?.id})})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Source binding could not be updated."},409)}}if(q.pathname==="/api/sources/webhooks"&&N.method==="POST"){let A=await re(N),P=Ke.getConnection(String(A.connectionId??""));if(!P||P.organizationId!==y.organization.id)return O({ok:!1,error:"Source connection was not found."},404);try{let F=Ke.createWebhook({connectionId:String(A.connectionId??""),repositoryId:typeof A.repositoryId==="string"?A.repositoryId:void 0,repositoryFullName:String(A.repositoryFullName??""),events:Array.isArray(A.events)?A.events.map(String):void 0,secret:typeof A.secret==="string"?A.secret:void 0}),U=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||pt,H=U?Zt(U,F.webhook):void 0,Q=A.reconcile!==!1&&U?await Zr(Ke,F.webhook.id,U):F.webhook;return O({ok:!0,webhook:Q,endpoint:H,endpointRevealOnce:!0},201)}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Source webhook could not be created."},422)}}if(q.pathname==="/api/sources/webhooks"&&N.method==="PATCH"){let A=await re(N),P=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||pt,F=Ke.getWebhook(String(A.id??"")),U=F?Ke.getConnection(F.connectionId):void 0;if(!F||!U||U.organizationId!==y.organization.id)return O({ok:!1,error:"Source webhook was not found."},404);if(!P)return O({ok:!1,error:"Set TS_CLOUD_WEBHOOK_BASE_URL to reconcile provider webhooks."},422);try{return O({ok:!0,webhook:await Zr(Ke,String(A.id??""),P)})}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"Source webhook could not be reconciled."},422)}}if(q.pathname==="/api/sources/webhooks"&&N.method==="DELETE"){let A=await re(N),P=Ke.getWebhook(String(A.id??"")),F=P?Ke.getConnection(P.connectionId):void 0;if(!P||!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Source webhook was not found."},404);try{return O({ok:!0,webhook:await vl(Ke,String(A.id??""))})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Source webhook could not be removed."},422)}}if(q.pathname==="/api/security/posture"&&N.method==="GET"){let A=ne(y,String(Ce)),P=ut.listFindings({...A,limit:500});return O({scope:A,summary:ut.summary(A.organizationId,A.projectId,A.environmentId),findings:P,scans:ut.listScanRuns({...A,limit:100}),policies:ut.listPolicies(A.organizationId).filter((F)=>!F.environmentId||F.environmentId===A.environmentId),waivers:P.flatMap((F)=>ut.listWaivers(F.id)),decisions:ut.listDecisions(A.environmentId,50),actors:y.store.listMemberships(y.organization.id).map((F)=>y.store.getActor(F.actorId)).filter(Boolean)})}if(q.pathname==="/api/security/export"&&N.method==="GET")return O(ut.exportPosture(y.organization.id));if(q.pathname==="/api/security/scan"&&N.method==="POST"){let A=ne(y,String(Ce)),P=await new St(ut).run(new rn,{...A,artifactRoot:t}),F=ji(ut,A,sr??{});return O({ok:!0,source:P,host:F,summary:ut.summary(A.organizationId,A.projectId,A.environmentId)})}if(q.pathname==="/api/security/review"&&N.method==="POST")try{let A=ne(y,String(Ce));return O({ok:!0,...zi(ut,{scope:A,desiredConfigHash:y.project.desiredConfigHash})})}catch(A){return O({ok:!1,error:A instanceof Error?A.message:"Security change review failed."},409)}if(q.pathname==="/api/security/policies"&&N.method==="POST"){let A=await re(N),P=We(me);if(!P.actor)return O({ok:!1,error:"An organization actor is required."},403);try{let F=ut.createPolicy({organizationId:y.organization.id,environmentId:A.environmentId===null?void 0:String(A.environmentId??ne(y,String(Ce)).environmentId),name:String(A.name??""),scannerFailMode:A.scannerFailMode==="open"?"open":"closed",requiredScanners:Array.isArray(A.requiredScanners)?A.requiredScanners.map(String):[],rules:Array.isArray(A.rules)?A.rules.map((U)=>({minimumSeverity:String(U.minimumSeverity),action:String(U.action),scannerId:U.scannerId?String(U.scannerId):void 0})):[],actorId:P.actor.id});return O({ok:!0,policy:F},201)}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Security policy could not be created."},422)}}if(q.pathname==="/api/security/policies"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=ut.getPolicy(String(A.id??""));if(!P.actor||!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Security policy was not found."},404);try{return O({ok:!0,policy:ut.updatePolicy(F.id,Number(A.version),{name:typeof A.name==="string"?A.name:void 0,scannerFailMode:A.scannerFailMode==="open"||A.scannerFailMode==="closed"?A.scannerFailMode:void 0,requiredScanners:Array.isArray(A.requiredScanners)?A.requiredScanners.map(String):void 0,rules:Array.isArray(A.rules)?A.rules.map((U)=>({minimumSeverity:String(U.minimumSeverity),action:String(U.action),scannerId:U.scannerId?String(U.scannerId):void 0})):void 0,enabled:typeof A.enabled==="boolean"?A.enabled:void 0,actorId:P.actor.id})})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Security policy could not be updated."},409)}}if(q.pathname==="/api/security/waivers"&&N.method==="POST"){let A=await re(N),P=We(me);if(!P.actor)return O({ok:!1,error:"An organization actor is required."},403);try{return O({ok:!0,waiver:ut.createWaiver({findingId:String(A.findingId??""),policyId:typeof A.policyId==="string"?A.policyId:void 0,reason:String(A.reason??""),referenceUrl:typeof A.referenceUrl==="string"?A.referenceUrl:void 0,expiresAt:String(A.expiresAt??""),actorId:P.actor.id})},201)}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Security waiver could not be created."},422)}}if(q.pathname==="/api/security/waivers"&&N.method==="DELETE"){let A=await re(N),P=We(me);if(!P.actor)return O({ok:!1,error:"An organization actor is required."},403);try{return O({ok:!0,waiver:ut.revokeWaiver(String(A.id??""),P.actor.id)})}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Security waiver could not be revoked."},404)}}if(q.pathname==="/api/security/findings"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=ut.getFinding(String(A.id??""));if(!P.actor||!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Security finding was not found."},404);try{let U=A.action==="acknowledge"?ut.acknowledgeFinding(F.id,P.actor.id):ut.assignFinding(F.id,typeof A.ownerActorId==="string"&&A.ownerActorId?A.ownerActorId:void 0,P.actor.id);return O({ok:!0,finding:U})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Security finding could not be updated."},422)}}if(q.pathname==="/api/security/comments"&&N.method==="POST"){let A=await re(N),P=We(me);if(!P.actor)return O({ok:!1,error:"An organization actor is required."},403);try{return O({ok:!0,comment:ut.addComment({findingId:String(A.findingId??""),actorId:P.actor.id,body:String(A.body??""),referenceUrl:typeof A.referenceUrl==="string"?A.referenceUrl:void 0})},201)}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Comment could not be saved."},422)}}if(q.pathname==="/api/auth/sessions"&&N.method==="GET"){let A=lr.resolveSession(N);return O({currentSessionId:A?.id,sessions:A?Ne.listSessions(A.identityId,{includeInactive:!0}):[]})}if(q.pathname==="/api/auth/sessions"&&N.method==="DELETE"){let A=await re(N),P=lr.resolveSession(N);if(!P)return O({ok:!1,error:"Sign in again to manage sessions."},401);let F=String(A.id??""),U=Ne.revokeSession(P.identityId,F),H=F===P.id&&U?{"set-cookie":Du({secure:Di})}:void 0;return O({ok:U,signedOut:F===P.id&&U},U?200:404,H)}if(q.pathname==="/api/auth/sessions/revoke-others"&&N.method==="POST"){let A=lr.resolveSession(N);if(!A)return O({ok:!1,error:"Sign in again to manage sessions."},401);return O({ok:!0,revoked:Ne.revokeOtherSessions(A.identityId,A.id)})}if(q.pathname==="/api/auth/password/change"&&N.method==="POST"){let A=await re(N),P=String(A.currentPassword??""),F=String(A.password??""),U=We(me),H=U.actor?Ne.getIdentityByActor(U.actor.id):void 0;if(!H||!Qn(P,H.passwordHash))return O({ok:!1,error:"Current password is incorrect."},401);if(F.length<12)return O({ok:!1,error:"New password must be at least 12 characters."},422);if(Qn(F,H.passwordHash))return O({ok:!1,error:"Choose a different password."},409);let Q=ho(F),J=Ne.updatePassword(H.id,Q);Nu(t,J.username,Q);let ee=_c(J.id,N,at.requestIP(N)?.address??"unknown");return y.store.appendEvent({organizationId:y.organization.id,actorId:J.actorId,type:"auth.password.changed"}),O({ok:!0,message:"Password changed and other sessions were signed out."},200,{"set-cookie":Ua(ee.token,{secure:Di,maxAgeMs:Xe})})}if(q.pathname==="/api/auth/mfa/enroll"&&N.method==="POST"){let A=await re(N),P=lr.resolveSession(N),F=We(me),U=F.actor?Ne.getIdentityByActor(F.actor.id):void 0;if(!P||!U)return O({ok:!1,error:"Sign in again before enabling MFA."},401);if(!Qn(String(A.password??""),U.passwordHash))return O({ok:!1,error:"Current password is incorrect."},401);try{let H=Ne.beginTotpEnrollment(U.id,{issuer:y.organization.name});return y.store.appendEvent({organizationId:y.organization.id,actorId:U.actorId,type:"auth.mfa.enrollment.started"}),O({factor:H.factor,secret:H.secret,uri:H.uri})}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"MFA enrollment failed."},409)}}if(q.pathname==="/api/auth/mfa/verify"&&N.method==="POST"){let A=await re(N),P=lr.resolveSession(N),F=We(me),U=F.actor?Ne.getIdentityByActor(F.actor.id):void 0;if(!P||!U)return O({ok:!1,error:"Sign in again before enabling MFA."},401);try{let H=Ne.verifyTotpEnrollment(U.id,String(A.code??""));return Ne.markSessionStepUp(P.id,!0),y.store.appendEvent({organizationId:y.organization.id,actorId:U.actorId,type:"auth.mfa.enabled",payload:{recoveryCodeCount:H.recoveryCodes.length}}),O(H)}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"MFA enrollment failed."},422)}}if(q.pathname==="/api/auth/mfa"&&N.method==="DELETE"){let A=await re(N),P=lr.resolveSession(N),F=We(me),U=F.actor?Ne.getIdentityByActor(F.actor.id):void 0;if(!P||!U||!Qn(String(A.password??""),U.passwordHash))return O({ok:!1,error:"Current password is incorrect."},401);let H=Ne.verifyMfaCode(U.id,String(A.code??""));if(!H.valid||!H.method)return O({ok:!1,error:"Authenticator or recovery code is incorrect."},401);return Ne.disableMfa(U.id),Ne.revokeOtherSessions(U.id,P.id),Ne.markSessionStepUp(P.id),y.store.appendEvent({organizationId:y.organization.id,actorId:U.actorId,type:"auth.mfa.disabled",payload:{method:H.method}}),O({ok:!0})}if(q.pathname==="/api/auth/step-up"&&N.method==="POST"){let A=await re(N),P=lr.resolveSession(N),F=We(me),U=F.actor?Ne.getIdentityByActor(F.actor.id):void 0;if(!P||!U||!Qn(String(A.password??""),U.passwordHash))return O({ok:!1,error:"Current password is incorrect."},401);let H=Ne.getMfaFactor(U.id);if(H?.state==="active"){if(!Ne.verifyMfaCode(U.id,String(A.code??"")).valid)return O({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}let Q=Ne.markSessionStepUp(P.id,H?.state==="active");return y.store.appendEvent({organizationId:y.organization.id,actorId:U.actorId,type:"auth.step_up.succeeded",payload:{mfa:H?.state==="active"}}),O({ok:!0,recentAuthAt:Q.recentAuthAt})}if(q.pathname==="/api/terminal"){if(!ue)return O({ok:!1,error:"The web terminal is disabled."},403);if(at.upgrade(N))return;return Wu("WebSocket upgrade failed",400)}if(q.pathname==="/api/health"){let A=y.store.health();return O({ok:!0,cwd:t,environment:Ce,environments:C,uiRoot:await Qt(me,Ce),liveData:ae.size>0,terminal:ue,localPackage:import.meta.url.includes("/Code/Libraries/ts-cloud/"),controlPlane:{schemaVersion:A.schemaVersion,supportedSchemaVersion:A.supportedSchemaVersion,integrity:A.integrity,pendingRetryableOperations:A.pendingRetryableOperations}})}if(q.pathname==="/api/control-plane/operations"){let A=q.searchParams.get("state"),P=A&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(A)?A:void 0;return O({operations:y.store.listOperations({projectId:y.project.id,state:P,kind:q.searchParams.get("kind")??void 0,limit:Number(q.searchParams.get("limit"))||100})})}if(q.pathname==="/api/queue"&&N.method==="GET"){let A=q.searchParams.get("state"),P=A&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(A)?A:void 0,F=Vt.list({projectId:y.project.id,state:P,limit:Number(q.searchParams.get("limit"))||250}).filter((U)=>ws(me,U.operation.id,"deployments:read")).map((U)=>{let H=U.operation.resourceId?y.store.getResource(U.operation.resourceId):void 0,Q=U.operation.environmentId?y.store.listEnvironments(y.project.id).find((Se)=>Se.id===U.operation.environmentId):void 0,J=U.operation.actorId?y.store.getActor(U.operation.actorId):void 0,ee=U.operation.input;return{...U,target:H?{id:H.id,name:H.name,slug:H.slug,kind:H.kind}:Q?{id:Q.id,name:Q.name,slug:Q.slug,kind:"environment"}:{id:y.project.id,name:y.project.name,slug:y.project.slug,kind:"project"},actor:J?{id:J.id,name:J.displayName,kind:J.kind}:void 0,commit:ee.revision??ee.source?.commitSha??null}});return O({operations:F,concurrency:Vt.limits})}if(q.pathname==="/api/queue/logs"&&N.method==="GET"){let A=String(q.searchParams.get("id")??"");if(!ws(me,A,"deployments:read"))return O({ok:!1,error:"Operation was not found in this scope."},404);let P=Vt.logs(A,{after:Number(q.searchParams.get("after"))||0,limit:Number(q.searchParams.get("limit"))||500});return O({entries:P,cursor:P.at(-1)?.sequence??(Number(q.searchParams.get("after"))||0),operation:y.store.getOperation(A)})}if(q.pathname==="/api/queue/stream"&&N.method==="GET"){let A=String(q.searchParams.get("id")??"");if(!ws(me,A,"deployments:read"))return O({ok:!1,error:"Operation was not found in this scope."},404);let P=N.headers.get("last-event-id")?.trim(),F=Number(P||q.searchParams.get("after")||0),U=new TextEncoder,H,Q=!1,J=new ReadableStream({start(ee){let Se=()=>{if(Q)return;let ve=lr.resolveUser(N);if(!ve||!ws(ve,A,"deployments:read")){if(Q=!0,H)clearInterval(H);ee.close();return}let nt=Vt.logs(A,{after:F,limit:500});for(let He of nt)F=He.sequence,ee.enqueue(U.encode(`id: ${He.sequence}
+This link expires in one hour and can be used once.`});y.store.appendEvent({organizationId:y.organization.id,actorId:H.actorId,type:"auth.password_reset.requested",payload:{delivered:ee}})}return x({ok:!0,message:"If that account has a verified email, a reset link has been sent."},202)}if(q.pathname==="/api/auth/password-reset/complete"&&N.method==="POST"){let A=await re(N),P=String(A.token??"").trim(),F=String(A.password??"");if(!P||F.length<12)return x({ok:!1,error:"A valid reset token and password of at least 12 characters are required."},422);try{let U=Ne.consumeActionToken(P,"password_reset"),H=ho(F),Q=Ne.updatePassword(U.identityId,H);return Nu(t,Q.username,H),y.store.appendEvent({organizationId:y.organization.id,actorId:Q.actorId,type:"auth.password_reset.completed"}),x({ok:!0,message:"Password changed. Sign in again."},200,{"set-cookie":Du({secure:Di})})}catch(U){let H=U instanceof Error?U.message:"Password reset failed.";return x({ok:!1,error:H.replace("Action token","Reset link")},H.includes("consumed")||H.includes("expired")?409:404)}}if(q.pathname==="/api/login"&&N.method==="POST"){let A=await re(N),P=String(A.username??"").trim(),F=String(A.password??""),U=at.requestIP(N)?.address??"unknown",H=Cc.check(P,U);if(!H.allowed)return x({ok:!1,error:`Too many failed attempts. Try again in ${Math.ceil((H.retryAfterSeconds??0)/60)} minute(s).`},429,{"retry-after":String(H.retryAfterSeconds??60)});let Q=Fn(wn(t),P),J=Ne.getIdentityByUsername(P),ee=J?.passwordHash??Q?.passwordHash??H_;if(!(Qn(F,ee)&&!!Q&&!!J&&!J.disabledAt))return Cc.recordFailure(P,U),x({ok:!1,error:"Incorrect username or password."},401);if(oS(Ne,y,J))return x({ok:!1,error:"Single sign-on is required for this account."},403);Cc.recordSuccess(P,U);let ve=J,nt=ve.requiresPasswordUpgrade||vb(ve.passwordHash);if(nt){let He=ho(F);ve=Ne.rehashPassword(ve.id,He),Nu(t,ve.username,He)}if(Ne.recordLogin(ve.id),Ne.getMfaFactor(ve.id)?.state==="active"){let He=Ne.createMfaChallenge(ve.id,"login");return y.store.appendEvent({organizationId:y.organization.id,actorId:ve.actorId,type:"auth.mfa.challenge.created",payload:{purpose:"login"}}),x({ok:!0,mfaRequired:!0,challengeToken:He.token,passwordUpgraded:nt})}let Pe=_c(ve.id,N,U);return y.store.appendEvent({organizationId:y.organization.id,actorId:ve.actorId,type:"auth.login.succeeded",payload:{method:"local"}}),x({ok:!0,user:qa(Q),passwordUpgraded:nt},200,{"set-cookie":Ua(Pe.token,{secure:Di,maxAgeMs:Xe})})}if(q.pathname==="/api/auth/mfa/complete"&&N.method==="POST"){let A=await re(N),P=String(A.challengeToken??"").trim(),F=String(A.code??"").trim(),U=at.requestIP(N)?.address??"unknown",Q=Ne.inspectMfaChallengeToken(P,"login")?.identityId??"unknown-mfa",J=Pc.check(Q,U);if(!J.allowed)return x({ok:!1,error:"Too many MFA attempts. Try again later."},429,{"retry-after":String(J.retryAfterSeconds??60)});try{let ee=Ne.completeMfaChallenge(P,F,"login");Pc.recordSuccess(Q,U);let Se=new Date().toISOString(),ve=Ne.createSession({identityId:ee.identity.id,userAgent:Fm(N),networkHint:Zu(U),mfaAt:Se,recentAuthAt:Se});return y.store.appendEvent({organizationId:y.organization.id,actorId:ee.identity.actorId,type:"auth.mfa.succeeded",payload:{purpose:"login",method:ee.method}}),x({ok:!0},200,{"set-cookie":Ua(ve.token,{secure:Di,maxAgeMs:Xe})})}catch{return Pc.recordFailure(Q,U),x({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}}if(q.pathname==="/api/logout"&&N.method==="POST"){let A=lr.resolveSession(N);if(A)Ne.revokeSession(A.identityId,A.id);let P=Du({secure:Di});if(N.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login","set-cookie":P}});return x({ok:!0},200,{"set-cookie":P})}if(q.pathname==="/login"){let A=Ne.listOidcProviders(y.organization.id).map((P)=>({slug:P.slug,name:P.name}));return new Response(sS(B?.mode==="serverless",A),{headers:{"content-type":"text/html; charset=utf-8"}})}if(q.pathname==="/forgot-password"||q.pathname==="/reset-password")return new Response(aS(q.pathname==="/reset-password"?"reset":"request"),{headers:{"content-type":"text/html; charset=utf-8"}});if(q.pathname==="/accept-invitation")return nw(lt,q.pathname);let me=lr.resolveUser(N);if(!me){if(!q.pathname.startsWith("/api/")&&N.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login"}});return x({ok:!1,error:"Sign in to continue."},401)}let $n=Jt(me,Ce);if(q.pathname==="/api/me"){let A=y.store.getActorByExternalId("user",`dashboard:${me.username.toLowerCase()}`),P=A?y.store.getMembershipForActor(y.organization.id,A.id):void 0,F=y.store.resolveAuthorizationTarget(y.organization.id,P?.scope??{type:"project",id:y.project.id})??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id});return x({ok:!0,user:qa(me),authEnabled:xe,organization:y.organization,membership:P,capabilities:Mt({membership:P,grants:P?y.store.listGrants(P.id):[],target:F})})}if(q.pathname.startsWith("/api/")){let A=await rS(N,q.pathname),P=lr.check(N,q.pathname,me,A);if(!P.ok)return x({ok:!1,error:P.error},P.status??403);if(xe&&rT.has(`${N.method.toUpperCase()} ${q.pathname}`)){let F=lr.resolveSession(N);if(!F||!Ne.isRecentlyAuthenticated(F))return x({ok:!1,error:"Recent authentication is required for this change.",stepUpRequired:!0},401)}}if(q.pathname==="/api/auth/security"&&N.method==="GET"){let A=We(me),P=A.actor?Ne.getIdentityByActor(A.actor.id):void 0,F=lr.resolveSession(N);return x({identity:P?{username:P.username,email:P.email,emailVerifiedAt:P.emailVerifiedAt,requiresPasswordUpgrade:P.requiresPasswordUpgrade,lastLoginAt:P.lastLoginAt}:void 0,currentSessionId:F?.id,sessions:P?Ne.listSessions(P.id,{includeInactive:!0}):[],mfa:P?{factor:Ne.getMfaFactor(P.id),recoveryCodesRemaining:Ne.remainingRecoveryCodes(P.id)}:void 0})}if(q.pathname==="/api/auth/oidc/providers"&&N.method==="GET")return x({providers:Ne.listOidcProviders(y.organization.id,{includeDisabled:!0}),callbackOrigin:pt,callbackPattern:pt?`${pt}/auth/oidc/{slug}/callback`:void 0,localOwnerRecovery:!0});if(q.pathname==="/api/auth/oidc/providers"&&N.method==="POST"){let A=await re(N),P=We(me),F=P.actor?Ne.getIdentityByActor(P.actor.id):void 0,U=A.enforceSso===!0;if(U&&(!F?.emailVerifiedAt||Ne.remainingRecoveryCodes(F.id)<1))return x({ok:!1,error:"Verify the owner email and generate MFA recovery codes before enforcing SSO."},409);try{let H=Uu(A.defaultRole),Q=Ne.upsertOidcProvider({id:typeof A.id==="string"?A.id:void 0,organizationId:y.organization.id,slug:String(A.slug??""),name:String(A.name??""),issuer:String(A.issuer??""),clientId:String(A.clientId??""),clientSecret:typeof A.clientSecret==="string"&&A.clientSecret?A.clientSecret:void 0,scopes:Array.isArray(A.scopes)?A.scopes.map(String):void 0,allowedDomains:Array.isArray(A.allowedDomains)?A.allowedDomains.map(String):[],defaultRole:H&&H!=="owner"?H:void 0,enabled:A.enabled!==!1,enforceSso:U});return y.store.appendEvent({organizationId:y.organization.id,actorId:P.actor?.id,type:"auth.oidc.provider.configured",payload:{providerId:Q.id,issuer:Q.issuer,enabled:Q.enabled,enforceSso:Q.enforceSso}}),x({ok:!0,provider:Q})}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"OIDC provider could not be saved."},422)}}if(q.pathname==="/api/auth/oidc/providers"&&N.method==="PATCH"){let A=await re(N),P=Ne.getOidcProvider(String(A.id??""));if(!P||P.organizationId!==y.organization.id)return x({ok:!1,error:"OIDC provider was not found."},404);let F=We(me),U=Ne.setOidcProviderEnabled(P.id,A.enabled===!0);return y.store.appendEvent({organizationId:y.organization.id,actorId:F.actor?.id,type:U.enabled?"auth.oidc.provider.enabled":"auth.oidc.provider.disabled",payload:{providerId:P.id}}),x({ok:!0,provider:U})}if(q.pathname==="/api/automation"&&N.method==="GET"){let A=yt.listServiceAccounts(y.organization.id,{includeDisabled:!0}).map((P)=>{let F=y.store.getMembershipForActor(y.organization.id,P.actorId),U=P.createdByActorId?y.store.getActor(P.createdByActorId):void 0,H=yt.listTokens(P.id,{includeInactive:!0}).map((Q)=>({...Q,createdBy:Q.createdByActorId?y.store.getActor(Q.createdByActorId):void 0}));return{account:P,createdBy:U,membership:F,tokens:H}});return x({accounts:A,apiBaseUrl:`${q.origin}/api/v1`,openApiUrl:`${q.origin}/api/v1/openapi.json`,tokenEnvironmentVariable:"TS_CLOUD_API_TOKEN"})}if(q.pathname==="/api/automation/service-accounts"&&N.method==="POST"){let A=await re(N),P=We(me),F=Uu(A.roleTemplate),U=Ic(A);if(!P.actor||!F||F==="owner"||!U)return x({ok:!1,error:"A non-owner role and valid organization scope are required."},422);try{let H=yt.createServiceAccount({organizationId:y.organization.id,slug:String(A.slug??""),name:String(A.name??""),description:typeof A.description==="string"?A.description:void 0,roleTemplate:F,scope:U,createdByActorId:P.actor.id});return x({ok:!0,...H},201)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"Service account could not be created."},422)}}if(q.pathname==="/api/automation/service-accounts"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=yt.getServiceAccount(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Service account was not found."},404);return x({ok:!0,account:yt.disableServiceAccount(F.id,P.actor?.id)})}if(q.pathname==="/api/automation/tokens"&&N.method==="POST"){let A=await re(N),P=We(me),F=yt.getServiceAccount(String(A.serviceAccountId??"")),U=Ic(A);if(!P.actor||!F||F.organizationId!==y.organization.id||!U||!Array.isArray(A.capabilities))return x({ok:!1,error:"Service account, explicit capabilities, and valid scope are required."},422);try{let H=yt.createToken({serviceAccountId:F.id,name:String(A.name??"API token"),capabilities:A.capabilities.map(String),scope:U,expiresAt:typeof A.expiresAt==="string"?A.expiresAt:void 0,createdByActorId:P.actor.id});return x({ok:!0,token:H.token,secret:H.secret,revealOnce:!0},201)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"API token could not be created."},422)}}if(q.pathname==="/api/automation/tokens/rotate"&&N.method==="POST"){let A=await re(N),P=We(me),F=yt.getToken(String(A.id??"")),U=F?yt.getServiceAccount(F.serviceAccountId):void 0;if(!P.actor||!F||U?.organizationId!==y.organization.id)return x({ok:!1,error:"API token was not found."},404);try{let H=yt.rotateToken(F.id,P.actor.id);return x({ok:!0,token:H.token,secret:H.secret,revealOnce:!0,overlap:!0},201)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"API token could not be rotated."},409)}}if(q.pathname==="/api/automation/tokens"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=yt.getToken(String(A.id??"")),U=F?yt.getServiceAccount(F.serviceAccountId):void 0;if(!F||U?.organizationId!==y.organization.id)return x({ok:!1,error:"API token was not found."},404);return x({ok:!0,token:yt.revokeToken(F.id,P.actor?.id)})}if(q.pathname==="/api/onboarding"&&N.method==="GET"){let A=Ke.listConnections(y.organization.id);return x({drafts:zr.list(y.project.id),artifacts:Ss.list(y.project.id),registries:Yn.list(y.organization.id),sourceConnections:A,repositories:A.flatMap((P)=>Ke.listRepositories(P.id)),project:{id:y.project.id,slug:y.project.slug,name:y.project.name},environments:[...y.environments.values()].map((P)=>({id:P.id,slug:P.slug,name:P.name,kind:P.kind,region:P.region})),resources:y.store.listResources(y.project.id).filter((P)=>P.kind==="application").map((P)=>({id:P.id,slug:P.slug,name:P.name,environmentId:P.environmentId}))})}if(q.pathname==="/api/onboarding/detect"&&N.method==="POST"){let A=await re(N);try{if(A.source?.kind==="git"){let U=Ke.getConnection(String(A.source.connectionId??"")),H=Ke.getRepository(String(A.source.repositoryId??""));if(!U||U.organizationId!==y.organization.id||!H||H.connectionId!==U.id)throw Error("Authorized Git repository was not found");let Q=typeof A.source.deployKeyId==="string"?Ke.getDeployKey(A.source.deployKeyId):void 0;if(Q&&Q.connectionId!==U.id)throw Error("Deploy key does not belong to this connection");let J=wm(Ut(Vu(),"ts-cloud-onboarding-git-"));try{let ee=await Go({remote:H.cloneUrl,destination:Ut(J,"checkout"),ref:String(A.source.ref??H.defaultBranch),sparsePaths:Array.isArray(A.source.sparsePaths)?A.source.sparsePaths.map(String):void 0,binding:{id:"detection",projectId:y.project.id,connectionId:U.id,repositoryId:H.id,repositoryFullName:H.fullName,defaultBranch:H.defaultBranch,monorepoRoot:String(A.source.monorepoRoot??"."),includePaths:[],excludePaths:[],submodules:A.source.submodules===!0,cloneDepth:1,deployKeyId:Q?.id,autoDeploy:!1,pullRequestPreviews:!1,status:"active",version:1,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()}},{credential:Ke.getCredential(U.id),deployKey:Q?{...Q,privateKey:Ke.getDeployPrivateKey(Q.id)}:void 0,timeoutMs:120000});return x({ok:!0,commitSha:ee.commitSha,candidates:_s(sp(ee.directory))})}finally{bs(J,{recursive:!0,force:!0})}}if(Array.isArray(A.files)){if(A.files.length>1e4)throw Error("Detection file-count limit exceeded");let U=A.files.map((H)=>({path:String(H.path??""),size:Number(H.size??0),content:typeof H.content==="string"?H.content.slice(0,262144):void 0}));return x({ok:!0,candidates:_s(U)})}let P=N_(t,String(A.root??".")),F=$_(t,P);if(F===".."||F.startsWith(`..${j_}`))throw Error("Detection root must stay inside the project");return x({ok:!0,candidates:_s(sp(P))})}catch(P){return x({ok:!1,error:P instanceof Error?P.message:"Application detection failed."},422)}}if(q.pathname==="/api/onboarding/plan"&&N.method==="POST"){let A=await re(N);try{return x({ok:!0,plan:qn(A.draft,Array.isArray(A.suppliedSecretNames)?A.suppliedSecretNames.map(String):[])})}catch(P){return x({ok:!1,error:P instanceof Error?P.message:"Application plan could not be generated."},422)}}if(q.pathname==="/api/onboarding/drafts"&&N.method==="POST"){let A=await re(N),P=We(me);try{return x({ok:!0,draft:zr.create({organizationId:y.organization.id,projectId:y.project.id,name:String(A.name??A.draft?.name??"Application draft"),draft:{...A.draft,projectId:y.project.id},step:A.step,suppliedSecretNames:Array.isArray(A.suppliedSecretNames)?A.suppliedSecretNames.map(String):[],actorId:P.actor?.id})},201)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Application draft could not be saved."},422)}}if(q.pathname==="/api/onboarding/drafts"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=zr.get(String(A.id??""));if(!F||F.projectId!==y.project.id)return x({ok:!1,error:"Application draft was not found."},404);try{return x({ok:!0,draft:zr.update(F.id,Number(A.version),{draft:{...A.draft,projectId:y.project.id},step:A.step,suppliedSecretNames:Array.isArray(A.suppliedSecretNames)?A.suppliedSecretNames.map(String):void 0,actorId:P.actor?.id})})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Application draft could not be updated."},409)}}if(q.pathname==="/api/onboarding/artifacts"&&N.method==="POST"){let A=We(me);if(Number(N.headers.get("content-length")??0)>104857600)return x({ok:!1,error:"Artifact exceeds the 100 MB upload limit."},413);try{let F=new Uint8Array(await N.arrayBuffer());return x({ok:!0,artifact:Ss.create({organizationId:y.organization.id,projectId:y.project.id,filename:N.headers.get("x-artifact-filename")??"application.zip",bytes:F,actorId:A.actor?.id})},201)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Artifact could not be inspected."},422)}}if(q.pathname==="/api/onboarding/registries"&&N.method==="POST"){let A=await re(N),P=We(me);try{return x({ok:!0,registry:Yn.create({organizationId:y.organization.id,provider:A.provider,name:String(A.name??"Container registry"),host:String(A.host??""),credential:A.token||A.password?{username:typeof A.username==="string"?A.username:void 0,password:typeof A.password==="string"?A.password:void 0,token:typeof A.token==="string"?A.token:void 0}:void 0,credentialExpiresAt:typeof A.credentialExpiresAt==="string"?A.credentialExpiresAt:void 0,actorId:P.actor?.id})},201)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Registry connection could not be created."},422)}}if(q.pathname==="/api/onboarding/registries"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=Yn.get(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Registry connection was not found."},404);try{if(A.action==="test")return x({ok:!0,registry:await Yn.test(F.id,{image:typeof A.image==="string"?A.image:void 0})});if(A.action==="rotate")return x({ok:!0,registry:Yn.rotate(F.id,{username:typeof A.username==="string"?A.username:void 0,password:typeof A.password==="string"?A.password:void 0,token:typeof A.token==="string"?A.token:void 0},{expiresAt:typeof A.expiresAt==="string"?A.expiresAt:void 0,actorId:P.actor?.id})});return x({ok:!1,error:"Registry action must be test or rotate."},422)}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Registry connection could not be updated."},422)}}if(q.pathname==="/api/onboarding/registries"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=Yn.get(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Registry connection was not found."},404);let U=zr.list(y.project.id).filter((H)=>H.input.source.kind==="image"&&H.input.source.registryConnectionId===F.id||H.input.build.kind==="prebuilt_image"&&H.input.build.registryConnectionId===F.id);if(A.preview===!0)return x({ok:!0,preview:!0,affectedDrafts:U});return x({ok:!0,registry:Yn.disconnect(F.id,P.actor?.id),affectedDrafts:U})}if(q.pathname==="/api/onboarding/apply"&&N.method==="POST"){let A=await re(N),P=We(me);try{let F=Bc({controlPlane:y.store,drafts:zr,draftId:String(A.id??""),expectedVersion:Number(A.version),confirmEnvironment:String(A.confirmEnvironment??""),actorId:P.actor?.id});return x({ok:!0,resource:F.resource,operation:F.operation,plan:F.plan},202)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Application plan could not be applied."},422)}}if(q.pathname==="/api/sources"&&N.method==="GET"){let A=Ke.listConnections(y.organization.id);return x({connections:A,bindings:Ke.listBindings({projectId:y.project.id}),repositories:A.flatMap((P)=>Ke.listRepositories(P.id)),deployKeys:A.flatMap((P)=>Ke.listDeployKeys(P.id)),webhooks:A.flatMap((P)=>Ke.listWebhooks(P.id)).map((P)=>({...P,deliveries:Ke.listDeliveries(P.id,20)})),project:{id:y.project.id,slug:y.project.slug},environment:ne(y,String(Ce)),resources:y.store.listResources(y.project.id,ne(y,String(Ce)).environmentId).filter((P)=>P.kind==="application").map((P)=>({id:P.id,slug:P.slug,name:P.name}))})}if(q.pathname==="/api/sources/connections"&&N.method==="POST"){let A=await re(N),P=We(me),F=String(A.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(F))return x({ok:!1,error:"A supported Git provider is required."},422);try{let U=F==="github"&&(A.privateKey||A.appId)?{appId:typeof A.appId==="string"?A.appId:void 0,installationId:typeof A.installationId==="string"?A.installationId:void 0,privateKey:typeof A.privateKey==="string"?A.privateKey:void 0}:F!=="generic_ssh"&&A.token?{token:typeof A.token==="string"?A.token:void 0,username:typeof A.username==="string"?A.username:void 0}:void 0,H={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"},Q,J,ee;if(y.store.database.transaction(()=>{if(Q=Ke.createConnection({organizationId:y.organization.id,provider:F,name:String(A.name??F),host:String(A.host??H[F]??""),owner:typeof A.owner==="string"?A.owner:void 0,authKind:A.authKind,credential:U,grantedScopes:Array.isArray(A.grantedScopes)?A.grantedScopes.map(String):[],credentialExpiresAt:typeof A.credentialExpiresAt==="string"?A.credentialExpiresAt:void 0,createdByActorId:P.actor?.id}),typeof A.repositoryUrl==="string"&&typeof A.repositoryFullName==="string")J=Ke.upsertRepository({connectionId:Q.id,providerRepositoryId:`manual:${A.repositoryFullName}`,fullName:A.repositoryFullName,cloneUrl:A.repositoryUrl,defaultBranch:String(A.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"manual"}});if(F==="generic_ssh")ee=Ke.createDeployKey({connectionId:Q.id,name:String(A.deployKeyName??"Repository deploy key"),publicKey:String(A.publicKey??""),privateKey:String(A.deployPrivateKey??""),host:String(A.sshHost??""),hostKey:String(A.hostKey??""),actorId:P.actor?.id})})(),A.test===!0)Q=await qo(Ke,Q.id,J?.id);return x({ok:!0,connection:Q,repository:J,deployKey:ee},201)}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Source connection could not be created."},422)}}if(q.pathname==="/api/sources/connections"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=Ke.getConnection(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Source connection was not found."},404);try{if(A.action==="test")return x({ok:!0,connection:await qo(Ke,F.id,typeof A.repositoryId==="string"?A.repositoryId:void 0)});if(A.action==="rotate")return x({ok:!0,connection:Ke.rotateCredential(F.id,{token:typeof A.token==="string"?A.token:void 0,username:typeof A.username==="string"?A.username:void 0,appId:typeof A.appId==="string"?A.appId:void 0,installationId:typeof A.installationId==="string"?A.installationId:void 0,privateKey:typeof A.privateKey==="string"?A.privateKey:void 0},{expiresAt:typeof A.expiresAt==="string"?A.expiresAt:void 0,actorId:P.actor?.id})});return x({ok:!1,error:"Connection action must be test or rotate."},422)}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Source connection could not be updated."},422)}}if(q.pathname==="/api/sources/connections"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=Ke.getConnection(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Source connection was not found."},404);let U=Ke.listBindings({connectionId:F.id,status:"active"});if(A.preview===!0)return x({ok:!0,preview:!0,affectedBindings:U});return x({ok:!0,...Ke.disconnectConnection(F.id,P.actor?.id)})}if(q.pathname==="/api/sources/deploy-keys"&&N.method==="POST"){let A=await re(N),P=We(me),F=Ke.getConnection(String(A.connectionId??""));if(!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Source connection was not found."},404);try{return x({ok:!0,deployKey:Ke.createDeployKey({connectionId:F.id,name:String(A.name??"Repository deploy key"),publicKey:String(A.publicKey??""),privateKey:String(A.privateKey??""),host:String(A.host??""),hostKey:String(A.hostKey??""),actorId:P.actor?.id})},201)}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Deploy key could not be stored."},422)}}if(q.pathname==="/api/sources/deploy-keys"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=Ke.getDeployKey(String(A.id??"")),U=F?Ke.getConnection(F.connectionId):void 0;if(!F||!U||U.organizationId!==y.organization.id)return x({ok:!1,error:"Deploy key was not found."},404);let H=Ke.listBindings({connectionId:U.id}).filter((Q)=>Q.deployKeyId===F.id);if(A.preview===!0)return x({ok:!0,preview:!0,affectedBindings:H});return x({ok:!0,...Ke.revokeDeployKey(F.id,P.actor?.id)})}if(q.pathname==="/api/sources/repositories/sync"&&N.method==="POST"){let A=await re(N),P=Ke.getConnection(String(A.connectionId??""));if(!P||P.organizationId!==y.organization.id)return x({ok:!1,error:"Source connection was not found."},404);try{return x({ok:!0,repositories:await Gi(Ke,String(A.connectionId??""),{search:typeof A.search==="string"?A.search:void 0})})}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Repositories could not be synchronized."},422)}}if(q.pathname==="/api/sources/references"&&N.method==="GET"){let A=Ke.getConnection(String(q.searchParams.get("connectionId")??""));if(!A||A.organizationId!==y.organization.id)return x({ok:!1,error:"Source connection was not found."},404);try{return x(await qi(Ke,{connectionId:String(q.searchParams.get("connectionId")??""),repository:String(q.searchParams.get("repository")??""),repositoryId:q.searchParams.get("repositoryId")??void 0,deployKeyId:q.searchParams.get("deployKeyId")??void 0,type:q.searchParams.get("type")==="tags"?"tags":"branches",cursor:q.searchParams.get("cursor")??void 0}))}catch(P){return x({ok:!1,error:P instanceof Error?P.message:"References could not be listed."},422)}}if(q.pathname==="/api/sources/bindings"&&N.method==="POST"){let A=await re(N),P=We(me),F=ne(y,String(Ce)),U=Ke.getConnection(String(A.connectionId??""));if(!U||U.organizationId!==y.organization.id)return x({ok:!1,error:"Source connection was not found."},404);try{return x({ok:!0,binding:Ke.createBinding({projectId:y.project.id,environmentId:F.environmentId,resourceId:typeof A.resourceId==="string"?A.resourceId:void 0,connectionId:String(A.connectionId??""),repositoryId:typeof A.repositoryId==="string"?A.repositoryId:void 0,repositoryFullName:String(A.repositoryFullName??""),defaultBranch:String(A.defaultBranch??"main"),branchRule:typeof A.branchRule==="string"?A.branchRule:void 0,tagRule:typeof A.tagRule==="string"?A.tagRule:void 0,monorepoRoot:String(A.monorepoRoot??"."),includePaths:Array.isArray(A.includePaths)?A.includePaths.map(String):[],excludePaths:Array.isArray(A.excludePaths)?A.excludePaths.map(String):[],submodules:A.submodules===!0,cloneDepth:A.cloneDepth?Number(A.cloneDepth):void 0,deployKeyId:typeof A.deployKeyId==="string"&&A.deployKeyId?A.deployKeyId:void 0,autoDeploy:A.autoDeploy!==!1,pullRequestPreviews:A.pullRequestPreviews!==!1,actorId:P.actor?.id})},201)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"Source binding could not be created."},422)}}if(q.pathname==="/api/sources/bindings"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=Ke.getBinding(String(A.id??""));if(!F||F.projectId!==y.project.id)return x({ok:!1,error:"Source binding was not found."},404);try{return x({ok:!0,binding:Ke.updateBinding(F.id,Number(A.version),{defaultBranch:A.defaultBranch,branchRule:A.branchRule,tagRule:A.tagRule,monorepoRoot:A.monorepoRoot,includePaths:A.includePaths,excludePaths:A.excludePaths,submodules:A.submodules,cloneDepth:A.cloneDepth,deployKeyId:A.deployKeyId,autoDeploy:A.autoDeploy,pullRequestPreviews:A.pullRequestPreviews,status:A.status,disabledReason:A.disabledReason,actorId:P.actor?.id})})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Source binding could not be updated."},409)}}if(q.pathname==="/api/sources/webhooks"&&N.method==="POST"){let A=await re(N),P=Ke.getConnection(String(A.connectionId??""));if(!P||P.organizationId!==y.organization.id)return x({ok:!1,error:"Source connection was not found."},404);try{let F=Ke.createWebhook({connectionId:String(A.connectionId??""),repositoryId:typeof A.repositoryId==="string"?A.repositoryId:void 0,repositoryFullName:String(A.repositoryFullName??""),events:Array.isArray(A.events)?A.events.map(String):void 0,secret:typeof A.secret==="string"?A.secret:void 0}),U=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||pt,H=U?Zt(U,F.webhook):void 0,Q=A.reconcile!==!1&&U?await Zr(Ke,F.webhook.id,U):F.webhook;return x({ok:!0,webhook:Q,endpoint:H,endpointRevealOnce:!0},201)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Source webhook could not be created."},422)}}if(q.pathname==="/api/sources/webhooks"&&N.method==="PATCH"){let A=await re(N),P=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||pt,F=Ke.getWebhook(String(A.id??"")),U=F?Ke.getConnection(F.connectionId):void 0;if(!F||!U||U.organizationId!==y.organization.id)return x({ok:!1,error:"Source webhook was not found."},404);if(!P)return x({ok:!1,error:"Set TS_CLOUD_WEBHOOK_BASE_URL to reconcile provider webhooks."},422);try{return x({ok:!0,webhook:await Zr(Ke,String(A.id??""),P)})}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"Source webhook could not be reconciled."},422)}}if(q.pathname==="/api/sources/webhooks"&&N.method==="DELETE"){let A=await re(N),P=Ke.getWebhook(String(A.id??"")),F=P?Ke.getConnection(P.connectionId):void 0;if(!P||!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Source webhook was not found."},404);try{return x({ok:!0,webhook:await vl(Ke,String(A.id??""))})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Source webhook could not be removed."},422)}}if(q.pathname==="/api/security/posture"&&N.method==="GET"){let A=ne(y,String(Ce)),P=ut.listFindings({...A,limit:500});return x({scope:A,summary:ut.summary(A.organizationId,A.projectId,A.environmentId),findings:P,scans:ut.listScanRuns({...A,limit:100}),policies:ut.listPolicies(A.organizationId).filter((F)=>!F.environmentId||F.environmentId===A.environmentId),waivers:P.flatMap((F)=>ut.listWaivers(F.id)),decisions:ut.listDecisions(A.environmentId,50),actors:y.store.listMemberships(y.organization.id).map((F)=>y.store.getActor(F.actorId)).filter(Boolean)})}if(q.pathname==="/api/security/export"&&N.method==="GET")return x(ut.exportPosture(y.organization.id));if(q.pathname==="/api/security/scan"&&N.method==="POST"){let A=ne(y,String(Ce)),P=await new St(ut).run(new rn,{...A,artifactRoot:t}),F=ji(ut,A,sr??{});return x({ok:!0,source:P,host:F,summary:ut.summary(A.organizationId,A.projectId,A.environmentId)})}if(q.pathname==="/api/security/review"&&N.method==="POST")try{let A=ne(y,String(Ce));return x({ok:!0,...zi(ut,{scope:A,desiredConfigHash:y.project.desiredConfigHash})})}catch(A){return x({ok:!1,error:A instanceof Error?A.message:"Security change review failed."},409)}if(q.pathname==="/api/security/policies"&&N.method==="POST"){let A=await re(N),P=We(me);if(!P.actor)return x({ok:!1,error:"An organization actor is required."},403);try{let F=ut.createPolicy({organizationId:y.organization.id,environmentId:A.environmentId===null?void 0:String(A.environmentId??ne(y,String(Ce)).environmentId),name:String(A.name??""),scannerFailMode:A.scannerFailMode==="open"?"open":"closed",requiredScanners:Array.isArray(A.requiredScanners)?A.requiredScanners.map(String):[],rules:Array.isArray(A.rules)?A.rules.map((U)=>({minimumSeverity:String(U.minimumSeverity),action:String(U.action),scannerId:U.scannerId?String(U.scannerId):void 0})):[],actorId:P.actor.id});return x({ok:!0,policy:F},201)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Security policy could not be created."},422)}}if(q.pathname==="/api/security/policies"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=ut.getPolicy(String(A.id??""));if(!P.actor||!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Security policy was not found."},404);try{return x({ok:!0,policy:ut.updatePolicy(F.id,Number(A.version),{name:typeof A.name==="string"?A.name:void 0,scannerFailMode:A.scannerFailMode==="open"||A.scannerFailMode==="closed"?A.scannerFailMode:void 0,requiredScanners:Array.isArray(A.requiredScanners)?A.requiredScanners.map(String):void 0,rules:Array.isArray(A.rules)?A.rules.map((U)=>({minimumSeverity:String(U.minimumSeverity),action:String(U.action),scannerId:U.scannerId?String(U.scannerId):void 0})):void 0,enabled:typeof A.enabled==="boolean"?A.enabled:void 0,actorId:P.actor.id})})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Security policy could not be updated."},409)}}if(q.pathname==="/api/security/waivers"&&N.method==="POST"){let A=await re(N),P=We(me);if(!P.actor)return x({ok:!1,error:"An organization actor is required."},403);try{return x({ok:!0,waiver:ut.createWaiver({findingId:String(A.findingId??""),policyId:typeof A.policyId==="string"?A.policyId:void 0,reason:String(A.reason??""),referenceUrl:typeof A.referenceUrl==="string"?A.referenceUrl:void 0,expiresAt:String(A.expiresAt??""),actorId:P.actor.id})},201)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Security waiver could not be created."},422)}}if(q.pathname==="/api/security/waivers"&&N.method==="DELETE"){let A=await re(N),P=We(me);if(!P.actor)return x({ok:!1,error:"An organization actor is required."},403);try{return x({ok:!0,waiver:ut.revokeWaiver(String(A.id??""),P.actor.id)})}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Security waiver could not be revoked."},404)}}if(q.pathname==="/api/security/findings"&&N.method==="PATCH"){let A=await re(N),P=We(me),F=ut.getFinding(String(A.id??""));if(!P.actor||!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Security finding was not found."},404);try{let U=A.action==="acknowledge"?ut.acknowledgeFinding(F.id,P.actor.id):ut.assignFinding(F.id,typeof A.ownerActorId==="string"&&A.ownerActorId?A.ownerActorId:void 0,P.actor.id);return x({ok:!0,finding:U})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Security finding could not be updated."},422)}}if(q.pathname==="/api/security/comments"&&N.method==="POST"){let A=await re(N),P=We(me);if(!P.actor)return x({ok:!1,error:"An organization actor is required."},403);try{return x({ok:!0,comment:ut.addComment({findingId:String(A.findingId??""),actorId:P.actor.id,body:String(A.body??""),referenceUrl:typeof A.referenceUrl==="string"?A.referenceUrl:void 0})},201)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Comment could not be saved."},422)}}if(q.pathname==="/api/auth/sessions"&&N.method==="GET"){let A=lr.resolveSession(N);return x({currentSessionId:A?.id,sessions:A?Ne.listSessions(A.identityId,{includeInactive:!0}):[]})}if(q.pathname==="/api/auth/sessions"&&N.method==="DELETE"){let A=await re(N),P=lr.resolveSession(N);if(!P)return x({ok:!1,error:"Sign in again to manage sessions."},401);let F=String(A.id??""),U=Ne.revokeSession(P.identityId,F),H=F===P.id&&U?{"set-cookie":Du({secure:Di})}:void 0;return x({ok:U,signedOut:F===P.id&&U},U?200:404,H)}if(q.pathname==="/api/auth/sessions/revoke-others"&&N.method==="POST"){let A=lr.resolveSession(N);if(!A)return x({ok:!1,error:"Sign in again to manage sessions."},401);return x({ok:!0,revoked:Ne.revokeOtherSessions(A.identityId,A.id)})}if(q.pathname==="/api/auth/password/change"&&N.method==="POST"){let A=await re(N),P=String(A.currentPassword??""),F=String(A.password??""),U=We(me),H=U.actor?Ne.getIdentityByActor(U.actor.id):void 0;if(!H||!Qn(P,H.passwordHash))return x({ok:!1,error:"Current password is incorrect."},401);if(F.length<12)return x({ok:!1,error:"New password must be at least 12 characters."},422);if(Qn(F,H.passwordHash))return x({ok:!1,error:"Choose a different password."},409);let Q=ho(F),J=Ne.updatePassword(H.id,Q);Nu(t,J.username,Q);let ee=_c(J.id,N,at.requestIP(N)?.address??"unknown");return y.store.appendEvent({organizationId:y.organization.id,actorId:J.actorId,type:"auth.password.changed"}),x({ok:!0,message:"Password changed and other sessions were signed out."},200,{"set-cookie":Ua(ee.token,{secure:Di,maxAgeMs:Xe})})}if(q.pathname==="/api/auth/mfa/enroll"&&N.method==="POST"){let A=await re(N),P=lr.resolveSession(N),F=We(me),U=F.actor?Ne.getIdentityByActor(F.actor.id):void 0;if(!P||!U)return x({ok:!1,error:"Sign in again before enabling MFA."},401);if(!Qn(String(A.password??""),U.passwordHash))return x({ok:!1,error:"Current password is incorrect."},401);try{let H=Ne.beginTotpEnrollment(U.id,{issuer:y.organization.name});return y.store.appendEvent({organizationId:y.organization.id,actorId:U.actorId,type:"auth.mfa.enrollment.started"}),x({factor:H.factor,secret:H.secret,uri:H.uri})}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"MFA enrollment failed."},409)}}if(q.pathname==="/api/auth/mfa/verify"&&N.method==="POST"){let A=await re(N),P=lr.resolveSession(N),F=We(me),U=F.actor?Ne.getIdentityByActor(F.actor.id):void 0;if(!P||!U)return x({ok:!1,error:"Sign in again before enabling MFA."},401);try{let H=Ne.verifyTotpEnrollment(U.id,String(A.code??""));return Ne.markSessionStepUp(P.id,!0),y.store.appendEvent({organizationId:y.organization.id,actorId:U.actorId,type:"auth.mfa.enabled",payload:{recoveryCodeCount:H.recoveryCodes.length}}),x(H)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"MFA enrollment failed."},422)}}if(q.pathname==="/api/auth/mfa"&&N.method==="DELETE"){let A=await re(N),P=lr.resolveSession(N),F=We(me),U=F.actor?Ne.getIdentityByActor(F.actor.id):void 0;if(!P||!U||!Qn(String(A.password??""),U.passwordHash))return x({ok:!1,error:"Current password is incorrect."},401);let H=Ne.verifyMfaCode(U.id,String(A.code??""));if(!H.valid||!H.method)return x({ok:!1,error:"Authenticator or recovery code is incorrect."},401);return Ne.disableMfa(U.id),Ne.revokeOtherSessions(U.id,P.id),Ne.markSessionStepUp(P.id),y.store.appendEvent({organizationId:y.organization.id,actorId:U.actorId,type:"auth.mfa.disabled",payload:{method:H.method}}),x({ok:!0})}if(q.pathname==="/api/auth/step-up"&&N.method==="POST"){let A=await re(N),P=lr.resolveSession(N),F=We(me),U=F.actor?Ne.getIdentityByActor(F.actor.id):void 0;if(!P||!U||!Qn(String(A.password??""),U.passwordHash))return x({ok:!1,error:"Current password is incorrect."},401);let H=Ne.getMfaFactor(U.id);if(H?.state==="active"){if(!Ne.verifyMfaCode(U.id,String(A.code??"")).valid)return x({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}let Q=Ne.markSessionStepUp(P.id,H?.state==="active");return y.store.appendEvent({organizationId:y.organization.id,actorId:U.actorId,type:"auth.step_up.succeeded",payload:{mfa:H?.state==="active"}}),x({ok:!0,recentAuthAt:Q.recentAuthAt})}if(q.pathname==="/api/terminal"){if(!ue)return x({ok:!1,error:"The web terminal is disabled."},403);if(at.upgrade(N))return;return Wu("WebSocket upgrade failed",400)}if(q.pathname==="/api/health"){let A=y.store.health();return x({ok:!0,cwd:t,environment:Ce,environments:C,uiRoot:await Qt(me,Ce),liveData:ae.size>0,terminal:ue,localPackage:import.meta.url.includes("/Code/Libraries/ts-cloud/"),controlPlane:{schemaVersion:A.schemaVersion,supportedSchemaVersion:A.supportedSchemaVersion,integrity:A.integrity,pendingRetryableOperations:A.pendingRetryableOperations}})}if(q.pathname==="/api/control-plane/operations"){let A=q.searchParams.get("state"),P=A&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(A)?A:void 0;return x({operations:y.store.listOperations({projectId:y.project.id,state:P,kind:q.searchParams.get("kind")??void 0,limit:Number(q.searchParams.get("limit"))||100})})}if(q.pathname==="/api/queue"&&N.method==="GET"){let A=q.searchParams.get("state"),P=A&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(A)?A:void 0,F=Vt.list({projectId:y.project.id,state:P,limit:Number(q.searchParams.get("limit"))||250}).filter((U)=>ws(me,U.operation.id,"deployments:read")).map((U)=>{let H=U.operation.resourceId?y.store.getResource(U.operation.resourceId):void 0,Q=U.operation.environmentId?y.store.listEnvironments(y.project.id).find((Se)=>Se.id===U.operation.environmentId):void 0,J=U.operation.actorId?y.store.getActor(U.operation.actorId):void 0,ee=U.operation.input;return{...U,target:H?{id:H.id,name:H.name,slug:H.slug,kind:H.kind}:Q?{id:Q.id,name:Q.name,slug:Q.slug,kind:"environment"}:{id:y.project.id,name:y.project.name,slug:y.project.slug,kind:"project"},actor:J?{id:J.id,name:J.displayName,kind:J.kind}:void 0,commit:ee.revision??ee.source?.commitSha??null}});return x({operations:F,concurrency:Vt.limits})}if(q.pathname==="/api/queue/logs"&&N.method==="GET"){let A=String(q.searchParams.get("id")??"");if(!ws(me,A,"deployments:read"))return x({ok:!1,error:"Operation was not found in this scope."},404);let P=Vt.logs(A,{after:Number(q.searchParams.get("after"))||0,limit:Number(q.searchParams.get("limit"))||500});return x({entries:P,cursor:P.at(-1)?.sequence??(Number(q.searchParams.get("after"))||0),operation:y.store.getOperation(A)})}if(q.pathname==="/api/queue/stream"&&N.method==="GET"){let A=String(q.searchParams.get("id")??"");if(!ws(me,A,"deployments:read"))return x({ok:!1,error:"Operation was not found in this scope."},404);let P=N.headers.get("last-event-id")?.trim(),F=Number(P||q.searchParams.get("after")||0),U=new TextEncoder,H,Q=!1,J=new ReadableStream({start(ee){let Se=()=>{if(Q)return;let ve=lr.resolveUser(N);if(!ve||!ws(ve,A,"deployments:read")){if(Q=!0,H)clearInterval(H);ee.close();return}let nt=Vt.logs(A,{after:F,limit:500});for(let He of nt)F=He.sequence,ee.enqueue(U.encode(`id: ${He.sequence}
 event: log
 data: ${JSON.stringify(He)}
 
 `));let Pe=y.store.getOperation(A);if(Pe&&["succeeded","failed","cancelled","timed_out"].includes(Pe.state)&&Vt.logs(A,{after:F,limit:1}).length===0){if(Q=!0,H)clearInterval(H);ee.enqueue(U.encode(`event: complete
 data: ${JSON.stringify({state:Pe.state,cursor:F})}
 
-`)),ee.close()}};if(Se(),!Q)H=setInterval(Se,500);N.signal.addEventListener("abort",()=>{if(Q=!0,H)clearInterval(H);try{ee.close()}catch{}},{once:!0})},cancel(){if(Q=!0,H)clearInterval(H)}});return new Response(J,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no"}})}if(q.pathname==="/api/queue/cancel"&&N.method==="POST"){let A=await re(N),P=String(A.id??"");if(!ws(me,P,"deployments:cancel"))return O({ok:!1,error:"Operation was not found or cannot be cancelled in this scope."},404);let F=E(y.store,me);try{return O({ok:!0,operation:Vt.requestCancellation(P,F.id)})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Cancellation failed."},409)}}if(q.pathname==="/api/queue/retry"&&N.method==="POST"){let A=await re(N),P=String(A.id??"");if(!ws(me,P,"deployments:create"))return O({ok:!1,error:"Operation was not found or cannot be retried in this scope."},404);let F=E(y.store,me);try{return O({ok:!0,operation:Vt.retry(P,String(A.errorClass??"manual"),{delayMs:Number(A.delayMs)||0,actorId:F.id})})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Retry failed."},409)}}if(q.pathname==="/api/queue/settings"&&N.method==="GET")return O({concurrency:Vt.limits});if(q.pathname==="/api/queue/settings"&&N.method==="PATCH"){let A=await re(N);if(A.confirm!=="update queue limits")return O({ok:!1,error:'Type "update queue limits" to confirm production concurrency changes.'},409);let P=E(y.store,me);return O({ok:!0,concurrency:Vt.configureConcurrency(A.concurrency??{},{organizationId:y.organization.id,actorId:P.id})})}if(q.pathname==="/api/queue/history"&&N.method==="DELETE"){let A=await re(N);if(A.confirm!=="clear completed")return O({ok:!1,error:'Type "clear completed" to confirm retained history cleanup.'},409);let P=E(y.store,me);return O({ok:!0,deleted:Vt.clearCompleted({projectId:y.project.id,before:typeof A.before==="string"?A.before:void 0,actorId:P.id})})}if(q.pathname==="/api/previews"&&N.method==="GET"){let A=yr.previews.listInstances({projectId:y.project.id}).filter((U)=>Dr(me,U.resourceId,"deployments:read")),P=yr.previews.listDefinitions(y.project.id).filter((U)=>Dr(me,U.resourceId,"project:read")),F=y.store.listResources(y.project.id).filter((U)=>U.kind==="application"&&Dr(me,U.id,"project:read")).map((U)=>({id:U.id,slug:U.slug,name:U.name,environmentId:U.environmentId}));return O({previews:A,definitions:P,resources:F,environments:[...y.environments.values()]})}if(q.pathname==="/api/releases"&&N.method==="GET"){let A=[...y.environments.values()],P=y.store.listResources(y.project.id).filter((H)=>Dr(me,H.id,"deployments:read")),F=new Set(P.map((H)=>H.id)),U=Dn.releases.list({projectId:y.project.id}).filter((H)=>F.has(H.resourceId)).map((H)=>{let Q=P.find((Se)=>Se.id===H.resourceId),J=A.find((Se)=>Se.id===H.environmentId),ee=H.previousReleaseId?Dn.releases.get(H.previousReleaseId):void 0;return{...H,resource:Q?{id:Q.id,name:Q.name,slug:Q.slug,provider:Q.provider}:void 0,environment:J?{id:J.id,name:J.name,slug:J.slug,kind:J.kind}:void 0,artifact:Dn.releases.getArtifact(H.artifactId),transitions:Dn.releases.transitions(H.id),approvals:Dn.releases.approvals(H.id),previous:ee,comparison:ee?Dn.releases.compare(ee.id,H.id):void 0,capabilities:Yr({kind:H.kind,provider:Q?.provider,hasHealthGate:!!H.healthGate,replicas:Number(H.manifest?.replicas)||1})}});return O({releases:U,resources:P.map((H)=>({id:H.id,name:H.name,slug:H.slug,environmentId:H.environmentId,provider:H.provider})),environments:A})}if(q.pathname==="/api/releases/action"&&N.method==="POST"){let A=await re(N),P=Dn.releases.get(String(A.id??"")),F=String(A.action??"");if(!P||!Dr(me,P.resourceId,"deployments:create"))return O({ok:!1,error:"Release was not found in this scope."},404);let U=E(y.store,me);try{if(F==="activate")return O({ok:!0,operation:Dn.enqueueActivation(P,{actorId:U.id})});if(F==="rollback"){let H=y.store.getResource(P.resourceId);if(A.confirm!==H?.slug)return O({ok:!1,error:`Type "${H?.slug??""}" to confirm rollback.`},409);return O({ok:!0,operation:Dn.enqueueRollback(P,{actorId:U.id,targetReleaseId:typeof A.targetReleaseId==="string"?A.targetReleaseId:void 0})})}if(F==="approve"){let H=y.store.listEnvironments(P.projectId).find((Q)=>Q.id===P.environmentId);if(A.confirm!==H?.slug)return O({ok:!1,error:`Type "${H?.slug??""}" to confirm the environment gate.`},409);return O({ok:!0,release:Dn.releases.approve(P.id,{actorId:U.id,decision:A.decision==="rejected"?"rejected":"approved",comment:typeof A.comment==="string"?A.comment:void 0})})}if(F==="pin")return O({ok:!0,release:Dn.releases.pin(P.id,A.pinned!==!1,typeof A.reason==="string"?A.reason:void 0)});if(F==="promote"){let H=y.store.getResource(String(A.targetResourceId??"")),Q=H?y.store.listEnvironments(P.projectId).find((J)=>J.id===H.environmentId):void 0;if(!H||!Q||!Dr(me,H.id,"deployments:create"))return O({ok:!1,error:"Promotion target was not found in this scope."},404);if(A.confirm!==Q.slug)return O({ok:!1,error:`Type "${Q.slug}" to confirm promotion.`},409);return O({ok:!0,release:Dn.releases.promote(P.id,{targetEnvironmentId:Q.id,targetResourceId:H.id,config:A.config&&typeof A.config==="object"?A.config:{},strategy:typeof A.strategy==="string"?A.strategy:void 0,actorId:U.id,approvalRequired:A.approvalRequired===!0})})}return O({ok:!1,error:"Unsupported release action."},422)}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"Release action failed."},409)}}if(q.pathname==="/api/compose"&&N.method==="GET"){let A=xi.applications.list({projectId:y.project.id}).filter((P)=>Dr(me,P.resourceId,"applications:read")).map((P)=>({...P,services:xi.applications.services(P.id)}));return O({applications:A,templates:Br(),environments:[...y.environments.values()]})}if(q.pathname==="/api/compose/preview"&&N.method==="POST"){let A=await re(N),P=String(A.environmentId??"");if(!Ga(me,P,"applications:manage"))return O({ok:!1,error:"Environment was not found in this scope."},404);try{return O({ok:!0,result:xi.applications.preview(String(A.source??""),{name:String(A.name??""),slug:typeof A.slug==="string"?A.slug:void 0,projectId:y.project.id,environmentId:P})})}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Compose could not be parsed."},422)}}if((q.pathname==="/api/compose/import"||q.pathname==="/api/compose/template")&&N.method==="POST"){let A=await re(N),P=String(A.environmentId??"");if(!Ga(me,P,"applications:manage"))return O({ok:!1,error:"Environment was not found in this scope."},404);let F=E(y.store,me);try{let U=q.pathname.endsWith("/template")?xi.applications.fromTemplate(String(A.templateId??""),A.inputs&&typeof A.inputs==="object"?A.inputs:{},{name:String(A.name??""),projectId:y.project.id,environmentId:P,version:typeof A.templateVersion==="string"?A.templateVersion:void 0,createdByActorId:F.id}):xi.applications.import(String(A.source??""),{name:String(A.name??""),slug:typeof A.slug==="string"?A.slug:void 0,projectId:y.project.id,environmentId:P,createdByActorId:F.id});return O({ok:!0,application:U.application,diagnostics:U.parsed.diagnostics})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Compose application could not be saved."},422)}}if(q.pathname==="/api/compose/action"&&N.method==="POST"){let A=await re(N),P=xi.applications.get(String(A.id??"")),F=String(A.action??""),U=F==="delete"||F==="stop"?"deployments:cancel":"deployments:create";if(!P||!Dr(me,P.resourceId,U))return O({ok:!1,error:"Compose application was not found in this scope."},404);try{let H=E(y.store,me);return O({ok:!0,operation:xi.enqueue(P,F,{actorId:H.id,service:typeof A.service==="string"?A.service:void 0,replicas:Number.isFinite(Number(A.replicas))?Number(A.replicas):void 0,removeVolumes:A.removeVolumes===!0,confirmation:typeof A.confirm==="string"?A.confirm:void 0})})}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"Compose operation could not be queued."},409)}}if((q.pathname==="/api/compose/logs"||q.pathname==="/api/compose/shell")&&N.method==="POST"){let A=await re(N),P=xi.applications.get(String(A.id??"")),F=q.pathname.endsWith("/shell"),U=F?"runtime:terminal":"runtime:logs";if(!P||!Dr(me,P.resourceId,U))return O({ok:!1,error:"Compose service was not found in this scope."},404);let H=String(A.service??"");if(!P.manifest.spec.services[H])return O({ok:!1,error:"Compose service was not found."},404);if(F&&A.confirm!==H)return O({ok:!1,error:`Type "${H}" to run a service command.`},409);let Q=y.store.listEnvironments(P.projectId).find((ee)=>ee.id===P.environmentId)?.slug;if(!Q)return O({ok:!1,error:"Compose environment was not found."},404);let J=F?zc(P.manifest,H,Array.isArray(A.command)?A.command.map(String):["sh"]):jc(P.manifest,H,Number(A.lines)||200);return O(await bc(m,Q,J))}if(q.pathname==="/api/previews/definitions"&&N.method==="POST"){let A=await re(N),P=String(A.resourceId??"");if(!Dr(me,P,"config:write"))return O({ok:!1,error:"Application was not found in this scope."},404);let F=E(y.store,me);try{return O({ok:!0,definition:yr.previews.createDefinition({...A,projectId:y.project.id,resourceId:P,baseEnvironmentId:String(A.baseEnvironmentId??""),domainPattern:String(A.domainPattern??""),createdByActorId:F.id})})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Preview policy could not be created."},409)}}if(q.pathname==="/api/previews/deploy"&&N.method==="POST"){let A=await re(N),P=yr.previews.getDefinition(String(A.definitionId??""));if(!P||!Dr(me,P.resourceId,"deployments:create"))return O({ok:!1,error:"Preview policy was not found in this scope."},404);let F=E(y.store,me);try{let U=yr.previews.upsert({definitionId:P.id,sourceProvider:"dashboard",repository:"dashboard",branch:String(A.branch??""),pullRequestNumber:Number(A.pullRequestNumber)||void 0,commitSha:String(A.commitSha??""),createdByActorId:F.id});return O({ok:!0,preview:U.preview,operation:yr.enqueueDeploy(U.preview,{created:U.created,actorId:F.id})})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Preview could not be queued."},409)}}if(q.pathname==="/api/previews/destroy"&&N.method==="POST"){let A=await re(N),P=yr.previews.getInstance(String(A.id??""));if(!P||!Dr(me,P.resourceId,"deployments:cancel"))return O({ok:!1,error:"Preview was not found in this scope."},404);if(A.confirm!==P.name)return O({ok:!1,error:`Type "${P.name}" to confirm tagged teardown.`},409);let F=E(y.store,me);return O({ok:!0,operation:yr.enqueueDestroy(P,"dashboard",F.id)})}if(q.pathname==="/api/previews/extend"&&N.method==="POST"){let A=await re(N),P=yr.previews.getInstance(String(A.id??""));if(!P||!Dr(me,P.resourceId,"deployments:create"))return O({ok:!1,error:"Preview was not found in this scope."},404);return O({ok:!0,preview:yr.previews.extend(P.id,Number(A.hours))})}if(q.pathname==="/api/previews/rebuild"&&N.method==="POST"){let A=await re(N),P=yr.previews.getInstance(String(A.id??""));if(!P||!Dr(me,P.resourceId,"deployments:create"))return O({ok:!1,error:"Preview was not found in this scope."},404);let F=E(y.store,me);return O({ok:!0,operation:yr.enqueueDeploy(P,{actorId:F.id,reason:"manual_rebuild"})})}if(q.pathname==="/api/previews/cleanup"&&N.method==="POST"){let A=await re(N);if(!A.dryRun&&A.confirm!=="cleanup previews")return O({ok:!1,error:'Type "cleanup previews" to confirm teardown.'},409);let P=E(y.store,me);return O({ok:!0,...yr.cleanup({dryRun:A.dryRun===!0,maxAgeHours:Number(A.maxAgeHours)||void 0,keepCount:Number(A.keepCount)||void 0,actorId:P.id})})}if(q.pathname==="/api/control-plane/events")return O({events:y.store.listEvents({organizationId:y.organization.id,projectId:y.project.id,operationId:q.searchParams.get("operationId")??void 0,correlationId:q.searchParams.get("correlationId")??void 0,afterSequence:Number(q.searchParams.get("afterSequence"))||void 0,limit:Number(q.searchParams.get("limit"))||200})});if(q.pathname==="/api/search"){let A=String(q.searchParams.get("q")??"").trim().slice(0,128),P=$n.role==="member"?new Set(Object.keys($n.sites)):void 0,F=A?Qs(y.store,{projectId:y.project.id,query:A,allowedResourceSlugs:P,limit:Number(q.searchParams.get("limit"))||20}):[];return O({query:A,results:F,stale:!1})}if(q.pathname==="/api/search/preferences"&&N.method==="GET"){let A=`dashboard:${me.username.toLowerCase()}`;return O({savedFilters:y.store.listSavedFilters(A),navigation:y.store.listNavigation(A)})}if(q.pathname==="/api/search/preferences"&&N.method==="POST"){let A=`dashboard:${me.username.toLowerCase()}`,P=await re(N),F=String(P.action??"");if(F==="save-filter")return O({savedFilter:y.store.saveFilter(A,String(P.name??""),String(P.routeId??""),P.query??{})});if(F==="favorite")return O({navigation:y.store.setFavorite(A,String(P.entityType??""),String(P.entityId??""),P.favorite!==!1)});if(F==="visit")return O({navigation:y.store.recordNavigation(A,String(P.entityType??""),String(P.entityId??""))});return O({ok:!1,error:"Unknown search preference action."},422)}if(q.pathname==="/api/search/preferences"&&N.method==="DELETE"){let A=`dashboard:${me.username.toLowerCase()}`,P=await re(N);return O({ok:y.store.deleteSavedFilter(A,String(P.id??""))})}if(q.pathname==="/api/organization"&&N.method==="GET"){let A=y.store.listMemberships(y.organization.id,{includeRevoked:!0}).map((P)=>{let F=y.store.getActor(P.actorId);return{...P,actor:F?{id:F.id,displayName:F.displayName,externalId:F.externalId,disabledAt:F.disabledAt}:void 0,grants:y.store.listGrants(P.id)}});return O({organization:y.organization,project:y.project,environments:y.store.listEnvironments(y.project.id),resources:y.store.listResources(y.project.id).map((P)=>({id:P.id,environmentId:P.environmentId,kind:P.kind,slug:P.slug,name:P.name})),memberships:A,invitations:y.store.listInvitations(y.organization.id)})}if(q.pathname==="/api/organization/invitations"&&N.method==="GET")return O({invitations:y.store.listInvitations(y.organization.id)});if(q.pathname==="/api/organization/invitations"&&N.method==="POST"){let A=await re(N),P=Uu(A.roleTemplate),F=Ic(A);if(!P||!F)return O({ok:!1,error:"Choose a valid role template and resource scope."},422);let U=We(me);if(!U.actor||!U.membership)return O({ok:!1,error:"Your organization membership is unavailable."},403);if(P==="owner"&&(!Qn(String(A.password??""),me.passwordHash)||U.membership.roleTemplate!=="owner"))return O({ok:!1,error:"Owner invitations require an owner to re-enter their password."},401);try{let H=y.store.createInvitation({organizationId:y.organization.id,email:String(A.email??""),roleTemplate:P,scope:F,invitedByActorId:U.actor.id,expiresInMs:Number(A.expiresInMs)||void 0}),Q=`${q.origin}/accept-invitation?token=${encodeURIComponent(H.token)}`,J=await Xr(m,{to:H.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${Q}
+`)),ee.close()}};if(Se(),!Q)H=setInterval(Se,500);N.signal.addEventListener("abort",()=>{if(Q=!0,H)clearInterval(H);try{ee.close()}catch{}},{once:!0})},cancel(){if(Q=!0,H)clearInterval(H)}});return new Response(J,{headers:{"content-type":"text/event-stream","cache-control":"no-store","x-accel-buffering":"no"}})}if(q.pathname==="/api/queue/cancel"&&N.method==="POST"){let A=await re(N),P=String(A.id??"");if(!ws(me,P,"deployments:cancel"))return x({ok:!1,error:"Operation was not found or cannot be cancelled in this scope."},404);let F=E(y.store,me);try{return x({ok:!0,operation:Vt.requestCancellation(P,F.id)})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Cancellation failed."},409)}}if(q.pathname==="/api/queue/retry"&&N.method==="POST"){let A=await re(N),P=String(A.id??"");if(!ws(me,P,"deployments:create"))return x({ok:!1,error:"Operation was not found or cannot be retried in this scope."},404);let F=E(y.store,me);try{return x({ok:!0,operation:Vt.retry(P,String(A.errorClass??"manual"),{delayMs:Number(A.delayMs)||0,actorId:F.id})})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Retry failed."},409)}}if(q.pathname==="/api/queue/settings"&&N.method==="GET")return x({concurrency:Vt.limits});if(q.pathname==="/api/queue/settings"&&N.method==="PATCH"){let A=await re(N);if(A.confirm!=="update queue limits")return x({ok:!1,error:'Type "update queue limits" to confirm production concurrency changes.'},409);let P=E(y.store,me);return x({ok:!0,concurrency:Vt.configureConcurrency(A.concurrency??{},{organizationId:y.organization.id,actorId:P.id})})}if(q.pathname==="/api/queue/history"&&N.method==="DELETE"){let A=await re(N);if(A.confirm!=="clear completed")return x({ok:!1,error:'Type "clear completed" to confirm retained history cleanup.'},409);let P=E(y.store,me);return x({ok:!0,deleted:Vt.clearCompleted({projectId:y.project.id,before:typeof A.before==="string"?A.before:void 0,actorId:P.id})})}if(q.pathname==="/api/previews"&&N.method==="GET"){let A=yr.previews.listInstances({projectId:y.project.id}).filter((U)=>Dr(me,U.resourceId,"deployments:read")),P=yr.previews.listDefinitions(y.project.id).filter((U)=>Dr(me,U.resourceId,"project:read")),F=y.store.listResources(y.project.id).filter((U)=>U.kind==="application"&&Dr(me,U.id,"project:read")).map((U)=>({id:U.id,slug:U.slug,name:U.name,environmentId:U.environmentId}));return x({previews:A,definitions:P,resources:F,environments:[...y.environments.values()]})}if(q.pathname==="/api/releases"&&N.method==="GET"){let A=[...y.environments.values()],P=y.store.listResources(y.project.id).filter((H)=>Dr(me,H.id,"deployments:read")),F=new Set(P.map((H)=>H.id)),U=Dn.releases.list({projectId:y.project.id}).filter((H)=>F.has(H.resourceId)).map((H)=>{let Q=P.find((Se)=>Se.id===H.resourceId),J=A.find((Se)=>Se.id===H.environmentId),ee=H.previousReleaseId?Dn.releases.get(H.previousReleaseId):void 0;return{...H,resource:Q?{id:Q.id,name:Q.name,slug:Q.slug,provider:Q.provider}:void 0,environment:J?{id:J.id,name:J.name,slug:J.slug,kind:J.kind}:void 0,artifact:Dn.releases.getArtifact(H.artifactId),transitions:Dn.releases.transitions(H.id),approvals:Dn.releases.approvals(H.id),previous:ee,comparison:ee?Dn.releases.compare(ee.id,H.id):void 0,capabilities:Yr({kind:H.kind,provider:Q?.provider,hasHealthGate:!!H.healthGate,replicas:Number(H.manifest?.replicas)||1})}});return x({releases:U,resources:P.map((H)=>({id:H.id,name:H.name,slug:H.slug,environmentId:H.environmentId,provider:H.provider})),environments:A})}if(q.pathname==="/api/releases/action"&&N.method==="POST"){let A=await re(N),P=Dn.releases.get(String(A.id??"")),F=String(A.action??"");if(!P||!Dr(me,P.resourceId,"deployments:create"))return x({ok:!1,error:"Release was not found in this scope."},404);let U=E(y.store,me);try{if(F==="activate")return x({ok:!0,operation:Dn.enqueueActivation(P,{actorId:U.id})});if(F==="rollback"){let H=y.store.getResource(P.resourceId);if(A.confirm!==H?.slug)return x({ok:!1,error:`Type "${H?.slug??""}" to confirm rollback.`},409);return x({ok:!0,operation:Dn.enqueueRollback(P,{actorId:U.id,targetReleaseId:typeof A.targetReleaseId==="string"?A.targetReleaseId:void 0})})}if(F==="approve"){let H=y.store.listEnvironments(P.projectId).find((Q)=>Q.id===P.environmentId);if(A.confirm!==H?.slug)return x({ok:!1,error:`Type "${H?.slug??""}" to confirm the environment gate.`},409);return x({ok:!0,release:Dn.releases.approve(P.id,{actorId:U.id,decision:A.decision==="rejected"?"rejected":"approved",comment:typeof A.comment==="string"?A.comment:void 0})})}if(F==="pin")return x({ok:!0,release:Dn.releases.pin(P.id,A.pinned!==!1,typeof A.reason==="string"?A.reason:void 0)});if(F==="promote"){let H=y.store.getResource(String(A.targetResourceId??"")),Q=H?y.store.listEnvironments(P.projectId).find((J)=>J.id===H.environmentId):void 0;if(!H||!Q||!Dr(me,H.id,"deployments:create"))return x({ok:!1,error:"Promotion target was not found in this scope."},404);if(A.confirm!==Q.slug)return x({ok:!1,error:`Type "${Q.slug}" to confirm promotion.`},409);return x({ok:!0,release:Dn.releases.promote(P.id,{targetEnvironmentId:Q.id,targetResourceId:H.id,config:A.config&&typeof A.config==="object"?A.config:{},strategy:typeof A.strategy==="string"?A.strategy:void 0,actorId:U.id,approvalRequired:A.approvalRequired===!0})})}return x({ok:!1,error:"Unsupported release action."},422)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"Release action failed."},409)}}if(q.pathname==="/api/compose"&&N.method==="GET"){let A=xi.applications.list({projectId:y.project.id}).filter((P)=>Dr(me,P.resourceId,"applications:read")).map((P)=>({...P,services:xi.applications.services(P.id)}));return x({applications:A,templates:Br(),environments:[...y.environments.values()]})}if(q.pathname==="/api/compose/preview"&&N.method==="POST"){let A=await re(N),P=String(A.environmentId??"");if(!Ga(me,P,"applications:manage"))return x({ok:!1,error:"Environment was not found in this scope."},404);try{return x({ok:!0,result:xi.applications.preview(String(A.source??""),{name:String(A.name??""),slug:typeof A.slug==="string"?A.slug:void 0,projectId:y.project.id,environmentId:P})})}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Compose could not be parsed."},422)}}if((q.pathname==="/api/compose/import"||q.pathname==="/api/compose/template")&&N.method==="POST"){let A=await re(N),P=String(A.environmentId??"");if(!Ga(me,P,"applications:manage"))return x({ok:!1,error:"Environment was not found in this scope."},404);let F=E(y.store,me);try{let U=q.pathname.endsWith("/template")?xi.applications.fromTemplate(String(A.templateId??""),A.inputs&&typeof A.inputs==="object"?A.inputs:{},{name:String(A.name??""),projectId:y.project.id,environmentId:P,version:typeof A.templateVersion==="string"?A.templateVersion:void 0,createdByActorId:F.id}):xi.applications.import(String(A.source??""),{name:String(A.name??""),slug:typeof A.slug==="string"?A.slug:void 0,projectId:y.project.id,environmentId:P,createdByActorId:F.id});return x({ok:!0,application:U.application,diagnostics:U.parsed.diagnostics})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Compose application could not be saved."},422)}}if(q.pathname==="/api/compose/action"&&N.method==="POST"){let A=await re(N),P=xi.applications.get(String(A.id??"")),F=String(A.action??""),U=F==="delete"||F==="stop"?"deployments:cancel":"deployments:create";if(!P||!Dr(me,P.resourceId,U))return x({ok:!1,error:"Compose application was not found in this scope."},404);try{let H=E(y.store,me);return x({ok:!0,operation:xi.enqueue(P,F,{actorId:H.id,service:typeof A.service==="string"?A.service:void 0,replicas:Number.isFinite(Number(A.replicas))?Number(A.replicas):void 0,removeVolumes:A.removeVolumes===!0,confirmation:typeof A.confirm==="string"?A.confirm:void 0})})}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"Compose operation could not be queued."},409)}}if((q.pathname==="/api/compose/logs"||q.pathname==="/api/compose/shell")&&N.method==="POST"){let A=await re(N),P=xi.applications.get(String(A.id??"")),F=q.pathname.endsWith("/shell"),U=F?"runtime:terminal":"runtime:logs";if(!P||!Dr(me,P.resourceId,U))return x({ok:!1,error:"Compose service was not found in this scope."},404);let H=String(A.service??"");if(!P.manifest.spec.services[H])return x({ok:!1,error:"Compose service was not found."},404);if(F&&A.confirm!==H)return x({ok:!1,error:`Type "${H}" to run a service command.`},409);let Q=y.store.listEnvironments(P.projectId).find((ee)=>ee.id===P.environmentId)?.slug;if(!Q)return x({ok:!1,error:"Compose environment was not found."},404);let J=F?zc(P.manifest,H,Array.isArray(A.command)?A.command.map(String):["sh"]):jc(P.manifest,H,Number(A.lines)||200);return x(await bc(m,Q,J))}if(q.pathname==="/api/previews/definitions"&&N.method==="POST"){let A=await re(N),P=String(A.resourceId??"");if(!Dr(me,P,"config:write"))return x({ok:!1,error:"Application was not found in this scope."},404);let F=E(y.store,me);try{return x({ok:!0,definition:yr.previews.createDefinition({...A,projectId:y.project.id,resourceId:P,baseEnvironmentId:String(A.baseEnvironmentId??""),domainPattern:String(A.domainPattern??""),createdByActorId:F.id})})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Preview policy could not be created."},409)}}if(q.pathname==="/api/previews/deploy"&&N.method==="POST"){let A=await re(N),P=yr.previews.getDefinition(String(A.definitionId??""));if(!P||!Dr(me,P.resourceId,"deployments:create"))return x({ok:!1,error:"Preview policy was not found in this scope."},404);let F=E(y.store,me);try{let U=yr.previews.upsert({definitionId:P.id,sourceProvider:"dashboard",repository:"dashboard",branch:String(A.branch??""),pullRequestNumber:Number(A.pullRequestNumber)||void 0,commitSha:String(A.commitSha??""),createdByActorId:F.id});return x({ok:!0,preview:U.preview,operation:yr.enqueueDeploy(U.preview,{created:U.created,actorId:F.id})})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Preview could not be queued."},409)}}if(q.pathname==="/api/previews/destroy"&&N.method==="POST"){let A=await re(N),P=yr.previews.getInstance(String(A.id??""));if(!P||!Dr(me,P.resourceId,"deployments:cancel"))return x({ok:!1,error:"Preview was not found in this scope."},404);if(A.confirm!==P.name)return x({ok:!1,error:`Type "${P.name}" to confirm tagged teardown.`},409);let F=E(y.store,me);return x({ok:!0,operation:yr.enqueueDestroy(P,"dashboard",F.id)})}if(q.pathname==="/api/previews/extend"&&N.method==="POST"){let A=await re(N),P=yr.previews.getInstance(String(A.id??""));if(!P||!Dr(me,P.resourceId,"deployments:create"))return x({ok:!1,error:"Preview was not found in this scope."},404);return x({ok:!0,preview:yr.previews.extend(P.id,Number(A.hours))})}if(q.pathname==="/api/previews/rebuild"&&N.method==="POST"){let A=await re(N),P=yr.previews.getInstance(String(A.id??""));if(!P||!Dr(me,P.resourceId,"deployments:create"))return x({ok:!1,error:"Preview was not found in this scope."},404);let F=E(y.store,me);return x({ok:!0,operation:yr.enqueueDeploy(P,{actorId:F.id,reason:"manual_rebuild"})})}if(q.pathname==="/api/previews/cleanup"&&N.method==="POST"){let A=await re(N);if(!A.dryRun&&A.confirm!=="cleanup previews")return x({ok:!1,error:'Type "cleanup previews" to confirm teardown.'},409);let P=E(y.store,me);return x({ok:!0,...yr.cleanup({dryRun:A.dryRun===!0,maxAgeHours:Number(A.maxAgeHours)||void 0,keepCount:Number(A.keepCount)||void 0,actorId:P.id})})}if(q.pathname==="/api/control-plane/events")return x({events:y.store.listEvents({organizationId:y.organization.id,projectId:y.project.id,operationId:q.searchParams.get("operationId")??void 0,correlationId:q.searchParams.get("correlationId")??void 0,afterSequence:Number(q.searchParams.get("afterSequence"))||void 0,limit:Number(q.searchParams.get("limit"))||200})});if(q.pathname==="/api/search"){let A=String(q.searchParams.get("q")??"").trim().slice(0,128),P=$n.role==="member"?new Set(Object.keys($n.sites)):void 0,F=A?Qs(y.store,{projectId:y.project.id,query:A,allowedResourceSlugs:P,limit:Number(q.searchParams.get("limit"))||20}):[];return x({query:A,results:F,stale:!1})}if(q.pathname==="/api/search/preferences"&&N.method==="GET"){let A=`dashboard:${me.username.toLowerCase()}`;return x({savedFilters:y.store.listSavedFilters(A),navigation:y.store.listNavigation(A)})}if(q.pathname==="/api/search/preferences"&&N.method==="POST"){let A=`dashboard:${me.username.toLowerCase()}`,P=await re(N),F=String(P.action??"");if(F==="save-filter")return x({savedFilter:y.store.saveFilter(A,String(P.name??""),String(P.routeId??""),P.query??{})});if(F==="favorite")return x({navigation:y.store.setFavorite(A,String(P.entityType??""),String(P.entityId??""),P.favorite!==!1)});if(F==="visit")return x({navigation:y.store.recordNavigation(A,String(P.entityType??""),String(P.entityId??""))});return x({ok:!1,error:"Unknown search preference action."},422)}if(q.pathname==="/api/search/preferences"&&N.method==="DELETE"){let A=`dashboard:${me.username.toLowerCase()}`,P=await re(N);return x({ok:y.store.deleteSavedFilter(A,String(P.id??""))})}if(q.pathname==="/api/organization"&&N.method==="GET"){let A=y.store.listMemberships(y.organization.id,{includeRevoked:!0}).map((P)=>{let F=y.store.getActor(P.actorId);return{...P,actor:F?{id:F.id,displayName:F.displayName,externalId:F.externalId,disabledAt:F.disabledAt}:void 0,grants:y.store.listGrants(P.id)}});return x({organization:y.organization,project:y.project,environments:y.store.listEnvironments(y.project.id),resources:y.store.listResources(y.project.id).map((P)=>({id:P.id,environmentId:P.environmentId,kind:P.kind,slug:P.slug,name:P.name})),memberships:A,invitations:y.store.listInvitations(y.organization.id)})}if(q.pathname==="/api/organization/invitations"&&N.method==="GET")return x({invitations:y.store.listInvitations(y.organization.id)});if(q.pathname==="/api/organization/invitations"&&N.method==="POST"){let A=await re(N),P=Uu(A.roleTemplate),F=Ic(A);if(!P||!F)return x({ok:!1,error:"Choose a valid role template and resource scope."},422);let U=We(me);if(!U.actor||!U.membership)return x({ok:!1,error:"Your organization membership is unavailable."},403);if(P==="owner"&&(!Qn(String(A.password??""),me.passwordHash)||U.membership.roleTemplate!=="owner"))return x({ok:!1,error:"Owner invitations require an owner to re-enter their password."},401);try{let H=y.store.createInvitation({organizationId:y.organization.id,email:String(A.email??""),roleTemplate:P,scope:F,invitedByActorId:U.actor.id,expiresInMs:Number(A.expiresInMs)||void 0}),Q=`${q.origin}/accept-invitation?token=${encodeURIComponent(H.token)}`,J=await Xr(m,{to:H.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${Q}
 
-This link expires ${H.invitation.expiresAt} and can be used once.`});return O({invitation:H.invitation,token:H.token,acceptUrl:Q,delivered:J},201)}catch(H){return O({ok:!1,error:H instanceof Error?H.message:"Invitation could not be created."},422)}}if(q.pathname==="/api/organization/invitations"&&N.method==="DELETE"){let A=await re(N),P=We(me);try{return O({invitation:y.store.revokeInvitation(String(A.id??""),P.actor?.id)})}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Invitation could not be revoked."},409)}}if(q.pathname==="/api/organization/invitations/resend"&&N.method==="POST"){let A=await re(N),P=We(me);try{let F=y.store.reissueInvitation(String(A.id??""),P.actor?.id),U=`${q.origin}/accept-invitation?token=${encodeURIComponent(F.token)}`,H=await Xr(m,{to:F.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${U}
+This link expires ${H.invitation.expiresAt} and can be used once.`});return x({invitation:H.invitation,token:H.token,acceptUrl:Q,delivered:J},201)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:"Invitation could not be created."},422)}}if(q.pathname==="/api/organization/invitations"&&N.method==="DELETE"){let A=await re(N),P=We(me);try{return x({invitation:y.store.revokeInvitation(String(A.id??""),P.actor?.id)})}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Invitation could not be revoked."},409)}}if(q.pathname==="/api/organization/invitations/resend"&&N.method==="POST"){let A=await re(N),P=We(me);try{let F=y.store.reissueInvitation(String(A.id??""),P.actor?.id),U=`${q.origin}/accept-invitation?token=${encodeURIComponent(F.token)}`,H=await Xr(m,{to:F.invitation.email,subject:"Your ts-cloud organization invitation",text:`Accept your ts-cloud invitation: ${U}
 
-This replacement link expires ${F.invitation.expiresAt} and can be used once.`});return O({invitation:F.invitation,token:F.token,acceptUrl:U,delivered:H})}catch(F){return O({ok:!1,error:F instanceof Error?F.message:"Invitation could not be resent."},409)}}if(q.pathname==="/api/organization/memberships"&&N.method==="PATCH"){let A=await re(N),P=y.store.getMembership(String(A.id??"")),F=Uu(A.roleTemplate),U=Ic(A);if(!P||P.organizationId!==y.organization.id)return O({ok:!1,error:"Membership was not found."},404);if(!F||!U)return O({ok:!1,error:"Choose a valid role template and resource scope."},422);let H=We(me);if((P.roleTemplate==="owner"||F==="owner")&&(!Qn(String(A.password??""),me.passwordHash)||H.membership?.roleTemplate!=="owner"))return O({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let J=y.store.resolveAuthorizationTarget(y.organization.id,U)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),ee=y.store.listGrants(P.id),Se=Mt({membership:P,grants:ee,target:J}),ve={...P,roleTemplate:F,scope:U},nt=Mt({membership:ve,grants:ee,target:J}),Pe={gained:nt.filter((He)=>!Se.includes(He)),lost:Se.filter((He)=>!nt.includes(He))};if(A.preview===!0)return O({membership:P,proposed:{roleTemplate:F,scope:U},accessDiff:Pe});if(String(A.confirm??"")!==P.id)return O({ok:!1,error:`Confirm this change with membership ID ${P.id}.`,accessDiff:Pe},409);try{return O({membership:y.store.updateMembership({id:P.id,roleTemplate:F,scope:U,actorId:H.actor?.id}),accessDiff:Pe})}catch(He){return O({ok:!1,error:He instanceof Error?He.message:"Membership could not be updated."},409)}}if(q.pathname==="/api/organization/memberships"&&N.method==="DELETE"){let A=await re(N),P=y.store.getMembership(String(A.id??""));if(!P||P.organizationId!==y.organization.id)return O({ok:!1,error:"Membership was not found."},404);if(String(A.confirm??"")!==P.id)return O({ok:!1,error:`Confirm removal with membership ID ${P.id}.`},409);let F=We(me);if(P.roleTemplate==="owner"&&(F.membership?.roleTemplate!=="owner"||!Qn(String(A.password??""),me.passwordHash)))return O({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return O({membership:y.store.revokeMembership(P.id,F.actor?.id)})}catch(U){return O({ok:!1,error:U instanceof Error?U.message:"Membership could not be removed."},409)}}if(q.pathname==="/api/organization/grants"&&N.method==="POST"){let A=await re(N),P=String(A.capability??""),F=A.effect==="deny"?"deny":A.effect==="allow"?"allow":void 0,U=Ic(A),H=We(me);if(!F||!U||!pe.includes(P))return O({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return O({grant:y.store.upsertGrant({organizationId:y.organization.id,membershipId:String(A.membershipId??""),effect:F,capability:P,scope:U,actorId:H.actor?.id})},201)}catch(Q){return O({ok:!1,error:Q instanceof Error?Q.message:"Grant could not be created."},422)}}if(q.pathname==="/api/organization/grants"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=y.store.getGrant(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return O({ok:!1,error:"Grant was not found."},404);return O({ok:y.store.removeGrant(F.id,P.actor?.id)})}if(q.pathname==="/api/tags"&&N.method==="GET")return O({tags:y.store.listTags(y.project.id),assignments:y.store.listResourceTags(y.project.id)});if(q.pathname==="/api/tags"&&N.method==="POST"){let A=await re(N),P=y.store.upsertTag(y.project.id,String(A.name??""),String(A.color??"#5a8be0"));if(A.resourceId)y.store.assignTag(String(A.resourceId),P.id);return O({tag:P},201)}if(q.pathname==="/api/tags"&&N.method==="DELETE"){let A=await re(N);return y.store.removeTag(String(A.resourceId??""),String(A.tagId??"")),O({ok:!0})}if(q.pathname==="/"&&!rw(q.pathname,$n))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(Ce)}`}});if(q.pathname==="/"&&sr?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(Ce)}`}});let xc=cu(q.pathname);if(xc)return new Response(null,{status:308,headers:{location:`${xc}?env=${encodeURIComponent(Ce)}`}});if(q.pathname==="/api/env"&&N.method==="POST"){let A=await re(N),P=String(A.env??"");if(!C.includes(P))return O({ok:!1,error:`Unknown environment '${P}'.`,environments:C},404);return O({ok:!0,environment:P,environments:C,href:`?env=${encodeURIComponent(P)}`})}if(q.pathname==="/api/config"){let A={...ns(m),environment:Ce,environments:C};return O(hS(A,$n))}if(q.pathname==="/api/ssh-keys"&&N.method==="GET")return O({configPath:j,keys:yo(Ka(m))});if(q.pathname==="/api/ssh-keys"&&N.method==="POST"){if(!j)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=await ii(j,"utf8"),F=Ka(m),U=Sb({configText:P,name:String(A.name??""),publicKey:String(A.publicKey??""),existingKeys:F});return await ys(j,U),ZS(m,[...F,{name:String(A.name??"").trim(),publicKey:String(A.publicKey??"").trim().replace(/\s+/g," ")}]),O({ok:!0,configPath:j,keys:yo(Ka(m))})}if(q.pathname==="/api/ssh-keys"&&N.method==="DELETE"){if(!j)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=String(A.name??q.searchParams.get("name")??""),F=await ii(j,"utf8"),U=Ka(m),H=wb({configText:F,name:P,existingKeys:U});return await ys(j,H),ZS(m,U.filter((Q)=>Q.name!==P.trim())),O({ok:!0,configPath:j,keys:yo(Ka(m))})}if(q.pathname==="/api/firewall"&&N.method==="GET")return O({configPath:j,alwaysOpen:[22,80,443],ports:bm(m)});if(q.pathname==="/api/firewall"&&N.method==="POST"){if(!j)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=Number(A.port);if(!wc(P))return O({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let F=bm(m),U=await ii(j,"utf8");try{await ys(j,ES(U,P,F))}catch(J){return O({ok:!1,error:J?.message??String(J)},422)}let H=hs([...F,P]);XS(m,H);let Q=A.apply===!1?null:await bc(m,Ce,`ufw allow ${P}/tcp`).catch((J)=>({ok:!1,error:String(J?.message??J)}));return O({ok:!0,configPath:j,ports:H,apply:Q})}if(q.pathname==="/api/firewall"&&N.method==="DELETE"){if(!j)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=Number(A.port??q.searchParams.get("port"));if(!wc(P))return O({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let F=bm(m),U=await ii(j,"utf8");await ys(j,RS(U,P,F));let H=hs(F.filter((J)=>J!==P));XS(m,H);let Q=A.apply===!1?null:await bc(m,Ce,`ufw delete allow ${P}/tcp`).catch((J)=>({ok:!1,error:String(J?.message??J)}));return O({ok:!0,configPath:j,ports:H,apply:Q})}if(q.pathname==="/api/sites"&&N.method==="POST"){if(!j)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=String(A.name??"").trim(),F=String(A.root??"").trim();if(!P||!F)return O({ok:!1,error:"Site name and root are required."},422);let U={deploy:A.deploy==="bucket"?"bucket":"server",root:F,path:String(A.path??"").trim()||void 0,domain:String(A.domain??"").trim()||void 0,build:String(A.build??"").trim()||void 0,start:String(A.start??"").trim()||void 0,port:A.port?Number(A.port):void 0,type:String(A.type??"").trim()||void 0};if(U.port!==void 0&&(!Number.isInteger(U.port)||U.port<1||U.port>65535))return O({ok:!1,error:"Port must be a number between 1 and 65535."},422);let H=await ii(j,"utf8"),Q=cn({configText:H,name:P,root:U.root,domain:U.domain,path:U.path,deploy:U.deploy,build:U.build,start:U.start,port:U.port,type:U.type});return await ys(j,Q),Z_(m,P,Object.fromEntries(Object.entries(U).filter(([,J])=>J!==void 0))),sr=await vs(m,Ce),V.set(Ce,sr),O({ok:!0,configPath:j,site:P,data:sr})}if(q.pathname==="/api/sites"&&N.method==="DELETE"){if(!j)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=String(A.name??q.searchParams.get("name")??"").trim();if(!P||!m.sites?.[P])return O({ok:!1,error:`Site '${P}' was not found.`},404);let F=await ii(j,"utf8");return await ys(j,dn({configText:F,name:P})),delete m.sites[P],sr=await vs(m,Ce),V.set(Ce,sr),O({ok:!0,configPath:j,site:P,data:sr})}if(q.pathname==="/api/sites"&&N.method==="PATCH"){if(!j)return O({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=String(A.name??"").trim(),F=m.sites?.[P];if(!P||!F)return O({ok:!1,error:`Site '${P}' was not found.`},404);if($n.role==="member"){let Q=SS(A);if(!Q.ok)return O({ok:!1,error:Q.error},403);let J=wS({siteName:P,body:A,sites:m.sites??{},ownSites:Object.keys($n.sites)});if(!J.ok)return O({ok:!1,error:J.error},409)}if(A.port!==void 0&&A.port!==null&&A.port!==""&&(!Number.isInteger(Number(A.port))||Number(A.port)<1||Number(A.port)>65535))return O({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof A.domain==="string"&&A.domain.trim()&&!Ca(A.domain.trim()))return O({ok:!1,error:`Domain '${A.domain.trim()}' is not a valid hostname.`},422);let U=await ii(j,"utf8"),H=(Q,J)=>{U=Yi({configText:U,siteName:P,key:Q,valueText:J})};if(A.ssl!==void 0)H("ssl",eu(A.ssl)),F.ssl=A.ssl;if(A.env!==void 0&&A.env&&typeof A.env==="object")H("env",ru(A.env)),F.env=A.env;if(A.aliases!==void 0&&Array.isArray(A.aliases)){let Q=A.aliases.map((J)=>String(J));H("aliases",nu(Q)),F.aliases=Q.map((J)=>J.trim().toLowerCase()).filter(Boolean)}if(A.redirects!==void 0&&A.redirects&&typeof A.redirects==="object")H("redirects",iu(A.redirects)),F.redirects=A.redirects;for(let Q of["domain","path","build","start","type","root","php"])if(typeof A[Q]==="string"&&A[Q].trim())H(Q,tu(String(A[Q]).trim())),F[Q]=String(A[Q]).trim();if(A.port!==void 0&&A.port!==null&&A.port!=="")H("port",String(Number(A.port))),F.port=Number(A.port);return await ys(j,U),sr=await vs(m,Ce),V.set(Ce,sr),O({ok:!0,configPath:j,site:P,data:sr})}if(q.pathname==="/api/sites/deploy"&&N.method==="POST"){let A=await re(N),P=String(A.name??"").trim();if(!P||!m.sites?.[P])return O({ok:!1,error:`Site '${P}' was not found.`},404);if(A.confirm!==P)return O({ok:!1,error:`Type "${P}" to deploy this site.`},409);let F=ne(y,String(Ce));await new St(ut).run(new rn,{...F,artifactRoot:t}),ji(ut,F,sr??{});let U=zi(ut,{scope:F,desiredConfigHash:y.project.desiredConfigHash});if(U.decision.outcome==="block")return O({ok:!1,error:`Deployment blocked by security policy: ${U.decision.explanation}`,securityReview:U},409);let H={id:`deploy:${P}`,label:`Deploy ${P}`,description:`Deploy the ${P} site for ${Ce}.`,command:["deploy","--env",Ce,"--site",P,"--yes"],mutates:!0},Q=await _e({controlPlane:y,environment:Ce,actor:me,kind:"dashboard.site.deploy",resourceSlug:P,input:{site:P},execute:()=>Sm(H,{cwd:t,cliEntry:l})});return O({...Q.result,controlPlaneOperation:Q.operation,securityReview:U})}if(q.pathname==="/api/actions")return O(mn(Ce));if(q.pathname==="/api/server/operations")return O(ju(m,sr));if(q.pathname==="/api/runtime/workloads"&&N.method==="GET"){let A=await ie(m,Ce);return O(A)}if(q.pathname==="/api/runtime/logs"&&N.method==="GET"){let A=String(q.searchParams.get("workload")??"");if(!A)return O({ok:!1,error:"A workload query parameter is required."},422);let P=Math.min(1000,Math.max(1,Number(q.searchParams.get("limit"))||200));try{return O(await new fe(m,Ce).logs(A,{limit:P}))}catch(F){return O({ok:!1,error:String(F?.message??F)},404)}}if(q.pathname==="/api/runtime/log-sessions"&&N.method==="POST"){let A=await re(N),P=String(A.workloadId??"");if(!P)return O({ok:!1,error:"A workloadId is required."},422);let F=await ie(m,Ce),U=F.workloads.find((J)=>J.id===P);if(!U)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!U.capabilities.logs.supported)return O({ok:!1,error:U.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let H=new fe(m,Ce,{inventory:async()=>F}),Q=Sr.create("logs",P);return(async()=>{let J=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(A.sinceMs)||60000)));try{for(let ee=0;ee<200&&!Sr.signal(Q.id)?.aborted;ee++){let Se=await H.logs(P,{limit:Math.min(500,Math.max(1,Number(A.limit)||200)),since:J});for(let ve of Se.lines)if(Sr.append(Q.id,`${ve.timestamp?`${ve.timestamp} `:""}${ve.message}
-`),ve.timestamp)J=new Date(Math.max(J.getTime(),new Date(ve.timestamp).getTime()+1));await Bun.sleep(3000)}if(!Sr.signal(Q.id)?.aborted)Sr.close(Q.id,"complete")}catch(ee){Sr.append(Q.id,ee instanceof Error?ee.message:String(ee),"stderr"),Sr.close(Q.id,"failed",ee instanceof Error?ee.message:String(ee))}})(),O({ok:!0,session:Q,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(Q.id)}&workload=${encodeURIComponent(P)}`},201)}if((q.pathname==="/api/runtime/log-stream"||q.pathname==="/api/runtime/exec-stream")&&N.method==="GET"){let A=String(q.searchParams.get("id")??""),P=String(q.searchParams.get("workload")??""),F=Number(N.headers.get("last-event-id")??q.searchParams.get("after")??0)||0,U=Sr.read(A,P,F),H=q.pathname.includes("exec")?"exec":"logs";if(!U||U.kind!==H)return O({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return q_(Sr,U,F,N.signal)}if((q.pathname==="/api/runtime/log-sessions"||q.pathname==="/api/runtime/exec-sessions")&&N.method==="DELETE"){let A=await re(N),P=Sr.cancel(String(A.id??""),String(A.workloadId??""));if(!P)return O({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return O({ok:!0,session:P})}if(q.pathname==="/api/runtime/exec-sessions"&&N.method==="POST"){let A=await re(N),P=String(A.workloadId??""),F=await ie(m,Ce),U=F.workloads.find((ee)=>ee.id===P);if(!U)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);let H=lr.resolveSession(N),Q=new fe(m,Ce,{inventory:async()=>F}),J=Sr.create("exec",P);return _e({controlPlane:y,environment:Ce,actor:me,kind:"runtime.exec",resourceSlug:U.links.service,input:{workloadId:P,provider:U.provider,preset:A.preset?String(A.preset):null,freeForm:!!String(A.command??"").trim()},execute:()=>Q.exec({workloadId:P,preset:["process","sockets","filesystem"].includes(String(A.preset))?String(A.preset):void 0,command:typeof A.command==="string"?A.command:void 0,confirm:String(A.confirm??""),recentAuth:!De||!!H&&Ne.isRecentlyAuthenticated(H)})}).then(({result:ee,operation:Se})=>{if(Sr.append(J.id,`operation ${Se.id}
-`,"system"),ee.stdout)Sr.append(J.id,ee.stdout,"stdout");if(ee.stderr)Sr.append(J.id,ee.stderr,"stderr");Sr.close(J.id,ee.ok?"complete":"failed",ee.error)}).catch((ee)=>{let Se=ee instanceof Error?ee.message:String(ee);Sr.append(J.id,Se,"stderr"),Sr.close(J.id,"failed",Se)}),O({ok:!0,session:J,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(J.id)}&workload=${encodeURIComponent(P)}`},202)}if(q.pathname==="/api/runtime/files/read"&&N.method==="POST"){let A=await re(N),P=await ie(m,Ce),F=lr.resolveSession(N),U=await new fe(m,Ce,{inventory:async()=>P}).readFile({workloadId:String(A.workloadId??""),path:String(A.path??""),confirm:String(A.confirm??""),recentAuth:!De||!!F&&Ne.isRecentlyAuthenticated(F)});return O(U,U.ok?200:409)}if(q.pathname==="/api/runtime/files/write"&&N.method==="POST"){let A=await re(N),P=await ie(m,Ce),F=String(A.workloadId??""),U=P.workloads.find((ee)=>ee.id===F);if(!U)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);let H=lr.resolveSession(N),Q=new fe(m,Ce,{inventory:async()=>P}),J=await _e({controlPlane:y,environment:Ce,actor:me,kind:"runtime.file.write",resourceSlug:U.links.service,input:{workloadId:F,provider:U.provider,path:String(A.path??""),bytes:Buffer.from(String(A.contentBase64??""),"base64").byteLength},execute:()=>Q.writeFile({workloadId:F,path:String(A.path??""),contentBase64:String(A.contentBase64??""),confirm:String(A.confirm??""),recentAuth:!De||!!H&&Ne.isRecentlyAuthenticated(H)})});return O({...J.result,controlPlaneOperation:J.operation},J.result.ok?200:409)}if(q.pathname==="/api/runtime/operations"&&N.method==="POST"){let A=await re(N),P=String(A.workloadId??""),F=String(A.action??"");if(!P||!["start","stop","restart","redeploy","scale","inspect"].includes(F))return O({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let U=await ie(m,Ce),H=U.workloads.find((Se)=>Se.id===P);if(!H)return O({ok:!1,error:"Workload was not found in the current project and environment."},404);let Q=lr.resolveSession(N),J=new fe(m,Ce,{inventory:async()=>U}),ee=await _e({controlPlane:y,environment:Ce,actor:me,kind:`runtime.${F}`,resourceSlug:H.links.service,input:{workloadId:P,provider:H.provider,action:F,replicas:A.replicas==null?null:Number(A.replicas)},execute:()=>J.run({workloadId:P,action:F,replicas:A.replicas==null?void 0:Number(A.replicas),confirm:String(A.confirm??""),recentAuth:!De||!!Q&&Ne.isRecentlyAuthenticated(Q)})});return O({...ee.result,controlPlaneOperation:ee.operation},ee.result.ok?200:409)}if(q.pathname.startsWith("/api/protection")){let A=me.role==="admin"||Tc(me,"security:read"),P=me.role==="admin"||Tc(me,"security:manage");if(!A)return O({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:F,describePosture:U}=await import("./protection/index.js"),H=new F(y.store),Q=()=>{if(!P)throw Error("Changing protection controls requires security:manage.")};if(q.pathname==="/api/protection"&&N.method==="GET"){let J=H.current();return O({ok:!0,posture:U(J),controls:J,raw:H.raw()})}if(q.pathname==="/api/protection/attack-mode"&&N.method==="POST"){Q();let J=await re(N);if(J.enabled===!1)return O({ok:!0,disabled:H.disableAttackMode()});return O({ok:!0,control:H.enableAttackMode({hours:J.hours==null?void 0:Number(J.hours),reason:String(J.reason??"Enabled from the dashboard."),actorId:We(me).actor?.id})})}if(q.pathname==="/api/protection/pause"&&N.method==="POST"){Q();let J=await re(N);if(J.enabled===!1)return O({ok:!0,resumed:H.resumeMitigations()});return O({ok:!0,control:H.pauseMitigations({hours:J.hours==null?void 0:Number(J.hours),reason:String(J.reason??""),actorId:We(me).actor?.id})})}if(q.pathname==="/api/protection/ip-rules"&&N.method==="GET")return O({ok:!0,ipRules:H.current().ipRules});if(q.pathname==="/api/protection/ip-rules"&&(N.method==="POST"||N.method==="DELETE")){Q();let J=await re(N),ee=J.list==="allow"?"allow":"block",Se=N.method==="POST"?H.addIpRule(ee,String(J.cidr??"")):H.removeIpRule(ee,String(J.cidr??""));return O({ok:!0,ipRules:Se})}return O({ok:!1,error:"Protection endpoint was not found."},404)}if(q.pathname.startsWith("/api/spend/")||q.pathname==="/api/usage"){let A=await pw(),{store:P,service:F,gate:U}=A,H=me.role==="admin"||Tc(me,"billing:read"),Q=me.role==="admin"||Tc(me,"billing:manage");if(!H)return O({ok:!1,error:"Spend data requires the billing:read capability."},403);let J=y.environments.get(Ce),ee={organizationId:y.organization.id,projectId:y.project.id,environmentId:J?.id},Se=()=>{if(!Q)throw Error("Changing a budget requires the billing:manage capability.")};if(q.pathname==="/api/usage"&&N.method==="GET")return O({ok:!0,...F.usageReport({organizationId:ee.organizationId,projectId:ee.projectId,period:q.searchParams.get("period")??"monthly",timezone:q.searchParams.get("timezone")??void 0})});if(q.pathname==="/api/spend/budgets"&&N.method==="GET")return O({ok:!0,budgets:P.listBudgets({organizationId:ee.organizationId,projectId:ee.projectId}).map((ve)=>({...ve,status:F.status(ve)}))});if(q.pathname==="/api/spend/budgets"&&N.method==="POST"){Se();let ve=await re(N),nt=String(ve.scope??"project"),Pe=P.createBudget({organizationId:ee.organizationId,projectId:nt==="organization"?void 0:ee.projectId,environmentId:nt==="environment"?ee.environmentId:void 0,name:String(ve.name??"").trim(),period:ve.period??"monthly",timezone:ve.timezone?String(ve.timezone):void 0,softLimitCents:ve.softLimitCents==null?void 0:Math.round(Number(ve.softLimitCents)),hardLimitCents:ve.hardLimitCents==null?void 0:Math.round(Number(ve.hardLimitCents)),graceSeconds:ve.graceSeconds==null?void 0:Number(ve.graceSeconds),dryRun:ve.dryRun!==!1});return O({ok:!0,budget:Pe})}if(q.pathname==="/api/spend/budgets"&&N.method==="PATCH"){Se();let ve=await re(N),nt=String(ve.id??""),Pe=P.getBudget(nt);if(!Pe||Pe.organizationId!==ee.organizationId)return O({ok:!1,error:"Budget was not found."},404);return O({ok:!0,budget:P.updateBudget(nt,{softLimitCents:ve.softLimitCents==null?Pe.softLimitCents:Math.round(Number(ve.softLimitCents)),hardLimitCents:ve.hardLimitCents==null?Pe.hardLimitCents:Math.round(Number(ve.hardLimitCents)),enabled:ve.enabled==null?Pe.enabled:ve.enabled===!0,dryRun:ve.dryRun==null?Pe.dryRun:ve.dryRun===!0},ve.expectedVersion==null?void 0:Number(ve.expectedVersion))})}if(q.pathname==="/api/spend/budgets"&&N.method==="DELETE"){Se();let ve=await re(N),nt=String(ve.id??""),Pe=P.getBudget(nt);if(!Pe||Pe.organizationId!==ee.organizationId)return O({ok:!1,error:"Budget was not found."},404);let He=U.closeBudget(nt);return P.deleteBudget(nt),O({ok:!0,deleted:!0,lifted:He})}if(q.pathname==="/api/spend/check"&&N.method==="POST"){Se();let ve=await re(N),{SpendRunner:nt}=await import("./spend/index.js"),Pe=new nt({controlPlane:y.store,store:P,alerts:st});if(ve.apply!==!0){let Te=P.budgetsForScope(ee.organizationId,ee.projectId,ee.environmentId);return O({ok:!0,applied:!1,preview:Te.map((Ue)=>F.status(Ue))})}let He=await Pe.run({...ee,environmentKind:J?.kind});return O({ok:!0,applied:!0,result:He})}if(q.pathname==="/api/spend/enforcement"&&N.method==="GET")return O({ok:!0,enforcement:U.listUnder({organizationId:ee.organizationId})});if(q.pathname==="/api/spend/release"&&N.method==="POST"){Se();let ve=await re(N),nt=U.close(String(ve.budgetId??""),ve.action);return O({ok:nt,released:nt,note:nt?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(q.pathname==="/api/spend/anomalies"&&N.method==="GET")return O({ok:!0,anomalies:P.listAnomalies({organizationId:ee.organizationId,projectId:ee.projectId,unacknowledgedOnly:q.searchParams.get("unacknowledged")==="true"})});if(q.pathname==="/api/spend/anomalies/acknowledge"&&N.method==="POST"){Se();let ve=await re(N);return O({ok:!0,acknowledged:P.acknowledgeAnomaly(String(ve.id??""))})}return O({ok:!1,error:"Spend endpoint was not found."},404)}if(q.pathname.startsWith("/api/health/")||q.pathname.startsWith("/api/alerts")||q.pathname.startsWith("/api/notifications/")){let A=y.environments.get(Ce),P=y.store.listResources(y.project.id,A?.id),F=me.role==="admin"||!!A&&Ga(me,A.id,"runtime:read")?P:P.filter((J)=>Dr(me,J.id,"runtime:read")),U=(J)=>!J||F.some((ee)=>ee.id===J),H=(J)=>{if(!J)return;let ee=P.find((Se)=>Se.id===J||Se.slug===J);if(!ee)throw Error("Alert resource was not found.");if(!U(ee.id))throw Error("Alert resource is outside your authorized scope.");return ee.id},Q=We(me).actor;if(q.pathname==="/api/health/checks"&&N.method==="GET")return O({ok:!0,checks:st.listHealthChecks(y.project.id,A?.id).filter((J)=>U(J.resourceId)).map((J)=>({...J,results:st.listHealthResults(J.id,20)}))});if(q.pathname==="/api/health/checks"&&N.method==="POST"){let J=await re(N),ee=String(J.kind??"http");if(ee==="command"&&me.role!=="admin")return O({ok:!1,error:"Command health checks require an administrator."},403);let Se={method:String(J.config?.method??"GET").toUpperCase().slice(0,10),path:J.config?.path?String(J.config.path).slice(0,500):void 0,port:J.config?.port==null?void 0:Number(J.config.port),command:Array.isArray(J.config?.command)?J.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(J.config?.expectedStatuses)?J.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:J.config?.expectedBody?String(J.config.expectedBody).slice(0,500):void 0};return O({ok:!0,check:st.createHealthCheck({projectId:y.project.id,environmentId:A?.id,resourceId:H(J.resourceId??J.resource),name:String(J.name??""),kind:ee,target:String(J.target??""),config:Se,intervalSeconds:Number(J.intervalSeconds)||60,timeoutSeconds:Number(J.timeoutSeconds)||10,failureThreshold:Number(J.failureThreshold)||3,recoveryThreshold:Number(J.recoveryThreshold)||2,regions:Array.isArray(J.regions)?J.regions.map(String):["local"],enabled:J.enabled!==!1})},201)}if(q.pathname==="/api/health/checks"&&N.method==="PATCH"){let J=await re(N),ee=st.getHealthCheck(String(J.id??""));if(!ee||!U(ee.resourceId))return O({ok:!1,error:"Health check was not found."},404);return O({ok:!0,check:st.setHealthCheckEnabled(ee.id,J.enabled!==!1)})}if(q.pathname==="/api/health/checks/test"&&N.method==="POST"){let J=await re(N),ee=st.getHealthCheck(String(J.id??""));if(!ee||!U(ee.resourceId))return O({ok:!1,error:"Health check was not found."},404);return O({ok:!0,productionIncidentCreated:!1,result:await new je(st).probe(ee)})}if(q.pathname==="/api/health/checks/run"&&N.method==="POST"){let J=await re(N),ee=st.getHealthCheck(String(J.id??""));if(!ee||!U(ee.resourceId))return O({ok:!1,error:"Health check was not found."},404);let Se=await new je(st).runAndEvaluate(ee),ve=[];for(let nt of Se.evaluations.filter((Pe)=>Pe.notify&&Pe.alert)){let Pe=On.enqueue(y.organization.id,nt.alert,nt.transition);ve.push(...await On.deliverAll(Pe))}return O({ok:!0,...Se,deliveries:ve})}if(q.pathname==="/api/alerts/rules"&&N.method==="GET")return O({ok:!0,rules:st.listRules(y.project.id,A?.id).filter((J)=>U(J.resourceId))});if(q.pathname==="/api/alerts/rules"&&N.method==="POST"){let J=await re(N),ee=J.healthCheckId?st.getHealthCheck(String(J.healthCheckId)):void 0;if(J.healthCheckId&&(!ee||!U(ee.resourceId)))return O({ok:!1,error:"Health check was not found."},404);return O({ok:!0,rule:st.createRule({projectId:y.project.id,environmentId:A?.id,resourceId:H(J.resourceId??J.resource)??ee?.resourceId,healthCheckId:ee?.id,name:String(J.name??""),signal:String(J.signal??(ee?"health":"")),operator:String(J.operator??(ee?"unhealthy":"gt")),threshold:J.threshold==null?void 0:Number(J.threshold),recoveryThreshold:J.recoveryThreshold==null?void 0:Number(J.recoveryThreshold),windowMs:Number(J.windowMs)||300000,consecutive:Number(J.consecutive)||ee?.failureThreshold||3,recoveryConsecutive:Number(J.recoveryConsecutive)||ee?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(J.noDataPolicy))?J.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(J.severity))?J.severity:"warning",groupBy:Array.isArray(J.groupBy)?J.groupBy.map(String):[],labels:J.labels&&typeof J.labels==="object"?J.labels:{},enabled:J.enabled!==!1})},201)}if(q.pathname==="/api/alerts/rules"&&N.method==="PATCH"){let J=await re(N),ee=st.getRule(String(J.id??""));if(!ee||!U(ee.resourceId))return O({ok:!1,error:"Alert rule was not found."},404);return O({ok:!0,rule:st.setRuleEnabled(ee.id,J.enabled!==!1)})}if(q.pathname==="/api/alerts/evaluate"&&N.method==="POST")return O({ok:!0,...await _m(A?.id)});if(q.pathname==="/api/alerts"&&N.method==="GET")return O({ok:!0,alerts:st.listAlerts(y.project.id,{environmentId:A?.id,states:q.searchParams.getAll("state").length?q.searchParams.getAll("state"):void 0,limit:Number(q.searchParams.get("limit"))||200}).filter((J)=>U(J.resourceId)).map((J)=>({...J,deliveries:st.listDeliveries({alertId:J.id,limit:50})}))});if(q.pathname==="/api/alerts/action"&&N.method==="POST"){let J=await re(N),ee=st.getAlert(String(J.id??""));if(!ee||!U(ee.resourceId))return O({ok:!1,error:"Alert was not found."},404);let Se=String(J.action??"");if(Se==="acknowledge")return O({ok:!0,alert:st.acknowledge(ee.id,Q?.id??"")});if(Se==="assign")return O({ok:!0,alert:st.assign(ee.id,J.ownerActorId==="me"?Q?.id:J.ownerActorId?String(J.ownerActorId):void 0,Q?.id)});if(Se==="silence"){if(me.role!=="admin")return O({ok:!1,error:"Silencing production alerts requires an administrator."},403);let ve=lr.resolveSession(N);if(De&&(!ve||!Ne.isRecentlyAuthenticated(ve)))return O({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return O({ok:!0,alert:st.silenceAlert(ee.id,String(J.until??""),Q?.id)})}return O({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(q.pathname==="/api/alerts/silences"&&N.method==="POST"){let J=await re(N);return O({ok:!0,id:st.createSilence({projectId:y.project.id,environmentId:A?.id,resourceId:H(J.resourceId??J.resource),matcher:J.matcher,reason:String(J.reason??""),startsAt:String(J.startsAt??new Date().toISOString()),endsAt:String(J.endsAt??""),timezone:String(J.timezone??"UTC"),actorId:Q?.id})},201)}if(q.pathname==="/api/notifications/channels"&&N.method==="GET")return O({ok:!0,channels:st.listChannels(y.organization.id)});if(q.pathname==="/api/notifications/channels"&&N.method==="POST"){let J=await re(N),ee=String(J.kind??""),Se=ee==="email"?{to:J.config?.to,from:J.config?.from}:ee==="telegram"?{chatId:String(J.config?.chatId??"")}:{};return O({ok:!0,channel:st.createChannel({organizationId:y.organization.id,name:String(J.name??""),kind:ee,config:Se,credential:J.credential?String(J.credential):void 0,actorId:Q?.id})},201)}if(q.pathname==="/api/notifications/channels"&&N.method==="PATCH"){let J=await re(N),ee=String(J.id??"");if(J.credential)return O({ok:!0,channel:st.rotateChannel(ee,String(J.credential))});let Se=String(J.status??"paused");if(!["active","paused","disabled"].includes(Se))return O({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return O({ok:!0,channel:st.setChannelStatus(ee,Se)})}if(q.pathname==="/api/notifications/channels/test"&&N.method==="POST"){let J=await re(N);return O({ok:!0,productionIncidentCreated:!1,result:await On.testChannel(String(J.id??""))})}if(q.pathname==="/api/notifications/routes"&&N.method==="GET")return O({ok:!0,routes:st.listRoutes(y.organization.id)});if(q.pathname==="/api/notifications/routes"&&N.method==="POST"){let J=await re(N),ee=Array.isArray(J.channelIds)?J.channelIds.map(String):[];if(ee.some((Se)=>st.getChannel(Se)?.organizationId!==y.organization.id))return O({ok:!1,error:"Route contains an unavailable channel."},422);return O({ok:!0,route:st.createRoute({organizationId:y.organization.id,name:String(J.name??""),priority:Number(J.priority)||0,matcher:J.matcher&&typeof J.matcher==="object"?J.matcher:{},channelIds:ee,quietHours:J.quietHours,groupWaitSeconds:Number(J.groupWaitSeconds)||30,reminderSeconds:J.reminderSeconds==null?void 0:Number(J.reminderSeconds),escalation:Array.isArray(J.escalation)?J.escalation:[],template:J.template?String(J.template):void 0,rateLimitPerMinute:Number(J.rateLimitPerMinute)||60,enabled:J.enabled!==!1})},201)}if(q.pathname==="/api/notifications/routes"&&N.method==="PATCH"){let J=await re(N),ee=st.getRoute(String(J.id??""));if(!ee||ee.organizationId!==y.organization.id)return O({ok:!1,error:"Notification route was not found."},404);return O({ok:!0,route:st.setRouteEnabled(ee.id,J.enabled!==!1)})}if(q.pathname==="/api/notifications/routes/preview"&&N.method==="POST"){let J=await re(N),Se=(J.alertId?st.getAlert(String(J.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:y.project.id,environmentId:A?.id,resourceId:H(J.resourceId??J.resource),dedupKey:"preview",groupKey:String(J.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(J.severity))?J.severity:"warning",title:String(J.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return O({ok:!0,productionIncidentCreated:!1,matches:On.preview(y.organization.id,Se,String(J.eventType??"firing")).map((ve)=>({route:ve.route,channels:ve.channels,quiet:ve.quiet}))})}if(q.pathname==="/api/notifications/deliveries"&&N.method==="GET")return O({ok:!0,deliveries:st.listDeliveries({alertId:q.searchParams.get("alertId")??void 0,states:q.searchParams.getAll("state"),limit:Number(q.searchParams.get("limit"))||200})});if(q.pathname==="/api/notifications/deliveries/retry"&&N.method==="POST"){let J=await re(N),ee=st.getDelivery(String(J.id??""));if(!ee)return O({ok:!1,error:"Delivery was not found."},404);return st.updateDelivery(ee.id,{state:"retrying",attempt:Math.max(0,ee.attempt-1),nextAttemptAt:new Date().toISOString()}),O({ok:!0,delivery:await On.deliver(ee.id)})}}if(q.pathname.startsWith("/api/jobs")||q.pathname.startsWith("/api/workers")){let A=y.environments.get(Ce),P=y.store.listResources(y.project.id,A?.id),U=me.role==="admin"||!!A&&Ga(me,A.id,"automation:read")?P:P.filter((Te)=>Dr(me,Te.id,"automation:read")),H=(Te)=>!Te||U.some((Ue)=>Ue.id===Te),Q=We(me).actor,J=V.get(Ce)??B,ee=ju(m,J),Se=ee.filter((Te)=>!Te.danger&&["scheduler","backup","worker"].includes(Te.group)),ve=M(m),nt=()=>{let Te=lr.resolveSession(N);return!De||!!Te&&Ne.isRecentlyAuthenticated(Te)},Pe=(Te)=>{if(!Te||typeof Te!=="object"||Array.isArray(Te))return{};let Ue=Object.entries(Te).slice(0,50);if(Ue.some(([,ct])=>typeof ct!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(ct)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(Ue)},He=(Te,Ue,ct)=>y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,resourceId:ct,actorId:Q?.id,type:`job.${Te}`,payload:Ue});if(q.pathname==="/api/jobs/preview"&&N.method==="POST"){let Te=await re(N);try{return O({ok:!0,productionExecutionCreated:!1,preview:vt(String(Te.expression??""),String(Te.timezone??"UTC"),new Date(Te.from?String(Te.from):Date.now()),Number(Te.count)||5)})}catch(Ue){return O({ok:!1,error:Ue instanceof Error?Ue.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(q.pathname==="/api/jobs"&&N.method==="GET")return O({ok:!0,jobs:Pr.list(y.project.id,{environmentId:A?.id}).filter((Te)=>H(Te.resourceId)).map((Te)=>({...Te,preview:vt(Te.normalizedExpression,Te.timezone,new Date,5),capability:nn(Te),lastExecution:Pr.listExecutions(Te.id,1)[0]}))});if(q.pathname==="/api/jobs"&&N.method==="POST"){let Te=await re(N),Ue=String(Te.provider??(ve==="serverless"?"eventbridge":"server")),ct=ve==="serverless"?"eventbridge":"server";if(Ue!==ct)return O({ok:!1,error:`${ve} environments accept ${ct} schedules through this adapter.`},422);let ht=Te.operationId?String(Te.operationId):void 0;if(Ue==="server"&&(!ht||!Se.some((wr)=>wr.id===ht)))return O({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let Nt=nn({provider:Ue,expression:String(Te.expression??""),flexibleMinutes:Number(Te.flexibleMinutes)||0,missedRunPolicy:Te.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Te.overlapPolicy))?Te.overlapPolicy:"forbid"});if(!Nt.supported)return O({ok:!1,error:Nt.notes.join(" ")},422);let Pn=Te.resourceId?P.find((wr)=>wr.id===Te.resourceId||wr.slug===Te.resourceId):void 0;if(Te.resourceId&&(!Pn||!H(Pn.id)))return O({ok:!1,error:"Job resource was not found."},404);try{let wr=Ue==="server"?{kind:"dashboard_operation",operationId:ht}:{kind:"serverless_scheduler",action:"run"},Oi=Pr.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:A?.id,resourceId:Pn?.id,name:String(Te.name??""),provider:Ue,expression:String(Te.expression??""),timezone:String(Te.timezone??"UTC"),startsAt:Te.startsAt?String(Te.startsAt):void 0,endsAt:Te.endsAt?String(Te.endsAt):void 0,flexibleMinutes:Number(Te.flexibleMinutes)||0,target:wr,payloadRefs:Pe(Te.payloadRefs),missedRunPolicy:Te.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Te.overlapPolicy))?Te.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(Te.maxAttempts)||3,backoffSeconds:Number(Te.backoffSeconds)||30,deadLetterRef:Te.deadLetterRef?String(Te.deadLetterRef):void 0},timeoutSeconds:Number(Te.timeoutSeconds)||900,enabled:Te.enabled!==!1,origin:"managed",ownerActorId:Q?.id,observedState:{},reconciliationStatus:"pending"});return He("created",{jobId:Oi.id,provider:Oi.provider,expression:Oi.normalizedExpression},Oi.resourceId),O({ok:!0,job:Oi,capability:Nt},201)}catch(wr){return O({ok:!1,error:wr instanceof Error?wr.message:"Scheduled job could not be created."},422)}}if(q.pathname==="/api/jobs"&&N.method==="PATCH"){let Te=await re(N),Ue=Pr.get(String(Te.id??""));if(!Ue||!H(Ue.resourceId))return O({ok:!1,error:"Scheduled job was not found."},404);if(Ue.origin==="config")return O({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let ct=Te.missedRunPolicy==null?void 0:String(Te.missedRunPolicy),ht=Te.overlapPolicy==null?void 0:String(Te.overlapPolicy);if(ct&&!["skip","catch_up"].includes(ct))return O({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ht&&!["allow","forbid","replace"].includes(ht))return O({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let Nt=Pr.updateSchedule(Ue.id,{expression:Te.expression?String(Te.expression):void 0,timezone:Te.timezone?String(Te.timezone):void 0,missedRunPolicy:ct,overlapPolicy:ht,timeoutSeconds:Te.timeoutSeconds==null?void 0:Number(Te.timeoutSeconds)});return He("updated",{jobId:Nt.id,expression:Nt.normalizedExpression,version:Nt.version},Nt.resourceId),O({ok:!0,job:Nt})}catch(Nt){return O({ok:!1,error:Nt instanceof Error?Nt.message:"Scheduled job could not be updated."},422)}}if(q.pathname==="/api/jobs/action"&&N.method==="POST"){let Te=await re(N),Ue=Pr.get(String(Te.id??""));if(!Ue||!H(Ue.resourceId))return O({ok:!1,error:"Scheduled job was not found."},404);let ct=String(Te.action??"");if(ct==="run"){let ht=Pm.enqueue(Ue,{trigger:"manual",actorId:Q?.id});return He("run_queued",{jobId:Ue.id,executionId:ht.id},Ue.resourceId),O({ok:!0,execution:ht},202)}if(["disable","delete"].includes(ct)&&A?.kind==="production"){if(String(Te.confirm??"")!==ct)return O({ok:!1,error:`Type "${ct}" to confirm this production change.`},409);if(!nt())return O({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(ct==="enable"||ct==="disable"){let ht=Pr.setEnabled(Ue.id,ct==="enable");return He(ct==="enable"?"enabled":"disabled",{jobId:Ue.id},Ue.resourceId),O({ok:!0,job:ht})}if(ct==="delete")try{return Pr.remove(Ue.id),He("deleted",{jobId:Ue.id,name:Ue.name},Ue.resourceId),O({ok:!0,deleted:Ue.id})}catch(ht){return O({ok:!1,error:ht instanceof Error?ht.message:"Scheduled job could not be deleted."},409)}return O({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(q.pathname==="/api/jobs/history"&&N.method==="GET"){let Te=Pr.get(String(q.searchParams.get("jobId")??""));if(!Te||!H(Te.resourceId))return O({ok:!1,error:"Scheduled job was not found."},404);return O({ok:!0,executions:Pr.listExecutions(Te.id,Number(q.searchParams.get("limit"))||100).map((Ue)=>({...Ue,logs:Ue.operationId?Vt.logs(Ue.operationId,{limit:500}):[]}))})}if(q.pathname==="/api/jobs/reconcile"&&N.method==="POST"){if(!A)return O({ok:!1,error:"Environment was not found."},404);let Te=Zo(Pr,m,{organization:y.organization,project:y.project,environment:A,resources:P});return He("reconciled",Te),O({ok:!0,reconciliation:Te})}if(q.pathname==="/api/workers"&&N.method==="GET"){let Te=Array.isArray(J.workersDetail??J.workers)?J.workersDetail??J.workers:[];return O({ok:!0,workers:Pr.listWorkers(y.project.id,A?.id).filter((Ue)=>H(Ue.resourceId)).map((Ue)=>{let ct=Te.find((ht)=>ht.name===Ue.name||ht.site===Ue.target.site);return ct?{...Ue,observedState:{...Ue.observedState,status:ct.status??"configured",currentJob:ct.currentJob??null,failures:Number(ct.failed??ct.failures)||0,processed:Number(ct.processed)||0}}:Ue})})}if(q.pathname==="/api/workers/action"&&N.method==="POST"){let Te=await re(N),Ue=Pr.getWorker(String(Te.id??""));if(!Ue||!H(Ue.resourceId))return O({ok:!1,error:"Worker was not found."},404);let ct=String(Te.action??"");if(ct==="restart"){if(String(Te.confirm??"")!==Ue.name)return O({ok:!1,error:`Type "${Ue.name}" to restart this worker.`},409);let ht=ee.find((wr)=>wr.id===Ue.target.operationId);if(!ht)return O({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let Nt=await Bu(m,Ce,ht),Pn=Pr.reconcileWorker(Ue.id,Nt.ok?"in_sync":"unavailable",{...Ue.observedState,lastRestartAt:new Date().toISOString(),command:Nt.command??null,error:Nt.error??Nt.stderr??null});return He("worker_restarted",{workerId:Ue.id,ok:Nt.ok},Ue.resourceId),O({...Nt,worker:Pn},Nt.ok?200:409)}if(ct==="scale")return O({ok:!1,error:Ue.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return O({ok:!1,error:"Action must be restart or scale."},422)}}if(q.pathname.startsWith("/api/telemetry/")){let A=y.environments.get(Ce),P=new ft(y.store),F=y.store.listResources(y.project.id,A?.id),U=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(q.pathname)?"runtime:logs":"runtime:read",H=me.role==="admin"||!!A&&Ga(me,A.id,U),Q=H?F:F.filter((Pe)=>Dr(me,Pe.id,U)),J=(Pe)=>zS(Q,H,Pe),ee=(Pe)=>{let He=new Date,Te={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},Ue=String(Pe.to??He.toISOString()),ct=String(Pe.from??new Date(new Date(Ue).getTime()-(Te[String(Pe.range??"1h")]??Te["1h"])).toISOString()),ht=(Pn)=>{let wr=(Array.isArray(Pn)?Pn:String(Pn??"").split(",")).map(String).filter(Boolean);return wr.length?wr:void 0},Nt=ht(Pe.kinds)?.filter((Pn)=>["metric","log","trace","request","event"].includes(Pn));return{projectId:y.project.id,environmentId:A?.id,resourceIds:J(Pe.resources),kinds:Nt,names:ht(Pe.names),sources:ht(Pe.sources),levels:ht(Pe.levels),from:ct,to:Ue,text:String(Pe.text??"")||void 0,traceId:String(Pe.traceId??"")||void 0,requestId:String(Pe.requestId??"")||void 0,deploymentId:String(Pe.deploymentId??"")||void 0,releaseId:String(Pe.releaseId??"")||void 0,workloadId:String(Pe.workloadId??"")||void 0,cursor:String(Pe.cursor??"")||void 0,limit:Number(Pe.limit)||void 0}},Se=Object.fromEntries(q.searchParams.entries()),ve=(Pe=!1)=>vm({controlPlane:y.store,projectId:y.project.id,environmentId:A?.id,config:m,environment:Ce,force:Pe,lightweight:!Pe}),nt=()=>{let Pe=y.store.getSetting(`telemetry.collection:${y.project.id}:${A?.id??"all"}`)??{};return{generatedAt:String(Pe.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(Pe.statuses)?Pe.statuses:[],errors:Array.isArray(Pe.errors)?Pe.errors:[],policy:Pe.policy??Gt(y.store,y.project.id)}};if(q.pathname==="/api/telemetry/status"&&N.method==="GET"){ve(!1);let Pe=nt(),He=H?Pe.statuses:P.status(y.project.id,A?.id,Pe.policy.rawDays,Pe.policy.samplingRate,Q.map((Ue)=>Ue.id)),Te=He.reduce((Ue,ct)=>Ue+ct.estimatedDailyBytes*30,0);return O({ok:!0,generatedAt:Pe.generatedAt,cached:Pe.cached,sources:He,errors:H?Pe.errors:[],policy:Pe.policy,retention:{rawDays:Pe.policy.rawDays,downsampleAfterDays:Pe.policy.downsampleAfterDays,downsampleBucketMs:Pe.policy.downsampleBucketMs,maxRecords:Pe.policy.maxRecords},estimatedMonthlyBytes:Te,estimatedMonthlyCostUsd:Ad(Te,Pe.policy),costEstimateConfigured:Pe.policy.estimatedStorageUsdPerGbMonth>0})}if(q.pathname==="/api/telemetry/settings"&&N.method==="GET")return O({ok:!0,policy:Gt(y.store,y.project.id)});if(q.pathname==="/api/telemetry/settings"&&N.method==="PATCH"){let Pe=fd(y.store,y.project.id,await re(N));return KS(y.project.id),O({ok:!0,policy:Pe})}if(q.pathname==="/api/telemetry/query"&&N.method==="GET"){ve(!1);let Pe=nt();return O({ok:!0,collection:{generatedAt:Pe.generatedAt,cached:Pe.cached},...P.query(ee(Se))})}if(q.pathname==="/api/telemetry/tail"&&N.method==="GET"){ve(!1);let Pe=new TextEncoder,He=new Date,Te=ee({...Se,kinds:Se.kinds||"log,request,event,trace",from:Se.from||new Date(He.getTime()-120000).toISOString(),to:He.toISOString(),limit:Math.min(1000,Number(Se.limit)||200),cursor:void 0}),Ue=N.headers.get("last-event-id")||String(Se.cursor??"")||void 0,ct,ht=!1,Nt=!1,Pn=new ReadableStream({start(wr){let Oi=()=>{if(ht)return;if(ht=!0,ct)clearInterval(ct);N.signal.removeEventListener("abort",Oi);try{wr.close()}catch{}},Hm=async()=>{if(ht||Nt)return;Nt=!0;try{let wo=P.tail({...Te,to:new Date(Date.now()+1000).toISOString()},Ue);for(let Gm of wo.records)Ue=wi(Gm)??Ue,wr.enqueue(Pe.encode(`id: ${Ue??""}
+This replacement link expires ${F.invitation.expiresAt} and can be used once.`});return x({invitation:F.invitation,token:F.token,acceptUrl:U,delivered:H})}catch(F){return x({ok:!1,error:F instanceof Error?F.message:"Invitation could not be resent."},409)}}if(q.pathname==="/api/organization/memberships"&&N.method==="PATCH"){let A=await re(N),P=y.store.getMembership(String(A.id??"")),F=Uu(A.roleTemplate),U=Ic(A);if(!P||P.organizationId!==y.organization.id)return x({ok:!1,error:"Membership was not found."},404);if(!F||!U)return x({ok:!1,error:"Choose a valid role template and resource scope."},422);let H=We(me);if((P.roleTemplate==="owner"||F==="owner")&&(!Qn(String(A.password??""),me.passwordHash)||H.membership?.roleTemplate!=="owner"))return x({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let J=y.store.resolveAuthorizationTarget(y.organization.id,U)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),ee=y.store.listGrants(P.id),Se=Mt({membership:P,grants:ee,target:J}),ve={...P,roleTemplate:F,scope:U},nt=Mt({membership:ve,grants:ee,target:J}),Pe={gained:nt.filter((He)=>!Se.includes(He)),lost:Se.filter((He)=>!nt.includes(He))};if(A.preview===!0)return x({membership:P,proposed:{roleTemplate:F,scope:U},accessDiff:Pe});if(String(A.confirm??"")!==P.id)return x({ok:!1,error:`Confirm this change with membership ID ${P.id}.`,accessDiff:Pe},409);try{return x({membership:y.store.updateMembership({id:P.id,roleTemplate:F,scope:U,actorId:H.actor?.id}),accessDiff:Pe})}catch(He){return x({ok:!1,error:He instanceof Error?He.message:"Membership could not be updated."},409)}}if(q.pathname==="/api/organization/memberships"&&N.method==="DELETE"){let A=await re(N),P=y.store.getMembership(String(A.id??""));if(!P||P.organizationId!==y.organization.id)return x({ok:!1,error:"Membership was not found."},404);if(String(A.confirm??"")!==P.id)return x({ok:!1,error:`Confirm removal with membership ID ${P.id}.`},409);let F=We(me);if(P.roleTemplate==="owner"&&(F.membership?.roleTemplate!=="owner"||!Qn(String(A.password??""),me.passwordHash)))return x({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return x({membership:y.store.revokeMembership(P.id,F.actor?.id)})}catch(U){return x({ok:!1,error:U instanceof Error?U.message:"Membership could not be removed."},409)}}if(q.pathname==="/api/organization/grants"&&N.method==="POST"){let A=await re(N),P=String(A.capability??""),F=A.effect==="deny"?"deny":A.effect==="allow"?"allow":void 0,U=Ic(A),H=We(me);if(!F||!U||!pe.includes(P))return x({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return x({grant:y.store.upsertGrant({organizationId:y.organization.id,membershipId:String(A.membershipId??""),effect:F,capability:P,scope:U,actorId:H.actor?.id})},201)}catch(Q){return x({ok:!1,error:Q instanceof Error?Q.message:"Grant could not be created."},422)}}if(q.pathname==="/api/organization/grants"&&N.method==="DELETE"){let A=await re(N),P=We(me),F=y.store.getGrant(String(A.id??""));if(!F||F.organizationId!==y.organization.id)return x({ok:!1,error:"Grant was not found."},404);return x({ok:y.store.removeGrant(F.id,P.actor?.id)})}if(q.pathname==="/api/tags"&&N.method==="GET")return x({tags:y.store.listTags(y.project.id),assignments:y.store.listResourceTags(y.project.id)});if(q.pathname==="/api/tags"&&N.method==="POST"){let A=await re(N),P=y.store.upsertTag(y.project.id,String(A.name??""),String(A.color??"#5a8be0"));if(A.resourceId)y.store.assignTag(String(A.resourceId),P.id);return x({tag:P},201)}if(q.pathname==="/api/tags"&&N.method==="DELETE"){let A=await re(N);return y.store.removeTag(String(A.resourceId??""),String(A.tagId??"")),x({ok:!0})}if(q.pathname==="/"&&!rw(q.pathname,$n))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(Ce)}`}});if(q.pathname==="/"&&sr?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(Ce)}`}});let xc=cu(q.pathname);if(xc)return new Response(null,{status:308,headers:{location:`${xc}?env=${encodeURIComponent(Ce)}`}});if(q.pathname==="/api/env"&&N.method==="POST"){let A=await re(N),P=String(A.env??"");if(!C.includes(P))return x({ok:!1,error:`Unknown environment '${P}'.`,environments:C},404);return x({ok:!0,environment:P,environments:C,href:`?env=${encodeURIComponent(P)}`})}if(q.pathname==="/api/config"){let A={...ns(m),environment:Ce,environments:C};return x(hS(A,$n))}if(q.pathname==="/api/ssh-keys"&&N.method==="GET")return x({configPath:j,keys:yo(Ka(m))});if(q.pathname==="/api/ssh-keys"&&N.method==="POST"){if(!j)return x({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=await ii(j,"utf8"),F=Ka(m),U=Sb({configText:P,name:String(A.name??""),publicKey:String(A.publicKey??""),existingKeys:F});return await ys(j,U),ZS(m,[...F,{name:String(A.name??"").trim(),publicKey:String(A.publicKey??"").trim().replace(/\s+/g," ")}]),x({ok:!0,configPath:j,keys:yo(Ka(m))})}if(q.pathname==="/api/ssh-keys"&&N.method==="DELETE"){if(!j)return x({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=String(A.name??q.searchParams.get("name")??""),F=await ii(j,"utf8"),U=Ka(m),H=wb({configText:F,name:P,existingKeys:U});return await ys(j,H),ZS(m,U.filter((Q)=>Q.name!==P.trim())),x({ok:!0,configPath:j,keys:yo(Ka(m))})}if(q.pathname==="/api/firewall"&&N.method==="GET")return x({configPath:j,alwaysOpen:[22,80,443],ports:bm(m)});if(q.pathname==="/api/firewall"&&N.method==="POST"){if(!j)return x({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=Number(A.port);if(!wc(P))return x({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let F=bm(m),U=await ii(j,"utf8");try{await ys(j,ES(U,P,F))}catch(J){return x({ok:!1,error:J?.message??String(J)},422)}let H=hs([...F,P]);XS(m,H);let Q=A.apply===!1?null:await bc(m,Ce,`ufw allow ${P}/tcp`).catch((J)=>({ok:!1,error:String(J?.message??J)}));return x({ok:!0,configPath:j,ports:H,apply:Q})}if(q.pathname==="/api/firewall"&&N.method==="DELETE"){if(!j)return x({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=Number(A.port??q.searchParams.get("port"));if(!wc(P))return x({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let F=bm(m),U=await ii(j,"utf8");await ys(j,RS(U,P,F));let H=hs(F.filter((J)=>J!==P));XS(m,H);let Q=A.apply===!1?null:await bc(m,Ce,`ufw delete allow ${P}/tcp`).catch((J)=>({ok:!1,error:String(J?.message??J)}));return x({ok:!0,configPath:j,ports:H,apply:Q})}if(q.pathname==="/api/sites"&&N.method==="POST"){if(!j)return x({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=String(A.name??"").trim(),F=String(A.root??"").trim();if(!P||!F)return x({ok:!1,error:"Site name and root are required."},422);let U={deploy:A.deploy==="bucket"?"bucket":"server",root:F,path:String(A.path??"").trim()||void 0,domain:String(A.domain??"").trim()||void 0,build:String(A.build??"").trim()||void 0,start:String(A.start??"").trim()||void 0,port:A.port?Number(A.port):void 0,type:String(A.type??"").trim()||void 0};if(U.port!==void 0&&(!Number.isInteger(U.port)||U.port<1||U.port>65535))return x({ok:!1,error:"Port must be a number between 1 and 65535."},422);let H=await ii(j,"utf8"),Q=cn({configText:H,name:P,root:U.root,domain:U.domain,path:U.path,deploy:U.deploy,build:U.build,start:U.start,port:U.port,type:U.type});return await ys(j,Q),Z_(m,P,Object.fromEntries(Object.entries(U).filter(([,J])=>J!==void 0))),sr=await vs(m,Ce),V.set(Ce,sr),x({ok:!0,configPath:j,site:P,data:sr})}if(q.pathname==="/api/sites"&&N.method==="DELETE"){if(!j)return x({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=String(A.name??q.searchParams.get("name")??"").trim();if(!P||!m.sites?.[P])return x({ok:!1,error:`Site '${P}' was not found.`},404);let F=await ii(j,"utf8");return await ys(j,dn({configText:F,name:P})),delete m.sites[P],sr=await vs(m,Ce),V.set(Ce,sr),x({ok:!0,configPath:j,site:P,data:sr})}if(q.pathname==="/api/sites"&&N.method==="PATCH"){if(!j)return x({ok:!1,error:"No cloud config file was found in this checkout."},404);let A=await re(N),P=String(A.name??"").trim(),F=m.sites?.[P];if(!P||!F)return x({ok:!1,error:`Site '${P}' was not found.`},404);if($n.role==="member"){let Q=SS(A);if(!Q.ok)return x({ok:!1,error:Q.error},403);let J=wS({siteName:P,body:A,sites:m.sites??{},ownSites:Object.keys($n.sites)});if(!J.ok)return x({ok:!1,error:J.error},409)}if(A.port!==void 0&&A.port!==null&&A.port!==""&&(!Number.isInteger(Number(A.port))||Number(A.port)<1||Number(A.port)>65535))return x({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof A.domain==="string"&&A.domain.trim()&&!Ca(A.domain.trim()))return x({ok:!1,error:`Domain '${A.domain.trim()}' is not a valid hostname.`},422);let U=await ii(j,"utf8"),H=(Q,J)=>{U=Yi({configText:U,siteName:P,key:Q,valueText:J})};if(A.ssl!==void 0)H("ssl",eu(A.ssl)),F.ssl=A.ssl;if(A.env!==void 0&&A.env&&typeof A.env==="object")H("env",ru(A.env)),F.env=A.env;if(A.aliases!==void 0&&Array.isArray(A.aliases)){let Q=A.aliases.map((J)=>String(J));H("aliases",nu(Q)),F.aliases=Q.map((J)=>J.trim().toLowerCase()).filter(Boolean)}if(A.redirects!==void 0&&A.redirects&&typeof A.redirects==="object")H("redirects",iu(A.redirects)),F.redirects=A.redirects;for(let Q of["domain","path","build","start","type","root","php"])if(typeof A[Q]==="string"&&A[Q].trim())H(Q,tu(String(A[Q]).trim())),F[Q]=String(A[Q]).trim();if(A.port!==void 0&&A.port!==null&&A.port!=="")H("port",String(Number(A.port))),F.port=Number(A.port);return await ys(j,U),sr=await vs(m,Ce),V.set(Ce,sr),x({ok:!0,configPath:j,site:P,data:sr})}if(q.pathname==="/api/sites/deploy"&&N.method==="POST"){let A=await re(N),P=String(A.name??"").trim();if(!P||!m.sites?.[P])return x({ok:!1,error:`Site '${P}' was not found.`},404);if(A.confirm!==P)return x({ok:!1,error:`Type "${P}" to deploy this site.`},409);let F=ne(y,String(Ce));await new St(ut).run(new rn,{...F,artifactRoot:t}),ji(ut,F,sr??{});let U=zi(ut,{scope:F,desiredConfigHash:y.project.desiredConfigHash});if(U.decision.outcome==="block")return x({ok:!1,error:`Deployment blocked by security policy: ${U.decision.explanation}`,securityReview:U},409);let H={id:`deploy:${P}`,label:`Deploy ${P}`,description:`Deploy the ${P} site for ${Ce}.`,command:["deploy","--env",Ce,"--site",P,"--yes"],mutates:!0},Q=await _e({controlPlane:y,environment:Ce,actor:me,kind:"dashboard.site.deploy",resourceSlug:P,input:{site:P},execute:()=>Sm(H,{cwd:t,cliEntry:l})});return x({...Q.result,controlPlaneOperation:Q.operation,securityReview:U})}if(q.pathname==="/api/actions")return x(mn(Ce));if(q.pathname==="/api/server/operations")return x(ju(m,sr));if(q.pathname==="/api/runtime/workloads"&&N.method==="GET"){let A=await ie(m,Ce);return x(A)}if(q.pathname==="/api/runtime/logs"&&N.method==="GET"){let A=String(q.searchParams.get("workload")??"");if(!A)return x({ok:!1,error:"A workload query parameter is required."},422);let P=Math.min(1000,Math.max(1,Number(q.searchParams.get("limit"))||200));try{return x(await new fe(m,Ce).logs(A,{limit:P}))}catch(F){return x({ok:!1,error:String(F?.message??F)},404)}}if(q.pathname==="/api/runtime/log-sessions"&&N.method==="POST"){let A=await re(N),P=String(A.workloadId??"");if(!P)return x({ok:!1,error:"A workloadId is required."},422);let F=await ie(m,Ce),U=F.workloads.find((J)=>J.id===P);if(!U)return x({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!U.capabilities.logs.supported)return x({ok:!1,error:U.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let H=new fe(m,Ce,{inventory:async()=>F}),Q=Sr.create("logs",P);return(async()=>{let J=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(A.sinceMs)||60000)));try{for(let ee=0;ee<200&&!Sr.signal(Q.id)?.aborted;ee++){let Se=await H.logs(P,{limit:Math.min(500,Math.max(1,Number(A.limit)||200)),since:J});for(let ve of Se.lines)if(Sr.append(Q.id,`${ve.timestamp?`${ve.timestamp} `:""}${ve.message}
+`),ve.timestamp)J=new Date(Math.max(J.getTime(),new Date(ve.timestamp).getTime()+1));await Bun.sleep(3000)}if(!Sr.signal(Q.id)?.aborted)Sr.close(Q.id,"complete")}catch(ee){Sr.append(Q.id,ee instanceof Error?ee.message:String(ee),"stderr"),Sr.close(Q.id,"failed",ee instanceof Error?ee.message:String(ee))}})(),x({ok:!0,session:Q,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(Q.id)}&workload=${encodeURIComponent(P)}`},201)}if((q.pathname==="/api/runtime/log-stream"||q.pathname==="/api/runtime/exec-stream")&&N.method==="GET"){let A=String(q.searchParams.get("id")??""),P=String(q.searchParams.get("workload")??""),F=Number(N.headers.get("last-event-id")??q.searchParams.get("after")??0)||0,U=Sr.read(A,P,F),H=q.pathname.includes("exec")?"exec":"logs";if(!U||U.kind!==H)return x({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return q_(Sr,U,F,N.signal)}if((q.pathname==="/api/runtime/log-sessions"||q.pathname==="/api/runtime/exec-sessions")&&N.method==="DELETE"){let A=await re(N),P=Sr.cancel(String(A.id??""),String(A.workloadId??""));if(!P)return x({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return x({ok:!0,session:P})}if(q.pathname==="/api/runtime/exec-sessions"&&N.method==="POST"){let A=await re(N),P=String(A.workloadId??""),F=await ie(m,Ce),U=F.workloads.find((ee)=>ee.id===P);if(!U)return x({ok:!1,error:"Workload was not found in the current project and environment."},404);let H=lr.resolveSession(N),Q=new fe(m,Ce,{inventory:async()=>F}),J=Sr.create("exec",P);return _e({controlPlane:y,environment:Ce,actor:me,kind:"runtime.exec",resourceSlug:U.links.service,input:{workloadId:P,provider:U.provider,preset:A.preset?String(A.preset):null,freeForm:!!String(A.command??"").trim()},execute:()=>Q.exec({workloadId:P,preset:["process","sockets","filesystem"].includes(String(A.preset))?String(A.preset):void 0,command:typeof A.command==="string"?A.command:void 0,confirm:String(A.confirm??""),recentAuth:!xe||!!H&&Ne.isRecentlyAuthenticated(H)})}).then(({result:ee,operation:Se})=>{if(Sr.append(J.id,`operation ${Se.id}
+`,"system"),ee.stdout)Sr.append(J.id,ee.stdout,"stdout");if(ee.stderr)Sr.append(J.id,ee.stderr,"stderr");Sr.close(J.id,ee.ok?"complete":"failed",ee.error)}).catch((ee)=>{let Se=ee instanceof Error?ee.message:String(ee);Sr.append(J.id,Se,"stderr"),Sr.close(J.id,"failed",Se)}),x({ok:!0,session:J,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(J.id)}&workload=${encodeURIComponent(P)}`},202)}if(q.pathname==="/api/runtime/files/read"&&N.method==="POST"){let A=await re(N),P=await ie(m,Ce),F=lr.resolveSession(N),U=await new fe(m,Ce,{inventory:async()=>P}).readFile({workloadId:String(A.workloadId??""),path:String(A.path??""),confirm:String(A.confirm??""),recentAuth:!xe||!!F&&Ne.isRecentlyAuthenticated(F)});return x(U,U.ok?200:409)}if(q.pathname==="/api/runtime/files/write"&&N.method==="POST"){let A=await re(N),P=await ie(m,Ce),F=String(A.workloadId??""),U=P.workloads.find((ee)=>ee.id===F);if(!U)return x({ok:!1,error:"Workload was not found in the current project and environment."},404);let H=lr.resolveSession(N),Q=new fe(m,Ce,{inventory:async()=>P}),J=await _e({controlPlane:y,environment:Ce,actor:me,kind:"runtime.file.write",resourceSlug:U.links.service,input:{workloadId:F,provider:U.provider,path:String(A.path??""),bytes:Buffer.from(String(A.contentBase64??""),"base64").byteLength},execute:()=>Q.writeFile({workloadId:F,path:String(A.path??""),contentBase64:String(A.contentBase64??""),confirm:String(A.confirm??""),recentAuth:!xe||!!H&&Ne.isRecentlyAuthenticated(H)})});return x({...J.result,controlPlaneOperation:J.operation},J.result.ok?200:409)}if(q.pathname==="/api/runtime/operations"&&N.method==="POST"){let A=await re(N),P=String(A.workloadId??""),F=String(A.action??"");if(!P||!["start","stop","restart","redeploy","scale","inspect"].includes(F))return x({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let U=await ie(m,Ce),H=U.workloads.find((Se)=>Se.id===P);if(!H)return x({ok:!1,error:"Workload was not found in the current project and environment."},404);let Q=lr.resolveSession(N),J=new fe(m,Ce,{inventory:async()=>U}),ee=await _e({controlPlane:y,environment:Ce,actor:me,kind:`runtime.${F}`,resourceSlug:H.links.service,input:{workloadId:P,provider:H.provider,action:F,replicas:A.replicas==null?null:Number(A.replicas)},execute:()=>J.run({workloadId:P,action:F,replicas:A.replicas==null?void 0:Number(A.replicas),confirm:String(A.confirm??""),recentAuth:!xe||!!Q&&Ne.isRecentlyAuthenticated(Q)})});return x({...ee.result,controlPlaneOperation:ee.operation},ee.result.ok?200:409)}if(q.pathname.startsWith("/api/protection")){let A=me.role==="admin"||Tc(me,"security:read"),P=me.role==="admin"||Tc(me,"security:manage");if(!A)return x({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:F,describePosture:U}=await import("./protection/index.js"),H=new F(y.store),Q=()=>{if(!P)throw Error("Changing protection controls requires security:manage.")};if(q.pathname==="/api/protection"&&N.method==="GET"){let J=H.current();return x({ok:!0,posture:U(J),controls:J,raw:H.raw()})}if(q.pathname==="/api/protection/attack-mode"&&N.method==="POST"){Q();let J=await re(N);if(J.enabled===!1)return x({ok:!0,disabled:H.disableAttackMode()});return x({ok:!0,control:H.enableAttackMode({hours:J.hours==null?void 0:Number(J.hours),reason:String(J.reason??"Enabled from the dashboard."),actorId:We(me).actor?.id})})}if(q.pathname==="/api/protection/pause"&&N.method==="POST"){Q();let J=await re(N);if(J.enabled===!1)return x({ok:!0,resumed:H.resumeMitigations()});return x({ok:!0,control:H.pauseMitigations({hours:J.hours==null?void 0:Number(J.hours),reason:String(J.reason??""),actorId:We(me).actor?.id})})}if(q.pathname==="/api/protection/ip-rules"&&N.method==="GET")return x({ok:!0,ipRules:H.current().ipRules});if(q.pathname==="/api/protection/ip-rules"&&(N.method==="POST"||N.method==="DELETE")){Q();let J=await re(N),ee=J.list==="allow"?"allow":"block",Se=N.method==="POST"?H.addIpRule(ee,String(J.cidr??"")):H.removeIpRule(ee,String(J.cidr??""));return x({ok:!0,ipRules:Se})}return x({ok:!1,error:"Protection endpoint was not found."},404)}if(q.pathname.startsWith("/api/spend/")||q.pathname==="/api/usage"){let A=await pw(),{store:P,service:F,gate:U}=A,H=me.role==="admin"||Tc(me,"billing:read"),Q=me.role==="admin"||Tc(me,"billing:manage");if(!H)return x({ok:!1,error:"Spend data requires the billing:read capability."},403);let J=y.environments.get(Ce),ee={organizationId:y.organization.id,projectId:y.project.id,environmentId:J?.id},Se=()=>{if(!Q)throw Error("Changing a budget requires the billing:manage capability.")};if(q.pathname==="/api/usage"&&N.method==="GET")return x({ok:!0,...F.usageReport({organizationId:ee.organizationId,projectId:ee.projectId,period:q.searchParams.get("period")??"monthly",timezone:q.searchParams.get("timezone")??void 0})});if(q.pathname==="/api/spend/budgets"&&N.method==="GET")return x({ok:!0,budgets:P.listBudgets({organizationId:ee.organizationId,projectId:ee.projectId}).map((ve)=>({...ve,status:F.status(ve)}))});if(q.pathname==="/api/spend/budgets"&&N.method==="POST"){Se();let ve=await re(N),nt=String(ve.scope??"project"),Pe=P.createBudget({organizationId:ee.organizationId,projectId:nt==="organization"?void 0:ee.projectId,environmentId:nt==="environment"?ee.environmentId:void 0,name:String(ve.name??"").trim(),period:ve.period??"monthly",timezone:ve.timezone?String(ve.timezone):void 0,softLimitCents:ve.softLimitCents==null?void 0:Math.round(Number(ve.softLimitCents)),hardLimitCents:ve.hardLimitCents==null?void 0:Math.round(Number(ve.hardLimitCents)),graceSeconds:ve.graceSeconds==null?void 0:Number(ve.graceSeconds),dryRun:ve.dryRun!==!1});return x({ok:!0,budget:Pe})}if(q.pathname==="/api/spend/budgets"&&N.method==="PATCH"){Se();let ve=await re(N),nt=String(ve.id??""),Pe=P.getBudget(nt);if(!Pe||Pe.organizationId!==ee.organizationId)return x({ok:!1,error:"Budget was not found."},404);return x({ok:!0,budget:P.updateBudget(nt,{softLimitCents:ve.softLimitCents==null?Pe.softLimitCents:Math.round(Number(ve.softLimitCents)),hardLimitCents:ve.hardLimitCents==null?Pe.hardLimitCents:Math.round(Number(ve.hardLimitCents)),enabled:ve.enabled==null?Pe.enabled:ve.enabled===!0,dryRun:ve.dryRun==null?Pe.dryRun:ve.dryRun===!0},ve.expectedVersion==null?void 0:Number(ve.expectedVersion))})}if(q.pathname==="/api/spend/budgets"&&N.method==="DELETE"){Se();let ve=await re(N),nt=String(ve.id??""),Pe=P.getBudget(nt);if(!Pe||Pe.organizationId!==ee.organizationId)return x({ok:!1,error:"Budget was not found."},404);let He=U.closeBudget(nt);return P.deleteBudget(nt),x({ok:!0,deleted:!0,lifted:He})}if(q.pathname==="/api/spend/check"&&N.method==="POST"){Se();let ve=await re(N),{SpendRunner:nt}=await import("./spend/index.js"),Pe=new nt({controlPlane:y.store,store:P,alerts:st});if(ve.apply!==!0){let Te=P.budgetsForScope(ee.organizationId,ee.projectId,ee.environmentId);return x({ok:!0,applied:!1,preview:Te.map((Ue)=>F.status(Ue))})}let He=await Pe.run({...ee,environmentKind:J?.kind});return x({ok:!0,applied:!0,result:He})}if(q.pathname==="/api/spend/enforcement"&&N.method==="GET")return x({ok:!0,enforcement:U.listUnder({organizationId:ee.organizationId})});if(q.pathname==="/api/spend/release"&&N.method==="POST"){Se();let ve=await re(N),nt=U.close(String(ve.budgetId??""),ve.action);return x({ok:nt,released:nt,note:nt?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(q.pathname==="/api/spend/anomalies"&&N.method==="GET")return x({ok:!0,anomalies:P.listAnomalies({organizationId:ee.organizationId,projectId:ee.projectId,unacknowledgedOnly:q.searchParams.get("unacknowledged")==="true"})});if(q.pathname==="/api/spend/anomalies/acknowledge"&&N.method==="POST"){Se();let ve=await re(N);return x({ok:!0,acknowledged:P.acknowledgeAnomaly(String(ve.id??""))})}return x({ok:!1,error:"Spend endpoint was not found."},404)}if(q.pathname.startsWith("/api/health/")||q.pathname.startsWith("/api/alerts")||q.pathname.startsWith("/api/notifications/")){let A=y.environments.get(Ce),P=y.store.listResources(y.project.id,A?.id),F=me.role==="admin"||!!A&&Ga(me,A.id,"runtime:read")?P:P.filter((J)=>Dr(me,J.id,"runtime:read")),U=(J)=>!J||F.some((ee)=>ee.id===J),H=(J)=>{if(!J)return;let ee=P.find((Se)=>Se.id===J||Se.slug===J);if(!ee)throw Error("Alert resource was not found.");if(!U(ee.id))throw Error("Alert resource is outside your authorized scope.");return ee.id},Q=We(me).actor;if(q.pathname==="/api/health/checks"&&N.method==="GET")return x({ok:!0,checks:st.listHealthChecks(y.project.id,A?.id).filter((J)=>U(J.resourceId)).map((J)=>({...J,results:st.listHealthResults(J.id,20)}))});if(q.pathname==="/api/health/checks"&&N.method==="POST"){let J=await re(N),ee=String(J.kind??"http");if(ee==="command"&&me.role!=="admin")return x({ok:!1,error:"Command health checks require an administrator."},403);let Se={method:String(J.config?.method??"GET").toUpperCase().slice(0,10),path:J.config?.path?String(J.config.path).slice(0,500):void 0,port:J.config?.port==null?void 0:Number(J.config.port),command:Array.isArray(J.config?.command)?J.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(J.config?.expectedStatuses)?J.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:J.config?.expectedBody?String(J.config.expectedBody).slice(0,500):void 0};return x({ok:!0,check:st.createHealthCheck({projectId:y.project.id,environmentId:A?.id,resourceId:H(J.resourceId??J.resource),name:String(J.name??""),kind:ee,target:String(J.target??""),config:Se,intervalSeconds:Number(J.intervalSeconds)||60,timeoutSeconds:Number(J.timeoutSeconds)||10,failureThreshold:Number(J.failureThreshold)||3,recoveryThreshold:Number(J.recoveryThreshold)||2,regions:Array.isArray(J.regions)?J.regions.map(String):["local"],enabled:J.enabled!==!1})},201)}if(q.pathname==="/api/health/checks"&&N.method==="PATCH"){let J=await re(N),ee=st.getHealthCheck(String(J.id??""));if(!ee||!U(ee.resourceId))return x({ok:!1,error:"Health check was not found."},404);return x({ok:!0,check:st.setHealthCheckEnabled(ee.id,J.enabled!==!1)})}if(q.pathname==="/api/health/checks/test"&&N.method==="POST"){let J=await re(N),ee=st.getHealthCheck(String(J.id??""));if(!ee||!U(ee.resourceId))return x({ok:!1,error:"Health check was not found."},404);return x({ok:!0,productionIncidentCreated:!1,result:await new je(st).probe(ee)})}if(q.pathname==="/api/health/checks/run"&&N.method==="POST"){let J=await re(N),ee=st.getHealthCheck(String(J.id??""));if(!ee||!U(ee.resourceId))return x({ok:!1,error:"Health check was not found."},404);let Se=await new je(st).runAndEvaluate(ee),ve=[];for(let nt of Se.evaluations.filter((Pe)=>Pe.notify&&Pe.alert)){let Pe=On.enqueue(y.organization.id,nt.alert,nt.transition);ve.push(...await On.deliverAll(Pe))}return x({ok:!0,...Se,deliveries:ve})}if(q.pathname==="/api/alerts/rules"&&N.method==="GET")return x({ok:!0,rules:st.listRules(y.project.id,A?.id).filter((J)=>U(J.resourceId))});if(q.pathname==="/api/alerts/rules"&&N.method==="POST"){let J=await re(N),ee=J.healthCheckId?st.getHealthCheck(String(J.healthCheckId)):void 0;if(J.healthCheckId&&(!ee||!U(ee.resourceId)))return x({ok:!1,error:"Health check was not found."},404);return x({ok:!0,rule:st.createRule({projectId:y.project.id,environmentId:A?.id,resourceId:H(J.resourceId??J.resource)??ee?.resourceId,healthCheckId:ee?.id,name:String(J.name??""),signal:String(J.signal??(ee?"health":"")),operator:String(J.operator??(ee?"unhealthy":"gt")),threshold:J.threshold==null?void 0:Number(J.threshold),recoveryThreshold:J.recoveryThreshold==null?void 0:Number(J.recoveryThreshold),windowMs:Number(J.windowMs)||300000,consecutive:Number(J.consecutive)||ee?.failureThreshold||3,recoveryConsecutive:Number(J.recoveryConsecutive)||ee?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(J.noDataPolicy))?J.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(J.severity))?J.severity:"warning",groupBy:Array.isArray(J.groupBy)?J.groupBy.map(String):[],labels:J.labels&&typeof J.labels==="object"?J.labels:{},enabled:J.enabled!==!1})},201)}if(q.pathname==="/api/alerts/rules"&&N.method==="PATCH"){let J=await re(N),ee=st.getRule(String(J.id??""));if(!ee||!U(ee.resourceId))return x({ok:!1,error:"Alert rule was not found."},404);return x({ok:!0,rule:st.setRuleEnabled(ee.id,J.enabled!==!1)})}if(q.pathname==="/api/alerts/evaluate"&&N.method==="POST")return x({ok:!0,...await _m(A?.id)});if(q.pathname==="/api/alerts"&&N.method==="GET")return x({ok:!0,alerts:st.listAlerts(y.project.id,{environmentId:A?.id,states:q.searchParams.getAll("state").length?q.searchParams.getAll("state"):void 0,limit:Number(q.searchParams.get("limit"))||200}).filter((J)=>U(J.resourceId)).map((J)=>({...J,deliveries:st.listDeliveries({alertId:J.id,limit:50})}))});if(q.pathname==="/api/alerts/action"&&N.method==="POST"){let J=await re(N),ee=st.getAlert(String(J.id??""));if(!ee||!U(ee.resourceId))return x({ok:!1,error:"Alert was not found."},404);let Se=String(J.action??"");if(Se==="acknowledge")return x({ok:!0,alert:st.acknowledge(ee.id,Q?.id??"")});if(Se==="assign")return x({ok:!0,alert:st.assign(ee.id,J.ownerActorId==="me"?Q?.id:J.ownerActorId?String(J.ownerActorId):void 0,Q?.id)});if(Se==="silence"){if(me.role!=="admin")return x({ok:!1,error:"Silencing production alerts requires an administrator."},403);let ve=lr.resolveSession(N);if(xe&&(!ve||!Ne.isRecentlyAuthenticated(ve)))return x({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return x({ok:!0,alert:st.silenceAlert(ee.id,String(J.until??""),Q?.id)})}return x({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(q.pathname==="/api/alerts/silences"&&N.method==="POST"){let J=await re(N);return x({ok:!0,id:st.createSilence({projectId:y.project.id,environmentId:A?.id,resourceId:H(J.resourceId??J.resource),matcher:J.matcher,reason:String(J.reason??""),startsAt:String(J.startsAt??new Date().toISOString()),endsAt:String(J.endsAt??""),timezone:String(J.timezone??"UTC"),actorId:Q?.id})},201)}if(q.pathname==="/api/notifications/channels"&&N.method==="GET")return x({ok:!0,channels:st.listChannels(y.organization.id)});if(q.pathname==="/api/notifications/channels"&&N.method==="POST"){let J=await re(N),ee=String(J.kind??""),Se=ee==="email"?{to:J.config?.to,from:J.config?.from}:ee==="telegram"?{chatId:String(J.config?.chatId??"")}:{};return x({ok:!0,channel:st.createChannel({organizationId:y.organization.id,name:String(J.name??""),kind:ee,config:Se,credential:J.credential?String(J.credential):void 0,actorId:Q?.id})},201)}if(q.pathname==="/api/notifications/channels"&&N.method==="PATCH"){let J=await re(N),ee=String(J.id??"");if(J.credential)return x({ok:!0,channel:st.rotateChannel(ee,String(J.credential))});let Se=String(J.status??"paused");if(!["active","paused","disabled"].includes(Se))return x({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return x({ok:!0,channel:st.setChannelStatus(ee,Se)})}if(q.pathname==="/api/notifications/channels/test"&&N.method==="POST"){let J=await re(N);return x({ok:!0,productionIncidentCreated:!1,result:await On.testChannel(String(J.id??""))})}if(q.pathname==="/api/notifications/routes"&&N.method==="GET")return x({ok:!0,routes:st.listRoutes(y.organization.id)});if(q.pathname==="/api/notifications/routes"&&N.method==="POST"){let J=await re(N),ee=Array.isArray(J.channelIds)?J.channelIds.map(String):[];if(ee.some((Se)=>st.getChannel(Se)?.organizationId!==y.organization.id))return x({ok:!1,error:"Route contains an unavailable channel."},422);return x({ok:!0,route:st.createRoute({organizationId:y.organization.id,name:String(J.name??""),priority:Number(J.priority)||0,matcher:J.matcher&&typeof J.matcher==="object"?J.matcher:{},channelIds:ee,quietHours:J.quietHours,groupWaitSeconds:Number(J.groupWaitSeconds)||30,reminderSeconds:J.reminderSeconds==null?void 0:Number(J.reminderSeconds),escalation:Array.isArray(J.escalation)?J.escalation:[],template:J.template?String(J.template):void 0,rateLimitPerMinute:Number(J.rateLimitPerMinute)||60,enabled:J.enabled!==!1})},201)}if(q.pathname==="/api/notifications/routes"&&N.method==="PATCH"){let J=await re(N),ee=st.getRoute(String(J.id??""));if(!ee||ee.organizationId!==y.organization.id)return x({ok:!1,error:"Notification route was not found."},404);return x({ok:!0,route:st.setRouteEnabled(ee.id,J.enabled!==!1)})}if(q.pathname==="/api/notifications/routes/preview"&&N.method==="POST"){let J=await re(N),Se=(J.alertId?st.getAlert(String(J.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:y.project.id,environmentId:A?.id,resourceId:H(J.resourceId??J.resource),dedupKey:"preview",groupKey:String(J.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(J.severity))?J.severity:"warning",title:String(J.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return x({ok:!0,productionIncidentCreated:!1,matches:On.preview(y.organization.id,Se,String(J.eventType??"firing")).map((ve)=>({route:ve.route,channels:ve.channels,quiet:ve.quiet}))})}if(q.pathname==="/api/notifications/deliveries"&&N.method==="GET")return x({ok:!0,deliveries:st.listDeliveries({alertId:q.searchParams.get("alertId")??void 0,states:q.searchParams.getAll("state"),limit:Number(q.searchParams.get("limit"))||200})});if(q.pathname==="/api/notifications/deliveries/retry"&&N.method==="POST"){let J=await re(N),ee=st.getDelivery(String(J.id??""));if(!ee)return x({ok:!1,error:"Delivery was not found."},404);return st.updateDelivery(ee.id,{state:"retrying",attempt:Math.max(0,ee.attempt-1),nextAttemptAt:new Date().toISOString()}),x({ok:!0,delivery:await On.deliver(ee.id)})}}if(q.pathname.startsWith("/api/jobs")||q.pathname.startsWith("/api/workers")){let A=y.environments.get(Ce),P=y.store.listResources(y.project.id,A?.id),U=me.role==="admin"||!!A&&Ga(me,A.id,"automation:read")?P:P.filter((Te)=>Dr(me,Te.id,"automation:read")),H=(Te)=>!Te||U.some((Ue)=>Ue.id===Te),Q=We(me).actor,J=V.get(Ce)??B,ee=ju(m,J),Se=ee.filter((Te)=>!Te.danger&&["scheduler","backup","worker"].includes(Te.group)),ve=M(m),nt=()=>{let Te=lr.resolveSession(N);return!xe||!!Te&&Ne.isRecentlyAuthenticated(Te)},Pe=(Te)=>{if(!Te||typeof Te!=="object"||Array.isArray(Te))return{};let Ue=Object.entries(Te).slice(0,50);if(Ue.some(([,ct])=>typeof ct!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(ct)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(Ue)},He=(Te,Ue,ct)=>y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,resourceId:ct,actorId:Q?.id,type:`job.${Te}`,payload:Ue});if(q.pathname==="/api/jobs/preview"&&N.method==="POST"){let Te=await re(N);try{return x({ok:!0,productionExecutionCreated:!1,preview:vt(String(Te.expression??""),String(Te.timezone??"UTC"),new Date(Te.from?String(Te.from):Date.now()),Number(Te.count)||5)})}catch(Ue){return x({ok:!1,error:Ue instanceof Error?Ue.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(q.pathname==="/api/jobs"&&N.method==="GET")return x({ok:!0,jobs:Pr.list(y.project.id,{environmentId:A?.id}).filter((Te)=>H(Te.resourceId)).map((Te)=>({...Te,preview:vt(Te.normalizedExpression,Te.timezone,new Date,5),capability:nn(Te),lastExecution:Pr.listExecutions(Te.id,1)[0]}))});if(q.pathname==="/api/jobs"&&N.method==="POST"){let Te=await re(N),Ue=String(Te.provider??(ve==="serverless"?"eventbridge":"server")),ct=ve==="serverless"?"eventbridge":"server";if(Ue!==ct)return x({ok:!1,error:`${ve} environments accept ${ct} schedules through this adapter.`},422);let ht=Te.operationId?String(Te.operationId):void 0;if(Ue==="server"&&(!ht||!Se.some((wr)=>wr.id===ht)))return x({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let Nt=nn({provider:Ue,expression:String(Te.expression??""),flexibleMinutes:Number(Te.flexibleMinutes)||0,missedRunPolicy:Te.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Te.overlapPolicy))?Te.overlapPolicy:"forbid"});if(!Nt.supported)return x({ok:!1,error:Nt.notes.join(" ")},422);let Pn=Te.resourceId?P.find((wr)=>wr.id===Te.resourceId||wr.slug===Te.resourceId):void 0;if(Te.resourceId&&(!Pn||!H(Pn.id)))return x({ok:!1,error:"Job resource was not found."},404);try{let wr=Ue==="server"?{kind:"dashboard_operation",operationId:ht}:{kind:"serverless_scheduler",action:"run"},Oi=Pr.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:A?.id,resourceId:Pn?.id,name:String(Te.name??""),provider:Ue,expression:String(Te.expression??""),timezone:String(Te.timezone??"UTC"),startsAt:Te.startsAt?String(Te.startsAt):void 0,endsAt:Te.endsAt?String(Te.endsAt):void 0,flexibleMinutes:Number(Te.flexibleMinutes)||0,target:wr,payloadRefs:Pe(Te.payloadRefs),missedRunPolicy:Te.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Te.overlapPolicy))?Te.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(Te.maxAttempts)||3,backoffSeconds:Number(Te.backoffSeconds)||30,deadLetterRef:Te.deadLetterRef?String(Te.deadLetterRef):void 0},timeoutSeconds:Number(Te.timeoutSeconds)||900,enabled:Te.enabled!==!1,origin:"managed",ownerActorId:Q?.id,observedState:{},reconciliationStatus:"pending"});return He("created",{jobId:Oi.id,provider:Oi.provider,expression:Oi.normalizedExpression},Oi.resourceId),x({ok:!0,job:Oi,capability:Nt},201)}catch(wr){return x({ok:!1,error:wr instanceof Error?wr.message:"Scheduled job could not be created."},422)}}if(q.pathname==="/api/jobs"&&N.method==="PATCH"){let Te=await re(N),Ue=Pr.get(String(Te.id??""));if(!Ue||!H(Ue.resourceId))return x({ok:!1,error:"Scheduled job was not found."},404);if(Ue.origin==="config")return x({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let ct=Te.missedRunPolicy==null?void 0:String(Te.missedRunPolicy),ht=Te.overlapPolicy==null?void 0:String(Te.overlapPolicy);if(ct&&!["skip","catch_up"].includes(ct))return x({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ht&&!["allow","forbid","replace"].includes(ht))return x({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let Nt=Pr.updateSchedule(Ue.id,{expression:Te.expression?String(Te.expression):void 0,timezone:Te.timezone?String(Te.timezone):void 0,missedRunPolicy:ct,overlapPolicy:ht,timeoutSeconds:Te.timeoutSeconds==null?void 0:Number(Te.timeoutSeconds)});return He("updated",{jobId:Nt.id,expression:Nt.normalizedExpression,version:Nt.version},Nt.resourceId),x({ok:!0,job:Nt})}catch(Nt){return x({ok:!1,error:Nt instanceof Error?Nt.message:"Scheduled job could not be updated."},422)}}if(q.pathname==="/api/jobs/action"&&N.method==="POST"){let Te=await re(N),Ue=Pr.get(String(Te.id??""));if(!Ue||!H(Ue.resourceId))return x({ok:!1,error:"Scheduled job was not found."},404);let ct=String(Te.action??"");if(ct==="run"){let ht=Pm.enqueue(Ue,{trigger:"manual",actorId:Q?.id});return He("run_queued",{jobId:Ue.id,executionId:ht.id},Ue.resourceId),x({ok:!0,execution:ht},202)}if(["disable","delete"].includes(ct)&&A?.kind==="production"){if(String(Te.confirm??"")!==ct)return x({ok:!1,error:`Type "${ct}" to confirm this production change.`},409);if(!nt())return x({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(ct==="enable"||ct==="disable"){let ht=Pr.setEnabled(Ue.id,ct==="enable");return He(ct==="enable"?"enabled":"disabled",{jobId:Ue.id},Ue.resourceId),x({ok:!0,job:ht})}if(ct==="delete")try{return Pr.remove(Ue.id),He("deleted",{jobId:Ue.id,name:Ue.name},Ue.resourceId),x({ok:!0,deleted:Ue.id})}catch(ht){return x({ok:!1,error:ht instanceof Error?ht.message:"Scheduled job could not be deleted."},409)}return x({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(q.pathname==="/api/jobs/history"&&N.method==="GET"){let Te=Pr.get(String(q.searchParams.get("jobId")??""));if(!Te||!H(Te.resourceId))return x({ok:!1,error:"Scheduled job was not found."},404);return x({ok:!0,executions:Pr.listExecutions(Te.id,Number(q.searchParams.get("limit"))||100).map((Ue)=>({...Ue,logs:Ue.operationId?Vt.logs(Ue.operationId,{limit:500}):[]}))})}if(q.pathname==="/api/jobs/reconcile"&&N.method==="POST"){if(!A)return x({ok:!1,error:"Environment was not found."},404);let Te=Zo(Pr,m,{organization:y.organization,project:y.project,environment:A,resources:P});return He("reconciled",Te),x({ok:!0,reconciliation:Te})}if(q.pathname==="/api/workers"&&N.method==="GET"){let Te=Array.isArray(J.workersDetail??J.workers)?J.workersDetail??J.workers:[];return x({ok:!0,workers:Pr.listWorkers(y.project.id,A?.id).filter((Ue)=>H(Ue.resourceId)).map((Ue)=>{let ct=Te.find((ht)=>ht.name===Ue.name||ht.site===Ue.target.site);return ct?{...Ue,observedState:{...Ue.observedState,status:ct.status??"configured",currentJob:ct.currentJob??null,failures:Number(ct.failed??ct.failures)||0,processed:Number(ct.processed)||0}}:Ue})})}if(q.pathname==="/api/workers/action"&&N.method==="POST"){let Te=await re(N),Ue=Pr.getWorker(String(Te.id??""));if(!Ue||!H(Ue.resourceId))return x({ok:!1,error:"Worker was not found."},404);let ct=String(Te.action??"");if(ct==="restart"){if(String(Te.confirm??"")!==Ue.name)return x({ok:!1,error:`Type "${Ue.name}" to restart this worker.`},409);let ht=ee.find((wr)=>wr.id===Ue.target.operationId);if(!ht)return x({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let Nt=await Bu(m,Ce,ht),Pn=Pr.reconcileWorker(Ue.id,Nt.ok?"in_sync":"unavailable",{...Ue.observedState,lastRestartAt:new Date().toISOString(),command:Nt.command??null,error:Nt.error??Nt.stderr??null});return He("worker_restarted",{workerId:Ue.id,ok:Nt.ok},Ue.resourceId),x({...Nt,worker:Pn},Nt.ok?200:409)}if(ct==="scale")return x({ok:!1,error:Ue.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return x({ok:!1,error:"Action must be restart or scale."},422)}}if(q.pathname.startsWith("/api/telemetry/")){let A=y.environments.get(Ce),P=new ft(y.store),F=y.store.listResources(y.project.id,A?.id),U=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(q.pathname)?"runtime:logs":"runtime:read",H=me.role==="admin"||!!A&&Ga(me,A.id,U),Q=H?F:F.filter((Pe)=>Dr(me,Pe.id,U)),J=(Pe)=>zS(Q,H,Pe),ee=(Pe)=>{let He=new Date,Te={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},Ue=String(Pe.to??He.toISOString()),ct=String(Pe.from??new Date(new Date(Ue).getTime()-(Te[String(Pe.range??"1h")]??Te["1h"])).toISOString()),ht=(Pn)=>{let wr=(Array.isArray(Pn)?Pn:String(Pn??"").split(",")).map(String).filter(Boolean);return wr.length?wr:void 0},Nt=ht(Pe.kinds)?.filter((Pn)=>["metric","log","trace","request","event"].includes(Pn));return{projectId:y.project.id,environmentId:A?.id,resourceIds:J(Pe.resources),kinds:Nt,names:ht(Pe.names),sources:ht(Pe.sources),levels:ht(Pe.levels),from:ct,to:Ue,text:String(Pe.text??"")||void 0,traceId:String(Pe.traceId??"")||void 0,requestId:String(Pe.requestId??"")||void 0,deploymentId:String(Pe.deploymentId??"")||void 0,releaseId:String(Pe.releaseId??"")||void 0,workloadId:String(Pe.workloadId??"")||void 0,cursor:String(Pe.cursor??"")||void 0,limit:Number(Pe.limit)||void 0}},Se=Object.fromEntries(q.searchParams.entries()),ve=(Pe=!1)=>vm({controlPlane:y.store,projectId:y.project.id,environmentId:A?.id,config:m,environment:Ce,force:Pe,lightweight:!Pe}),nt=()=>{let Pe=y.store.getSetting(`telemetry.collection:${y.project.id}:${A?.id??"all"}`)??{};return{generatedAt:String(Pe.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(Pe.statuses)?Pe.statuses:[],errors:Array.isArray(Pe.errors)?Pe.errors:[],policy:Pe.policy??Gt(y.store,y.project.id)}};if(q.pathname==="/api/telemetry/status"&&N.method==="GET"){ve(!1);let Pe=nt(),He=H?Pe.statuses:P.status(y.project.id,A?.id,Pe.policy.rawDays,Pe.policy.samplingRate,Q.map((Ue)=>Ue.id)),Te=He.reduce((Ue,ct)=>Ue+ct.estimatedDailyBytes*30,0);return x({ok:!0,generatedAt:Pe.generatedAt,cached:Pe.cached,sources:He,errors:H?Pe.errors:[],policy:Pe.policy,retention:{rawDays:Pe.policy.rawDays,downsampleAfterDays:Pe.policy.downsampleAfterDays,downsampleBucketMs:Pe.policy.downsampleBucketMs,maxRecords:Pe.policy.maxRecords},estimatedMonthlyBytes:Te,estimatedMonthlyCostUsd:Ad(Te,Pe.policy),costEstimateConfigured:Pe.policy.estimatedStorageUsdPerGbMonth>0})}if(q.pathname==="/api/telemetry/settings"&&N.method==="GET")return x({ok:!0,policy:Gt(y.store,y.project.id)});if(q.pathname==="/api/telemetry/settings"&&N.method==="PATCH"){let Pe=fd(y.store,y.project.id,await re(N));return KS(y.project.id),x({ok:!0,policy:Pe})}if(q.pathname==="/api/telemetry/query"&&N.method==="GET"){ve(!1);let Pe=nt();return x({ok:!0,collection:{generatedAt:Pe.generatedAt,cached:Pe.cached},...P.query(ee(Se))})}if(q.pathname==="/api/telemetry/tail"&&N.method==="GET"){ve(!1);let Pe=new TextEncoder,He=new Date,Te=ee({...Se,kinds:Se.kinds||"log,request,event,trace",from:Se.from||new Date(He.getTime()-120000).toISOString(),to:He.toISOString(),limit:Math.min(1000,Number(Se.limit)||200),cursor:void 0}),Ue=N.headers.get("last-event-id")||String(Se.cursor??"")||void 0,ct,ht=!1,Nt=!1,Pn=new ReadableStream({start(wr){let Oi=()=>{if(ht)return;if(ht=!0,ct)clearInterval(ct);N.signal.removeEventListener("abort",Oi);try{wr.close()}catch{}},Hm=async()=>{if(ht||Nt)return;Nt=!0;try{let wo=P.tail({...Te,to:new Date(Date.now()+1000).toISOString()},Ue);for(let Gm of wo.records)Ue=wi(Gm)??Ue,wr.enqueue(Pe.encode(`id: ${Ue??""}
 event: record
 data: ${JSON.stringify(Gm)}
 
@@ -705,5 +705,5 @@ data: ${JSON.stringify({message:wo instanceof Error?wo.message:String(wo)})}
 `))}finally{Nt=!1}};Hm(),ct=setInterval(()=>{if(Hm(),!ht)wr.enqueue(Pe.encode(`event: heartbeat
 data: ${JSON.stringify({cursor:Ue,at:new Date().toISOString()})}
 
-`))},5000),ct.unref?.(),N.signal.addEventListener("abort",Oi,{once:!0})},cancel(){if(ht=!0,ct)clearInterval(ct)}});return new Response(Pn,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(q.pathname==="/api/telemetry/series"&&N.method==="GET"){ve(!1);let Pe=nt(),He=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(Se.aggregation))?Se.aggregation:"avg",Te=ee({...Se,kinds:"metric",limit:5000}),Ue=P.series({...Te,bucketMs:Number(Se.bucketMs)||60000,aggregation:He,timezone:String(Se.timezone??"UTC"),compareFrom:Se.compareFrom,compareTo:Se.compareTo});return O({ok:!0,collection:{generatedAt:Pe.generatedAt,cached:Pe.cached},query:{aggregation:He,bucketMs:Number(Se.bucketMs)||60000,timezone:String(Se.timezone??"UTC")},series:Ue})}if(q.pathname==="/api/telemetry/refresh"&&N.method==="POST")return O({ok:!0,...await ve(!0)});if(q.pathname==="/api/telemetry/export"&&N.method==="POST"){let Pe=await re(N);await ve(!1);let He=P.query({...ee(Pe),limit:Math.min(5000,Number(Pe.limit)||5000),cursor:void 0});if((Pe.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:ee(Pe),...He},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let Ue=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],ct=[Ue.join(","),...He.records.map((ht)=>Ue.map((Nt)=>`"${String(ht[Nt]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(ct,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(q.pathname==="/api/telemetry/saved-queries"&&N.method==="GET"){let Pe=We(me);return O({ok:!0,queries:P.listSavedQueries(y.project.id,Pe.actor?.id)})}if(q.pathname==="/api/telemetry/saved-queries"&&N.method==="POST"){let Pe=await re(N),He=We(me);return O({ok:!0,query:P.saveQuery(y.project.id,He.actor?.id,String(Pe.name??""),ee(Pe.query??Pe))},201)}if(q.pathname==="/api/telemetry/saved-queries"&&N.method==="DELETE"){let Pe=await re(N),He=We(me),Te=P.deleteSavedQuery(y.project.id,He.actor?.id,String(Pe.id??""));return O({ok:Te},Te?200:404)}}if(q.pathname.startsWith("/api/configuration")){let A=y.environments.get(Ce),P=me.role==="admin"||!!$n.capabilities?.includes("secrets:read"),F=me.role==="admin"||!!$n.capabilities?.includes("secrets:write"),U={projectId:y.project.id,environmentId:A?.id},H={"cache-control":"no-store"};if(q.pathname==="/api/configuration"&&N.method==="GET"){let Q=Object.fromEntries(q.searchParams),J=Q.scopeType||Q.scopeId?Wa(Q,U):void 0,ee=["variable","secret"].includes(String(Q.kind))?Q.kind:void 0,Se=J?.type==="preview"?yr.previews.getInstance(J.id):void 0,ve=Se?yr.previews.getDefinition(Se.definitionId):void 0,nt=J?await kn.resolve({projectId:y.project.id,environmentId:J.environmentId,resourceId:J.resourceId,functionId:J.type==="function"?J.id:void 0,previewId:J.previewId,trustedPreview:!!Se&&!Se.fork,allowedPreviewSecrets:ve?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:P}):void 0,Pe=y.store.listResources(y.project.id);return O({ok:!0,entries:kn.list({projectId:y.project.id,scope:J,kind:ee,search:Q.search,canReadSecretMetadata:P}),effectiveEntries:nt?Object.values(nt.entries).filter((He)=>!ee||He.kind===ee).filter((He)=>!Q.search||He.key.toLowerCase().includes(String(Q.search).toLowerCase())):[],configurationHash:nt?.configurationHash,warnings:nt?.warnings??[],scopes:{project:y.project,environments:y.store.listEnvironments(y.project.id),resources:Pe.filter((He)=>He.kind!=="function"),functions:Pe.filter((He)=>He.kind==="function"),previews:yr.previews.listInstances({projectId:y.project.id}).filter((He)=>He.status!=="destroyed").map((He)=>({id:He.id,name:He.name,environmentId:He.baseEnvironmentId,resourceId:He.resourceId,fork:He.fork,status:He.status}))}},200,H)}if(q.pathname==="/api/configuration/export"&&N.method==="GET"){let Q=Wa(Object.fromEntries(q.searchParams),U);return new Response(kn.exportVariables({projectId:y.project.id,scope:Q}),{headers:{...H,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(q.pathname==="/api/configuration/plan"&&N.method==="POST"){let Q=await re(N),J=Wa(Q,U),ee=Q.values&&typeof Q.values==="object"&&!Array.isArray(Q.values)?Object.fromEntries(Object.entries(Q.values).map(([Se,ve])=>[Se,String(ve)])):{};return O({ok:!0,plan:kn.plan({projectId:y.project.id,scope:J,values:ee,removeMissing:Q.removeMissing===!0})},200,H)}if(q.pathname==="/api/configuration"&&N.method==="POST"){let Q=await re(N),J=Wa(Q,U),ee=Q.kind==="secret"?"secret":"variable",Se=String(Q.key??"");if(ee==="secret"&&!F)return O({ok:!1,error:"Secret write permission is required."},403,H);try{let ve=await kn.set({organizationId:y.organization.id,projectId:y.project.id,scope:J,key:Se,kind:ee,value:Q.value==null?void 0:String(Q.value),reference:Q.reference==null?void 0:String(Q.reference),backend:Q.backend,required:Q.required===!0,expectedVersion:Q.expectedVersion==null?void 0:Number(Q.expectedVersion),confirmed:String(Q.confirm??"")===Se,idempotencyKey:N.headers.get("idempotency-key")??Q.idempotencyKey,actorId:We(me).actor?.id});return O({ok:!0,entry:kn.list({projectId:y.project.id,scope:J,canReadSecretMetadata:P}).find((nt)=>nt.id===ve.entry.id),mutation:ve.mutation,warnings:ve.warnings},ve.mutation.added.length?201:200,H)}catch(ve){return O({ok:!1,error:ve instanceof Error?ve.message:String(ve)},409,H)}}if(q.pathname==="/api/configuration/import"&&N.method==="POST"){let Q=await re(N),J=Wa(Q,U),ee=Array.isArray(Q.secretKeys)?Q.secretKeys.map(String):[];if(ee.length&&!F)return O({ok:!1,error:"Secret write permission is required."},403,H);try{let Se=await kn.importDotenv({organizationId:y.organization.id,projectId:y.project.id,scope:J,source:String(Q.source??""),secretKeys:ee,backend:Q.backend,confirmed:Q.confirm==="import",idempotencyKey:N.headers.get("idempotency-key")??Q.idempotencyKey,actorId:We(me).actor?.id});return O({ok:Se.document.valid,diagnostics:Se.document.diagnostics,mutation:Se.mutation,warnings:Se.warnings},Se.document.valid?200:422,H)}catch(Se){return O({ok:!1,error:Se instanceof Error?Se.message:String(Se)},409,H)}}if(q.pathname==="/api/configuration/dependencies"&&N.method==="POST"){let Q=await re(N),J=Ci.get(String(Q.entryId??"")),ee=y.store.getResource(String(Q.resourceId??""));if(!J||J.projectId!==y.project.id||!ee||ee.projectId!==y.project.id)return O({ok:!1,error:"Configuration entry or dependent resource was not found."},404,H);return O({ok:!0,dependency:Ci.setDependency({entryId:J.id,resourceId:ee.id,injectionTarget:["native_reference","file"].includes(String(Q.injectionTarget))?Q.injectionTarget:"environment",required:Q.required!==!1,requiresRedeploy:Q.requiresRedeploy!==!1,lastDeployedVersion:Q.lastDeployedVersion==null?void 0:Number(Q.lastDeployedVersion)})},200,H)}if(q.pathname==="/api/configuration/transfer"&&N.method==="POST"){let Q=await re(N),J=Ci.get(String(Q.id??"")),ee=Wa({...Q,scopeType:Q.targetScopeType,scopeId:Q.targetScopeId},U);if(!J||J.projectId!==y.project.id)return O({ok:!1,error:"Configuration entry was not found."},404,H);if(J.kind==="secret"&&!F)return O({ok:!1,error:"Secret write permission is required."},403,H);try{let Se=await kn.transfer({entryId:J.id,targetScope:ee,mode:Q.mode==="move"?"move":"copy",confirmed:Q.confirm===J.key,actorId:We(me).actor?.id,idempotencyKey:N.headers.get("idempotency-key")??Q.idempotencyKey});return O({ok:!0,entry:kn.list({projectId:y.project.id,scope:ee,canReadSecretMetadata:P}).find((ve)=>ve.id===Se.entry.id),mutation:Se.mutation},200,H)}catch(Se){return O({ok:!1,error:Se instanceof Error?Se.message:String(Se)},409,H)}}if(q.pathname==="/api/configuration/bulk"&&N.method==="POST"){let Q=await re(N),J=Array.isArray(Q.ids)?Q.ids.map(String).slice(0,500):[],ee=J.map((ve)=>Ci.get(ve)).filter((ve)=>!!ve&&ve.projectId===y.project.id);if(ee.length!==J.length)return O({ok:!1,error:"One or more configuration entries were not found."},404,H);if(ee.some((ve)=>ve.kind==="secret")&&!F)return O({ok:!1,error:"Secret write permission is required."},403,H);if(Q.action!=="delete"||Q.confirm!=="bulk")return O({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,H);let Se=[];try{for(let ve of ee)Se.push(await kn.remove({entryId:ve.id,expectedVersion:ve.version,confirmed:!0,actorId:We(me).actor?.id}));return O({ok:!0,removed:Se.flatMap((ve)=>ve.removed),affectedResourceIds:[...new Set(Se.flatMap((ve)=>ve.affectedResourceIds))].sort()},200,H)}catch(ve){return O({ok:!1,error:ve instanceof Error?ve.message:String(ve),partial:Se.flatMap((nt)=>nt.removed)},409,H)}}if(q.pathname==="/api/configuration/reveal"&&N.method==="POST"){let Q=await re(N),J=lr.resolveSession(N);try{return O({ok:!0,value:await kn.reveal({entryId:String(Q.id??""),canRevealSecrets:P,recentlyAuthenticated:!De||!!J&&Ne.isRecentlyAuthenticated(J),actorId:We(me).actor?.id})},200,H)}catch(ee){return O({ok:!1,error:ee instanceof Error?ee.message:String(ee)},403,H)}}if(q.pathname==="/api/configuration"&&N.method==="DELETE"){let Q=await re(N),J=Ci.get(String(Q.id??""));if(J?.kind==="secret"&&!F)return O({ok:!1,error:"Secret write permission is required."},403,H);if(!J||J.projectId!==y.project.id)return O({ok:!1,error:"Configuration entry was not found."},404,H);try{return O({ok:!0,mutation:await kn.remove({entryId:J.id,expectedVersion:Number(Q.expectedVersion),confirmed:String(Q.confirm??"")===J.key,actorId:We(me).actor?.id})},200,H)}catch(ee){return O({ok:!1,error:ee instanceof Error?ee.message:String(ee)},409,H)}}}if(q.pathname.startsWith("/api/fleet")){let A=We(me).actor?.id,P=(F,U=409)=>O({ok:!1,error:F instanceof Error?F.message:String(F)},U,{"cache-control":"no-store"});if(q.pathname==="/api/fleet"&&N.method==="GET")return O({ok:!0,servers:Ja.list(y.project.id),resources:y.store.listResources(y.project.id),operations:Vt.list({projectId:y.project.id,limit:200}).filter((F)=>F.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(q.pathname==="/api/fleet"&&N.method==="POST"){let F=await re(N);try{return O({ok:!0,server:Zn.enroll({organizationId:y.organization.id,projectId:y.project.id,name:String(F.name??""),provider:["aws","hetzner"].includes(String(F.provider))?F.provider:"ssh",providerId:F.providerId?String(F.providerId):void 0,region:F.region?String(F.region):void 0,zone:F.zone?String(F.zone):void 0,endpoint:String(F.endpoint??""),sshUser:String(F.sshUser??"deploy"),sshPort:F.sshPort?Number(F.sshPort):22,credentialRef:String(F.credentialRef??""),roles:Array.isArray(F.roles)?F.roles:[],labels:F.labels&&typeof F.labels==="object"?F.labels:{}})},201)}catch(U){return P(U,422)}}if(q.pathname==="/api/fleet/action"&&N.method==="POST"){let F=await re(N),U=String(F.id??""),H=String(F.action??"");try{if(H==="test")return O({ok:!0,server:await Zn.test(U)});if(H==="validate")return O({ok:!0,server:await Zn.validate(U)});if(H==="review_host_key")return O({ok:!0,server:Zn.reviewHostKey(U,String(F.fingerprint??""))});if(H==="bootstrap")return O({ok:!0,...Zn.bootstrap(U,F.confirmed===!0)},F.confirmed===!0?202:200);if(H==="heartbeat")return O({ok:!0,server:Zn.heartbeat(U,{usage:F.usage&&typeof F.usage==="object"?F.usage:{}})});if(H==="drain")return O({ok:!0,server:Zn.drain(U,F.completed===!0)});if(H==="uncordon")return O({ok:!0,server:Zn.uncordon(U)});if(H==="archive")return O({ok:!0,server:Zn.archive(U,String(F.confirmation??""))});return P("Unsupported fleet action.",422)}catch(Q){return P(Q)}}}if(q.pathname.startsWith("/api/capacity")){let A=(P,F=409)=>O({ok:!1,error:P instanceof Error?P.message:String(P)},F,{"cache-control":"no-store"});if(q.pathname==="/api/capacity"&&N.method==="GET")return O({ok:!0,pools:_i.listPools(y.project.id),placements:_i.listPlacements(y.project.id),servers:Ja.list(y.project.id)},200,{"cache-control":"no-store"});if(q.pathname==="/api/capacity"&&N.method==="POST"){let P=await re(N);try{return O({ok:!0,pool:_i.createPool({organizationId:y.organization.id,projectId:y.project.id,name:String(P.name??""),purpose:String(P.purpose??"application"),backend:String(P.backend??"server"),region:P.region?String(P.region):void 0,architecture:P.architecture?String(P.architecture):void 0,labels:P.labels&&typeof P.labels==="object"?P.labels:{},requiredServerLabels:P.requiredServerLabels&&typeof P.requiredServerLabels==="object"?P.requiredServerLabels:{},toleratedTaints:Array.isArray(P.toleratedTaints)?P.toleratedTaints.map(String):[],capacity:P.capacity&&typeof P.capacity==="object"?P.capacity:{},maxWorkloads:Number(P.maxWorkloads??10),costWeight:Number(P.costWeight??1),spreadKey:P.spreadKey?String(P.spreadKey):void 0,concurrency:Number(P.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(F){return A(F,422)}}if(q.pathname==="/api/capacity/member"&&N.method==="POST"){let P=await re(N);try{return _i.addMember(String(P.poolId??""),String(P.serverId??"")),O({ok:!0,pool:_i.getPool(String(P.poolId??""))})}catch(F){return A(F,422)}}if(q.pathname==="/api/capacity/explain"&&N.method==="POST"){let P=await re(N);try{return O({ok:!0,decisions:Rm.explain(y.project.id,{purpose:String(P.purpose??"application"),resources:P.resources&&typeof P.resources==="object"?P.resources:{},region:P.region?String(P.region):void 0,architecture:P.architecture?String(P.architecture):void 0,labels:P.labels&&typeof P.labels==="object"?P.labels:{}})})}catch(F){return A(F,422)}}if(q.pathname==="/api/capacity/action"&&N.method==="POST"){let P=await re(N);try{if(P.action==="drain")return O({ok:!0,...Rm.drainPool(String(P.poolId??""))});if(P.action==="enable")return O({ok:!0,pool:_i.updatePool(String(P.poolId??""),{status:"active"})});if(P.action==="disable")return O({ok:!0,pool:_i.updatePool(String(P.poolId??""),{status:"disabled"})});return A("Unsupported capacity action.",422)}catch(F){return A(F,422)}}}if(q.pathname.startsWith("/api/regions")){let A=(P,F=409)=>O({ok:!1,error:P instanceof Error?P.message:String(P)},F,{"cache-control":"no-store"});if(q.pathname==="/api/regions"&&N.method==="GET")return O({ok:!0,topologies:bo.list(y.project.id).map((P)=>({topology:P,targets:bo.targets(P.id),channels:bo.channels(P.id),route:bo.route(P.id),executions:bo.executions(P.id)}))},200,{"cache-control":"no-store"});if(q.pathname==="/api/regions"&&N.method==="POST"){let P=await re(N);try{return O({ok:!0,topology:Am.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:y.environments.get(Ce)?.id,name:String(P.name??""),hostname:String(P.hostname??""),regions:Array.isArray(P.regions)?P.regions:[],trafficPolicy:P.trafficPolicy==="weighted"||P.trafficPolicy==="latency"?P.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(P.replicate)?P.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(P.maxLagSeconds??30),retainOnDestroy:P.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:P.cdnEnabled===!0,wafEnabled:P.wafEnabled===!0})},201)}catch(F){return A(F,422)}}if(q.pathname==="/api/regions/action"&&N.method==="POST"){let P=await re(N);try{return O({ok:!0,...Am.enqueue({topologyId:String(P.topologyId??""),kind:String(P.action??""),targetRegion:P.targetRegion?String(P.targetRegion):void 0,revision:P.revision?String(P.revision):void 0,manifest:P.manifest&&typeof P.manifest==="object"?P.manifest:{},confirmation:P.confirmation?String(P.confirmation):void 0,deleteData:P.deleteData===!0})},202)}catch(F){return A(F,422)}}}if(q.pathname.startsWith("/api/maintenance")){let A=(P,F=409)=>O({ok:!1,error:P instanceof Error?P.message:String(P)},F,{"cache-control":"no-store"});if(q.pathname==="/api/maintenance"&&N.method==="GET")return O({ok:!0,manifests:ai.manifests(y.organization.id),windows:ai.windows(y.project.id),campaigns:ai.campaigns(y.project.id).map((P)=>({campaign:P,targets:ai.targets(P.id)})),cleanups:ai.cleanups(y.project.id),drills:ai.drills(y.project.id)},200,{"cache-control":"no-store"});if(q.pathname==="/api/maintenance/cleanup-preview"&&N.method==="POST"){let P=await re(N);try{return O({ok:!0,plan:await Gu.previewCleanup({projectId:y.project.id,kind:String(P.kind??"operations"),criteria:{olderThanDays:Number(P.olderThanDays??30)}},Cm)},201)}catch(F){return A(F,422)}}if(q.pathname==="/api/maintenance/cleanup-apply"&&N.method==="POST"){let P=await re(N);try{return O({ok:!0,...Gu.enqueueCleanup(String(P.planId??""),String(P.confirmation??""))},202)}catch(F){return A(F,422)}}if(q.pathname==="/api/maintenance/drill"&&N.method==="POST"){let P=await re(N);try{return O({ok:!0,drill:ai.createDrill({projectId:y.project.id,scenario:String(P.scenario??"control_plane"),isolatedTarget:String(P.isolatedTarget??""),expectedRpoMinutes:Number(P.expectedRpoMinutes??60),expectedRtoMinutes:Number(P.expectedRtoMinutes??30),recoveryPointId:P.recoveryPointId?String(P.recoveryPointId):void 0,topologyId:P.topologyId?String(P.topologyId):void 0})},201)}catch(F){return A(F,422)}}if(q.pathname==="/api/maintenance/drill-run"&&N.method==="POST"){let P=await re(N);try{return O({ok:!0,...Gu.enqueueDrill(String(P.drillId??""))},202)}catch(F){return A(F,422)}}}if(q.pathname.startsWith("/api/volumes")){let A=y.environments.get(Ce),P=We(me).actor?.id,F=(U,H=409)=>O({ok:!1,error:U instanceof Error?U.message:String(U)},H,{"cache-control":"no-store"});if(q.pathname==="/api/volumes"&&N.method==="GET"){let U=Ku.inventory(y.project.id,A?.id),H=y.store.listResources(y.project.id,A?.id).map((Q)=>({id:Q.id,name:Q.name,slug:Q.slug,kind:Q.kind,provider:Q.provider,providerId:Q.providerId}));return O({ok:!0,volumes:U,resources:H,operations:Vt.list({projectId:y.project.id,limit:100}).filter((Q)=>Q.operation.kind.startsWith("volume.")),recoveryPoints:br.listRecoveryPoints(y.project.id).filter((Q)=>Q.kind==="volume"),providers:Ju.map((Q)=>({provider:Q.provider,type:Q.type,capabilities:Q.capabilities()}))},200,{"cache-control":"no-store"})}if(q.pathname==="/api/volumes"&&N.method==="POST"){let U=await re(N);try{return O({ok:!0,...si.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:A?.id,resourceId:U.resourceId?String(U.resourceId):void 0,name:String(U.name??""),provider:String(U.provider??"docker"),type:U.type==="docker"?"docker":U.type,capacityBytes:U.capacityBytes==null?void 0:Number(U.capacityBytes),filesystem:U.filesystem?String(U.filesystem):void 0,encrypted:U.encrypted===!0,desiredState:U.desiredState&&typeof U.desiredState==="object"?U.desiredState:{},actorId:P})},202,{"cache-control":"no-store"})}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/attach"&&N.method==="POST"){let U=await re(N);try{return O({ok:!0,...si.attach(String(U.volumeId??""),{resourceId:String(U.resourceId??""),targetPath:String(U.targetPath??""),readOnly:U.readOnly===!0,uid:U.uid==null?void 0:Number(U.uid),gid:U.gid==null?void 0:Number(U.gid),mode:U.mode?String(U.mode):void 0,propagation:U.propagation,driverOptions:U.driverOptions&&typeof U.driverOptions==="object"?U.driverOptions:{},actorId:P})},202)}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/detach"&&N.method==="POST"){let U=await re(N);try{return O({ok:!0,...si.detach(String(U.volumeId??""),String(U.attachmentId??""),{force:U.force===!0,drained:U.drained===!0,unmounted:U.unmounted===!0,confirmation:U.confirmation?String(U.confirmation):void 0,actorId:P})},202)}catch(H){return F(H)}}if(q.pathname==="/api/volumes/resize"&&N.method==="POST"){let U=await re(N);try{return O({ok:!0,...si.resize(String(U.volumeId??""),Number(U.capacityBytes),{drained:U.drained===!0,actorId:P})},202)}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/snapshot"&&N.method==="POST"){let U=await re(N);try{return O({ok:!0,...si.snapshot(String(U.volumeId??""),{name:U.name?String(U.name):void 0,actorId:P})},202)}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/restore"&&N.method==="POST"){let U=await re(N);try{return O({ok:!0,...si.restore(String(U.snapshotId??""),{name:String(U.name??""),actorId:P})},202)}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/discover"&&N.method==="POST")try{return O({ok:!0,volumes:await si.discover({organizationId:y.organization.id,projectId:y.project.id,environmentId:A?.id,actorId:P})})}catch(U){return F(U,502)}if(q.pathname==="/api/volumes/adopt"&&N.method==="POST"){let U=await re(N);try{return O({ok:!0,volume:si.adopt(String(U.volumeId??""),{name:String(U.name??""),actorId:P})})}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes"&&N.method==="DELETE"){let U=await re(N),H=lr.resolveSession(N);try{return O({ok:!0,...si.delete(String(U.volumeId??""),{recentAuthAt:!De||H&&Ne.isRecentlyAuthenticated(H)?new Date().toISOString():void 0,confirmation:U.confirmation?String(U.confirmation):void 0,backupOverride:U.backupOverride===!0,backupOverrideConfirmation:U.backupOverrideConfirmation?String(U.backupOverrideConfirmation):void 0,actorId:P})},202)}catch(Q){return F(Q)}}}if(q.pathname==="/api/backups"&&N.method==="GET"){let A=y.environments.get(Ce),P=br.listPolicies(y.project.id,A?.id),F=new Set(P.map((ee)=>ee.id)),U=br.listRecoveryPoints(y.project.id).filter((ee)=>!ee.policyId||F.has(ee.policyId)),H=br.listJobs(y.project.id).filter((ee)=>!ee.policyId||F.has(ee.policyId)),Q=(ee)=>({...ee,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!ee.credentialRef,clientEncryptionConfigured:!!ee.encryptionKeyRef}),J=await Promise.all(br.listDestinations(y.project.id).map(async(ee)=>({...Q(ee),credentialStatus:await fu(ee,oi)})));return O({ok:!0,destinations:J,policies:P,recoveryPoints:U,jobs:H,coverage:br.coverage(y.project.id).filter((ee)=>F.has(ee.policy.id)),resources:A?y.store.listResources(y.project.id,A.id).map((ee)=>({id:ee.id,name:ee.name,slug:ee.slug,kind:ee.kind})):[]})}if(q.pathname==="/api/backups/destinations"&&N.method==="POST"){let A=await re(N),P=String(A.name??"").trim(),F=String(A.provider??""),U=String(A.encryption??"provider"),H=`secret://data-services/backups/${y.project.id}/${P}`,Q=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(F))return O({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(U))return O({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let J,ee;if(A.credentials&&typeof A.credentials==="object"&&!Array.isArray(A.credentials))J=`${H}/credentials`,await oi.put(J,JSON.stringify(A.credentials)),Q.push(J);if(U!=="provider"){let ve=String(A.encryptionKey??"");if(ve.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");ee=`${H}/encryption-key`,await oi.put(ee,ve),Q.push(ee)}let Se=br.createDestination({organizationId:y.organization.id,projectId:y.project.id,name:P,provider:F,endpoint:A.endpoint?String(A.endpoint):void 0,endpointPolicy:A.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:A.bucket?String(A.bucket):void 0,prefix:String(A.prefix??""),region:A.region?String(A.region):Pi,forcePathStyle:A.forcePathStyle===!0,credentialRef:J,encryption:U,encryptionKeyRef:ee,immutability:A.immutability&&typeof A.immutability==="object"&&!Array.isArray(A.immutability)?A.immutability:{},status:"untested"});return O({ok:!0,destination:{...Se,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!J,clientEncryptionConfigured:!!ee}},201)}catch(J){for(let ee of Q)await oi.remove(ee).catch(()=>{});return O({ok:!1,error:J instanceof Error?J.message:String(J)},422)}}if(q.pathname==="/api/backups/destinations/test"&&N.method==="POST"){let A=await re(N),P=br.getDestination(String(A.id??""));if(!P||P.projectId!==y.project.id)return O({ok:!1,error:"Backup destination was not found."},404);if(P.provider==="aws_backup")return O({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Em.test(P),O({ok:!0,destination:br.recordDestinationTest(P.id,{ok:!0})})}catch(F){let U=F instanceof Error?F.message:String(F);return br.recordDestinationTest(P.id,{ok:!1,error:U}),O({ok:!1,error:U},502)}}if(q.pathname==="/api/backups/policies"&&N.method==="POST"){let A=await re(N),P=y.environments.get(Ce),F=br.getDestination(String(A.destinationId??"")),U=String(A.resourceKind??""),H=A.dataServiceId?String(A.dataServiceId):void 0,Q=H?or.get(H):void 0,J=A.resourceId?String(A.resourceId):void 0,ee=J?y.store.getResource(J):void 0;if(!P)return O({ok:!1,error:"Environment was not found."},404);if(!F||F.projectId!==y.project.id)return O({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(U))return O({ok:!1,error:"A supported backup resource kind is required."},422);if(H&&(!Q||Q.projectId!==y.project.id||Q.environmentId!==P.id))return O({ok:!1,error:"Data service was not found in this environment."},404);if(J&&(!ee||ee.projectId!==y.project.id||ee.environmentId!==P.id))return O({ok:!1,error:"Resource was not found in this environment."},404);if(U==="managed_database"&&!Q)return O({ok:!1,error:"Managed database policies require a data service."},422);if(U==="logical_database"&&(!Q||!["container","server"].includes(Q.provider)))return O({ok:!1,error:"Logical database policies require an on-box data service."},422);if(U==="volume"&&(!ee||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(A.volumeName??""))))return O({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let Se=Array.isArray(A.includePatterns)?A.includePatterns.map(String).filter(Boolean):[];if(U==="files"&&(!ee||!Se.length))return O({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(U==="control_plane"&&F.encryption==="provider")return O({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(U==="infrastructure"&&(F.provider!=="aws_backup"||!Se.some((ve)=>ve.startsWith("resource:arn:"))||!Se.some((ve)=>ve.startsWith("role:arn:"))))return O({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let ve=br.createPolicy({organizationId:y.organization.id,projectId:y.project.id,environmentId:P.id,resourceId:J,dataServiceId:H,destinationId:F.id,name:String(A.name??"").trim(),resourceKind:U,schedule:String(A.schedule??"daily"),timezone:String(A.timezone??"UTC"),retention:A.retention&&typeof A.retention==="object"&&!Array.isArray(A.retention)?A.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(A.compression))?A.compression:"gzip",encryption:["destination","client_side","both"].includes(String(A.encryption))?A.encryption:"destination",includePatterns:U==="volume"?[String(A.volumeName),...Se]:Se,excludePatterns:Array.isArray(A.excludePatterns)?A.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(A.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(A.expectedRtoMinutes)||120),healthCheckId:A.healthCheckId?String(A.healthCheckId):void 0,enabled:A.enabled!==!1});return O({ok:!0,policy:ve},201)}catch(ve){return O({ok:!1,error:ve instanceof Error?ve.message:String(ve)},422)}}if(q.pathname==="/api/backups/run"&&N.method==="POST"){let A=await re(N),P=br.getPolicy(String(A.policyId??"")),F=y.environments.get(Ce);if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return O({ok:!1,error:"Backup policy was not found in this environment."},404);try{let U=vo.enqueueBackup(P,new Date().toISOString(),We(me).actor?.id);return O({ok:!0,job:U},202)}catch(U){return O({ok:!1,error:U instanceof Error?U.message:String(U)},409)}}if(q.pathname==="/api/backups/verify"&&N.method==="POST"){let A=await re(N),P=br.getRecoveryPoint(String(A.recoveryPointId??""));if(!P||P.projectId!==y.project.id)return O({ok:!1,error:"Recovery point was not found."},404);return O({ok:!0,job:vo.enqueueVerification(P)},202)}if(q.pathname==="/api/backups/restore"&&N.method==="POST"){let A=await re(N),P=br.getRecoveryPoint(String(A.recoveryPointId??"")),F=A.mode==="in_place"?"in_place":"isolated",U=A.target&&typeof A.target==="object"&&!Array.isArray(A.target)?{...A.target,inPlace:F==="in_place"}:{inPlace:F==="in_place"},H=lr.resolveSession(N),Q={mode:F,target:U,targetName:String(A.targetName??""),confirm:A.confirm?String(A.confirm):void 0,recentAuth:!De||!!H&&Ne.isRecentlyAuthenticated(H),downtimeAcknowledged:A.downtimeAcknowledged===!0,safetyBackupId:A.safetyBackupId?String(A.safetyBackupId):void 0};if(!P||P.projectId!==y.project.id)return O({ok:!1,error:"Recovery point was not found."},404);if(A.drill===!0&&F!=="isolated")return O({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let J=vo.planRestore(P,Q);if(A.execute!==!0)return O({ok:!0,plan:J,executionCreated:!1});let ee=vo.enqueueRestore(P,{...Q,drill:A.drill===!0,actorId:We(me).actor?.id});return O({ok:!0,plan:J,job:ee},202)}catch(J){return O({ok:!1,error:J instanceof Error?J.message:String(J)},409)}}if(q.pathname==="/api/backups/recovery-points"&&N.method==="POST"){let A=await re(N),P=br.getRecoveryPoint(String(A.id??""));if(!P||P.projectId!==y.project.id)return O({ok:!1,error:"Recovery point was not found."},404);if(A.held==null&&A.pinned==null)return O({ok:!1,error:"held or pinned must be provided."},422);return O({ok:!0,recoveryPoint:br.updateRecoveryPoint(P.id,{held:A.held==null?P.held:A.held===!0,pinned:A.pinned==null?P.pinned:A.pinned===!0})})}if(q.pathname==="/api/backups/retention"&&N.method==="POST")return O({ok:!0,jobs:vo.enqueueRetention()},202);if(q.pathname==="/api/data-services/capabilities"&&N.method==="GET"){let A=String(q.searchParams.get("engine")??""),P=String(q.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(A)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(P))return O({ok:!1,error:"A supported engine and provider are required."},422);return O({ok:!0,engine:A,provider:P,capabilities:sn(A,P)})}if(q.pathname==="/api/data-services"&&N.method==="GET"){let A=y.environments.get(Ce),P=or.list(y.project.id,A?.id).map((F)=>{let U=or.credential(F.id);return{...F,credentialRef:void 0,credential:U?{configured:!0,username:U.username,version:U.version,rotatedAt:U.rotatedAt}:void 0,dependencies:or.dependencies(F.id).map((H)=>({resourceId:H.resourceId,requiresRedeploy:H.requiresRedeploy}))}});return O({ok:!0,services:P})}if(q.pathname==="/api/data-services/preview"&&N.method==="POST"){let A=await re(N);if(A.id){let U=or.get(String(A.id)),H=y.environments.get(Ce),Q=String(A.action??"");if(!U||U.projectId!==y.project.id||U.environmentId!==H?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!qu.includes(Q))return O({ok:!1,error:`Action must be one of: ${qu.join(", ")}.`},422);try{return O({ok:!0,plan:Rc.plan(U,Q,A.changes??{})})}catch(J){return O({ok:!1,error:J instanceof Error?J.message:String(J)},422)}}let P=String(A.engine??""),F=String(A.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(P)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(F))return O({ok:!1,error:"A supported engine and provider are required."},422);return O({ok:!0,capabilities:sn(P,F),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(q.pathname==="/api/data-services"&&N.method==="POST"){let A=await re(N),P=String(A.engine??""),F=String(A.provider??""),U=y.environments.get(Ce),H=We(me);if(!U)return O({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(P)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(F))return O({ok:!1,error:"A supported engine and provider are required."},422);let Q={organizationId:y.organization.id,projectId:y.project.id,environmentId:U.id,resourceId:A.resourceId?String(A.resourceId):void 0,name:String(A.name??"").trim(),engine:P,provider:F,placement:String(A.placement??A.name??"").trim(),engineVersion:A.engineVersion?String(A.engineVersion):void 0,plan:String(A.plan??(F==="aws_elasticache"?"cache.t4g.micro":F==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:A.storageGb==null?void 0:Number(A.storageGb),highAvailability:A.highAvailability===!0,publicExposure:A.publicExposure===!0,allowedCidrs:Array.isArray(A.allowedCidrs)?A.allowedCidrs.map(String):[],desiredState:A.desiredState&&typeof A.desiredState==="object"&&!Array.isArray(A.desiredState)?A.desiredState:{},observedState:{},origin:A.adopt===!0?"adopted":"managed",managementEnabled:A.adopt!==!0,ownerActorId:H.actor?.id,username:A.username?String(A.username):void 0};try{if(A.adopt===!0){let ee=or.create({...Q,status:"adopted",credentialRef:void 0});return O({ok:!0,service:ee,readOnly:!0},201)}if(!Im({provider:F,engine:P}))return O({ok:!1,error:`No ${F}/${P} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let J=await Rc.create(Q);return O({ok:!0,service:J.service,operationId:J.operationId,oneTimeCredential:J.credential},201)}catch(J){return O({ok:!1,error:J instanceof Error?J.message:String(J)},422)}}if(q.pathname==="/api/data-services/connections"&&N.method==="GET"){let A=or.get(String(q.searchParams.get("id")??"")),P=y.environments.get(Ce);if(!A||A.projectId!==y.project.id||A.environmentId!==P?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);let F=typeof A.observedState.endpoint==="string"?A.observedState.endpoint:void 0,U=typeof A.observedState.readerEndpoint==="string"?A.observedState.readerEndpoint:void 0,H=Number(A.observedState.port)||(A.engine==="postgres"?5432:A.engine==="redis"?6379:A.engine==="mongodb"?27017:A.engine==="libsql"?8080:3306),Q=typeof A.observedState.database==="string"?A.observedState.database:void 0,J=typeof A.observedState.tls==="boolean"?A.observedState.tls:A.provider.startsWith("aws_"),ee=[...F?[{type:A.publicExposure?"external":"internal",host:F,port:H,database:Q,tls:J}]:[],...U?[{type:"internal",host:U,port:H,database:Q,tls:J}]:[],{type:"tunnel",host:F??A.placement,port:H,database:Q,tls:J}];return O({ok:!0,serviceId:A.id,guidance:Ql(A,ee)})}if(q.pathname==="/api/data-services/action"&&N.method==="POST"){let A=await re(N),P=or.get(String(A.id??"")),F=y.environments.get(Ce),U=String(A.action??"");if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!qu.includes(U))return O({ok:!1,error:`Action must be one of: ${qu.join(", ")}.`},422);let H=A.changes&&typeof A.changes==="object"&&!Array.isArray(A.changes)?A.changes:{};try{let Q=Rc.plan(P,U,H);if(A.execute!==!0)return O({ok:!0,plan:Q,productionExecutionCreated:!1});let J=Rc.enqueue(P,U,H,We(me).actor?.id);return O({ok:!0,plan:Q,operationId:J},202)}catch(Q){return O({ok:!1,error:Q instanceof Error?Q.message:String(Q)},409)}}if(q.pathname==="/api/data-services/dependencies"&&N.method==="POST"){let A=await re(N),P=or.get(String(A.id??"")),F=y.environments.get(Ce),U=y.store.getResource(String(A.resourceId??""));if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!U||U.projectId!==y.project.id||U.environmentId!==F?.id)return O({ok:!1,error:"Dependent resource was not found in this environment."},404);if(A.remove===!0)return O({ok:or.removeDependency(P.id,U.id)});return or.addDependency({serviceId:P.id,resourceId:U.id,secretRef:P.credentialRef??`secret://data-services/${P.projectId}/${P.name}`,requiresRedeploy:A.requiresRedeploy!==!1}),O({ok:!0,dependencies:or.dependencies(P.id).map((H)=>({resourceId:H.resourceId,requiresRedeploy:H.requiresRedeploy}))})}if(q.pathname==="/api/data-services/management"&&N.method==="POST"){let A=await re(N),P=or.get(String(A.id??"")),F=y.environments.get(Ce);if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(P.origin!=="adopted"||A.reviewed!==!0||A.confirm!==P.name)return O({ok:!1,error:`Enabling management requires reviewed=true and typing ${P.name}.`},409);return O({ok:!0,service:or.update(P.id,P.version,{managementEnabled:!0})})}if(q.pathname==="/api/data-services/reveal"&&N.method==="POST"){let A=await re(N),P=or.get(String(A.id??"")),F=y.environments.get(Ce),U=P?or.credential(P.id):void 0;if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return O({ok:!1,error:"Data service was not found in this environment."},404);if(!U)return O({ok:!1,error:"No managed credential is configured."},404);return O({ok:!0,credential:{username:U.username,password:await oi.resolve(U.secretRef),version:U.version}},200,{"cache-control":"no-store"})}if(q.pathname==="/api/databases"&&N.method==="GET")return O(await Ob(m,Ce));if(q.pathname==="/api/databases"&&N.method==="POST"){let A=await re(N),P=String(A.name??"").trim();if(!Ii(P))return O({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return O({...await $b(m,Ce,P),name:P})}if(q.pathname==="/api/databases/vitess"&&N.method==="GET"){let A=await Mb(m,Ce);return O({...A,unhealthy:Lb(A.tablets),missingPrimary:Fb(A)})}if(q.pathname==="/api/databases/vitess/provision"&&N.method==="POST"){let A=await re(N);try{return O(await Gb(m,Ce,{keyspace:String(A.keyspace??""),username:String(A.username??""),password:String(A.password??""),sharded:A.sharded===!0,confirm:String(A.confirm??"")}))}catch(P){return O({ok:!1,error:P instanceof Error?P.message:String(P)},422)}}if(q.pathname==="/api/databases/vitess/migrations"&&N.method==="GET"){let A=q.searchParams.get("keyspace")??void 0;return O(await Kb(m,Ce,A))}if(q.pathname==="/api/databases/vitess/migrations/action"&&N.method==="POST"){let A=await re(N),P=String(A.uuid??"").trim(),F=String(A.action??"");if(!["retry","cancel","cleanup","complete"].includes(F))return O({ok:!1,error:"Unknown migration action."},422);return O(await Jb(m,Ce,P,F))}if(q.pathname==="/api/databases/vitess/keyspaces"&&N.method==="POST"){let A=await re(N),P=String(A.name??"").trim(),F=A.sharded===!0;return O(await Vb(m,Ce,P,{sharded:F}))}if(q.pathname==="/api/databases/vitess/vschema"&&N.method==="POST"){let A=await re(N),P=String(A.keyspace??"").trim(),F=typeof A.vschema==="string"?A.vschema:JSON.stringify(A.vschema??null);return O(await Wb(m,Ce,P,F))}if(q.pathname==="/api/databases/vitess/schema"&&N.method==="POST"){let A=await re(N),P=String(A.sql??"");return O(await Hb(m,Ce,P))}if(q.pathname==="/api/databases/vitess/install-client"&&N.method==="POST")return O(await qb(m,Ce));if(q.pathname==="/api/databases/backups"&&N.method==="GET")return O(await Bb(m,Ce));if(q.pathname==="/api/databases/backup"&&N.method==="POST"){let A=await re(N),P=String(A.database??"").trim();if(!Ii(P))return O({ok:!1,error:"Database name must be a valid identifier."},422);if(A.confirm!==P)return O({ok:!1,error:`Type "${P}" to back up this database.`},409);return O(await jb(m,Ce,P))}if(q.pathname==="/api/databases/users"&&N.method==="POST"){let A=await re(N),P=String(A.username??"").trim(),F=String(A.password??""),U=String(A.database??"").trim()||void 0,H=A.access==="readonly"?"readonly":"all";if(!Ii(P))return O({ok:!1,error:"Username must be a valid identifier."},422);if(!F)return O({ok:!1,error:"Password is required."},422);if(U&&!Ii(U))return O({ok:!1,error:"Database must be a valid identifier."},422);return O({...await Nb(m,Ce,{username:P,password:F,database:U,access:H}),username:P})}if(q.pathname==="/api/dashboard-data")return sr=V.get(Ce)??await Ee(Ce),Ee(Ce),O(dm(sr,{user:$n,slug:m.project.slug}));if(q.pathname==="/api/users"&&N.method==="GET")return O({ok:!0,users:wn(t).map(qa)});if(q.pathname==="/api/users"&&N.method==="POST"){let A=await re(N),P=String(A.username??"").trim();if(!Ou(P))return O({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let F=A.sites&&typeof A.sites==="object"?A.sites:{},U=new Set(Object.keys(m.sites??{})),H={};for(let[ee,Se]of Object.entries(F)){if(!U.has(ee))return O({ok:!1,error:`Site '${ee}' was not found.`},404);if(Se!=="owner"&&Se!=="collaborator")return O({ok:!1,error:`Unknown site role '${Se}'. Use 'owner' or 'collaborator'.`},422);H[ee]=Se}let Q=typeof A.password==="string"&&A.password.trim()?A.password.trim():void 0;if(Q&&Q.length<12)return O({ok:!1,error:"Password must be at least 12 characters."},422);let J=vc(t,{username:P,password:Q,name:typeof A.name==="string"?A.name:void 0,sites:H});return Zi(y,wn(t)),ot(),O({ok:!0,user:qa(J.user),password:J.password})}if(q.pathname==="/api/users"&&N.method==="DELETE"){let A=await re(N),P=String(A.username??"").trim();if(P.toLowerCase()===me.username.toLowerCase())return O({ok:!1,error:"You cannot remove your own account."},409);let F=Fn(wn(t),P),U=F?y.store.getActorByExternalId("user",`dashboard:${F.username.toLowerCase()}`):void 0,H=U?y.store.getMembershipForActor(y.organization.id,U.id):void 0;if(H&&H.source!=="legacy")return O({ok:!1,error:"Organization members must be removed from Organization access."},409);let Q=sm(t,P);if(!Q.ok)return O(Q,409);return Zi(y,wn(t)),ae.clear(),O({ok:!0,username:P})}if(q.pathname==="/api/actions/run"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=A.action?is(A.action,Ce):void 0;if(!P)return O({ok:!1,error:"Unknown dashboard action."},404);if(P.mutates&&A.confirm!==P.confirm)return O({ok:!1,error:`Type "${P.confirm}" to run this action.`},409);let F=await _e({controlPlane:y,environment:Ce,actor:me,kind:`dashboard.action.${P.id}`,input:{action:P.id},execute:()=>Sm(P,{cwd:t,cliEntry:l})});return O({...F.result,controlPlaneOperation:F.operation})}if(q.pathname==="/api/server/operations/run"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=A.operation?cm(A.operation,m,sr):void 0;if(!P)return O({ok:!1,error:"Unknown or unavailable server operation."},404);if(P.mutates&&A.confirm!==P.confirm)return O({ok:!1,error:`Type "${P.confirm}" to run this operation.`},409);let F=ne(y,String(Ce));await new St(ut).run(new rn,{...F,artifactRoot:t});let U=zi(ut,{scope:F,desiredConfigHash:y.project.desiredConfigHash});if(U.decision.outcome==="block")return O({ok:!1,error:`Operation blocked by security policy: ${U.decision.explanation}`,securityReview:U},409);let H=await _e({controlPlane:y,environment:Ce,actor:me,kind:`dashboard.server.${P.id}`,resourceSlug:P.target,input:{operation:P.id,target:P.target,to:A.to??null},execute:()=>Bu(m,Ce,P,{to:A.to})});return O({...H.result,controlPlaneOperation:H.operation,securityReview:U})}if(q.pathname==="/api/server/command"&&N.method==="POST"){let A=await N.json().catch(()=>({}));if(A.confirm!=="run")return O({ok:!1,error:'Type "run" to execute this command on the server.'},409);let P=await _e({controlPlane:y,environment:Ce,actor:me,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>bc(m,Ce,String(A.command??""))});return O({...P.result,controlPlaneOperation:P.operation})}if(q.pathname==="/api/serverless/operations")return O(mm(m,Ce,sr));if(q.pathname==="/api/serverless/operations/run"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=A.operation?PS(A.operation,m,Ce,sr):void 0;if(!P)return O({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(P.mutates&&A.confirm!==P.confirm)return O({ok:!1,error:`Type "${P.confirm}" to run this operation.`},409);let F=await _e({controlPlane:y,environment:Ce,actor:me,kind:`dashboard.serverless.${P.id}`,input:{operation:P.id,min:A.min??null,max:A.max??null},execute:()=>_S(m,Ce,P,{min:A.min,max:A.max})});return sr=await vs(m,Ce),V.set(Ce,sr),O({...F.result,controlPlaneOperation:F.operation})}if(q.pathname==="/api/serverless/command"&&N.method==="POST"){let A=await N.json().catch(()=>({}));if(A.confirm!=="run")return O({ok:!1,error:'Type "run" to execute this command.'},409);return O(await TS(m,Ce,String(A.command??"")))}if(q.pathname==="/api/serverless/dlq"&&N.method==="GET"){let A=Number(q.searchParams.get("max"))||10;return O(await xS(m,Ce,A))}if(q.pathname==="/api/serverless/dlq/redrive"&&N.method==="POST"){let A=await N.json().catch(()=>({}));if(A.confirm!=="redrive")return O({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return O(await DS(m,Ce,{max:A.max,targetQueue:A.targetQueue}))}if(q.pathname==="/api/serverless/dlq/purge"&&N.method==="POST"){if((await N.json().catch(()=>({}))).confirm!=="purge")return O({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return O(await OS(m,Ce))}if(q.pathname==="/api/serverless/secrets"&&N.method==="GET")return O({secrets:$S(m,Ce)});if(q.pathname==="/api/serverless/secrets"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=String(A.secretId??"").trim();if(!P)return O({ok:!1,error:"A secret id is required."},422);if(typeof A.value!=="string"||A.value==="")return O({ok:!1,error:"A non-empty value is required."},422);return O(await NS(m,Ce,P,A.value))}if(q.pathname==="/api/serverless/secrets"&&N.method==="DELETE"){let A=await N.json().catch(()=>({})),P=String(A.secretId??"").trim();if(!P)return O({ok:!1,error:"A secret id is required."},422);if(A.confirm!==P)return O({ok:!1,error:`Type "${P}" to delete this secret.`},409);return O(await jS(m,Ce,P))}if(q.pathname==="/api/serverless/functions/config"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=String(A.mode??"").trim();if(A.confirm!==P)return O({ok:!1,error:`Type "${P}" to update this function.`},409);return O(await BS(m,Ce,P,{memory:A.memory,timeout:A.timeout}))}if(q.pathname==="/api/serverless/alarms"&&N.method==="GET")return O(await MS(m,Ce));if(q.pathname==="/api/serverless/alarms"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=String(A.preset??"").trim(),F=Number(A.threshold);if(!P)return O({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(F))return O({ok:!1,error:"A numeric threshold is required."},422);return O(await LS(m,Ce,P,F))}if(q.pathname==="/api/serverless/alarms"&&N.method==="DELETE"){let A=await N.json().catch(()=>({})),P=String(A.name??"").trim();if(!P)return O({ok:!1,error:"An alarm name is required."},422);if(A.confirm!==P)return O({ok:!1,error:`Type "${P}" to delete this alarm.`},409);return O(await FS(m,Ce,P))}if(q.pathname==="/api/serverless/traces"&&N.method==="GET"){let A=Number(q.searchParams.get("minutes"))||30;return O(await zu(m,Ce,A))}if(q.pathname==="/api/serverless/scheduler"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=String(A.action??"").trim();if(P!=="enable"&&P!=="disable"&&P!=="run")return O({ok:!1,error:"Unknown scheduler action."},422);if(A.confirm!==P)return O({ok:!1,error:`Type "${P}" to ${P} the scheduler.`},409);return O(await ym(m,Ce,P))}if(!rw(q.pathname,$n))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(Ce)}`}});let Es=await Qt(me,Ce);if(!Es)return Wu("ts-cloud dashboard UI is unavailable.",503);return nw(Es,q.pathname)}catch(So){if(e.verbose)console.error(So);return O({ok:!1,error:So?.message??String(So)},500)}})();if(!vr)return vr;if(Rt&&(q.pathname.startsWith("/api/")||q.pathname.startsWith("/auth/"))){let at;if((Fe.headers.get("content-type")||"").includes("application/json"))at=await Fe.json().catch(()=>{return});let $r=lr.resolveUser(N),Rr=$r?We($r).actor:void 0;y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,actorId:Rr?.id,correlationId:Ge,type:vr.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:vr.status<400?"info":"warning",payload:W_(N.method,q.pathname,at,vr.status,Date.now()-qe)})}return vr.headers.set("x-request-id",Ge),vr}});Ac?.start();let vw=e.spendLoop??!0,Um;if(vw)(async()=>{let{SpendRunner:N,SpendLoopLease:ze,startSpendLoop:qe}=await import("./spend/index.js"),{store:Fe}=await ow(y.store),Ge=new N({controlPlane:y.store,store:Fe,alerts:st});Um=qe(Ge,{lease:new ze(y.store,{owner:`dashboard:${process.pid}`}),onError:(Rt)=>console.error(`[ts-cloud] spend cycle failed: ${Rt instanceof Error?Rt.message:String(Rt)}`)})})();let bw=ks.stop.bind(ks);return ks.stop=(N)=>{clearInterval(Bm),clearInterval(Mm),clearInterval(Lm),clearInterval(Nm),clearInterval($m),clearInterval(Tm),clearInterval(xm),clearInterval(Dm),clearInterval(Om),ot(),Sr.clear(),Ac?.stop(),Um?.();let ze=bw(N);if(Ac)Ac.settled().finally(()=>y.store.close());else y.store.close();return ze},{server:ks,url:`http://${r}:${ks.port}/`}}export{_o,qm,sl,hy,Fi,ol,xo,Vm,jm,Jr,Oo,al,Xe,cl,dl,ll,Ui,Xr,zm,Ye,ul,Lo,$o,Mo,pl,gl,ml,Qi,Fo,hl,Yr,Hi,Uo,It,Km,fl,Al,Wm,yl,Qo,Yt,Il,Sl,Cl,El,Ze,Jm,bl,Zt,Ho,Go,qo,Gi,qi,Zr,vl,Vi,Vo,jo,en,Tl,tn,Xm,Ym,St,rn,zo,Zm,wl,Rl,Ko,Dl,Pl,Nl,fy,ne,kl,Ay,yy,ji,zi,Iy,he,eh,Ct,ke,Be,Et,Bl,_l,xl,Ol,th,rh,Wo,nh,ih,Jo,Ll,$l,sh,ie,oh,Ml,fe,Xo,et,bt,vt,nn,Ki,Fl,Sy,Yo,ah,ch,dh,lh,Zo,ea,Ul,sn,ta,Ql,Wi,Hl,ra,na,ia,sa,oa,aa,ca,da,Gl,er,la,ql,on,Vl,ua,pa,jl,tr,ga,ma,uh,Cy,Ji,Ey,by,vy,ha,fa,zl,ph,Aa,an,Kl,Xi,Wl,Jl,Xl,ya,gh,Ia,Yl,mh,Sa,hh,cn,dn,Zl,Yi,eu,tu,ru,Ca,nu,iu,fh,su,E,ou,Zi,_e,au,cu,Ty,du,lu,uu,pu,gu,Ah,wy,Ry,Dy,yh,Ih,Py,Ny,Sh,Ch,ky,es,rr,Ea,ln,un,nr,tt,Tt,ts,Eh,pn,mu,hu,ba,bh,va,vh,Th,fu,Ta,rs,Au,wa,wt,xe,yu,Ra,Da,Iu,Pa,Na,ka,Ba,Su,Cu,gn,_a,xa,Oa,La,Eu,ns,mn,is,$a};
+`))},5000),ct.unref?.(),N.signal.addEventListener("abort",Oi,{once:!0})},cancel(){if(ht=!0,ct)clearInterval(ct)}});return new Response(Pn,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(q.pathname==="/api/telemetry/series"&&N.method==="GET"){ve(!1);let Pe=nt(),He=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(Se.aggregation))?Se.aggregation:"avg",Te=ee({...Se,kinds:"metric",limit:5000}),Ue=P.series({...Te,bucketMs:Number(Se.bucketMs)||60000,aggregation:He,timezone:String(Se.timezone??"UTC"),compareFrom:Se.compareFrom,compareTo:Se.compareTo});return x({ok:!0,collection:{generatedAt:Pe.generatedAt,cached:Pe.cached},query:{aggregation:He,bucketMs:Number(Se.bucketMs)||60000,timezone:String(Se.timezone??"UTC")},series:Ue})}if(q.pathname==="/api/telemetry/refresh"&&N.method==="POST")return x({ok:!0,...await ve(!0)});if(q.pathname==="/api/telemetry/export"&&N.method==="POST"){let Pe=await re(N);await ve(!1);let He=P.query({...ee(Pe),limit:Math.min(5000,Number(Pe.limit)||5000),cursor:void 0});if((Pe.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:ee(Pe),...He},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let Ue=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],ct=[Ue.join(","),...He.records.map((ht)=>Ue.map((Nt)=>`"${String(ht[Nt]??"").replaceAll('"','""')}"`).join(","))].join(`
+`);return new Response(ct,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(q.pathname==="/api/telemetry/saved-queries"&&N.method==="GET"){let Pe=We(me);return x({ok:!0,queries:P.listSavedQueries(y.project.id,Pe.actor?.id)})}if(q.pathname==="/api/telemetry/saved-queries"&&N.method==="POST"){let Pe=await re(N),He=We(me);return x({ok:!0,query:P.saveQuery(y.project.id,He.actor?.id,String(Pe.name??""),ee(Pe.query??Pe))},201)}if(q.pathname==="/api/telemetry/saved-queries"&&N.method==="DELETE"){let Pe=await re(N),He=We(me),Te=P.deleteSavedQuery(y.project.id,He.actor?.id,String(Pe.id??""));return x({ok:Te},Te?200:404)}}if(q.pathname.startsWith("/api/configuration")){let A=y.environments.get(Ce),P=me.role==="admin"||!!$n.capabilities?.includes("secrets:read"),F=me.role==="admin"||!!$n.capabilities?.includes("secrets:write"),U={projectId:y.project.id,environmentId:A?.id},H={"cache-control":"no-store"};if(q.pathname==="/api/configuration"&&N.method==="GET"){let Q=Object.fromEntries(q.searchParams),J=Q.scopeType||Q.scopeId?Wa(Q,U):void 0,ee=["variable","secret"].includes(String(Q.kind))?Q.kind:void 0,Se=J?.type==="preview"?yr.previews.getInstance(J.id):void 0,ve=Se?yr.previews.getDefinition(Se.definitionId):void 0,nt=J?await kn.resolve({projectId:y.project.id,environmentId:J.environmentId,resourceId:J.resourceId,functionId:J.type==="function"?J.id:void 0,previewId:J.previewId,trustedPreview:!!Se&&!Se.fork,allowedPreviewSecrets:ve?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:P}):void 0,Pe=y.store.listResources(y.project.id);return x({ok:!0,entries:kn.list({projectId:y.project.id,scope:J,kind:ee,search:Q.search,canReadSecretMetadata:P}),effectiveEntries:nt?Object.values(nt.entries).filter((He)=>!ee||He.kind===ee).filter((He)=>!Q.search||He.key.toLowerCase().includes(String(Q.search).toLowerCase())):[],configurationHash:nt?.configurationHash,warnings:nt?.warnings??[],scopes:{project:y.project,environments:y.store.listEnvironments(y.project.id),resources:Pe.filter((He)=>He.kind!=="function"),functions:Pe.filter((He)=>He.kind==="function"),previews:yr.previews.listInstances({projectId:y.project.id}).filter((He)=>He.status!=="destroyed").map((He)=>({id:He.id,name:He.name,environmentId:He.baseEnvironmentId,resourceId:He.resourceId,fork:He.fork,status:He.status}))}},200,H)}if(q.pathname==="/api/configuration/export"&&N.method==="GET"){let Q=Wa(Object.fromEntries(q.searchParams),U);return new Response(kn.exportVariables({projectId:y.project.id,scope:Q}),{headers:{...H,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(q.pathname==="/api/configuration/plan"&&N.method==="POST"){let Q=await re(N),J=Wa(Q,U),ee=Q.values&&typeof Q.values==="object"&&!Array.isArray(Q.values)?Object.fromEntries(Object.entries(Q.values).map(([Se,ve])=>[Se,String(ve)])):{};return x({ok:!0,plan:kn.plan({projectId:y.project.id,scope:J,values:ee,removeMissing:Q.removeMissing===!0})},200,H)}if(q.pathname==="/api/configuration"&&N.method==="POST"){let Q=await re(N),J=Wa(Q,U),ee=Q.kind==="secret"?"secret":"variable",Se=String(Q.key??"");if(ee==="secret"&&!F)return x({ok:!1,error:"Secret write permission is required."},403,H);try{let ve=await kn.set({organizationId:y.organization.id,projectId:y.project.id,scope:J,key:Se,kind:ee,value:Q.value==null?void 0:String(Q.value),reference:Q.reference==null?void 0:String(Q.reference),backend:Q.backend,required:Q.required===!0,expectedVersion:Q.expectedVersion==null?void 0:Number(Q.expectedVersion),confirmed:String(Q.confirm??"")===Se,idempotencyKey:N.headers.get("idempotency-key")??Q.idempotencyKey,actorId:We(me).actor?.id});return x({ok:!0,entry:kn.list({projectId:y.project.id,scope:J,canReadSecretMetadata:P}).find((nt)=>nt.id===ve.entry.id),mutation:ve.mutation,warnings:ve.warnings},ve.mutation.added.length?201:200,H)}catch(ve){return x({ok:!1,error:ve instanceof Error?ve.message:String(ve)},409,H)}}if(q.pathname==="/api/configuration/import"&&N.method==="POST"){let Q=await re(N),J=Wa(Q,U),ee=Array.isArray(Q.secretKeys)?Q.secretKeys.map(String):[];if(ee.length&&!F)return x({ok:!1,error:"Secret write permission is required."},403,H);try{let Se=await kn.importDotenv({organizationId:y.organization.id,projectId:y.project.id,scope:J,source:String(Q.source??""),secretKeys:ee,backend:Q.backend,confirmed:Q.confirm==="import",idempotencyKey:N.headers.get("idempotency-key")??Q.idempotencyKey,actorId:We(me).actor?.id});return x({ok:Se.document.valid,diagnostics:Se.document.diagnostics,mutation:Se.mutation,warnings:Se.warnings},Se.document.valid?200:422,H)}catch(Se){return x({ok:!1,error:Se instanceof Error?Se.message:String(Se)},409,H)}}if(q.pathname==="/api/configuration/dependencies"&&N.method==="POST"){let Q=await re(N),J=Ci.get(String(Q.entryId??"")),ee=y.store.getResource(String(Q.resourceId??""));if(!J||J.projectId!==y.project.id||!ee||ee.projectId!==y.project.id)return x({ok:!1,error:"Configuration entry or dependent resource was not found."},404,H);return x({ok:!0,dependency:Ci.setDependency({entryId:J.id,resourceId:ee.id,injectionTarget:["native_reference","file"].includes(String(Q.injectionTarget))?Q.injectionTarget:"environment",required:Q.required!==!1,requiresRedeploy:Q.requiresRedeploy!==!1,lastDeployedVersion:Q.lastDeployedVersion==null?void 0:Number(Q.lastDeployedVersion)})},200,H)}if(q.pathname==="/api/configuration/transfer"&&N.method==="POST"){let Q=await re(N),J=Ci.get(String(Q.id??"")),ee=Wa({...Q,scopeType:Q.targetScopeType,scopeId:Q.targetScopeId},U);if(!J||J.projectId!==y.project.id)return x({ok:!1,error:"Configuration entry was not found."},404,H);if(J.kind==="secret"&&!F)return x({ok:!1,error:"Secret write permission is required."},403,H);try{let Se=await kn.transfer({entryId:J.id,targetScope:ee,mode:Q.mode==="move"?"move":"copy",confirmed:Q.confirm===J.key,actorId:We(me).actor?.id,idempotencyKey:N.headers.get("idempotency-key")??Q.idempotencyKey});return x({ok:!0,entry:kn.list({projectId:y.project.id,scope:ee,canReadSecretMetadata:P}).find((ve)=>ve.id===Se.entry.id),mutation:Se.mutation},200,H)}catch(Se){return x({ok:!1,error:Se instanceof Error?Se.message:String(Se)},409,H)}}if(q.pathname==="/api/configuration/bulk"&&N.method==="POST"){let Q=await re(N),J=Array.isArray(Q.ids)?Q.ids.map(String).slice(0,500):[],ee=J.map((ve)=>Ci.get(ve)).filter((ve)=>!!ve&&ve.projectId===y.project.id);if(ee.length!==J.length)return x({ok:!1,error:"One or more configuration entries were not found."},404,H);if(ee.some((ve)=>ve.kind==="secret")&&!F)return x({ok:!1,error:"Secret write permission is required."},403,H);if(Q.action!=="delete"||Q.confirm!=="bulk")return x({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,H);let Se=[];try{for(let ve of ee)Se.push(await kn.remove({entryId:ve.id,expectedVersion:ve.version,confirmed:!0,actorId:We(me).actor?.id}));return x({ok:!0,removed:Se.flatMap((ve)=>ve.removed),affectedResourceIds:[...new Set(Se.flatMap((ve)=>ve.affectedResourceIds))].sort()},200,H)}catch(ve){return x({ok:!1,error:ve instanceof Error?ve.message:String(ve),partial:Se.flatMap((nt)=>nt.removed)},409,H)}}if(q.pathname==="/api/configuration/reveal"&&N.method==="POST"){let Q=await re(N),J=lr.resolveSession(N);try{return x({ok:!0,value:await kn.reveal({entryId:String(Q.id??""),canRevealSecrets:P,recentlyAuthenticated:!xe||!!J&&Ne.isRecentlyAuthenticated(J),actorId:We(me).actor?.id})},200,H)}catch(ee){return x({ok:!1,error:ee instanceof Error?ee.message:String(ee)},403,H)}}if(q.pathname==="/api/configuration"&&N.method==="DELETE"){let Q=await re(N),J=Ci.get(String(Q.id??""));if(J?.kind==="secret"&&!F)return x({ok:!1,error:"Secret write permission is required."},403,H);if(!J||J.projectId!==y.project.id)return x({ok:!1,error:"Configuration entry was not found."},404,H);try{return x({ok:!0,mutation:await kn.remove({entryId:J.id,expectedVersion:Number(Q.expectedVersion),confirmed:String(Q.confirm??"")===J.key,actorId:We(me).actor?.id})},200,H)}catch(ee){return x({ok:!1,error:ee instanceof Error?ee.message:String(ee)},409,H)}}}if(q.pathname.startsWith("/api/fleet")){let A=We(me).actor?.id,P=(F,U=409)=>x({ok:!1,error:F instanceof Error?F.message:String(F)},U,{"cache-control":"no-store"});if(q.pathname==="/api/fleet"&&N.method==="GET")return x({ok:!0,servers:Ja.list(y.project.id),resources:y.store.listResources(y.project.id),operations:Vt.list({projectId:y.project.id,limit:200}).filter((F)=>F.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(q.pathname==="/api/fleet"&&N.method==="POST"){let F=await re(N);try{return x({ok:!0,server:Zn.enroll({organizationId:y.organization.id,projectId:y.project.id,name:String(F.name??""),provider:["aws","hetzner"].includes(String(F.provider))?F.provider:"ssh",providerId:F.providerId?String(F.providerId):void 0,region:F.region?String(F.region):void 0,zone:F.zone?String(F.zone):void 0,endpoint:String(F.endpoint??""),sshUser:String(F.sshUser??"deploy"),sshPort:F.sshPort?Number(F.sshPort):22,credentialRef:String(F.credentialRef??""),roles:Array.isArray(F.roles)?F.roles:[],labels:F.labels&&typeof F.labels==="object"?F.labels:{}})},201)}catch(U){return P(U,422)}}if(q.pathname==="/api/fleet/action"&&N.method==="POST"){let F=await re(N),U=String(F.id??""),H=String(F.action??"");try{if(H==="test")return x({ok:!0,server:await Zn.test(U)});if(H==="validate")return x({ok:!0,server:await Zn.validate(U)});if(H==="review_host_key")return x({ok:!0,server:Zn.reviewHostKey(U,String(F.fingerprint??""))});if(H==="bootstrap")return x({ok:!0,...Zn.bootstrap(U,F.confirmed===!0)},F.confirmed===!0?202:200);if(H==="heartbeat")return x({ok:!0,server:Zn.heartbeat(U,{usage:F.usage&&typeof F.usage==="object"?F.usage:{}})});if(H==="drain")return x({ok:!0,server:Zn.drain(U,F.completed===!0)});if(H==="uncordon")return x({ok:!0,server:Zn.uncordon(U)});if(H==="archive")return x({ok:!0,server:Zn.archive(U,String(F.confirmation??""))});return P("Unsupported fleet action.",422)}catch(Q){return P(Q)}}}if(q.pathname.startsWith("/api/capacity")){let A=(P,F=409)=>x({ok:!1,error:P instanceof Error?P.message:String(P)},F,{"cache-control":"no-store"});if(q.pathname==="/api/capacity"&&N.method==="GET")return x({ok:!0,pools:_i.listPools(y.project.id),placements:_i.listPlacements(y.project.id),servers:Ja.list(y.project.id)},200,{"cache-control":"no-store"});if(q.pathname==="/api/capacity"&&N.method==="POST"){let P=await re(N);try{return x({ok:!0,pool:_i.createPool({organizationId:y.organization.id,projectId:y.project.id,name:String(P.name??""),purpose:String(P.purpose??"application"),backend:String(P.backend??"server"),region:P.region?String(P.region):void 0,architecture:P.architecture?String(P.architecture):void 0,labels:P.labels&&typeof P.labels==="object"?P.labels:{},requiredServerLabels:P.requiredServerLabels&&typeof P.requiredServerLabels==="object"?P.requiredServerLabels:{},toleratedTaints:Array.isArray(P.toleratedTaints)?P.toleratedTaints.map(String):[],capacity:P.capacity&&typeof P.capacity==="object"?P.capacity:{},maxWorkloads:Number(P.maxWorkloads??10),costWeight:Number(P.costWeight??1),spreadKey:P.spreadKey?String(P.spreadKey):void 0,concurrency:Number(P.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(F){return A(F,422)}}if(q.pathname==="/api/capacity/member"&&N.method==="POST"){let P=await re(N);try{return _i.addMember(String(P.poolId??""),String(P.serverId??"")),x({ok:!0,pool:_i.getPool(String(P.poolId??""))})}catch(F){return A(F,422)}}if(q.pathname==="/api/capacity/explain"&&N.method==="POST"){let P=await re(N);try{return x({ok:!0,decisions:Rm.explain(y.project.id,{purpose:String(P.purpose??"application"),resources:P.resources&&typeof P.resources==="object"?P.resources:{},region:P.region?String(P.region):void 0,architecture:P.architecture?String(P.architecture):void 0,labels:P.labels&&typeof P.labels==="object"?P.labels:{}})})}catch(F){return A(F,422)}}if(q.pathname==="/api/capacity/action"&&N.method==="POST"){let P=await re(N);try{if(P.action==="drain")return x({ok:!0,...Rm.drainPool(String(P.poolId??""))});if(P.action==="enable")return x({ok:!0,pool:_i.updatePool(String(P.poolId??""),{status:"active"})});if(P.action==="disable")return x({ok:!0,pool:_i.updatePool(String(P.poolId??""),{status:"disabled"})});return A("Unsupported capacity action.",422)}catch(F){return A(F,422)}}}if(q.pathname.startsWith("/api/regions")){let A=(P,F=409)=>x({ok:!1,error:P instanceof Error?P.message:String(P)},F,{"cache-control":"no-store"});if(q.pathname==="/api/regions"&&N.method==="GET")return x({ok:!0,topologies:bo.list(y.project.id).map((P)=>({topology:P,targets:bo.targets(P.id),channels:bo.channels(P.id),route:bo.route(P.id),executions:bo.executions(P.id)}))},200,{"cache-control":"no-store"});if(q.pathname==="/api/regions"&&N.method==="POST"){let P=await re(N);try{return x({ok:!0,topology:Am.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:y.environments.get(Ce)?.id,name:String(P.name??""),hostname:String(P.hostname??""),regions:Array.isArray(P.regions)?P.regions:[],trafficPolicy:P.trafficPolicy==="weighted"||P.trafficPolicy==="latency"?P.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(P.replicate)?P.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(P.maxLagSeconds??30),retainOnDestroy:P.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:P.cdnEnabled===!0,wafEnabled:P.wafEnabled===!0})},201)}catch(F){return A(F,422)}}if(q.pathname==="/api/regions/action"&&N.method==="POST"){let P=await re(N);try{return x({ok:!0,...Am.enqueue({topologyId:String(P.topologyId??""),kind:String(P.action??""),targetRegion:P.targetRegion?String(P.targetRegion):void 0,revision:P.revision?String(P.revision):void 0,manifest:P.manifest&&typeof P.manifest==="object"?P.manifest:{},confirmation:P.confirmation?String(P.confirmation):void 0,deleteData:P.deleteData===!0})},202)}catch(F){return A(F,422)}}}if(q.pathname.startsWith("/api/maintenance")){let A=(P,F=409)=>x({ok:!1,error:P instanceof Error?P.message:String(P)},F,{"cache-control":"no-store"});if(q.pathname==="/api/maintenance"&&N.method==="GET")return x({ok:!0,manifests:ai.manifests(y.organization.id),windows:ai.windows(y.project.id),campaigns:ai.campaigns(y.project.id).map((P)=>({campaign:P,targets:ai.targets(P.id)})),cleanups:ai.cleanups(y.project.id),drills:ai.drills(y.project.id)},200,{"cache-control":"no-store"});if(q.pathname==="/api/maintenance/cleanup-preview"&&N.method==="POST"){let P=await re(N);try{return x({ok:!0,plan:await Gu.previewCleanup({projectId:y.project.id,kind:String(P.kind??"operations"),criteria:{olderThanDays:Number(P.olderThanDays??30)}},Cm)},201)}catch(F){return A(F,422)}}if(q.pathname==="/api/maintenance/cleanup-apply"&&N.method==="POST"){let P=await re(N);try{return x({ok:!0,...Gu.enqueueCleanup(String(P.planId??""),String(P.confirmation??""))},202)}catch(F){return A(F,422)}}if(q.pathname==="/api/maintenance/drill"&&N.method==="POST"){let P=await re(N);try{return x({ok:!0,drill:ai.createDrill({projectId:y.project.id,scenario:String(P.scenario??"control_plane"),isolatedTarget:String(P.isolatedTarget??""),expectedRpoMinutes:Number(P.expectedRpoMinutes??60),expectedRtoMinutes:Number(P.expectedRtoMinutes??30),recoveryPointId:P.recoveryPointId?String(P.recoveryPointId):void 0,topologyId:P.topologyId?String(P.topologyId):void 0})},201)}catch(F){return A(F,422)}}if(q.pathname==="/api/maintenance/drill-run"&&N.method==="POST"){let P=await re(N);try{return x({ok:!0,...Gu.enqueueDrill(String(P.drillId??""))},202)}catch(F){return A(F,422)}}}if(q.pathname.startsWith("/api/volumes")){let A=y.environments.get(Ce),P=We(me).actor?.id,F=(U,H=409)=>x({ok:!1,error:U instanceof Error?U.message:String(U)},H,{"cache-control":"no-store"});if(q.pathname==="/api/volumes"&&N.method==="GET"){let U=Ku.inventory(y.project.id,A?.id),H=y.store.listResources(y.project.id,A?.id).map((Q)=>({id:Q.id,name:Q.name,slug:Q.slug,kind:Q.kind,provider:Q.provider,providerId:Q.providerId}));return x({ok:!0,volumes:U,resources:H,operations:Vt.list({projectId:y.project.id,limit:100}).filter((Q)=>Q.operation.kind.startsWith("volume.")),recoveryPoints:br.listRecoveryPoints(y.project.id).filter((Q)=>Q.kind==="volume"),providers:Ju.map((Q)=>({provider:Q.provider,type:Q.type,capabilities:Q.capabilities()}))},200,{"cache-control":"no-store"})}if(q.pathname==="/api/volumes"&&N.method==="POST"){let U=await re(N);try{return x({ok:!0,...si.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:A?.id,resourceId:U.resourceId?String(U.resourceId):void 0,name:String(U.name??""),provider:String(U.provider??"docker"),type:U.type==="docker"?"docker":U.type,capacityBytes:U.capacityBytes==null?void 0:Number(U.capacityBytes),filesystem:U.filesystem?String(U.filesystem):void 0,encrypted:U.encrypted===!0,desiredState:U.desiredState&&typeof U.desiredState==="object"?U.desiredState:{},actorId:P})},202,{"cache-control":"no-store"})}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/attach"&&N.method==="POST"){let U=await re(N);try{return x({ok:!0,...si.attach(String(U.volumeId??""),{resourceId:String(U.resourceId??""),targetPath:String(U.targetPath??""),readOnly:U.readOnly===!0,uid:U.uid==null?void 0:Number(U.uid),gid:U.gid==null?void 0:Number(U.gid),mode:U.mode?String(U.mode):void 0,propagation:U.propagation,driverOptions:U.driverOptions&&typeof U.driverOptions==="object"?U.driverOptions:{},actorId:P})},202)}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/detach"&&N.method==="POST"){let U=await re(N);try{return x({ok:!0,...si.detach(String(U.volumeId??""),String(U.attachmentId??""),{force:U.force===!0,drained:U.drained===!0,unmounted:U.unmounted===!0,confirmation:U.confirmation?String(U.confirmation):void 0,actorId:P})},202)}catch(H){return F(H)}}if(q.pathname==="/api/volumes/resize"&&N.method==="POST"){let U=await re(N);try{return x({ok:!0,...si.resize(String(U.volumeId??""),Number(U.capacityBytes),{drained:U.drained===!0,actorId:P})},202)}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/snapshot"&&N.method==="POST"){let U=await re(N);try{return x({ok:!0,...si.snapshot(String(U.volumeId??""),{name:U.name?String(U.name):void 0,actorId:P})},202)}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/restore"&&N.method==="POST"){let U=await re(N);try{return x({ok:!0,...si.restore(String(U.snapshotId??""),{name:String(U.name??""),actorId:P})},202)}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes/discover"&&N.method==="POST")try{return x({ok:!0,volumes:await si.discover({organizationId:y.organization.id,projectId:y.project.id,environmentId:A?.id,actorId:P})})}catch(U){return F(U,502)}if(q.pathname==="/api/volumes/adopt"&&N.method==="POST"){let U=await re(N);try{return x({ok:!0,volume:si.adopt(String(U.volumeId??""),{name:String(U.name??""),actorId:P})})}catch(H){return F(H,422)}}if(q.pathname==="/api/volumes"&&N.method==="DELETE"){let U=await re(N),H=lr.resolveSession(N);try{return x({ok:!0,...si.delete(String(U.volumeId??""),{recentAuthAt:!xe||H&&Ne.isRecentlyAuthenticated(H)?new Date().toISOString():void 0,confirmation:U.confirmation?String(U.confirmation):void 0,backupOverride:U.backupOverride===!0,backupOverrideConfirmation:U.backupOverrideConfirmation?String(U.backupOverrideConfirmation):void 0,actorId:P})},202)}catch(Q){return F(Q)}}}if(q.pathname==="/api/backups"&&N.method==="GET"){let A=y.environments.get(Ce),P=br.listPolicies(y.project.id,A?.id),F=new Set(P.map((ee)=>ee.id)),U=br.listRecoveryPoints(y.project.id).filter((ee)=>!ee.policyId||F.has(ee.policyId)),H=br.listJobs(y.project.id).filter((ee)=>!ee.policyId||F.has(ee.policyId)),Q=(ee)=>({...ee,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!ee.credentialRef,clientEncryptionConfigured:!!ee.encryptionKeyRef}),J=await Promise.all(br.listDestinations(y.project.id).map(async(ee)=>({...Q(ee),credentialStatus:await fu(ee,oi)})));return x({ok:!0,destinations:J,policies:P,recoveryPoints:U,jobs:H,coverage:br.coverage(y.project.id).filter((ee)=>F.has(ee.policy.id)),resources:A?y.store.listResources(y.project.id,A.id).map((ee)=>({id:ee.id,name:ee.name,slug:ee.slug,kind:ee.kind})):[]})}if(q.pathname==="/api/backups/destinations"&&N.method==="POST"){let A=await re(N),P=String(A.name??"").trim(),F=String(A.provider??""),U=String(A.encryption??"provider"),H=`secret://data-services/backups/${y.project.id}/${P}`,Q=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(F))return x({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(U))return x({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let J,ee;if(A.credentials&&typeof A.credentials==="object"&&!Array.isArray(A.credentials))J=`${H}/credentials`,await oi.put(J,JSON.stringify(A.credentials)),Q.push(J);if(U!=="provider"){let ve=String(A.encryptionKey??"");if(ve.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");ee=`${H}/encryption-key`,await oi.put(ee,ve),Q.push(ee)}let Se=br.createDestination({organizationId:y.organization.id,projectId:y.project.id,name:P,provider:F,endpoint:A.endpoint?String(A.endpoint):void 0,endpointPolicy:A.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:A.bucket?String(A.bucket):void 0,prefix:String(A.prefix??""),region:A.region?String(A.region):Pi,forcePathStyle:A.forcePathStyle===!0,credentialRef:J,encryption:U,encryptionKeyRef:ee,immutability:A.immutability&&typeof A.immutability==="object"&&!Array.isArray(A.immutability)?A.immutability:{},status:"untested"});return x({ok:!0,destination:{...Se,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!J,clientEncryptionConfigured:!!ee}},201)}catch(J){for(let ee of Q)await oi.remove(ee).catch(()=>{});return x({ok:!1,error:J instanceof Error?J.message:String(J)},422)}}if(q.pathname==="/api/backups/destinations/test"&&N.method==="POST"){let A=await re(N),P=br.getDestination(String(A.id??""));if(!P||P.projectId!==y.project.id)return x({ok:!1,error:"Backup destination was not found."},404);if(P.provider==="aws_backup")return x({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Em.test(P),x({ok:!0,destination:br.recordDestinationTest(P.id,{ok:!0})})}catch(F){let U=F instanceof Error?F.message:String(F);return br.recordDestinationTest(P.id,{ok:!1,error:U}),x({ok:!1,error:U},502)}}if(q.pathname==="/api/backups/policies"&&N.method==="POST"){let A=await re(N),P=y.environments.get(Ce),F=br.getDestination(String(A.destinationId??"")),U=String(A.resourceKind??""),H=A.dataServiceId?String(A.dataServiceId):void 0,Q=H?or.get(H):void 0,J=A.resourceId?String(A.resourceId):void 0,ee=J?y.store.getResource(J):void 0;if(!P)return x({ok:!1,error:"Environment was not found."},404);if(!F||F.projectId!==y.project.id)return x({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(U))return x({ok:!1,error:"A supported backup resource kind is required."},422);if(H&&(!Q||Q.projectId!==y.project.id||Q.environmentId!==P.id))return x({ok:!1,error:"Data service was not found in this environment."},404);if(J&&(!ee||ee.projectId!==y.project.id||ee.environmentId!==P.id))return x({ok:!1,error:"Resource was not found in this environment."},404);if(U==="managed_database"&&!Q)return x({ok:!1,error:"Managed database policies require a data service."},422);if(U==="logical_database"&&(!Q||!["container","server"].includes(Q.provider)))return x({ok:!1,error:"Logical database policies require an on-box data service."},422);if(U==="volume"&&(!ee||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(A.volumeName??""))))return x({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let Se=Array.isArray(A.includePatterns)?A.includePatterns.map(String).filter(Boolean):[];if(U==="files"&&(!ee||!Se.length))return x({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(U==="control_plane"&&F.encryption==="provider")return x({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(U==="infrastructure"&&(F.provider!=="aws_backup"||!Se.some((ve)=>ve.startsWith("resource:arn:"))||!Se.some((ve)=>ve.startsWith("role:arn:"))))return x({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let ve=br.createPolicy({organizationId:y.organization.id,projectId:y.project.id,environmentId:P.id,resourceId:J,dataServiceId:H,destinationId:F.id,name:String(A.name??"").trim(),resourceKind:U,schedule:String(A.schedule??"daily"),timezone:String(A.timezone??"UTC"),retention:A.retention&&typeof A.retention==="object"&&!Array.isArray(A.retention)?A.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(A.compression))?A.compression:"gzip",encryption:["destination","client_side","both"].includes(String(A.encryption))?A.encryption:"destination",includePatterns:U==="volume"?[String(A.volumeName),...Se]:Se,excludePatterns:Array.isArray(A.excludePatterns)?A.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(A.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(A.expectedRtoMinutes)||120),healthCheckId:A.healthCheckId?String(A.healthCheckId):void 0,enabled:A.enabled!==!1});return x({ok:!0,policy:ve},201)}catch(ve){return x({ok:!1,error:ve instanceof Error?ve.message:String(ve)},422)}}if(q.pathname==="/api/backups/run"&&N.method==="POST"){let A=await re(N),P=br.getPolicy(String(A.policyId??"")),F=y.environments.get(Ce);if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return x({ok:!1,error:"Backup policy was not found in this environment."},404);try{let U=vo.enqueueBackup(P,new Date().toISOString(),We(me).actor?.id);return x({ok:!0,job:U},202)}catch(U){return x({ok:!1,error:U instanceof Error?U.message:String(U)},409)}}if(q.pathname==="/api/backups/verify"&&N.method==="POST"){let A=await re(N),P=br.getRecoveryPoint(String(A.recoveryPointId??""));if(!P||P.projectId!==y.project.id)return x({ok:!1,error:"Recovery point was not found."},404);return x({ok:!0,job:vo.enqueueVerification(P)},202)}if(q.pathname==="/api/backups/restore"&&N.method==="POST"){let A=await re(N),P=br.getRecoveryPoint(String(A.recoveryPointId??"")),F=A.mode==="in_place"?"in_place":"isolated",U=A.target&&typeof A.target==="object"&&!Array.isArray(A.target)?{...A.target,inPlace:F==="in_place"}:{inPlace:F==="in_place"},H=lr.resolveSession(N),Q={mode:F,target:U,targetName:String(A.targetName??""),confirm:A.confirm?String(A.confirm):void 0,recentAuth:!xe||!!H&&Ne.isRecentlyAuthenticated(H),downtimeAcknowledged:A.downtimeAcknowledged===!0,safetyBackupId:A.safetyBackupId?String(A.safetyBackupId):void 0};if(!P||P.projectId!==y.project.id)return x({ok:!1,error:"Recovery point was not found."},404);if(A.drill===!0&&F!=="isolated")return x({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let J=vo.planRestore(P,Q);if(A.execute!==!0)return x({ok:!0,plan:J,executionCreated:!1});let ee=vo.enqueueRestore(P,{...Q,drill:A.drill===!0,actorId:We(me).actor?.id});return x({ok:!0,plan:J,job:ee},202)}catch(J){return x({ok:!1,error:J instanceof Error?J.message:String(J)},409)}}if(q.pathname==="/api/backups/recovery-points"&&N.method==="POST"){let A=await re(N),P=br.getRecoveryPoint(String(A.id??""));if(!P||P.projectId!==y.project.id)return x({ok:!1,error:"Recovery point was not found."},404);if(A.held==null&&A.pinned==null)return x({ok:!1,error:"held or pinned must be provided."},422);return x({ok:!0,recoveryPoint:br.updateRecoveryPoint(P.id,{held:A.held==null?P.held:A.held===!0,pinned:A.pinned==null?P.pinned:A.pinned===!0})})}if(q.pathname==="/api/backups/retention"&&N.method==="POST")return x({ok:!0,jobs:vo.enqueueRetention()},202);if(q.pathname==="/api/data-services/capabilities"&&N.method==="GET"){let A=String(q.searchParams.get("engine")??""),P=String(q.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(A)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(P))return x({ok:!1,error:"A supported engine and provider are required."},422);return x({ok:!0,engine:A,provider:P,capabilities:sn(A,P)})}if(q.pathname==="/api/data-services"&&N.method==="GET"){let A=y.environments.get(Ce),P=or.list(y.project.id,A?.id).map((F)=>{let U=or.credential(F.id);return{...F,credentialRef:void 0,credential:U?{configured:!0,username:U.username,version:U.version,rotatedAt:U.rotatedAt}:void 0,dependencies:or.dependencies(F.id).map((H)=>({resourceId:H.resourceId,requiresRedeploy:H.requiresRedeploy}))}});return x({ok:!0,services:P})}if(q.pathname==="/api/data-services/preview"&&N.method==="POST"){let A=await re(N);if(A.id){let U=or.get(String(A.id)),H=y.environments.get(Ce),Q=String(A.action??"");if(!U||U.projectId!==y.project.id||U.environmentId!==H?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!qu.includes(Q))return x({ok:!1,error:`Action must be one of: ${qu.join(", ")}.`},422);try{return x({ok:!0,plan:Rc.plan(U,Q,A.changes??{})})}catch(J){return x({ok:!1,error:J instanceof Error?J.message:String(J)},422)}}let P=String(A.engine??""),F=String(A.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(P)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(F))return x({ok:!1,error:"A supported engine and provider are required."},422);return x({ok:!0,capabilities:sn(P,F),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(q.pathname==="/api/data-services"&&N.method==="POST"){let A=await re(N),P=String(A.engine??""),F=String(A.provider??""),U=y.environments.get(Ce),H=We(me);if(!U)return x({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(P)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(F))return x({ok:!1,error:"A supported engine and provider are required."},422);let Q={organizationId:y.organization.id,projectId:y.project.id,environmentId:U.id,resourceId:A.resourceId?String(A.resourceId):void 0,name:String(A.name??"").trim(),engine:P,provider:F,placement:String(A.placement??A.name??"").trim(),engineVersion:A.engineVersion?String(A.engineVersion):void 0,plan:String(A.plan??(F==="aws_elasticache"?"cache.t4g.micro":F==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:A.storageGb==null?void 0:Number(A.storageGb),highAvailability:A.highAvailability===!0,publicExposure:A.publicExposure===!0,allowedCidrs:Array.isArray(A.allowedCidrs)?A.allowedCidrs.map(String):[],desiredState:A.desiredState&&typeof A.desiredState==="object"&&!Array.isArray(A.desiredState)?A.desiredState:{},observedState:{},origin:A.adopt===!0?"adopted":"managed",managementEnabled:A.adopt!==!0,ownerActorId:H.actor?.id,username:A.username?String(A.username):void 0};try{if(A.adopt===!0){let ee=or.create({...Q,status:"adopted",credentialRef:void 0});return x({ok:!0,service:ee,readOnly:!0},201)}if(!Im({provider:F,engine:P}))return x({ok:!1,error:`No ${F}/${P} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let J=await Rc.create(Q);return x({ok:!0,service:J.service,operationId:J.operationId,oneTimeCredential:J.credential},201)}catch(J){return x({ok:!1,error:J instanceof Error?J.message:String(J)},422)}}if(q.pathname==="/api/data-services/connections"&&N.method==="GET"){let A=or.get(String(q.searchParams.get("id")??"")),P=y.environments.get(Ce);if(!A||A.projectId!==y.project.id||A.environmentId!==P?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);let F=typeof A.observedState.endpoint==="string"?A.observedState.endpoint:void 0,U=typeof A.observedState.readerEndpoint==="string"?A.observedState.readerEndpoint:void 0,H=Number(A.observedState.port)||(A.engine==="postgres"?5432:A.engine==="redis"?6379:A.engine==="mongodb"?27017:A.engine==="libsql"?8080:3306),Q=typeof A.observedState.database==="string"?A.observedState.database:void 0,J=typeof A.observedState.tls==="boolean"?A.observedState.tls:A.provider.startsWith("aws_"),ee=[...F?[{type:A.publicExposure?"external":"internal",host:F,port:H,database:Q,tls:J}]:[],...U?[{type:"internal",host:U,port:H,database:Q,tls:J}]:[],{type:"tunnel",host:F??A.placement,port:H,database:Q,tls:J}];return x({ok:!0,serviceId:A.id,guidance:Ql(A,ee)})}if(q.pathname==="/api/data-services/action"&&N.method==="POST"){let A=await re(N),P=or.get(String(A.id??"")),F=y.environments.get(Ce),U=String(A.action??"");if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!qu.includes(U))return x({ok:!1,error:`Action must be one of: ${qu.join(", ")}.`},422);let H=A.changes&&typeof A.changes==="object"&&!Array.isArray(A.changes)?A.changes:{};try{let Q=Rc.plan(P,U,H);if(A.execute!==!0)return x({ok:!0,plan:Q,productionExecutionCreated:!1});let J=Rc.enqueue(P,U,H,We(me).actor?.id);return x({ok:!0,plan:Q,operationId:J},202)}catch(Q){return x({ok:!1,error:Q instanceof Error?Q.message:String(Q)},409)}}if(q.pathname==="/api/data-services/dependencies"&&N.method==="POST"){let A=await re(N),P=or.get(String(A.id??"")),F=y.environments.get(Ce),U=y.store.getResource(String(A.resourceId??""));if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!U||U.projectId!==y.project.id||U.environmentId!==F?.id)return x({ok:!1,error:"Dependent resource was not found in this environment."},404);if(A.remove===!0)return x({ok:or.removeDependency(P.id,U.id)});return or.addDependency({serviceId:P.id,resourceId:U.id,secretRef:P.credentialRef??`secret://data-services/${P.projectId}/${P.name}`,requiresRedeploy:A.requiresRedeploy!==!1}),x({ok:!0,dependencies:or.dependencies(P.id).map((H)=>({resourceId:H.resourceId,requiresRedeploy:H.requiresRedeploy}))})}if(q.pathname==="/api/data-services/management"&&N.method==="POST"){let A=await re(N),P=or.get(String(A.id??"")),F=y.environments.get(Ce);if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(P.origin!=="adopted"||A.reviewed!==!0||A.confirm!==P.name)return x({ok:!1,error:`Enabling management requires reviewed=true and typing ${P.name}.`},409);return x({ok:!0,service:or.update(P.id,P.version,{managementEnabled:!0})})}if(q.pathname==="/api/data-services/reveal"&&N.method==="POST"){let A=await re(N),P=or.get(String(A.id??"")),F=y.environments.get(Ce),U=P?or.credential(P.id):void 0;if(!P||P.projectId!==y.project.id||P.environmentId!==F?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!U)return x({ok:!1,error:"No managed credential is configured."},404);return x({ok:!0,credential:{username:U.username,password:await oi.resolve(U.secretRef),version:U.version}},200,{"cache-control":"no-store"})}if(q.pathname==="/api/databases"&&N.method==="GET")return x(await Ob(m,Ce));if(q.pathname==="/api/databases"&&N.method==="POST"){let A=await re(N),P=String(A.name??"").trim();if(!Ii(P))return x({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return x({...await $b(m,Ce,P),name:P})}if(q.pathname==="/api/databases/vitess"&&N.method==="GET"){let A=await Mb(m,Ce);return x({...A,unhealthy:Lb(A.tablets),missingPrimary:Fb(A)})}if(q.pathname==="/api/databases/vitess/provision"&&N.method==="POST"){let A=await re(N);try{return x(await Gb(m,Ce,{keyspace:String(A.keyspace??""),username:String(A.username??""),password:String(A.password??""),sharded:A.sharded===!0,confirm:String(A.confirm??"")}))}catch(P){return x({ok:!1,error:P instanceof Error?P.message:String(P)},422)}}if(q.pathname==="/api/databases/vitess/migrations"&&N.method==="GET"){let A=q.searchParams.get("keyspace")??void 0;return x(await Kb(m,Ce,A))}if(q.pathname==="/api/databases/vitess/migrations/action"&&N.method==="POST"){let A=await re(N),P=String(A.uuid??"").trim(),F=String(A.action??"");if(!["retry","cancel","cleanup","complete"].includes(F))return x({ok:!1,error:"Unknown migration action."},422);return x(await Jb(m,Ce,P,F))}if(q.pathname==="/api/databases/vitess/keyspaces"&&N.method==="POST"){let A=await re(N),P=String(A.name??"").trim(),F=A.sharded===!0;return x(await Vb(m,Ce,P,{sharded:F}))}if(q.pathname==="/api/databases/vitess/vschema"&&N.method==="POST"){let A=await re(N),P=String(A.keyspace??"").trim(),F=typeof A.vschema==="string"?A.vschema:JSON.stringify(A.vschema??null);return x(await Wb(m,Ce,P,F))}if(q.pathname==="/api/databases/vitess/schema"&&N.method==="POST"){let A=await re(N),P=String(A.sql??"");return x(await Hb(m,Ce,P))}if(q.pathname==="/api/databases/vitess/install-client"&&N.method==="POST")return x(await qb(m,Ce));if(q.pathname==="/api/databases/backups"&&N.method==="GET")return x(await Bb(m,Ce));if(q.pathname==="/api/databases/backup"&&N.method==="POST"){let A=await re(N),P=String(A.database??"").trim();if(!Ii(P))return x({ok:!1,error:"Database name must be a valid identifier."},422);if(A.confirm!==P)return x({ok:!1,error:`Type "${P}" to back up this database.`},409);return x(await jb(m,Ce,P))}if(q.pathname==="/api/databases/users"&&N.method==="POST"){let A=await re(N),P=String(A.username??"").trim(),F=String(A.password??""),U=String(A.database??"").trim()||void 0,H=A.access==="readonly"?"readonly":"all";if(!Ii(P))return x({ok:!1,error:"Username must be a valid identifier."},422);if(!F)return x({ok:!1,error:"Password is required."},422);if(U&&!Ii(U))return x({ok:!1,error:"Database must be a valid identifier."},422);return x({...await Nb(m,Ce,{username:P,password:F,database:U,access:H}),username:P})}if(q.pathname==="/api/dashboard-data")return sr=V.get(Ce)??await Ee(Ce),Ee(Ce),x(dm(sr,{user:$n,slug:m.project.slug}));if(q.pathname==="/api/users"&&N.method==="GET")return x({ok:!0,users:wn(t).map(qa)});if(q.pathname==="/api/users"&&N.method==="POST"){let A=await re(N),P=String(A.username??"").trim();if(!Ou(P))return x({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let F=A.sites&&typeof A.sites==="object"?A.sites:{},U=new Set(Object.keys(m.sites??{})),H={};for(let[ee,Se]of Object.entries(F)){if(!U.has(ee))return x({ok:!1,error:`Site '${ee}' was not found.`},404);if(Se!=="owner"&&Se!=="collaborator")return x({ok:!1,error:`Unknown site role '${Se}'. Use 'owner' or 'collaborator'.`},422);H[ee]=Se}let Q=typeof A.password==="string"&&A.password.trim()?A.password.trim():void 0;if(Q&&Q.length<12)return x({ok:!1,error:"Password must be at least 12 characters."},422);let J=vc(t,{username:P,password:Q,name:typeof A.name==="string"?A.name:void 0,sites:H});return Zi(y,wn(t)),ot(),x({ok:!0,user:qa(J.user),password:J.password})}if(q.pathname==="/api/users"&&N.method==="DELETE"){let A=await re(N),P=String(A.username??"").trim();if(P.toLowerCase()===me.username.toLowerCase())return x({ok:!1,error:"You cannot remove your own account."},409);let F=Fn(wn(t),P),U=F?y.store.getActorByExternalId("user",`dashboard:${F.username.toLowerCase()}`):void 0,H=U?y.store.getMembershipForActor(y.organization.id,U.id):void 0;if(H&&H.source!=="legacy")return x({ok:!1,error:"Organization members must be removed from Organization access."},409);let Q=sm(t,P);if(!Q.ok)return x(Q,409);return Zi(y,wn(t)),ae.clear(),x({ok:!0,username:P})}if(q.pathname==="/api/actions/run"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=A.action?is(A.action,Ce):void 0;if(!P)return x({ok:!1,error:"Unknown dashboard action."},404);if(P.mutates&&A.confirm!==P.confirm)return x({ok:!1,error:`Type "${P.confirm}" to run this action.`},409);let F=await _e({controlPlane:y,environment:Ce,actor:me,kind:`dashboard.action.${P.id}`,input:{action:P.id},execute:()=>Sm(P,{cwd:t,cliEntry:l})});return x({...F.result,controlPlaneOperation:F.operation})}if(q.pathname==="/api/server/operations/run"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=A.operation?cm(A.operation,m,sr):void 0;if(!P)return x({ok:!1,error:"Unknown or unavailable server operation."},404);if(P.mutates&&A.confirm!==P.confirm)return x({ok:!1,error:`Type "${P.confirm}" to run this operation.`},409);let F=ne(y,String(Ce));await new St(ut).run(new rn,{...F,artifactRoot:t});let U=zi(ut,{scope:F,desiredConfigHash:y.project.desiredConfigHash});if(U.decision.outcome==="block")return x({ok:!1,error:`Operation blocked by security policy: ${U.decision.explanation}`,securityReview:U},409);let H=await _e({controlPlane:y,environment:Ce,actor:me,kind:`dashboard.server.${P.id}`,resourceSlug:P.target,input:{operation:P.id,target:P.target,to:A.to??null},execute:()=>Bu(m,Ce,P,{to:A.to})});return x({...H.result,controlPlaneOperation:H.operation,securityReview:U})}if(q.pathname==="/api/server/command"&&N.method==="POST"){let A=await N.json().catch(()=>({}));if(A.confirm!=="run")return x({ok:!1,error:'Type "run" to execute this command on the server.'},409);let P=await _e({controlPlane:y,environment:Ce,actor:me,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>bc(m,Ce,String(A.command??""))});return x({...P.result,controlPlaneOperation:P.operation})}if(q.pathname==="/api/serverless/operations")return x(mm(m,Ce,sr));if(q.pathname==="/api/serverless/operations/run"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=A.operation?PS(A.operation,m,Ce,sr):void 0;if(!P)return x({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(P.mutates&&A.confirm!==P.confirm)return x({ok:!1,error:`Type "${P.confirm}" to run this operation.`},409);let F=await _e({controlPlane:y,environment:Ce,actor:me,kind:`dashboard.serverless.${P.id}`,input:{operation:P.id,min:A.min??null,max:A.max??null},execute:()=>_S(m,Ce,P,{min:A.min,max:A.max})});return sr=await vs(m,Ce),V.set(Ce,sr),x({...F.result,controlPlaneOperation:F.operation})}if(q.pathname==="/api/serverless/command"&&N.method==="POST"){let A=await N.json().catch(()=>({}));if(A.confirm!=="run")return x({ok:!1,error:'Type "run" to execute this command.'},409);return x(await TS(m,Ce,String(A.command??"")))}if(q.pathname==="/api/serverless/dlq"&&N.method==="GET"){let A=Number(q.searchParams.get("max"))||10;return x(await xS(m,Ce,A))}if(q.pathname==="/api/serverless/dlq/redrive"&&N.method==="POST"){let A=await N.json().catch(()=>({}));if(A.confirm!=="redrive")return x({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return x(await DS(m,Ce,{max:A.max,targetQueue:A.targetQueue}))}if(q.pathname==="/api/serverless/dlq/purge"&&N.method==="POST"){if((await N.json().catch(()=>({}))).confirm!=="purge")return x({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return x(await OS(m,Ce))}if(q.pathname==="/api/serverless/secrets"&&N.method==="GET")return x({secrets:$S(m,Ce)});if(q.pathname==="/api/serverless/secrets"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=String(A.secretId??"").trim();if(!P)return x({ok:!1,error:"A secret id is required."},422);if(typeof A.value!=="string"||A.value==="")return x({ok:!1,error:"A non-empty value is required."},422);return x(await NS(m,Ce,P,A.value))}if(q.pathname==="/api/serverless/secrets"&&N.method==="DELETE"){let A=await N.json().catch(()=>({})),P=String(A.secretId??"").trim();if(!P)return x({ok:!1,error:"A secret id is required."},422);if(A.confirm!==P)return x({ok:!1,error:`Type "${P}" to delete this secret.`},409);return x(await jS(m,Ce,P))}if(q.pathname==="/api/serverless/functions/config"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=String(A.mode??"").trim();if(A.confirm!==P)return x({ok:!1,error:`Type "${P}" to update this function.`},409);return x(await BS(m,Ce,P,{memory:A.memory,timeout:A.timeout}))}if(q.pathname==="/api/serverless/alarms"&&N.method==="GET")return x(await MS(m,Ce));if(q.pathname==="/api/serverless/alarms"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=String(A.preset??"").trim(),F=Number(A.threshold);if(!P)return x({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(F))return x({ok:!1,error:"A numeric threshold is required."},422);return x(await LS(m,Ce,P,F))}if(q.pathname==="/api/serverless/alarms"&&N.method==="DELETE"){let A=await N.json().catch(()=>({})),P=String(A.name??"").trim();if(!P)return x({ok:!1,error:"An alarm name is required."},422);if(A.confirm!==P)return x({ok:!1,error:`Type "${P}" to delete this alarm.`},409);return x(await FS(m,Ce,P))}if(q.pathname==="/api/serverless/traces"&&N.method==="GET"){let A=Number(q.searchParams.get("minutes"))||30;return x(await zu(m,Ce,A))}if(q.pathname==="/api/serverless/scheduler"&&N.method==="POST"){let A=await N.json().catch(()=>({})),P=String(A.action??"").trim();if(P!=="enable"&&P!=="disable"&&P!=="run")return x({ok:!1,error:"Unknown scheduler action."},422);if(A.confirm!==P)return x({ok:!1,error:`Type "${P}" to ${P} the scheduler.`},409);return x(await ym(m,Ce,P))}if(!rw(q.pathname,$n))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(Ce)}`}});let Es=await Qt(me,Ce);if(!Es)return Wu("ts-cloud dashboard UI is unavailable.",503);return nw(Es,q.pathname)}catch(So){if(e.verbose)console.error(So);return x({ok:!1,error:So?.message??String(So)},500)}})();if(!vr)return vr;if(Rt&&(q.pathname.startsWith("/api/")||q.pathname.startsWith("/auth/"))){let at;if((Fe.headers.get("content-type")||"").includes("application/json"))at=await Fe.json().catch(()=>{return});let $r=lr.resolveUser(N),Rr=$r?We($r).actor:void 0;y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,actorId:Rr?.id,correlationId:Ge,type:vr.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:vr.status<400?"info":"warning",payload:W_(N.method,q.pathname,at,vr.status,Date.now()-qe)})}return vr.headers.set("x-request-id",Ge),vr}});Ac?.start();let vw=e.spendLoop??!0,Um;if(vw)(async()=>{let{SpendRunner:N,SpendLoopLease:ze,startSpendLoop:qe}=await import("./spend/index.js"),{store:Fe}=await ow(y.store),Ge=new N({controlPlane:y.store,store:Fe,alerts:st});Um=qe(Ge,{lease:new ze(y.store,{owner:`dashboard:${process.pid}`}),onError:(Rt)=>console.error(`[ts-cloud] spend cycle failed: ${Rt instanceof Error?Rt.message:String(Rt)}`)})})();let bw=ks.stop.bind(ks);return ks.stop=(N)=>{clearInterval(Bm),clearInterval(Mm),clearInterval(Lm),clearInterval(Nm),clearInterval($m),clearInterval(Tm),clearInterval(xm),clearInterval(Dm),clearInterval(Om),ot(),Sr.clear(),Ac?.stop(),Um?.();let ze=bw(N);if(Ac)Ac.settled().finally(()=>y.store.close());else y.store.close();return ze},{server:ks,url:`http://${r}:${ks.port}/`}}export{_o,qm,sl,hy,Fi,ol,Oo,Vm,jm,Jr,xo,al,Xe,cl,dl,ll,Ui,Xr,zm,Ye,ul,Lo,$o,Mo,pl,gl,ml,Qi,Fo,hl,Yr,Hi,Uo,It,Km,fl,Al,Wm,yl,Qo,Yt,Il,Sl,Cl,El,Ze,Jm,bl,Zt,Ho,Go,qo,Gi,qi,Zr,vl,Vi,Vo,jo,en,Tl,tn,Xm,Ym,St,rn,zo,Zm,wl,Rl,Ko,Dl,Pl,Nl,fy,ne,kl,Ay,yy,ji,zi,Iy,he,eh,Ct,ke,Be,Et,Bl,_l,Ol,xl,th,rh,Wo,nh,ih,Jo,Ll,$l,sh,ie,oh,Ml,fe,Xo,et,bt,vt,nn,Ki,Fl,Sy,Yo,ah,ch,dh,lh,Zo,ea,Ul,sn,ta,Ql,Wi,Hl,ra,na,ia,sa,oa,aa,ca,da,Gl,er,la,ql,on,Vl,ua,pa,jl,tr,ga,ma,uh,Cy,Ji,Ey,by,vy,ha,fa,zl,ph,Aa,an,Kl,Xi,Wl,Jl,Xl,ya,gh,Ia,Yl,mh,Sa,hh,cn,dn,Zl,Yi,eu,tu,ru,Ca,nu,iu,fh,su,E,ou,Zi,_e,au,cu,Ty,du,lu,uu,pu,gu,Ah,wy,Ry,Dy,yh,Ih,Py,Ny,Sh,Ch,ky,es,rr,Ea,ln,un,nr,tt,Tt,ts,Eh,pn,mu,hu,ba,bh,va,vh,Th,fu,Ta,rs,Au,wa,wt,Oe,yu,Ra,Da,Iu,Pa,Na,ka,Ba,Su,Cu,gn,_a,Oa,xa,La,Eu,ns,mn,is,$a};