@stacksjs/ts-cloud 0.16.31 → 0.16.32

package/dist/{chunk-9n0q2cxj.js → chunk-nq51dyxz.js}

@@ -1,4 +1,4 @@
-import{L,d}from"./chunk-2c8pcbq8.js";import{Gr}from"./chunk-10asqy6j.js";var Ff=["edge.requests","edge.egress_gb","function.invocations","function.gb_seconds","build.minutes","compute.instance_hours","storage.gb_hours","object.egress_gb","object.requests","database.gb_hours","database.io_requests","telemetry.ingest_gb","image.transformations"],Ks={"edge.requests":{key:"edge.requests",unit:"requests",label:"Edge requests",precision:0},"edge.egress_gb":{key:"edge.egress_gb",unit:"gb",label:"Edge egress",precision:3},"function.invocations":{key:"function.invocations",unit:"invocations",label:"Function invocations",precision:0},"function.gb_seconds":{key:"function.gb_seconds",unit:"gb_seconds",label:"Function compute",precision:2},"build.minutes":{key:"build.minutes",unit:"minutes",label:"Build minutes",precision:2},"compute.instance_hours":{key:"compute.instance_hours",unit:"hours",label:"Instance hours",precision:2},"storage.gb_hours":{key:"storage.gb_hours",unit:"gb_hours",label:"Block storage",precision:2},"object.egress_gb":{key:"object.egress_gb",unit:"gb",label:"Object storage egress",precision:3},"object.requests":{key:"object.requests",unit:"requests",label:"Object storage requests",precision:0},"database.gb_hours":{key:"database.gb_hours",unit:"gb_hours",label:"Database storage",precision:2},"database.io_requests":{key:"database.io_requests",unit:"requests",label:"Database I/O",precision:0},"telemetry.ingest_gb":{key:"telemetry.ingest_gb",unit:"gb",label:"Telemetry ingest",precision:3},"image.transformations":{key:"image.transformations",unit:"count",label:"Image transformations",precision:0}},Uf=["notify","block_builds","block_deployments","throttle_requests","suspend_functions","serve_static","suspend_project"],P={notify:0,block_builds:1,block_deployments:2,throttle_requests:3,suspend_functions:4,serve_static:5,suspend_project:6};var Qf=1e6;function yr(e){if(e.tiers&&e.tiers.length>0)return e.tiers;return[{upToQuantity:null,microCentsPerUnit:e.microCentsPerUnit??0}]}function Xc(e,t){if(!(e>0))return 0;let r=[...t].sort((l,u)=>{if(l.upToQuantity===null)return 1;if(u.upToQuantity===null)return-1;return l.upToQuantity-u.upToQuantity}),n=e,o=0,a=0;for(let l of r){if(n<=0)break;let p=(l.upToQuantity===null?1/0:l.upToQuantity)-o;if(p<=0)continue;let E=Math.min(n,p);a+=E*l.microCentsPerUnit,n-=E,o+=E}if(n>0){let l=r.reduce((u,p)=>Math.max(u,p.microCentsPerUnit),0);a+=n*l}return a}function Hp(e,t,r,n){let o=e.entries.filter((u)=>u.meter===t);if(o.length===0)return;let a=o.filter((u)=>u.provider===r),l=a.length>0?a:o.filter((u)=>u.provider==="*");return l.find((u)=>u.region===n)??l.find((u)=>u.region==null)}function Ws(e,t,r=0){let n=Hp(e,t.meter,t.provider,t.region),o=Math.max(0,t.quantity);if(!n)return{meter:t.meter,provider:t.provider??"unknown",region:t.region,quantity:o,includedQuantity:0,billableQuantity:o,costCents:0,unpriced:!0};let a=Math.max(0,n.includedQuantity??0),l=Math.max(0,r-a),u=Math.max(0,a-Math.max(0,r)),p=Math.min(o,u),E=o-p,g=yr(n),m=Xc(l+E,g)-Xc(l,g);return{meter:t.meter,provider:n.provider,region:n.region??t.region,quantity:o,includedQuantity:p,billableQuantity:E,costCents:m/1e6,unpriced:!1}}function Hf(e,t){let r=new Map,n=[];for(let o of t){let a=`${o.meter}\x00${o.provider??""}\x00${o.region??""}`,l=r.get(a)??0,u=Ws(e,o,l);r.set(a,l+u.quantity),n.push(u)}return{currency:e.currency,totalCents:n.reduce((o,a)=>o+a.costCents,0),lines:n,unpricedMeters:[...new Set(n.filter((o)=>o.unpriced).map((o)=>String(o.meter)))]}}function Gf(e){return Math.round(e*100)/100}function qf(e,...t){let r=new Map,n=(a)=>`${a.meter}\x00${a.provider}\x00${a.region??""}`;for(let a of e.entries)r.set(n(a),a);let o=e.currency;for(let a of t){o=a.currency||o;for(let l of a.entries)r.set(n(l),l)}return{currency:o,entries:[...r.values()]}}var Q=(e)=>Math.round(e*1e6),q=(e)=>Math.round(e*1e6),Yc={currency:"USD",entries:[{meter:"edge.requests",provider:"aws",microCentsPerUnit:q(0.00075)},{meter:"edge.egress_gb",provider:"aws",includedQuantity:100,tiers:[{upToQuantity:10240,microCentsPerUnit:Q(8.5)},{upToQuantity:51200,microCentsPerUnit:Q(8)},{upToQuantity:null,microCentsPerUnit:Q(6)}]},{meter:"function.invocations",provider:"aws",includedQuantity:1e6,microCentsPerUnit:q(0.002)},{meter:"function.gb_seconds",provider:"aws",includedQuantity:400000,microCentsPerUnit:q(0.00166667)},{meter:"storage.gb_hours",provider:"aws",microCentsPerUnit:q(0.010958904109589041)},{meter:"object.egress_gb",provider:"aws",includedQuantity:100,microCentsPerUnit:Q(9)},{meter:"object.requests",provider:"aws",microCentsPerUnit:q(0.000039999999999999996)},{meter:"database.gb_hours",provider:"aws",microCentsPerUnit:q(0.015753424657534248)},{meter:"compute.instance_hours",provider:"aws",microCentsPerUnit:q(4.16)},{meter:"edge.egress_gb",provider:"hetzner",includedQuantity:20480,microCentsPerUnit:Q(0.108)},{meter:"object.egress_gb",provider:"hetzner",includedQuantity:1024,microCentsPerUnit:Q(0.108)},{meter:"compute.instance_hours",provider:"hetzner",microCentsPerUnit:q(0.95)},{meter:"storage.gb_hours",provider:"hetzner",microCentsPerUnit:q(0.006027397260273972)},{meter:"edge.requests",provider:"hetzner",microCentsPerUnit:0},{meter:"edge.requests",provider:"local",microCentsPerUnit:0},{meter:"edge.egress_gb",provider:"local",microCentsPerUnit:0},{meter:"function.invocations",provider:"local",microCentsPerUnit:0},{meter:"function.gb_seconds",provider:"local",microCentsPerUnit:0},{meter:"build.minutes",provider:"*",includedQuantity:6000,microCentsPerUnit:q(0.8)},{meter:"telemetry.ingest_gb",provider:"*",includedQuantity:5,microCentsPerUnit:Q(50)},{meter:"image.transformations",provider:"*",includedQuantity:5000,microCentsPerUnit:q(0.05)}]};var yt=new Map;function Lt(e){let t=yt.get(e);if(!t)t=new Intl.DateTimeFormat("en-US",{timeZone:e,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",weekday:"short",hourCycle:"h23"}),yt.set(e,t);return t}var vr={Sun:0,Mon:1,Tue:2,Wed:3,Thu:4,Fri:5,Sat:6};function Ai(e){try{return Lt(e),!0}catch{return!1}}function Js(e,t){let r=Lt(t).formatToParts(e),n=(o)=>r.find((a)=>a.type===o)?.value??"0";return{year:Number(n("year")),month:Number(n("month")),day:Number(n("day")),hour:Number(n("hour")),minute:Number(n("minute")),second:Number(n("second")),weekday:vr[n("weekday")]??0}}function Zc(e,t){let r=Js(e,t);return Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second)-Math.floor(e.getTime()/1000)*1000}function Qt(e,t,r,n,o=0){let a=Date.UTC(t,r-1,n,o),l=new Date(a-Zc(new Date(a),e));return new Date(a-Zc(l,e))}function Ir(e,t){return new Date(Date.UTC(e,t-1,1)).toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"})}function mt(e,t,r=new Date){let n=Ai(t)?t:"UTC",o=Js(r,n),a,l,u;if(e==="daily")a=Qt(n,o.year,o.month,o.day),l=Qt(n,o.year,o.month,o.day+1),u=`${o.year}-${String(o.month).padStart(2,"0")}-${String(o.day).padStart(2,"0")}`;else if(e==="weekly"){let g=(o.weekday+6)%7;a=Qt(n,o.year,o.month,o.day-g),l=Qt(n,o.year,o.month,o.day-g+7);let m=Js(a,n);u=`week of ${m.year}-${String(m.month).padStart(2,"0")}-${String(m.day).padStart(2,"0")}`}else a=Qt(n,o.year,o.month,1),l=Qt(n,o.year,o.month+1,1),u=Ir(o.year,o.month);let p=l.getTime()-a.getTime(),E=Math.max(0,Math.min(p,r.getTime()-a.getTime()));return{start:a.toISOString(),end:l.toISOString(),elapsedMs:E,totalMs:p,label:u}}function Vf(e,t,r=new Date){let n=mt(e,t,r),o=new Date(new Date(n.start).getTime()-1),a=mt(e,t,o);return{...a,elapsedMs:a.totalMs}}function Lr(e){let r=(typeof e==="string"?new Date(e):e).getTime();if(!Number.isFinite(r))throw Error("hourBucket requires a valid date");return new Date(Math.floor(r/3600000)*3600000).toISOString()}function jf(e,t,r=9600){let n=Math.floor(new Date(e).getTime()/3600000)*3600000,o=new Date(t).getTime();if(!Number.isFinite(n)||!Number.isFinite(o))throw Error("hourBucketsBetween requires valid dates");let a=[];for(let l=n;l<o&&a.length<r;l+=3600000)a.push(new Date(l).toISOString());return a}import{createHash as Sr}from"node:crypto";var he=1073741824,ed=[{match:"request.count",meter:"edge.requests"},{match:"traffic.requests",meter:"edge.requests"},{match:"http.request",meter:"edge.requests",field:"count"},{match:"traffic.bytes_out",meter:"edge.egress_gb",scale:1/he},{match:"storage.egress.day",meter:"object.egress_gb",scale:1/he},{match:"storage.egress.month",meter:"object.egress_gb",scale:1/he,cumulative:!0},{match:"storage.egress.day_downloads",meter:"object.requests"},{match:"function.invocation",meter:"function.invocations",field:"count"},{match:"function.duration_ms",meter:"function.gb_seconds",scale:0.001},{match:"build.duration_ms",meter:"build.minutes",scale:0.000016666666666666667},{match:"telemetry.ingest_bytes",meter:"telemetry.ingest_gb",scale:1/he},{match:"image.transform",meter:"image.transformations",field:"count"}];function br(e,t){return e.match.endsWith("*")?t.startsWith(e.match.slice(0,-1)):e.match===t}function Gp(e,t=ed){return t.find((r)=>!r.match.endsWith("*")&&r.match===e)??t.find((r)=>br(r,e))}function Rr(e,t){let r=t.field??"value",n=r==="count"?1:r==="bytesOut"?e.bytesOut:r==="bytesIn"?e.bytesIn:r==="durationMs"?e.durationMs:e.value;if(n==null||!Number.isFinite(n))return;return n*(t.scale??1)}function qp(e,t){return Sr("sha256").update([t,e.meter,e.organizationId,e.projectId??"",e.environmentId??"",e.resourceId??"",e.timestamp].join("\x00")).digest("hex").slice(0,32)}class Xs{resetToleranceRatio;last=new Map;constructor(e=0.999){this.resetToleranceRatio=e}delta(e,t,r=new Date){if(!Number.isFinite(t)||t<0)return;let n=new Date(r).getTime(),o=this.last.get(e);if(!o)return this.last.set(e,{value:t,at:n}),t>0?t:void 0;if(n<o.at)return;if(t<o.value&&t>=o.value*this.resetToleranceRatio)return;if(this.last.set(e,{value:t,at:n}),t>=o.value){let a=t-o.value;return a>0?a:void 0}return t>0?t:void 0}prune(e){let t=e.getTime(),r=0;for(let[n,o]of this.last)if(o.at<t)this.last.delete(n),r++;return r}get size(){return this.last.size}}function vt(e,t){let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function td(e,t,r={}){let n=r.mappings??ed,o=r.counters,a=[];for(let l of t){let u=Gp(l.name,n);if(!u)continue;let p=Rr(l,u);if(p==null)continue;if(u.cumulative){if(!o)continue;let g=[l.projectId,l.environmentId??"",l.resourceId??"",l.name,l.source].join("\x00"),m=o.delta(g,p,l.timestamp);if(m==null)continue;p=m}if(!(p>0))continue;let E={organizationId:e,projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,provider:vt(l.attributes,"provider")??r.defaultProvider,region:l.region??vt(l.attributes,"region"),meter:u.meter,quantity:p,timestamp:l.timestamp,attributes:{source:l.source,signal:l.name}};a.push({...E,key:qp(E,l.id)})}return a}function rd(e){let t=new Map;for(let r of e){let n=new Date(Math.floor(new Date(r.timestamp).getTime()/3600000)*3600000).toISOString(),o=[r.organizationId,r.projectId??"",r.environmentId??"",r.resourceId??"",r.provider??"",r.region??"",r.meter,n].join("\x00"),a=t.get(o);if(a)a.quantity+=r.quantity;else t.set(o,{...r,timestamp:n})}return[...t.values()]}import{createHash as Yr}from"node:crypto";var qe=40,Fc=[{version:1,name:"core_control_plane",sql:`
+import{L,d}from"./chunk-r45340yc.js";import{Gr}from"./chunk-10asqy6j.js";var Ff=["edge.requests","edge.egress_gb","function.invocations","function.gb_seconds","build.minutes","compute.instance_hours","storage.gb_hours","object.egress_gb","object.requests","database.gb_hours","database.io_requests","telemetry.ingest_gb","image.transformations"],Ks={"edge.requests":{key:"edge.requests",unit:"requests",label:"Edge requests",precision:0},"edge.egress_gb":{key:"edge.egress_gb",unit:"gb",label:"Edge egress",precision:3},"function.invocations":{key:"function.invocations",unit:"invocations",label:"Function invocations",precision:0},"function.gb_seconds":{key:"function.gb_seconds",unit:"gb_seconds",label:"Function compute",precision:2},"build.minutes":{key:"build.minutes",unit:"minutes",label:"Build minutes",precision:2},"compute.instance_hours":{key:"compute.instance_hours",unit:"hours",label:"Instance hours",precision:2},"storage.gb_hours":{key:"storage.gb_hours",unit:"gb_hours",label:"Block storage",precision:2},"object.egress_gb":{key:"object.egress_gb",unit:"gb",label:"Object storage egress",precision:3},"object.requests":{key:"object.requests",unit:"requests",label:"Object storage requests",precision:0},"database.gb_hours":{key:"database.gb_hours",unit:"gb_hours",label:"Database storage",precision:2},"database.io_requests":{key:"database.io_requests",unit:"requests",label:"Database I/O",precision:0},"telemetry.ingest_gb":{key:"telemetry.ingest_gb",unit:"gb",label:"Telemetry ingest",precision:3},"image.transformations":{key:"image.transformations",unit:"count",label:"Image transformations",precision:0}},Uf=["notify","block_builds","block_deployments","throttle_requests","suspend_functions","serve_static","suspend_project"],P={notify:0,block_builds:1,block_deployments:2,throttle_requests:3,suspend_functions:4,serve_static:5,suspend_project:6};var Qf=1e6;function yr(e){if(e.tiers&&e.tiers.length>0)return e.tiers;return[{upToQuantity:null,microCentsPerUnit:e.microCentsPerUnit??0}]}function Xc(e,t){if(!(e>0))return 0;let r=[...t].sort((l,u)=>{if(l.upToQuantity===null)return 1;if(u.upToQuantity===null)return-1;return l.upToQuantity-u.upToQuantity}),n=e,o=0,a=0;for(let l of r){if(n<=0)break;let p=(l.upToQuantity===null?1/0:l.upToQuantity)-o;if(p<=0)continue;let E=Math.min(n,p);a+=E*l.microCentsPerUnit,n-=E,o+=E}if(n>0){let l=r.reduce((u,p)=>Math.max(u,p.microCentsPerUnit),0);a+=n*l}return a}function Hp(e,t,r,n){let o=e.entries.filter((u)=>u.meter===t);if(o.length===0)return;let a=o.filter((u)=>u.provider===r),l=a.length>0?a:o.filter((u)=>u.provider==="*");return l.find((u)=>u.region===n)??l.find((u)=>u.region==null)}function Ws(e,t,r=0){let n=Hp(e,t.meter,t.provider,t.region),o=Math.max(0,t.quantity);if(!n)return{meter:t.meter,provider:t.provider??"unknown",region:t.region,quantity:o,includedQuantity:0,billableQuantity:o,costCents:0,unpriced:!0};let a=Math.max(0,n.includedQuantity??0),l=Math.max(0,r-a),u=Math.max(0,a-Math.max(0,r)),p=Math.min(o,u),E=o-p,g=yr(n),m=Xc(l+E,g)-Xc(l,g);return{meter:t.meter,provider:n.provider,region:n.region??t.region,quantity:o,includedQuantity:p,billableQuantity:E,costCents:m/1e6,unpriced:!1}}function Hf(e,t){let r=new Map,n=[];for(let o of t){let a=`${o.meter}\x00${o.provider??""}\x00${o.region??""}`,l=r.get(a)??0,u=Ws(e,o,l);r.set(a,l+u.quantity),n.push(u)}return{currency:e.currency,totalCents:n.reduce((o,a)=>o+a.costCents,0),lines:n,unpricedMeters:[...new Set(n.filter((o)=>o.unpriced).map((o)=>String(o.meter)))]}}function Gf(e){return Math.round(e*100)/100}function qf(e,...t){let r=new Map,n=(a)=>`${a.meter}\x00${a.provider}\x00${a.region??""}`;for(let a of e.entries)r.set(n(a),a);let o=e.currency;for(let a of t){o=a.currency||o;for(let l of a.entries)r.set(n(l),l)}return{currency:o,entries:[...r.values()]}}var Q=(e)=>Math.round(e*1e6),q=(e)=>Math.round(e*1e6),Yc={currency:"USD",entries:[{meter:"edge.requests",provider:"aws",microCentsPerUnit:q(0.00075)},{meter:"edge.egress_gb",provider:"aws",includedQuantity:100,tiers:[{upToQuantity:10240,microCentsPerUnit:Q(8.5)},{upToQuantity:51200,microCentsPerUnit:Q(8)},{upToQuantity:null,microCentsPerUnit:Q(6)}]},{meter:"function.invocations",provider:"aws",includedQuantity:1e6,microCentsPerUnit:q(0.002)},{meter:"function.gb_seconds",provider:"aws",includedQuantity:400000,microCentsPerUnit:q(0.00166667)},{meter:"storage.gb_hours",provider:"aws",microCentsPerUnit:q(0.010958904109589041)},{meter:"object.egress_gb",provider:"aws",includedQuantity:100,microCentsPerUnit:Q(9)},{meter:"object.requests",provider:"aws",microCentsPerUnit:q(0.000039999999999999996)},{meter:"database.gb_hours",provider:"aws",microCentsPerUnit:q(0.015753424657534248)},{meter:"compute.instance_hours",provider:"aws",microCentsPerUnit:q(4.16)},{meter:"edge.egress_gb",provider:"hetzner",includedQuantity:20480,microCentsPerUnit:Q(0.108)},{meter:"object.egress_gb",provider:"hetzner",includedQuantity:1024,microCentsPerUnit:Q(0.108)},{meter:"compute.instance_hours",provider:"hetzner",microCentsPerUnit:q(0.95)},{meter:"storage.gb_hours",provider:"hetzner",microCentsPerUnit:q(0.006027397260273972)},{meter:"edge.requests",provider:"hetzner",microCentsPerUnit:0},{meter:"edge.requests",provider:"local",microCentsPerUnit:0},{meter:"edge.egress_gb",provider:"local",microCentsPerUnit:0},{meter:"function.invocations",provider:"local",microCentsPerUnit:0},{meter:"function.gb_seconds",provider:"local",microCentsPerUnit:0},{meter:"build.minutes",provider:"*",includedQuantity:6000,microCentsPerUnit:q(0.8)},{meter:"telemetry.ingest_gb",provider:"*",includedQuantity:5,microCentsPerUnit:Q(50)},{meter:"image.transformations",provider:"*",includedQuantity:5000,microCentsPerUnit:q(0.05)}]};var yt=new Map;function Lt(e){let t=yt.get(e);if(!t)t=new Intl.DateTimeFormat("en-US",{timeZone:e,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit",weekday:"short",hourCycle:"h23"}),yt.set(e,t);return t}var vr={Sun:0,Mon:1,Tue:2,Wed:3,Thu:4,Fri:5,Sat:6};function Ai(e){try{return Lt(e),!0}catch{return!1}}function Js(e,t){let r=Lt(t).formatToParts(e),n=(o)=>r.find((a)=>a.type===o)?.value??"0";return{year:Number(n("year")),month:Number(n("month")),day:Number(n("day")),hour:Number(n("hour")),minute:Number(n("minute")),second:Number(n("second")),weekday:vr[n("weekday")]??0}}function Zc(e,t){let r=Js(e,t);return Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second)-Math.floor(e.getTime()/1000)*1000}function Qt(e,t,r,n,o=0){let a=Date.UTC(t,r-1,n,o),l=new Date(a-Zc(new Date(a),e));return new Date(a-Zc(l,e))}function Ir(e,t){return new Date(Date.UTC(e,t-1,1)).toLocaleString("en-US",{month:"long",year:"numeric",timeZone:"UTC"})}function mt(e,t,r=new Date){let n=Ai(t)?t:"UTC",o=Js(r,n),a,l,u;if(e==="daily")a=Qt(n,o.year,o.month,o.day),l=Qt(n,o.year,o.month,o.day+1),u=`${o.year}-${String(o.month).padStart(2,"0")}-${String(o.day).padStart(2,"0")}`;else if(e==="weekly"){let g=(o.weekday+6)%7;a=Qt(n,o.year,o.month,o.day-g),l=Qt(n,o.year,o.month,o.day-g+7);let m=Js(a,n);u=`week of ${m.year}-${String(m.month).padStart(2,"0")}-${String(m.day).padStart(2,"0")}`}else a=Qt(n,o.year,o.month,1),l=Qt(n,o.year,o.month+1,1),u=Ir(o.year,o.month);let p=l.getTime()-a.getTime(),E=Math.max(0,Math.min(p,r.getTime()-a.getTime()));return{start:a.toISOString(),end:l.toISOString(),elapsedMs:E,totalMs:p,label:u}}function Vf(e,t,r=new Date){let n=mt(e,t,r),o=new Date(new Date(n.start).getTime()-1),a=mt(e,t,o);return{...a,elapsedMs:a.totalMs}}function Lr(e){let r=(typeof e==="string"?new Date(e):e).getTime();if(!Number.isFinite(r))throw Error("hourBucket requires a valid date");return new Date(Math.floor(r/3600000)*3600000).toISOString()}function jf(e,t,r=9600){let n=Math.floor(new Date(e).getTime()/3600000)*3600000,o=new Date(t).getTime();if(!Number.isFinite(n)||!Number.isFinite(o))throw Error("hourBucketsBetween requires valid dates");let a=[];for(let l=n;l<o&&a.length<r;l+=3600000)a.push(new Date(l).toISOString());return a}import{createHash as Sr}from"node:crypto";var he=1073741824,ed=[{match:"request.count",meter:"edge.requests"},{match:"traffic.requests",meter:"edge.requests"},{match:"http.request",meter:"edge.requests",field:"count"},{match:"traffic.bytes_out",meter:"edge.egress_gb",scale:1/he},{match:"storage.egress.day",meter:"object.egress_gb",scale:1/he},{match:"storage.egress.month",meter:"object.egress_gb",scale:1/he,cumulative:!0},{match:"storage.egress.day_downloads",meter:"object.requests"},{match:"function.invocation",meter:"function.invocations",field:"count"},{match:"function.duration_ms",meter:"function.gb_seconds",scale:0.001},{match:"build.duration_ms",meter:"build.minutes",scale:0.000016666666666666667},{match:"telemetry.ingest_bytes",meter:"telemetry.ingest_gb",scale:1/he},{match:"image.transform",meter:"image.transformations",field:"count"}];function br(e,t){return e.match.endsWith("*")?t.startsWith(e.match.slice(0,-1)):e.match===t}function Gp(e,t=ed){return t.find((r)=>!r.match.endsWith("*")&&r.match===e)??t.find((r)=>br(r,e))}function Rr(e,t){let r=t.field??"value",n=r==="count"?1:r==="bytesOut"?e.bytesOut:r==="bytesIn"?e.bytesIn:r==="durationMs"?e.durationMs:e.value;if(n==null||!Number.isFinite(n))return;return n*(t.scale??1)}function qp(e,t){return Sr("sha256").update([t,e.meter,e.organizationId,e.projectId??"",e.environmentId??"",e.resourceId??"",e.timestamp].join("\x00")).digest("hex").slice(0,32)}class Xs{resetToleranceRatio;last=new Map;constructor(e=0.999){this.resetToleranceRatio=e}delta(e,t,r=new Date){if(!Number.isFinite(t)||t<0)return;let n=new Date(r).getTime(),o=this.last.get(e);if(!o)return this.last.set(e,{value:t,at:n}),t>0?t:void 0;if(n<o.at)return;if(t<o.value&&t>=o.value*this.resetToleranceRatio)return;if(this.last.set(e,{value:t,at:n}),t>=o.value){let a=t-o.value;return a>0?a:void 0}return t>0?t:void 0}prune(e){let t=e.getTime(),r=0;for(let[n,o]of this.last)if(o.at<t)this.last.delete(n),r++;return r}get size(){return this.last.size}}function vt(e,t){let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function td(e,t,r={}){let n=r.mappings??ed,o=r.counters,a=[];for(let l of t){let u=Gp(l.name,n);if(!u)continue;let p=Rr(l,u);if(p==null)continue;if(u.cumulative){if(!o)continue;let g=[l.projectId,l.environmentId??"",l.resourceId??"",l.name,l.source].join("\x00"),m=o.delta(g,p,l.timestamp);if(m==null)continue;p=m}if(!(p>0))continue;let E={organizationId:e,projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,provider:vt(l.attributes,"provider")??r.defaultProvider,region:l.region??vt(l.attributes,"region"),meter:u.meter,quantity:p,timestamp:l.timestamp,attributes:{source:l.source,signal:l.name}};a.push({...E,key:qp(E,l.id)})}return a}function rd(e){let t=new Map;for(let r of e){let n=new Date(Math.floor(new Date(r.timestamp).getTime()/3600000)*3600000).toISOString(),o=[r.organizationId,r.projectId??"",r.environmentId??"",r.resourceId??"",r.provider??"",r.region??"",r.meter,n].join("\x00"),a=t.get(o);if(a)a.quantity+=r.quantity;else t.set(o,{...r,timestamp:n})}return[...t.values()]}import{createHash as Yr}from"node:crypto";var qe=40,Fc=[{version:1,name:"core_control_plane",sql:`
       CREATE TABLE projects (
         id TEXT PRIMARY KEY,
         slug TEXT NOT NULL UNIQUE,
@@ -1610,8 +1610,8 @@ volumes:
 volumes:
   wordpress-data: {}
   database-data: {}
-`}];function Br(){return Er.map(({source:e,...t})=>({...t,source:`builtin:${t.id}`,lastVerifiedAt:ii,builtin:!0,checksum:pr("sha256").update(e).digest("hex"),exposedServices:[...t.exposedServices],inputs:t.inputs.map((r)=>({...r}))}))}function Bf(e,t){return Br().find((r)=>r.id===e&&(!t||r.version===t))}function Vc(e,t,r,n){let o=Er.find((l)=>l.id===e&&(!n||l.version===n));if(!o)throw Error(`Compose template ${e}${n?`@${n}`:""} was not found`);let a=o.source;for(let l of o.inputs){let u=t[l.name]??("default"in l?l.default:void 0);if(l.required&&!u)throw Error(`Template input ${l.name} is required`);if(u&&!/^[A-Za-z0-9._:/@+-]{1,255}$/.test(u))throw Error(`Template input ${l.name} contains unsupported characters`);a=a.replaceAll(`{{${l.name}}}`,u??"")}return kr(a,r)}function lI(e,t){if(Buffer.byteLength(e)>1048576)throw Error("Compose catalog exceeds the 1 MiB limit");let r;try{r=JSON.parse(e)}catch{throw Error("Compose catalog must be valid JSON")}if(r.apiVersion!=="ts-cloud.dev/compose-catalog/v1"||!Array.isArray(r.templates))throw Error("Compose catalog must use ts-cloud.dev/compose-catalog/v1 and contain templates");let n=String(r.source??"").trim();if(!/^https:\/\//.test(n)&&!n.startsWith("file:"))throw Error("Compose catalog source must be HTTPS or an explicit file: source");let o=[],a=[];for(let[l,u]of r.templates.slice(0,100).entries()){let p=u&&typeof u==="object"&&!Array.isArray(u)?u:{},E=`templates[${l}]`,g=String(p.compose??""),m=pr("sha256").update(g).digest("hex");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(String(p.id??""))||!/^\d+\.\d+\.\d+$/.test(String(p.version??""))){o.push({severity:"error",path:E,code:"template.identity",message:"Template id and semantic version are required."});continue}if(String(p.checksum??"")!==m){o.push({severity:"error",path:`${E}.checksum`,code:"template.checksum",message:"Template checksum does not match its Compose source."});continue}let T=kr(g,{name:String(p.name??p.id),projectId:t.projectId,environmentId:t.environmentId});o.push(...T.diagnostics.map((_)=>({..._,path:`${E}.compose.${_.path}`})));let h={id:String(p.id),name:String(p.name??p.id),description:String(p.description??""),category:String(p.category??"custom"),version:String(p.version),source:n,sourceVersion:String(p.sourceVersion??p.version),architecture:String(p.architecture??Object.keys(T.manifest.spec.services).join(" + ")),minimumResources:{cpu:Math.max(0.1,Number(p.minimumResources?.cpu)||1),memoryMb:Math.max(128,Number(p.minimumResources?.memoryMb)||512)},exposedServices:Array.isArray(p.exposedServices)?p.exposedServices.map(String):[],maintenanceNotes:String(p.maintenanceNotes??""),lastVerifiedAt:String(p.lastVerifiedAt??""),inputs:[],checksum:m,builtin:!1};a.push({template:h,parsed:T})}return{valid:!o.some((l)=>l.severity==="error"),source:n,templates:a,diagnostics:o}}function uI(e,t,r,n,o,a){let l=Bf(r,a);if(!l)throw Error(`Compose template ${r}@${a} was not found`);let u=Vc(r,n,o,a);return{template:l,parsed:u,templateChanges:qc(t,u.manifest),userChanges:qc(t,e)}}var Pe=/^[a-z0-9][a-z0-9_.-]{0,62}$/;function w(e){return`'${e.replaceAll("'","'\\''")}'`}function Hs(e){return`${e.metadata.slug}-${e.metadata.environmentId.slice(0,8)}`.replace(/[^a-z0-9_-]/g,"-").slice(0,63)}function pI(e,t,r={}){let n=Hs(e),o=`/opt/ts-cloud/compose/${n}`,a=`${o}/compose.yaml`,l=`docker compose --project-name ${w(n)} --file ${w(a)}`;if(r.service&&!Pe.test(r.service))throw Error("Unsafe Compose service name");if(t==="deploy"||t==="redeploy"){let u=Buffer.from(Gc(e)).toString("base64");return`install -d -m 0750 ${w(o)} && printf %s ${w(u)} | base64 --decode > ${w(a)} && chmod 0640 ${w(a)} && ${l} config --quiet && ${l} up --detach --remove-orphans --wait${t==="redeploy"?" --force-recreate":""}`}if(t==="start")return`${l} start${r.service?` ${w(r.service)}`:""}`;if(t==="stop")return`${l} stop${r.service?` ${w(r.service)}`:""}`;if(t==="status")return`${l} ps --format json`;return`${l} down --remove-orphans${r.removeVolumes?" --volumes":""}`}function gI(e,t,r){if(!Pe.test(t)||!Number.isInteger(r)||r<0||r>100)throw Error("Scale requires a safe service name and 0-100 replicas");let n=Hs(e);return`docker compose --project-name ${w(n)} --file ${w(`/opt/ts-cloud/compose/${n}/compose.yaml`)} up --detach --wait --scale ${w(`${t}=${r}`)}`}function jc(e,t,r=200){if(!Pe.test(t))throw Error("Unsafe Compose service name");let n=Hs(e);return`docker compose --project-name ${w(n)} --file ${w(`/opt/ts-cloud/compose/${n}/compose.yaml`)} logs --no-color --timestamps --tail ${Math.max(1,Math.min(2000,Math.floor(r)))} ${w(t)}`}function zc(e,t,r=["sh"]){if(!Pe.test(t)||!r.length||r.some((o)=>o.includes("\x00")||o.length>1024))throw Error("Unsafe Compose shell request");let n=Hs(e);return`docker compose --project-name ${w(n)} --file ${w(`/opt/ts-cloud/compose/${n}/compose.yaml`)} exec ${w(t)} ${r.map(w).join(" ")}`}import{mkdir as lt,readdir as li,rm as ui,stat as pi}from"node:fs/promises";import{basename as mi,resolve as mr,sep as gi}from"node:path";var ct=/^[a-z0-9][a-z0-9_.-]{1,62}$/,oi=/^0?[0-7]{3}$/,si=["/","/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run","/var/lib/docker","/var/lib/containers"],ai=["create","attach","detach","resize","snapshot","restore","delete","adopt","usage"],di=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function Of(e){return Object.fromEntries(ai.map((t)=>[t,{supported:!1,reason:e}]))}function Vs(e,t={}){let r=Of("This storage driver does not support the operation.");for(let n of e)r[n]={supported:!0};return{...r,...t}}function Lf(e){if(!e.startsWith("/")||e.includes("\x00")||e.split("/").includes(".."))throw Error("Mount target must be an absolute normalized path without traversal.");let t=e.replace(/\/+$/,"")||"/";if(si.some((r)=>t===r||t.startsWith(`${r}/`)))throw Error(`Mount target ${e} is a protected host or runtime path.`)}function $f(e){if(Lf(e.targetPath),e.uid!=null&&(!Number.isInteger(e.uid)||e.uid<0))throw Error("Mount UID must be a non-negative integer.");if(e.gid!=null&&(!Number.isInteger(e.gid)||e.gid<0))throw Error("Mount GID must be a non-negative integer.");if(e.mode&&!oi.test(e.mode))throw Error("Mount mode must be a three or four digit octal value.");if(e.propagation&&!["private","rprivate","shared","rshared","slave","rslave"].includes(e.propagation))throw Error("Unsupported mount propagation mode.")}class js{store;drivers;now;queue;constructor(e,t,r,n=()=>new Date){this.store=e;this.drivers=t;this.now=n;this.queue=r??new c(e.controlPlane)}driver(e,t){let r=this.drivers.find((n)=>n.provider===e&&n.type===t);if(!r)throw Error(`No ${e} ${t} volume driver is configured.`);return r}capability(e,t){let r=e.capabilities[t];if(!r?.supported)throw Error(r?.reason??`${t} is unsupported for this volume.`)}queueMutation(e,t,r,n,o){return this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:o??e.resourceId,actorId:n,kind:t,idempotencyKey:`${t}:${e.id}:v${e.version}:${JSON.stringify(r)}`,correlationId:`volume:${e.id}`,input:{volumeId:e.id,...r},lockKey:o?`resource:${o}`:`volume:${e.id}`,providerKey:e.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}create(e){if(!ct.test(e.name))throw Error("Volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");if(e.capacityBytes!=null&&(!Number.isSafeInteger(e.capacityBytes)||e.capacityBytes<=0))throw Error("Volume capacity must be a positive byte count.");let t=this.store.controlPlane.getProject(e.projectId),r=e.environmentId?this.store.controlPlane.listEnvironments(e.projectId).find((E)=>E.id===e.environmentId):void 0,n=e.resourceId?this.store.controlPlane.getResource(e.resourceId):void 0;if(!t||t.organizationId!==e.organizationId)throw Error("Volume project does not belong to the organization.");if(e.environmentId&&!r)throw Error("Volume environment does not belong to the project.");if(n&&(n.projectId!==e.projectId||n.environmentId!==e.environmentId||n.kind!=="volume"))throw Error("Volume resource does not belong to the selected scope.");let o=n??this.store.controlPlane.createResource({projectId:e.projectId,environmentId:e.environmentId,kind:"volume",slug:e.name,name:e.name,provider:e.provider,desiredState:{type:e.type,capacityBytes:e.capacityBytes??null,filesystem:e.filesystem??null,encrypted:!!e.encrypted}}),a=this.driver(e.provider,e.type),l=a.capabilities(),u=this.store.create({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,resourceId:o.id,name:e.name,provider:e.provider,type:e.type,status:"pending",capacityBytes:e.capacityBytes,filesystem:e.filesystem,encrypted:!!e.encrypted,capabilities:l,desiredState:e.desiredState??{},observedState:{}}),p=this.queueMutation(u,"volume.create",{},e.actorId);return this.store.audit({organizationId:u.organizationId,projectId:u.projectId,environmentId:u.environmentId,actorId:e.actorId,type:"volume.create.queued",volumeId:u.id,payload:{name:u.name,type:u.type}}),{volume:u,operation:p}}attach(e,t){let r=this.store.get(e);if(!r)throw Error("Volume was not found.");this.capability(r,"attach"),$f(t);let n=this.store.controlPlane.getResource(t.resourceId);if(!n||n.projectId!==r.projectId||n.environmentId!==r.environmentId)throw Error("Cross-project or cross-environment volume attachments are forbidden.");let o=this.store.upsertAttachment({volumeId:e,resourceId:t.resourceId,targetPath:t.targetPath,readOnly:!!t.readOnly,uid:t.uid,gid:t.gid,mode:t.mode,propagation:t.propagation??"private",driverOptions:t.driverOptions??{},desiredState:"attached",observedState:"pending"}),a=this.queueMutation(r,"volume.attach",{attachmentId:o.id},t.actorId,t.resourceId);return this.store.updateAttachment(o.id,{operationId:a.id}),this.store.update(r.id,r.version,{status:"attaching"}),this.store.audit({organizationId:r.organizationId,projectId:r.projectId,environmentId:r.environmentId,actorId:t.actorId,type:"volume.attach.queued",volumeId:e,payload:{resourceId:t.resourceId,targetPath:t.targetPath}}),{volume:this.store.get(r.id),attachment:this.store.attachment(o.id),operation:a}}detach(e,t,r={}){let n=this.store.get(e),o=this.store.attachment(t);if(!n||!o||o.volumeId!==e)throw Error("Volume attachment was not found.");if(this.capability(n,"detach"),o.observedState==="attached"&&(!r.drained||!r.unmounted))throw Error("Detach requires completed workload drain and filesystem unmount checkpoints.");if(r.force&&r.confirmation!==`detach ${n.name}`)throw Error(`Force detach requires confirmation: detach ${n.name}`);let a=this.store.updateAttachment(t,{desiredState:"detached"}),l=this.queueMutation(n,"volume.detach",{attachmentId:t,force:!!r.force},r.actorId,o.resourceId);return this.store.updateAttachment(t,{operationId:l.id}),this.store.update(n.id,n.version,{status:"detaching"}),{volume:this.store.get(e),attachment:a,operation:l}}resize(e,t,r={}){let n=this.store.get(e);if(!n)throw Error("Volume was not found.");if(this.capability(n,"resize"),!Number.isSafeInteger(t)||t<=0)throw Error("Volume capacity must be a positive byte count.");if(n.capacityBytes!=null&&t<n.capacityBytes)throw Error("Volume shrinking is not supported because it can corrupt data.");let o=n.capabilities.resize;if(o.minimumBytes&&t<o.minimumBytes)throw Error(`Minimum supported capacity is ${o.minimumBytes} bytes.`);if(o.maximumBytes&&t>o.maximumBytes)throw Error(`Maximum supported capacity is ${o.maximumBytes} bytes.`);if(o.online===!1&&!r.drained)throw Error("This resize requires a completed workload drain checkpoint.");let a=this.store.update(e,n.version,{status:"resizing",desiredState:{...n.desiredState,capacityBytes:t}}),l=this.queueMutation(a,"volume.resize",{capacityBytes:t},r.actorId);return{volume:a,operation:l}}snapshot(e,t={}){let r=this.store.get(e);if(!r)throw Error("Volume was not found.");this.capability(r,"snapshot");let n=this.store.createSnapshot({volumeId:e,name:t.name??`${r.name}-${this.now().toISOString().replace(/[:.]/g,"-")}`,status:"pending",encrypted:r.encrypted,metadata:{}}),o=this.store.update(e,r.version,{status:"snapshotting"}),a=this.queueMutation(o,"volume.snapshot",{snapshotId:n.id},t.actorId);return{volume:o,snapshot:n,operation:a}}restore(e,t){let r=this.store.snapshot(e),n=r?this.store.get(r.volumeId):void 0;if(!r||!n||r.status!=="available")throw Error("An available volume snapshot is required for restore.");if(this.capability(n,"restore"),!ct.test(t.name))throw Error("Restored volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");let o=this.store.controlPlane.createResource({projectId:n.projectId,environmentId:n.environmentId,kind:"volume",slug:t.name,name:t.name,provider:n.provider,desiredState:{restoreFromSnapshotId:r.id}}),a=this.store.create({organizationId:n.organizationId,projectId:n.projectId,environmentId:n.environmentId,resourceId:o.id,name:t.name,provider:n.provider,type:n.type,status:"pending",capacityBytes:r.sizeBytes??n.capacityBytes,filesystem:n.filesystem,encrypted:r.encrypted,capabilities:n.capabilities,desiredState:{restoreFromSnapshotId:r.id,sourceVolumeId:n.id},observedState:{}}),l=this.queueMutation(a,"volume.restore",{snapshotId:r.id,sourceVolumeId:n.id},t.actorId);return{volume:a,snapshot:r,operation:l}}delete(e,t){let r=this.store.get(e);if(!r)throw Error("Volume was not found.");this.capability(r,"delete");let n=this.store.attachments(e).filter((u)=>u.desiredState==="attached"||u.observedState==="attached");if(n.length)throw Error(`Detach ${n.length} active consumer(s) before deleting this volume.`);if(!t.recentAuthAt||this.now().getTime()-new Date(t.recentAuthAt).getTime()>900000)throw Error("Volume deletion requires authentication verified within the last 15 minutes.");if(t.confirmation!==r.name)throw Error(`Type ${r.name} to confirm permanent volume deletion.`);if(!(r.lastBackupAt&&this.now().getTime()-new Date(r.lastBackupAt).getTime()<=86400000)&&(!t.backupOverride||t.backupOverrideConfirmation!==`delete without backup ${r.name}`))throw Error(`A verified backup from the last 24 hours is required, or confirm: delete without backup ${r.name}`);let a=this.store.update(e,r.version,{status:"deleting"}),l=this.queueMutation(a,"volume.delete",{backupOverride:!!t.backupOverride},t.actorId);return{volume:a,operation:l}}async discover(e){let t=new Set;for(let r of this.drivers)for(let n of await r.discover(e.projectId,e.environmentId)){let o=this.store.list({projectId:e.projectId,environmentId:e.environmentId}).find((l)=>l.provider===r.provider&&l.providerId===n.providerId);if(o){t.add(o.id),this.store.update(o.id,o.version,{capacityBytes:n.capacityBytes,usedBytes:n.usedBytes,filesystem:n.filesystem,encrypted:n.encrypted??o.encrypted,observedState:n.raw??{},status:o.status==="orphaned"?"available":o.status,orphanedAt:void 0});continue}let a=this.store.create({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,name:`orphan-${n.providerId}`.toLowerCase().replace(/[^a-z0-9_.-]/g,"-").slice(0,63),provider:r.provider,providerId:n.providerId,type:r.type,status:"orphaned",capacityBytes:n.capacityBytes,usedBytes:n.usedBytes,filesystem:n.filesystem,encrypted:!!n.encrypted,capabilities:r.capabilities(),desiredState:{},observedState:n.raw??{},orphanedAt:this.now().toISOString()});t.add(a.id)}return this.store.list({projectId:e.projectId,environmentId:e.environmentId})}adopt(e,t){let r=this.store.get(e);if(!r||r.status!=="orphaned")throw Error("Only discovered orphan volumes can be adopted.");if(!ct.test(t.name))throw Error("Volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");let n=this.store.update(e,r.version,{name:t.name,status:"available",adoptedAt:this.now().toISOString(),orphanedAt:void 0});return this.store.audit({organizationId:r.organizationId,projectId:r.projectId,environmentId:r.environmentId,actorId:t.actorId,type:"volume.adopted",volumeId:e,payload:{providerId:r.providerId??null}}),n}}function ci(e){let t=di(e.input);if(typeof t.volumeId!=="string")throw Error("Queued volume operation is missing its volume identity.");return{volumeId:t.volumeId,sourceVolumeId:typeof t.sourceVolumeId==="string"?t.sourceVolumeId:void 0,attachmentId:typeof t.attachmentId==="string"?t.attachmentId:void 0,snapshotId:typeof t.snapshotId==="string"?t.snapshotId:void 0,capacityBytes:typeof t.capacityBytes==="number"?t.capacityBytes:void 0,force:t.force===!0}}function Wc(e,t){let r=(o)=>{let a=t.find((l)=>l.provider===o.provider&&l.type===o.type);if(!a)throw Error(`No ${o.provider} ${o.type} volume driver is configured.`);return a},n=async(o)=>{let a=ci(o.operation),l=e.get(a.volumeId);if(!l)throw Error("Queued volume was not found.");let u=r(l);o.checkpoint("preflight","Validating persistent volume identity and capabilities."),o.throwIfCancellationRequested();let p;if(o.operation.kind==="volume.create")p=await u.create(l),e.update(l.id,l.version,{providerId:p.providerId,capacityBytes:p.capacityBytes??l.capacityBytes,usedBytes:p.usedBytes,filesystem:p.filesystem??l.filesystem,encrypted:p.encrypted??l.encrypted,observedState:p.raw??{},status:"available"});else if(o.operation.kind==="volume.attach"){let E=a.attachmentId?e.attachment(a.attachmentId):void 0;if(!E)throw Error("Queued volume attachment was not found.");await u.attach(l,E),e.updateAttachment(E.id,{observedState:"attached",lastError:void 0}),e.update(l.id,l.version,{status:"attached"})}else if(o.operation.kind==="volume.detach"){let E=a.attachmentId?e.attachment(a.attachmentId):void 0;if(!E)throw Error("Queued volume attachment was not found.");await u.detach(l,E,{force:a.force}),e.updateAttachment(E.id,{observedState:"detached",lastError:void 0});let g=e.attachments(l.id).some((m)=>m.id!==E.id&&m.observedState==="attached");e.update(l.id,l.version,{status:g?"attached":"available"})}else if(o.operation.kind==="volume.resize"){if(!a.capacityBytes)throw Error("Queued volume resize is missing its capacity.");p=await u.resize(l,a.capacityBytes),e.update(l.id,l.version,{capacityBytes:p.capacityBytes??a.capacityBytes,usedBytes:p.usedBytes??l.usedBytes,observedState:p.raw??l.observedState,status:e.attachments(l.id).some((E)=>E.observedState==="attached")?"attached":"available"})}else if(o.operation.kind==="volume.snapshot"){let E=a.snapshotId?e.snapshot(a.snapshotId):void 0;if(!E)throw Error("Queued volume snapshot was not found.");let g=await u.snapshot(l,E);e.updateSnapshot(E.id,{...g,status:"available"}),e.update(l.id,l.version,{status:e.attachments(l.id).some((m)=>m.observedState==="attached")?"attached":"available",lastBackupAt:new Date().toISOString()})}else if(o.operation.kind==="volume.restore"){let E=a.snapshotId?e.snapshot(a.snapshotId):void 0,g=a.sourceVolumeId?e.get(a.sourceVolumeId):void 0;if(!E||!g)throw Error("Queued volume restore source was not found.");p=await u.restore(g,E,l),e.update(l.id,l.version,{providerId:p.providerId,capacityBytes:p.capacityBytes??l.capacityBytes,usedBytes:p.usedBytes,filesystem:p.filesystem??l.filesystem,encrypted:p.encrypted??l.encrypted,observedState:p.raw??{},status:"available"})}else if(o.operation.kind==="volume.delete")await u.delete(l),e.update(l.id,l.version,{status:"deleted",deletedAt:new Date().toISOString()});return o.checkpoint("finalize","Persisted observed volume state."),{volumeId:l.id,status:e.get(l.id)?.status??"deleted"}};return Object.fromEntries(["volume.create","volume.attach","volume.detach","volume.resize","volume.snapshot","volume.restore","volume.delete"].map((o)=>[o,n]))}var _i=async(e)=>{let t=Bun.spawn(["docker",...e],{stdout:"pipe",stderr:"pipe"}),[r,n,o]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:n,stderr:o}},ee=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;class xr{command;provider="docker";type="docker";constructor(e=_i){this.command=e}capabilities(){return Vs(["create","attach","detach","delete","adopt","usage"],{resize:{supported:!1,reason:"Docker named volumes do not expose a portable capacity resize operation."},snapshot:{supported:!1,reason:"Attach a volume backup policy to create verified recovery points."},restore:{supported:!1,reason:"Restore this volume from its verified backup recovery point."}})}async run(e,t=!1){let r=await this.command(e);if(r.code!==0&&!t)throw Error(`Docker volume command failed: ${r.stderr.trim()||r.code}`);return r.stdout}async inspect(e){let t=await this.run(["volume","inspect",e],!0);if(!t.trim())return;let r;try{r=JSON.parse(t)[0]}catch{return}return{providerId:String(r.Name??e),raw:{driver:String(r.Driver??"local"),mountpoint:String(r.Mountpoint??""),labels:r.Labels??{}}}}async discover(e,t){let r=await this.run(["volume","ls","--format","{{.Name}}"]),n=[];for(let o of r.split(`
+`}];function Br(){return Er.map(({source:e,...t})=>({...t,source:`builtin:${t.id}`,lastVerifiedAt:ii,builtin:!0,checksum:pr("sha256").update(e).digest("hex"),exposedServices:[...t.exposedServices],inputs:t.inputs.map((r)=>({...r}))}))}function Bf(e,t){return Br().find((r)=>r.id===e&&(!t||r.version===t))}function Vc(e,t,r,n){let o=Er.find((l)=>l.id===e&&(!n||l.version===n));if(!o)throw Error(`Compose template ${e}${n?`@${n}`:""} was not found`);let a=o.source;for(let l of o.inputs){let u=t[l.name]??("default"in l?l.default:void 0);if(l.required&&!u)throw Error(`Template input ${l.name} is required`);if(u&&!/^[A-Za-z0-9._:/@+-]{1,255}$/.test(u))throw Error(`Template input ${l.name} contains unsupported characters`);a=a.replaceAll(`{{${l.name}}}`,u??"")}return kr(a,r)}function lI(e,t){if(Buffer.byteLength(e)>1048576)throw Error("Compose catalog exceeds the 1 MiB limit");let r;try{r=JSON.parse(e)}catch{throw Error("Compose catalog must be valid JSON")}if(r.apiVersion!=="ts-cloud.dev/compose-catalog/v1"||!Array.isArray(r.templates))throw Error("Compose catalog must use ts-cloud.dev/compose-catalog/v1 and contain templates");let n=String(r.source??"").trim();if(!/^https:\/\//.test(n)&&!n.startsWith("file:"))throw Error("Compose catalog source must be HTTPS or an explicit file: source");let o=[],a=[];for(let[l,u]of r.templates.slice(0,100).entries()){let p=u&&typeof u==="object"&&!Array.isArray(u)?u:{},E=`templates[${l}]`,g=String(p.compose??""),m=pr("sha256").update(g).digest("hex");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(String(p.id??""))||!/^\d+\.\d+\.\d+$/.test(String(p.version??""))){o.push({severity:"error",path:E,code:"template.identity",message:"Template id and semantic version are required."});continue}if(String(p.checksum??"")!==m){o.push({severity:"error",path:`${E}.checksum`,code:"template.checksum",message:"Template checksum does not match its Compose source."});continue}let T=kr(g,{name:String(p.name??p.id),projectId:t.projectId,environmentId:t.environmentId});o.push(...T.diagnostics.map((_)=>({..._,path:`${E}.compose.${_.path}`})));let h={id:String(p.id),name:String(p.name??p.id),description:String(p.description??""),category:String(p.category??"custom"),version:String(p.version),source:n,sourceVersion:String(p.sourceVersion??p.version),architecture:String(p.architecture??Object.keys(T.manifest.spec.services).join(" + ")),minimumResources:{cpu:Math.max(0.1,Number(p.minimumResources?.cpu)||1),memoryMb:Math.max(128,Number(p.minimumResources?.memoryMb)||512)},exposedServices:Array.isArray(p.exposedServices)?p.exposedServices.map(String):[],maintenanceNotes:String(p.maintenanceNotes??""),lastVerifiedAt:String(p.lastVerifiedAt??""),inputs:[],checksum:m,builtin:!1};a.push({template:h,parsed:T})}return{valid:!o.some((l)=>l.severity==="error"),source:n,templates:a,diagnostics:o}}function uI(e,t,r,n,o,a){let l=Bf(r,a);if(!l)throw Error(`Compose template ${r}@${a} was not found`);let u=Vc(r,n,o,a);return{template:l,parsed:u,templateChanges:qc(t,u.manifest),userChanges:qc(t,e)}}var Pe=/^[a-z0-9][a-z0-9_.-]{0,62}$/;function w(e){return`'${e.replaceAll("'","'\\''")}'`}function Hs(e){return`${e.metadata.slug}-${e.metadata.environmentId.slice(0,8)}`.replace(/[^a-z0-9_-]/g,"-").slice(0,63)}function pI(e,t,r={}){let n=Hs(e),o=`/opt/ts-cloud/compose/${n}`,a=`${o}/compose.yaml`,l=`docker compose --project-name ${w(n)} --file ${w(a)}`;if(r.service&&!Pe.test(r.service))throw Error("Unsafe Compose service name");if(t==="deploy"||t==="redeploy"){let u=Buffer.from(Gc(e)).toString("base64");return`install -d -m 0750 ${w(o)} && printf %s ${w(u)} | base64 --decode > ${w(a)} && chmod 0640 ${w(a)} && ${l} config --quiet && ${l} up --detach --remove-orphans --wait${t==="redeploy"?" --force-recreate":""}`}if(t==="start")return`${l} start${r.service?` ${w(r.service)}`:""}`;if(t==="stop")return`${l} stop${r.service?` ${w(r.service)}`:""}`;if(t==="status")return`${l} ps --format json`;return`${l} down --remove-orphans${r.removeVolumes?" --volumes":""}`}function gI(e,t,r){if(!Pe.test(t)||!Number.isInteger(r)||r<0||r>100)throw Error("Scale requires a safe service name and 0-100 replicas");let n=Hs(e);return`docker compose --project-name ${w(n)} --file ${w(`/opt/ts-cloud/compose/${n}/compose.yaml`)} up --detach --wait --scale ${w(`${t}=${r}`)}`}function jc(e,t,r=200){if(!Pe.test(t))throw Error("Unsafe Compose service name");let n=Hs(e);return`docker compose --project-name ${w(n)} --file ${w(`/opt/ts-cloud/compose/${n}/compose.yaml`)} logs --no-color --timestamps --tail ${Math.max(1,Math.min(2000,Math.floor(r)))} ${w(t)}`}function zc(e,t,r=["sh"]){if(!Pe.test(t)||!r.length||r.some((o)=>o.includes("\x00")||o.length>1024))throw Error("Unsafe Compose shell request");let n=Hs(e);return`docker compose --project-name ${w(n)} --file ${w(`/opt/ts-cloud/compose/${n}/compose.yaml`)} exec ${w(t)} ${r.map(w).join(" ")}`}import{mkdir as lt,readdir as li,rm as ui,stat as pi}from"node:fs/promises";import{basename as mi,resolve as mr,sep as gi}from"node:path";var ct=/^[a-z0-9][a-z0-9_.-]{1,62}$/,oi=/^0?[0-7]{3}$/,si=["/","/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run","/var/lib/docker","/var/lib/containers"],ai=["create","attach","detach","resize","snapshot","restore","delete","adopt","usage"],di=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function xf(e){return Object.fromEntries(ai.map((t)=>[t,{supported:!1,reason:e}]))}function Vs(e,t={}){let r=xf("This storage driver does not support the operation.");for(let n of e)r[n]={supported:!0};return{...r,...t}}function Lf(e){if(!e.startsWith("/")||e.includes("\x00")||e.split("/").includes(".."))throw Error("Mount target must be an absolute normalized path without traversal.");let t=e.replace(/\/+$/,"")||"/";if(si.some((r)=>t===r||t.startsWith(`${r}/`)))throw Error(`Mount target ${e} is a protected host or runtime path.`)}function $f(e){if(Lf(e.targetPath),e.uid!=null&&(!Number.isInteger(e.uid)||e.uid<0))throw Error("Mount UID must be a non-negative integer.");if(e.gid!=null&&(!Number.isInteger(e.gid)||e.gid<0))throw Error("Mount GID must be a non-negative integer.");if(e.mode&&!oi.test(e.mode))throw Error("Mount mode must be a three or four digit octal value.");if(e.propagation&&!["private","rprivate","shared","rshared","slave","rslave"].includes(e.propagation))throw Error("Unsupported mount propagation mode.")}class js{store;drivers;now;queue;constructor(e,t,r,n=()=>new Date){this.store=e;this.drivers=t;this.now=n;this.queue=r??new c(e.controlPlane)}driver(e,t){let r=this.drivers.find((n)=>n.provider===e&&n.type===t);if(!r)throw Error(`No ${e} ${t} volume driver is configured.`);return r}capability(e,t){let r=e.capabilities[t];if(!r?.supported)throw Error(r?.reason??`${t} is unsupported for this volume.`)}queueMutation(e,t,r,n,o){return this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:o??e.resourceId,actorId:n,kind:t,idempotencyKey:`${t}:${e.id}:v${e.version}:${JSON.stringify(r)}`,correlationId:`volume:${e.id}`,input:{volumeId:e.id,...r},lockKey:o?`resource:${o}`:`volume:${e.id}`,providerKey:e.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}create(e){if(!ct.test(e.name))throw Error("Volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");if(e.capacityBytes!=null&&(!Number.isSafeInteger(e.capacityBytes)||e.capacityBytes<=0))throw Error("Volume capacity must be a positive byte count.");let t=this.store.controlPlane.getProject(e.projectId),r=e.environmentId?this.store.controlPlane.listEnvironments(e.projectId).find((E)=>E.id===e.environmentId):void 0,n=e.resourceId?this.store.controlPlane.getResource(e.resourceId):void 0;if(!t||t.organizationId!==e.organizationId)throw Error("Volume project does not belong to the organization.");if(e.environmentId&&!r)throw Error("Volume environment does not belong to the project.");if(n&&(n.projectId!==e.projectId||n.environmentId!==e.environmentId||n.kind!=="volume"))throw Error("Volume resource does not belong to the selected scope.");let o=n??this.store.controlPlane.createResource({projectId:e.projectId,environmentId:e.environmentId,kind:"volume",slug:e.name,name:e.name,provider:e.provider,desiredState:{type:e.type,capacityBytes:e.capacityBytes??null,filesystem:e.filesystem??null,encrypted:!!e.encrypted}}),a=this.driver(e.provider,e.type),l=a.capabilities(),u=this.store.create({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,resourceId:o.id,name:e.name,provider:e.provider,type:e.type,status:"pending",capacityBytes:e.capacityBytes,filesystem:e.filesystem,encrypted:!!e.encrypted,capabilities:l,desiredState:e.desiredState??{},observedState:{}}),p=this.queueMutation(u,"volume.create",{},e.actorId);return this.store.audit({organizationId:u.organizationId,projectId:u.projectId,environmentId:u.environmentId,actorId:e.actorId,type:"volume.create.queued",volumeId:u.id,payload:{name:u.name,type:u.type}}),{volume:u,operation:p}}attach(e,t){let r=this.store.get(e);if(!r)throw Error("Volume was not found.");this.capability(r,"attach"),$f(t);let n=this.store.controlPlane.getResource(t.resourceId);if(!n||n.projectId!==r.projectId||n.environmentId!==r.environmentId)throw Error("Cross-project or cross-environment volume attachments are forbidden.");let o=this.store.upsertAttachment({volumeId:e,resourceId:t.resourceId,targetPath:t.targetPath,readOnly:!!t.readOnly,uid:t.uid,gid:t.gid,mode:t.mode,propagation:t.propagation??"private",driverOptions:t.driverOptions??{},desiredState:"attached",observedState:"pending"}),a=this.queueMutation(r,"volume.attach",{attachmentId:o.id},t.actorId,t.resourceId);return this.store.updateAttachment(o.id,{operationId:a.id}),this.store.update(r.id,r.version,{status:"attaching"}),this.store.audit({organizationId:r.organizationId,projectId:r.projectId,environmentId:r.environmentId,actorId:t.actorId,type:"volume.attach.queued",volumeId:e,payload:{resourceId:t.resourceId,targetPath:t.targetPath}}),{volume:this.store.get(r.id),attachment:this.store.attachment(o.id),operation:a}}detach(e,t,r={}){let n=this.store.get(e),o=this.store.attachment(t);if(!n||!o||o.volumeId!==e)throw Error("Volume attachment was not found.");if(this.capability(n,"detach"),o.observedState==="attached"&&(!r.drained||!r.unmounted))throw Error("Detach requires completed workload drain and filesystem unmount checkpoints.");if(r.force&&r.confirmation!==`detach ${n.name}`)throw Error(`Force detach requires confirmation: detach ${n.name}`);let a=this.store.updateAttachment(t,{desiredState:"detached"}),l=this.queueMutation(n,"volume.detach",{attachmentId:t,force:!!r.force},r.actorId,o.resourceId);return this.store.updateAttachment(t,{operationId:l.id}),this.store.update(n.id,n.version,{status:"detaching"}),{volume:this.store.get(e),attachment:a,operation:l}}resize(e,t,r={}){let n=this.store.get(e);if(!n)throw Error("Volume was not found.");if(this.capability(n,"resize"),!Number.isSafeInteger(t)||t<=0)throw Error("Volume capacity must be a positive byte count.");if(n.capacityBytes!=null&&t<n.capacityBytes)throw Error("Volume shrinking is not supported because it can corrupt data.");let o=n.capabilities.resize;if(o.minimumBytes&&t<o.minimumBytes)throw Error(`Minimum supported capacity is ${o.minimumBytes} bytes.`);if(o.maximumBytes&&t>o.maximumBytes)throw Error(`Maximum supported capacity is ${o.maximumBytes} bytes.`);if(o.online===!1&&!r.drained)throw Error("This resize requires a completed workload drain checkpoint.");let a=this.store.update(e,n.version,{status:"resizing",desiredState:{...n.desiredState,capacityBytes:t}}),l=this.queueMutation(a,"volume.resize",{capacityBytes:t},r.actorId);return{volume:a,operation:l}}snapshot(e,t={}){let r=this.store.get(e);if(!r)throw Error("Volume was not found.");this.capability(r,"snapshot");let n=this.store.createSnapshot({volumeId:e,name:t.name??`${r.name}-${this.now().toISOString().replace(/[:.]/g,"-")}`,status:"pending",encrypted:r.encrypted,metadata:{}}),o=this.store.update(e,r.version,{status:"snapshotting"}),a=this.queueMutation(o,"volume.snapshot",{snapshotId:n.id},t.actorId);return{volume:o,snapshot:n,operation:a}}restore(e,t){let r=this.store.snapshot(e),n=r?this.store.get(r.volumeId):void 0;if(!r||!n||r.status!=="available")throw Error("An available volume snapshot is required for restore.");if(this.capability(n,"restore"),!ct.test(t.name))throw Error("Restored volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");let o=this.store.controlPlane.createResource({projectId:n.projectId,environmentId:n.environmentId,kind:"volume",slug:t.name,name:t.name,provider:n.provider,desiredState:{restoreFromSnapshotId:r.id}}),a=this.store.create({organizationId:n.organizationId,projectId:n.projectId,environmentId:n.environmentId,resourceId:o.id,name:t.name,provider:n.provider,type:n.type,status:"pending",capacityBytes:r.sizeBytes??n.capacityBytes,filesystem:n.filesystem,encrypted:r.encrypted,capabilities:n.capabilities,desiredState:{restoreFromSnapshotId:r.id,sourceVolumeId:n.id},observedState:{}}),l=this.queueMutation(a,"volume.restore",{snapshotId:r.id,sourceVolumeId:n.id},t.actorId);return{volume:a,snapshot:r,operation:l}}delete(e,t){let r=this.store.get(e);if(!r)throw Error("Volume was not found.");this.capability(r,"delete");let n=this.store.attachments(e).filter((u)=>u.desiredState==="attached"||u.observedState==="attached");if(n.length)throw Error(`Detach ${n.length} active consumer(s) before deleting this volume.`);if(!t.recentAuthAt||this.now().getTime()-new Date(t.recentAuthAt).getTime()>900000)throw Error("Volume deletion requires authentication verified within the last 15 minutes.");if(t.confirmation!==r.name)throw Error(`Type ${r.name} to confirm permanent volume deletion.`);if(!(r.lastBackupAt&&this.now().getTime()-new Date(r.lastBackupAt).getTime()<=86400000)&&(!t.backupOverride||t.backupOverrideConfirmation!==`delete without backup ${r.name}`))throw Error(`A verified backup from the last 24 hours is required, or confirm: delete without backup ${r.name}`);let a=this.store.update(e,r.version,{status:"deleting"}),l=this.queueMutation(a,"volume.delete",{backupOverride:!!t.backupOverride},t.actorId);return{volume:a,operation:l}}async discover(e){let t=new Set;for(let r of this.drivers)for(let n of await r.discover(e.projectId,e.environmentId)){let o=this.store.list({projectId:e.projectId,environmentId:e.environmentId}).find((l)=>l.provider===r.provider&&l.providerId===n.providerId);if(o){t.add(o.id),this.store.update(o.id,o.version,{capacityBytes:n.capacityBytes,usedBytes:n.usedBytes,filesystem:n.filesystem,encrypted:n.encrypted??o.encrypted,observedState:n.raw??{},status:o.status==="orphaned"?"available":o.status,orphanedAt:void 0});continue}let a=this.store.create({organizationId:e.organizationId,projectId:e.projectId,environmentId:e.environmentId,name:`orphan-${n.providerId}`.toLowerCase().replace(/[^a-z0-9_.-]/g,"-").slice(0,63),provider:r.provider,providerId:n.providerId,type:r.type,status:"orphaned",capacityBytes:n.capacityBytes,usedBytes:n.usedBytes,filesystem:n.filesystem,encrypted:!!n.encrypted,capabilities:r.capabilities(),desiredState:{},observedState:n.raw??{},orphanedAt:this.now().toISOString()});t.add(a.id)}return this.store.list({projectId:e.projectId,environmentId:e.environmentId})}adopt(e,t){let r=this.store.get(e);if(!r||r.status!=="orphaned")throw Error("Only discovered orphan volumes can be adopted.");if(!ct.test(t.name))throw Error("Volume names must be 2-63 lowercase letters, numbers, dots, dashes, or underscores.");let n=this.store.update(e,r.version,{name:t.name,status:"available",adoptedAt:this.now().toISOString(),orphanedAt:void 0});return this.store.audit({organizationId:r.organizationId,projectId:r.projectId,environmentId:r.environmentId,actorId:t.actorId,type:"volume.adopted",volumeId:e,payload:{providerId:r.providerId??null}}),n}}function ci(e){let t=di(e.input);if(typeof t.volumeId!=="string")throw Error("Queued volume operation is missing its volume identity.");return{volumeId:t.volumeId,sourceVolumeId:typeof t.sourceVolumeId==="string"?t.sourceVolumeId:void 0,attachmentId:typeof t.attachmentId==="string"?t.attachmentId:void 0,snapshotId:typeof t.snapshotId==="string"?t.snapshotId:void 0,capacityBytes:typeof t.capacityBytes==="number"?t.capacityBytes:void 0,force:t.force===!0}}function Wc(e,t){let r=(o)=>{let a=t.find((l)=>l.provider===o.provider&&l.type===o.type);if(!a)throw Error(`No ${o.provider} ${o.type} volume driver is configured.`);return a},n=async(o)=>{let a=ci(o.operation),l=e.get(a.volumeId);if(!l)throw Error("Queued volume was not found.");let u=r(l);o.checkpoint("preflight","Validating persistent volume identity and capabilities."),o.throwIfCancellationRequested();let p;if(o.operation.kind==="volume.create")p=await u.create(l),e.update(l.id,l.version,{providerId:p.providerId,capacityBytes:p.capacityBytes??l.capacityBytes,usedBytes:p.usedBytes,filesystem:p.filesystem??l.filesystem,encrypted:p.encrypted??l.encrypted,observedState:p.raw??{},status:"available"});else if(o.operation.kind==="volume.attach"){let E=a.attachmentId?e.attachment(a.attachmentId):void 0;if(!E)throw Error("Queued volume attachment was not found.");await u.attach(l,E),e.updateAttachment(E.id,{observedState:"attached",lastError:void 0}),e.update(l.id,l.version,{status:"attached"})}else if(o.operation.kind==="volume.detach"){let E=a.attachmentId?e.attachment(a.attachmentId):void 0;if(!E)throw Error("Queued volume attachment was not found.");await u.detach(l,E,{force:a.force}),e.updateAttachment(E.id,{observedState:"detached",lastError:void 0});let g=e.attachments(l.id).some((m)=>m.id!==E.id&&m.observedState==="attached");e.update(l.id,l.version,{status:g?"attached":"available"})}else if(o.operation.kind==="volume.resize"){if(!a.capacityBytes)throw Error("Queued volume resize is missing its capacity.");p=await u.resize(l,a.capacityBytes),e.update(l.id,l.version,{capacityBytes:p.capacityBytes??a.capacityBytes,usedBytes:p.usedBytes??l.usedBytes,observedState:p.raw??l.observedState,status:e.attachments(l.id).some((E)=>E.observedState==="attached")?"attached":"available"})}else if(o.operation.kind==="volume.snapshot"){let E=a.snapshotId?e.snapshot(a.snapshotId):void 0;if(!E)throw Error("Queued volume snapshot was not found.");let g=await u.snapshot(l,E);e.updateSnapshot(E.id,{...g,status:"available"}),e.update(l.id,l.version,{status:e.attachments(l.id).some((m)=>m.observedState==="attached")?"attached":"available",lastBackupAt:new Date().toISOString()})}else if(o.operation.kind==="volume.restore"){let E=a.snapshotId?e.snapshot(a.snapshotId):void 0,g=a.sourceVolumeId?e.get(a.sourceVolumeId):void 0;if(!E||!g)throw Error("Queued volume restore source was not found.");p=await u.restore(g,E,l),e.update(l.id,l.version,{providerId:p.providerId,capacityBytes:p.capacityBytes??l.capacityBytes,usedBytes:p.usedBytes,filesystem:p.filesystem??l.filesystem,encrypted:p.encrypted??l.encrypted,observedState:p.raw??{},status:"available"})}else if(o.operation.kind==="volume.delete")await u.delete(l),e.update(l.id,l.version,{status:"deleted",deletedAt:new Date().toISOString()});return o.checkpoint("finalize","Persisted observed volume state."),{volumeId:l.id,status:e.get(l.id)?.status??"deleted"}};return Object.fromEntries(["volume.create","volume.attach","volume.detach","volume.resize","volume.snapshot","volume.restore","volume.delete"].map((o)=>[o,n]))}var _i=async(e)=>{let t=Bun.spawn(["docker",...e],{stdout:"pipe",stderr:"pipe"}),[r,n,o]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:n,stderr:o}},ee=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;class Or{command;provider="docker";type="docker";constructor(e=_i){this.command=e}capabilities(){return Vs(["create","attach","detach","delete","adopt","usage"],{resize:{supported:!1,reason:"Docker named volumes do not expose a portable capacity resize operation."},snapshot:{supported:!1,reason:"Attach a volume backup policy to create verified recovery points."},restore:{supported:!1,reason:"Restore this volume from its verified backup recovery point."}})}async run(e,t=!1){let r=await this.command(e);if(r.code!==0&&!t)throw Error(`Docker volume command failed: ${r.stderr.trim()||r.code}`);return r.stdout}async inspect(e){let t=await this.run(["volume","inspect",e],!0);if(!t.trim())return;let r;try{r=JSON.parse(t)[0]}catch{return}return{providerId:String(r.Name??e),raw:{driver:String(r.Driver??"local"),mountpoint:String(r.Mountpoint??""),labels:r.Labels??{}}}}async discover(e,t){let r=await this.run(["volume","ls","--format","{{.Name}}"]),n=[];for(let o of r.split(`
 `).map((a)=>a.trim()).filter(ee.test.bind(ee))){let a=await this.inspect(o);if(a)n.push(a)}return n}async create(e){let t=typeof e.desiredState.nativeName==="string"?e.desiredState.nativeName:e.name;if(!ee.test(t))throw Error("Docker volume name is invalid.");return await this.run(["volume","create","--label",`ts-cloud.volume=${e.id}`,"--label",`ts-cloud.project=${e.projectId}`,t]),await this.inspect(t)??{providerId:t}}async attach(e,t){}async detach(e,t){}async resize(){throw Error(this.capabilities().resize.reason)}async snapshot(){throw Error(this.capabilities().snapshot.reason)}async restore(e,t,r){throw Error(this.capabilities().restore.reason)}async delete(e){if(!e.providerId||!ee.test(e.providerId))throw Error("Docker volume provider identity is missing or invalid.");await this.run(["volume","rm",e.providerId])}async usage(e){let t=await this.run(["system","df","-v","--format","{{json .}}"],!0),r=t.split(`
-`).find((n)=>n.includes(`"Name":"${e.providerId}"`));if(!r)return{};try{let n=JSON.parse(r);return{usedBytes:typeof n.Size==="number"?n.Size:void 0}}catch{return{}}}}class zs{provider="server";type="server_path";root;constructor(e){this.root=mr(e)}capabilities(){return Vs(["create","attach","detach","delete","adopt","usage"],{resize:{supported:!1,reason:"Server paths use the capacity of their containing filesystem."},snapshot:{supported:!1,reason:"Attach a filesystem backup policy for verified recovery points."},restore:{supported:!1,reason:"Restore a filesystem recovery point into a new managed path."}})}path(e){if(!ee.test(e))throw Error("Server path volume name is invalid.");let t=mr(this.root,e);if(!t.startsWith(`${this.root}${gi}`)||mi(t)!==e)throw Error("Server path escaped the managed volume root.");return t}async discover(e,t){return await lt(this.root,{recursive:!0,mode:488}),(await li(this.root,{withFileTypes:!0})).filter((n)=>n.isDirectory()&&ee.test(n.name)).map((n)=>({providerId:n.name,raw:{path:this.path(n.name)}}))}async create(e){let t=typeof e.desiredState.nativeName==="string"?e.desiredState.nativeName:e.name,r=this.path(t);return await lt(this.root,{recursive:!0,mode:488}),await lt(r,{recursive:!1,mode:488}),{providerId:t,filesystem:"host",raw:{path:r}}}async attach(e,t){}async detach(e,t){}async resize(){throw Error(this.capabilities().resize.reason)}async snapshot(){throw Error(this.capabilities().snapshot.reason)}async restore(e,t,r){throw Error(this.capabilities().restore.reason)}async delete(e){if(!e.providerId)throw Error("Server path provider identity is unavailable.");await ui(this.path(e.providerId),{recursive:!0,force:!1})}async usage(e){if(!e.providerId)return{};return{usedBytes:(await pi(this.path(e.providerId))).size}}}class Mf{provider;transport;type="ebs";constructor(e,t){this.provider=e;this.transport=t}capabilities(){return Vs(["create","attach","detach","resize","snapshot","restore","delete","adopt","usage"],{resize:{supported:!0,online:!0,minimumBytes:1073741824}})}discover(e,t){return this.transport.list(e,t)}create(e){return this.transport.create({name:e.name,projectId:e.projectId,environmentId:e.environmentId,capacityBytes:e.capacityBytes,encrypted:e.encrypted,filesystem:e.filesystem})}resource(e,t){let r=e.resourceId===t.resourceId?e.observedState.resourceProviderId:void 0,n=typeof r==="string"?r:t.driverOptions.resourceProviderId;if(typeof n!=="string"||!n)throw Error("Cloud attachment requires a reviewed resourceProviderId driver option.");return n}attach(e,t){return this.transport.attach(e.providerId,this.resource(e,t),t.targetPath,t.readOnly)}detach(e,t,r){return this.transport.detach(e.providerId,this.resource(e,t),r.force)}resize(e,t){return this.transport.resize(e.providerId,t)}snapshot(e,t){return this.transport.snapshot(e.providerId,t.name)}restore(e,t,r){if(!t.providerId)throw Error("Cloud snapshot provider identity is unavailable.");return this.transport.restore(e.providerId,t.providerId,r.name)}delete(e){return this.transport.delete(e.providerId)}usage(e){return this.transport.usage(e.providerId)}}var j=(e)=>e==null?void 0:String(e),ge=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},pt=(e)=>Number(e)===1,te=(e)=>e().toISOString();function Tr(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:j(e.environment_id),resourceId:j(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:j(e.provider_id),type:String(e.type),status:String(e.status),capacityBytes:e.capacity_bytes==null?void 0:Number(e.capacity_bytes),usedBytes:e.used_bytes==null?void 0:Number(e.used_bytes),filesystem:j(e.filesystem),encrypted:pt(e.encrypted),capabilities:ge(e.capabilities,{}),desiredState:ge(e.desired_state,{}),observedState:ge(e.observed_state,{}),backupPolicyId:j(e.backup_policy_id),lastBackupAt:j(e.last_backup_at),orphanedAt:j(e.orphaned_at),adoptedAt:j(e.adopted_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deletedAt:j(e.deleted_at)}}function ut(e){return{id:String(e.id),volumeId:String(e.volume_id),resourceId:String(e.resource_id),targetPath:String(e.target_path),readOnly:pt(e.read_only),uid:e.uid==null?void 0:Number(e.uid),gid:e.gid==null?void 0:Number(e.gid),mode:j(e.mode),propagation:String(e.propagation),driverOptions:ge(e.driver_options,{}),desiredState:String(e.desired_state),observedState:String(e.observed_state),operationId:j(e.operation_id),lastError:j(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function gr(e){return{id:String(e.id),volumeId:String(e.volume_id),recoveryPointId:j(e.recovery_point_id),providerId:j(e.provider_id),name:String(e.name),status:String(e.status),sizeBytes:e.size_bytes==null?void 0:Number(e.size_bytes),encrypted:pt(e.encrypted),checksum:j(e.checksum),metadata:ge(e.metadata,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deletedAt:j(e.deleted_at)}}class Ft{controlPlane;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.controlPlane=e;this.now=t;this.id=r}get(e){let t=this.controlPlane.database.query("SELECT * FROM persistent_volumes WHERE id=?").get(e);return t?Tr(t):void 0}list(e){let t=["project_id=?"],r=[e.projectId];if(e.environmentId)t.push("environment_id=?"),r.push(e.environmentId);if(!e.includeDeleted)t.push("deleted_at IS NULL");return this.controlPlane.database.query(`SELECT * FROM persistent_volumes WHERE ${t.join(" AND ")} ORDER BY name`).all(...r).map(Tr)}create(e){let t=te(this.now),r=e.id??this.id();return this.controlPlane.database.run("INSERT INTO persistent_volumes (id,organization_id,project_id,environment_id,resource_id,name,provider,provider_id,type,status,capacity_bytes,used_bytes,filesystem,encrypted,capabilities,desired_state,observed_state,backup_policy_id,last_backup_at,orphaned_at,adopted_at,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.provider,e.providerId??null,e.type,e.status,e.capacityBytes??null,e.usedBytes??null,e.filesystem??null,e.encrypted?1:0,JSON.stringify(e.capabilities),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),e.backupPolicyId??null,e.lastBackupAt??null,e.orphanedAt??null,e.adoptedAt??null,t,t,e.deletedAt??null]),this.get(r)}update(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error("Volume changed before this operation could be applied.");let o={...n,...r,updatedAt:te(this.now)};if(this.controlPlane.database.run("UPDATE persistent_volumes SET environment_id=?,resource_id=?,name=?,provider=?,provider_id=?,type=?,status=?,capacity_bytes=?,used_bytes=?,filesystem=?,encrypted=?,capabilities=?,desired_state=?,observed_state=?,backup_policy_id=?,last_backup_at=?,orphaned_at=?,adopted_at=?,deleted_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[o.environmentId??null,o.resourceId??null,o.name,o.provider,o.providerId??null,o.type,o.status,o.capacityBytes??null,o.usedBytes??null,o.filesystem??null,o.encrypted?1:0,JSON.stringify(o.capabilities),JSON.stringify(o.desiredState),JSON.stringify(o.observedState),o.backupPolicyId??null,o.lastBackupAt??null,o.orphanedAt??null,o.adoptedAt??null,o.deletedAt??null,o.updatedAt,e,t]).changes!==1)throw Error("Volume changed before this operation could be applied.");return this.get(e)}attachments(e){return this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? ORDER BY target_path").all(e).map(ut)}attachment(e){let t=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE id=?").get(e);return t?ut(t):void 0}upsertAttachment(e){let t=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? AND resource_id=? AND target_path=?").get(e.volumeId,e.resourceId,e.targetPath),r=te(this.now);if(t){let o=ut(t);return this.controlPlane.database.run("UPDATE volume_attachments SET read_only=?,uid=?,gid=?,mode=?,propagation=?,driver_options=?,desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[e.readOnly?1:0,e.uid??null,e.gid??null,e.mode??null,e.propagation,JSON.stringify(e.driverOptions),e.desiredState,e.observedState,e.operationId??null,e.lastError??null,r,o.id]),this.attachment(o.id)}let n=e.id??this.id();return this.controlPlane.database.run("INSERT INTO volume_attachments (id,volume_id,resource_id,target_path,read_only,uid,gid,mode,propagation,driver_options,desired_state,observed_state,operation_id,last_error,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[n,e.volumeId,e.resourceId,e.targetPath,e.readOnly?1:0,e.uid??null,e.gid??null,e.mode??null,e.propagation,JSON.stringify(e.driverOptions),e.desiredState,e.observedState,e.operationId??null,e.lastError??null,r,r]),this.attachment(n)}updateAttachment(e,t){let r=this.attachment(e);if(!r)throw Error("Volume attachment was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE volume_attachments SET desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[n.desiredState,n.observedState,n.operationId??null,n.lastError??null,te(this.now),e]),this.attachment(e)}snapshots(e){return this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE volume_id=? AND deleted_at IS NULL ORDER BY created_at DESC").all(e).map(gr)}snapshot(e){let t=this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE id=?").get(e);return t?gr(t):void 0}createSnapshot(e){let t=e.id??this.id(),r=te(this.now);return this.controlPlane.database.run("INSERT INTO volume_snapshots (id,volume_id,recovery_point_id,provider_id,name,status,size_bytes,encrypted,checksum,metadata,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.volumeId,e.recoveryPointId??null,e.providerId??null,e.name,e.status,e.sizeBytes??null,e.encrypted?1:0,e.checksum??null,JSON.stringify(e.metadata),r,r,e.deletedAt??null]),this.snapshot(t)}updateSnapshot(e,t){let r=this.snapshot(e);if(!r)throw Error("Volume snapshot was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE volume_snapshots SET recovery_point_id=?,provider_id=?,name=?,status=?,size_bytes=?,encrypted=?,checksum=?,metadata=?,deleted_at=?,updated_at=? WHERE id=?",[n.recoveryPointId??null,n.providerId??null,n.name,n.status,n.sizeBytes??null,n.encrypted?1:0,n.checksum??null,JSON.stringify(n.metadata),n.deletedAt??null,te(this.now),e]),this.snapshot(e)}inventory(e,t){return this.list({projectId:e,environmentId:t}).map((r)=>{let n=this.attachments(r.id),o=this.snapshots(r.id),a=r.lastBackupAt?Date.now()-new Date(r.lastBackupAt).getTime():1/0;return{...r,attachments:n,snapshots:o,orphaned:r.status==="orphaned",usagePercent:r.capacityBytes&&r.usedBytes!=null?Math.round(r.usedBytes/r.capacityBytes*1000)/10:void 0,backupState:r.backupPolicyId?a<=86400000?"protected":"stale":"unprotected"}})}audit(e){this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,resourceId:this.get(e.volumeId)?.resourceId,actorId:e.actorId,type:e.type,level:"warning",payload:{volumeId:e.volumeId,environmentId:e.environmentId??null,...e.payload}})}}function Jc(e,t){let r=e.getProject(t.projectId);if(!r?.organizationId)return;let n=new Ft(e),o=new xr,a=new Set(t.manifest.spec.volumes),l=new Set;for(let u of a){let p=`${t.slug}-${u}`.toLowerCase().replace(/[^a-z0-9_.-]/g,"-").slice(0,63),E=n.list({projectId:t.projectId,environmentId:t.environmentId,includeDeleted:!0}).find((h)=>h.name===p);if(E?.deletedAt)throw Error(`Compose volume ${p} was permanently deleted; rename it before redeploying.`);let g=E?.resourceId?e.getResource(E.resourceId):e.createResource({projectId:t.projectId,environmentId:t.environmentId,kind:"volume",slug:p,name:p,provider:"docker",providerId:p,desiredState:{composeApplicationId:t.id,composeVolume:u}}),m=E??n.create({organizationId:r.organizationId,projectId:t.projectId,environmentId:t.environmentId,resourceId:g?.id,name:p,provider:"docker",providerId:p,type:"docker",status:"available",encrypted:!1,capabilities:o.capabilities(),desiredState:{composeApplicationId:t.id,composeVolume:u,nativeName:p},observedState:{}});l.add(m.id);let T=new Map;for(let h of Object.values(t.manifest.spec.services))for(let _ of h.volumes.filter((N)=>N.source===u)){let N=T.get(_.target)??[];N.push(h.name),T.set(_.target,N),n.upsertAttachment({volumeId:m.id,resourceId:t.resourceId,targetPath:_.target,readOnly:_.readOnly,propagation:"private",driverOptions:{composeServices:N},desiredState:"attached",observedState:"pending"})}}for(let u of n.list({projectId:t.projectId,environmentId:t.environmentId}).filter((p)=>p.desiredState.composeApplicationId===t.id&&!l.has(p.id)))for(let p of n.attachments(u.id))n.updateAttachment(p.id,{desiredState:"detached"})}function Qp(e,t,r){let n=new Ft(e);for(let o of n.list({projectId:t.projectId,environmentId:t.environmentId}).filter((a)=>a.desiredState.composeApplicationId===t.id)){for(let a of n.attachments(o.id))n.updateAttachment(a.id,{desiredState:"detached",observedState:"detached"});n.update(o.id,o.version,{status:r?"deleted":"available",deletedAt:r?new Date().toISOString():void 0})}}function re(e){return typeof e==="string"&&e?e:void 0}function Et(e,t){try{return JSON.parse(String(e))}catch{return t}}function xe(e){return{id:String(e.id),resourceId:String(e.resource_id),projectId:String(e.project_id),environmentId:String(e.environment_id),name:String(e.name),slug:String(e.slug),status:String(e.status),sourceKind:String(e.source_kind),sourceHash:String(e.source_hash),redactedSource:String(e.redacted_source),manifest:Et(e.manifest,{}),diagnostics:Et(e.diagnostics,[]),templateId:re(e.template_id),templateVersion:re(e.template_version),latestOperationId:re(e.latest_operation_id),createdByActorId:re(e.created_by_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deletedAt:re(e.deleted_at)}}function Ni(e){return{applicationId:String(e.application_id),serviceName:String(e.service_name),status:String(e.status),replicas:Number(e.replicas),healthyReplicas:Number(e.healthy_replicas),latestOperationId:re(e.latest_operation_id),observedState:Et(e.observed_state,{}),updatedAt:String(e.updated_at)}}class Ut{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}persist(e,t){if(!e.valid)throw Error(`Compose definition contains ${e.diagnostics.filter((_)=>_.severity==="error").length} blocking diagnostic(s)`);let{projectId:r,environmentId:n,name:o,slug:a}=e.manifest.metadata;if(!this.controlPlane.listEnvironments(r).find((_)=>_.id===n))throw Error("Compose project and environment scope was not found");let u=this.getBySlug(r,n,a),p=this.now().toISOString(),E=JSON.stringify(e.manifest),g=JSON.stringify(s(e.diagnostics));if(u){if(u.status==="deleted")throw Error("A deleted Compose application cannot be overwritten; choose another slug");let _=this.controlPlane.getResource(u.resourceId);if(!_)throw Error("Compose application resource was not found");this.controlPlane.updateResource(_.id,_.version,{name:o,provider:_.provider,providerId:_.providerId,desiredState:e.manifest,discoveredState:_.discoveredState,metadata:{sourceKind:t.sourceKind,templateId:t.templateId??null,templateVersion:t.templateVersion??null,sourceHash:e.sourceHash}}),this.controlPlane.database.run("UPDATE compose_applications SET name=?, status='ready', source_kind=?, source_hash=?, redacted_source=?, manifest=?, diagnostics=?, template_id=?, template_version=?, version=version+1, updated_at=? WHERE id=?",[o,t.sourceKind,e.sourceHash,e.redactedSource,E,g,t.templateId??null,t.templateVersion??null,p,u.id]);let N=Object.keys(e.manifest.spec.services);if(N.length)this.controlPlane.database.run(`DELETE FROM compose_service_states WHERE application_id=? AND service_name NOT IN (${N.map(()=>"?").join(",")})`,[u.id,...N]);for(let v of Object.values(e.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?) ON CONFLICT(application_id, service_name) DO UPDATE SET replicas=excluded.replicas, updated_at=excluded.updated_at",[u.id,v.name,v.replicas,p]);this.controlPlane.appendEvent({projectId:r,resourceId:u.resourceId,actorId:t.createdByActorId,type:"compose.application.updated",payload:{applicationId:u.id,sourceHash:e.sourceHash,diagnosticCount:e.diagnostics.length,templateId:t.templateId??null,templateVersion:t.templateVersion??null}});let y=this.get(u.id);return Jc(this.controlPlane,y),y}let m=this.controlPlane.createResource({projectId:r,environmentId:n,kind:"compose_application",slug:a,name:o,desiredState:e.manifest,metadata:{sourceKind:t.sourceKind,templateId:t.templateId??null,templateVersion:t.templateVersion??null,sourceHash:e.sourceHash}}),T=this.id();this.controlPlane.database.run("INSERT INTO compose_applications (id, resource_id, project_id, environment_id, name, slug, status, source_kind, source_hash, redacted_source, manifest, diagnostics, template_id, template_version, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, 'ready', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[T,m.id,r,n,o,a,t.sourceKind,e.sourceHash,e.redactedSource,E,g,t.templateId??null,t.templateVersion??null,t.createdByActorId??null,p,p]);for(let _ of Object.values(e.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?)",[T,_.name,_.replicas,p]);this.controlPlane.appendEvent({projectId:r,resourceId:m.id,actorId:t.createdByActorId,type:"compose.application.created",payload:{applicationId:T,sourceHash:e.sourceHash,serviceNames:Object.keys(e.manifest.spec.services),templateId:t.templateId??null}});let h=this.get(T);return Jc(this.controlPlane,h),h}import(e,t){let r=kr(e,t);return{application:this.persist(r,{sourceKind:"compose",createdByActorId:t.createdByActorId}),parsed:r}}fromTemplate(e,t,r){let n=Vc(e,t,r,r.version);return{application:this.persist(n,{sourceKind:"template",templateId:e,templateVersion:r.version??"1.0.0",createdByActorId:r.createdByActorId}),parsed:n}}preview(e,t){return kr(e,t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE id=?").get(e);return t?xe(t):void 0}getByResource(e){let t=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE resource_id=?").get(e);return t?xe(t):void 0}getBySlug(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE project_id=? AND environment_id=? AND slug=?").get(e,t,r);return n?xe(n):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM compose_applications ORDER BY updated_at DESC").all().map(xe).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(e.includeDeleted||t.status!=="deleted"))}services(e){return this.controlPlane.database.query("SELECT * FROM compose_service_states WHERE application_id=? ORDER BY service_name").all(e).map(Ni)}transition(e,t,r={}){let n=this.get(e);if(!n)throw Error(`Compose application ${e} was not found`);let o=this.now().toISOString(),a=t==="deleted"?o:null;this.controlPlane.database.run("UPDATE compose_applications SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), version=version+1, updated_at=?, deleted_at=? WHERE id=?",[t,r.operationId??null,o,a,e]);for(let l of r.services??[])if(n.manifest.spec.services[l.name])this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, latest_operation_id, observed_state, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(application_id, service_name) DO UPDATE SET status=excluded.status, replicas=excluded.replicas, healthy_replicas=excluded.healthy_replicas, latest_operation_id=excluded.latest_operation_id, observed_state=excluded.observed_state, updated_at=excluded.updated_at",[e,l.name,l.status,l.replicas??n.manifest.spec.services[l.name].replicas,l.healthyReplicas??0,r.operationId??null,JSON.stringify(s(l.observedState??{})),o]);return this.controlPlane.appendEvent({projectId:n.projectId,resourceId:n.resourceId,operationId:r.operationId,type:`compose.application.${t}`,level:t==="failed"||t==="degraded"?"error":"info",payload:{applicationId:e,error:r.error??null}}),this.get(e)}}class Or{controlPlane;applications;queue;constructor(e){this.controlPlane=e;this.applications=new Ut(e),this.queue=new c(e)}enqueue(e,t,r={}){if(e.status==="deleted")throw Error("Deleted Compose applications cannot be operated");if(r.service&&!e.manifest.spec.services[r.service])throw Error(`Compose service ${r.service} was not found`);if(t==="delete"){let o=r.removeVolumes?`${e.slug} delete volumes`:e.slug;if(r.confirmation!==o)throw Error(`Type ${o} to confirm ${r.removeVolumes?"persistent data removal":"stack deletion"}`)}if(t==="scale"&&(!r.service||!Number.isInteger(r.replicas)||r.replicas<0||r.replicas>100))throw Error("Scale requires a service and 0-100 replicas");let n=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:r.actorId,kind:`compose.${t}`,idempotencyKey:`compose:${e.id}:${t}:${r.service??"stack"}:${r.replicas??""}:${e.version}`,correlationId:`compose:${e.id}`,input:{applicationId:e.id,service:r.service??null,replicas:r.replicas??null,removeVolumes:!!r.removeVolumes},lockKey:`compose:${e.id}`,providerKey:this.controlPlane.getResource(e.resourceId)?.provider??"default",buildSlot:t==="deploy"||t==="redeploy",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.applications.transition(e.id,t==="delete"?"deleting":t==="stop"?"stopped":t==="start"?"deploying":t==="scale"?e.status:"deploying",{operationId:n.id}),n}}import{createHash as Li}from"node:crypto";var Oi=/^[a-f0-9]{40,64}$/i,Ui=/^[A-Z][A-Z0-9_]{1,127}$/;function V(e){return typeof e==="string"&&e?e:void 0}function ne(e){try{return JSON.parse(String(e))}catch{return{}}}function Di(e){let t=ne(e);return Array.isArray(t)?t.map(String):[]}function Tt(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:String(e.resource_id),baseEnvironmentId:String(e.base_environment_id),enabled:Number(e.enabled)===1,branchRule:V(e.branch_rule),domainPattern:String(e.domain_pattern),ttlHours:Number(e.ttl_hours),keepCount:Number(e.keep_count),publicAccess:Number(e.public_access)===1,authenticationRequired:Number(e.authentication_required)===1,allowForks:Number(e.allow_forks)===1,inheritedSecrets:Di(e.inherited_secrets),resourceOverrides:ne(e.resource_overrides),databaseStrategy:String(e.database_strategy),maxMonthlyCost:Number(e.max_monthly_cost),maxCpu:Number(e.max_cpu),maxMemoryMb:Number(e.max_memory_mb),cleanupOnClose:Number(e.cleanup_on_close)===1,version:Number(e.version),createdByActorId:V(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function _e(e){return{id:String(e.id),definitionId:String(e.definition_id),projectId:String(e.project_id),resourceId:String(e.resource_id),baseEnvironmentId:String(e.base_environment_id),identityKey:String(e.identity_key),sourceProvider:V(e.source_provider),repository:V(e.repository),branch:String(e.branch),pullRequestNumber:e.pull_request_number==null?void 0:Number(e.pull_request_number),fork:Number(e.fork)===1,commitSha:String(e.commit_sha),name:String(e.name),stackName:String(e.stack_name),url:V(e.url),status:String(e.status),expiresAt:String(e.expires_at),latestOperationId:V(e.latest_operation_id),createdByActorId:V(e.created_by_actor_id),costEstimate:e.cost_estimate==null?void 0:Number(e.cost_estimate),desiredState:ne(e.desired_state),observedState:ne(e.observed_state),teardownError:V(e.teardown_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at),destroyedAt:V(e.destroyed_at)}}function hr(e){return{id:String(e.id),previewId:String(e.preview_id),provider:String(e.provider),providerResourceId:String(e.provider_resource_id),kind:String(e.kind),tags:ne(e.tags),observedState:ne(e.observed_state),discoveredAt:String(e.discovered_at),deletedAt:V(e.deleted_at)}}function K(e,t,r,n){return Number.isFinite(e)?Math.min(n,Math.max(r,Math.floor(e))):t}function Fe(e,t,r,n){return Number.isFinite(e)?Math.min(n,Math.max(r,e)):t}function _t(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"").slice(0,28)||"preview"}class Ve{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}createDefinition(e){let t=this.controlPlane.getResource(e.resourceId),r=this.controlPlane.listEnvironments(e.projectId).find((E)=>E.id===e.baseEnvironmentId);if(!t||t.projectId!==e.projectId||t.environmentId!==r?.id)throw Error("Preview resource and base environment must belong to the same project scope");if(t.kind!=="application")throw Error("Preview environments currently support application resources only");if(!/^https:\/\//.test(e.domainPattern)||!e.domainPattern.includes("{name}"))throw Error("Preview domainPattern must be HTTPS and include {name}");let n=this.getDefinitionForResource(e.resourceId),o=e.publicAccess??n?.publicAccess??!1,a=e.authenticationRequired??n?.authenticationRequired??!0;if(o&&!a)throw Error("Public preview environments require an authentication policy");let l=[...new Set(e.inheritedSecrets??[])];if(l.some((E)=>!Ui.test(E)))throw Error("Inherited preview secret names must use uppercase environment-variable identifiers");let u=this.now().toISOString();if(n)return this.controlPlane.database.run("UPDATE preview_definitions SET base_environment_id=?, enabled=1, branch_rule=?, domain_pattern=?, ttl_hours=?, keep_count=?, public_access=?, authentication_required=?, allow_forks=?, inherited_secrets=?, resource_overrides=?, database_strategy=?, max_monthly_cost=?, max_cpu=?, max_memory_mb=?, cleanup_on_close=?, version=version+1, updated_at=? WHERE id=?",[e.baseEnvironmentId,e.branchRule??null,e.domainPattern,K(e.ttlHours,n.ttlHours,1,720),K(e.keepCount,n.keepCount,1,100),o?1:0,a?1:0,e.allowForks??n.allowForks?1:0,JSON.stringify(e.inheritedSecrets===void 0?n.inheritedSecrets:l),JSON.stringify(s(e.resourceOverrides??n.resourceOverrides)),e.databaseStrategy??n.databaseStrategy,Fe(e.maxMonthlyCost,n.maxMonthlyCost,0,1e4),Fe(e.maxCpu,n.maxCpu,0.1,64),K(e.maxMemoryMb,n.maxMemoryMb,128,131072),e.cleanupOnClose??n.cleanupOnClose?1:0,u,n.id]),this.controlPlane.appendEvent({projectId:e.projectId,resourceId:e.resourceId,actorId:e.createdByActorId,type:"preview.definition.updated",payload:{definitionId:n.id,baseEnvironmentId:e.baseEnvironmentId,version:n.version+1}}),this.getDefinition(n.id);let p=this.id();return this.controlPlane.database.run("INSERT INTO preview_definitions (id, project_id, resource_id, base_environment_id, enabled, branch_rule, domain_pattern, ttl_hours, keep_count, public_access, authentication_required, allow_forks, inherited_secrets, resource_overrides, database_strategy, max_monthly_cost, max_cpu, max_memory_mb, cleanup_on_close, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[p,e.projectId,e.resourceId,e.baseEnvironmentId,e.branchRule??null,e.domainPattern,K(e.ttlHours,24,1,720),K(e.keepCount,10,1,100),e.publicAccess?1:0,e.authenticationRequired===!1?0:1,e.allowForks?1:0,JSON.stringify(l),JSON.stringify(s(e.resourceOverrides??{})),e.databaseStrategy??"disabled",Fe(e.maxMonthlyCost,25,0,1e4),Fe(e.maxCpu,1,0.1,64),K(e.maxMemoryMb,1024,128,131072),e.cleanupOnClose===!1?0:1,e.createdByActorId??null,u,u]),this.controlPlane.appendEvent({projectId:e.projectId,resourceId:e.resourceId,actorId:e.createdByActorId,type:"preview.definition.created",payload:{definitionId:p,baseEnvironmentId:e.baseEnvironmentId,ttlHours:K(e.ttlHours,24,1,720),inheritedSecretNames:l}}),this.getDefinition(p)}getDefinition(e){let t=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE id=?").get(e);return t?Tt(t):void 0}getDefinitionForResource(e){let t=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE resource_id=?").get(e);return t?Tt(t):void 0}listDefinitions(e){return this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE project_id=? ORDER BY updated_at DESC").all(e).map(Tt)}listInstances(e={}){return this.controlPlane.database.query("SELECT * FROM preview_instances ORDER BY created_at DESC").all().map(_e).filter((r)=>(!e.projectId||r.projectId===e.projectId)&&(!e.definitionId||r.definitionId===e.definitionId)&&(!e.status||r.status===e.status))}getInstance(e){let t=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE id=?").get(e);return t?_e(t):void 0}findForPullRequest(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(e,`pr:${t}:${r}`);return n?_e(n):void 0}findForBranch(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(e,`branch:${t}:${r}`);return n?_e(n):void 0}upsert(e){let t=this.getDefinition(e.definitionId);if(!t?.enabled)throw Error("Preview environments are not enabled for this application");if(!Oi.test(e.commitSha))throw Error("Preview deployment requires an immutable 40-64 character commit SHA");if(e.fork&&!t.allowForks)throw Error("Untrusted fork previews are disabled");let r=e.pullRequestNumber?`pr:${e.repository??"unknown"}:${e.pullRequestNumber}`:`branch:${e.repository??"local"}:${e.branch}`,n=Li("sha256").update(`${t.id}:${r}`).digest("hex").slice(0,8),a=`${(e.pullRequestNumber?`pr-${e.pullRequestNumber}`:_t(e.branch)).slice(0,28)}-${n}`,l=`preview-${a}`.slice(0,63),u=t.domainPattern.replaceAll("{name}",a).replaceAll("{project}",_t(t.projectId)).replaceAll("{branch}",_t(e.branch)).replaceAll("{pr}",String(e.pullRequestNumber??"branch")),p=e.now??this.now(),E=p.toISOString(),g=new Date(p.getTime()+t.ttlHours*60*60*1000).toISOString(),m=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(t.id,r);if(m){let _=_e(m),N=_.commitSha!==e.commitSha||_.status==="destroyed";if(N)this.controlPlane.database.run("UPDATE preview_instances SET commit_sha=?, branch=?, fork=?, status='queued', expires_at=?, url=?, teardown_error=NULL, destroyed_at=NULL, version=version+1, updated_at=? WHERE id=?",[e.commitSha,e.branch,e.fork?1:0,g,u,E,_.id]);return{preview:this.getInstance(_.id),created:!1,changed:N,inheritedSecrets:e.fork?[]:t.inheritedSecrets}}let T=this.id(),h=s({source:{provider:e.sourceProvider??null,repository:e.repository??null,branch:e.branch,commitSha:e.commitSha,pullRequestNumber:e.pullRequestNumber??null,fork:!!e.fork},policy:{databaseStrategy:t.databaseStrategy,resourceOverrides:t.resourceOverrides,maxMonthlyCost:t.maxMonthlyCost,maxCpu:t.maxCpu,maxMemoryMb:t.maxMemoryMb,publicAccess:t.publicAccess,authenticationRequired:t.authenticationRequired},inheritedSecretNames:e.fork?[]:t.inheritedSecrets});return this.controlPlane.database.run("INSERT INTO preview_instances (id, definition_id, project_id, resource_id, base_environment_id, identity_key, source_provider, repository, branch, pull_request_number, fork, commit_sha, name, stack_name, url, status, expires_at, created_by_actor_id, desired_state, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, ?, ?)",[T,t.id,t.projectId,t.resourceId,t.baseEnvironmentId,r,e.sourceProvider??null,e.repository??null,e.branch,e.pullRequestNumber??null,e.fork?1:0,e.commitSha,a,l,u,g,e.createdByActorId??null,JSON.stringify(h),E,E]),this.controlPlane.appendEvent({projectId:t.projectId,resourceId:t.resourceId,actorId:e.createdByActorId,type:"preview.created",payload:{previewId:T,identityKey:r,commitSha:e.commitSha,expiresAt:g,fork:!!e.fork}}),{preview:this.getInstance(T),created:!0,changed:!0,inheritedSecrets:e.fork?[]:t.inheritedSecrets}}transition(e,t,r={}){let n=this.getInstance(e);if(!n)throw Error(`Preview ${e} was not found`);let o=this.now().toISOString(),a=t==="destroyed"?o:null;return this.controlPlane.database.run("UPDATE preview_instances SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), observed_state=?, teardown_error=?, cost_estimate=COALESCE(?, cost_estimate), destroyed_at=?, version=version+1, updated_at=? WHERE id=?",[t,r.operationId??null,JSON.stringify(s(r.observedState??n.observedState)),r.teardownError??null,r.costEstimate??null,a,o,e]),this.controlPlane.appendEvent({projectId:n.projectId,resourceId:n.resourceId,operationId:r.operationId,type:`preview.${t}`,level:t==="failed"||t==="cleanup_failed"?"error":"info",payload:{previewId:e,commitSha:n.commitSha,teardownError:r.teardownError??null}}),this.getInstance(e)}extend(e,t){let r=this.getInstance(e),n=r?this.getDefinition(r.definitionId):void 0;if(!r||!n)throw Error(`Preview ${e} was not found`);let o=this.now(),a=K(t,n.ttlHours,1,720),l=new Date(Math.max(o.getTime(),new Date(r.expiresAt).getTime())+a*3600000).toISOString();return this.controlPlane.database.run("UPDATE preview_instances SET expires_at=?, version=version+1, updated_at=? WHERE id=?",[l,o.toISOString(),e]),this.getInstance(e)}expired(e=this.now()){return this.listInstances().filter((t)=>["queued","deploying","active","updating","failed","cleanup_failed"].includes(t.status)&&new Date(t.expiresAt)<=e)}recordResource(e){let t=this.getInstance(e.previewId);if(!t)throw Error(`Preview ${e.previewId} was not found`);let r={"ts-cloud:preview":t.id,"ts-cloud:project":t.projectId,"ts-cloud:expires-at":t.expiresAt};for(let[l,u]of Object.entries(r))if(e.tags[l]!==u)throw Error(`Preview resource is missing immutable tag ${l}`);let n=this.id(),o=this.now().toISOString();this.controlPlane.database.run("INSERT INTO preview_resources (id, preview_id, provider, provider_resource_id, kind, tags, observed_state, discovered_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(preview_id, provider, provider_resource_id) DO UPDATE SET kind=excluded.kind, tags=excluded.tags, observed_state=excluded.observed_state, deleted_at=NULL",[n,t.id,e.provider,e.providerResourceId,e.kind,JSON.stringify(e.tags),JSON.stringify(s(e.observedState??{})),o]);let a=this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? AND provider=? AND provider_resource_id=?").get(t.id,e.provider,e.providerResourceId);return hr(a)}listResources(e){return this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? ORDER BY kind, provider_resource_id").all(e).map(hr)}markResourcesDeleted(e){if(!this.getInstance(e))throw Error(`Preview ${e} was not found`);return this.controlPlane.database.run("UPDATE preview_resources SET deleted_at=? WHERE preview_id=? AND deleted_at IS NULL",[this.now().toISOString(),e]).changes}}class _r{controlPlane;previews;queue;constructor(e){this.controlPlane=e;this.previews=new Ve(e),this.queue=new c(e)}enqueueDeploy(e,t={}){let r=t.created?"preview.create":"preview.update",n=t.reason==="manual_rebuild"?`:${crypto.randomUUID()}`:"",o=this.queue.enqueue({projectId:e.projectId,environmentId:e.baseEnvironmentId,resourceId:e.resourceId,actorId:t.actorId,kind:r,correlationId:`preview:${e.id}`,idempotencyKey:`preview:${e.id}:${e.commitSha}${n}`,input:{previewId:e.id,reason:t.reason??(t.created?"create":"commit_update"),source:{repository:e.repository??null,branch:e.branch,commitSha:e.commitSha,pullRequestNumber:e.pullRequestNumber??null,fork:e.fork}},lockKey:`preview:${e.id}`,providerKey:"preview",buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(e.id,"queued",{operationId:o.id}),o}enqueueDestroy(e,t,r){if(e.status==="destroyed")throw Error("Preview is already destroyed");let n=this.queue.enqueue({projectId:e.projectId,environmentId:e.baseEnvironmentId,resourceId:e.resourceId,actorId:r,kind:"preview.destroy",correlationId:`preview:${e.id}`,idempotencyKey:`preview:${e.id}:destroy:${t}`,input:{previewId:e.id,reason:t},lockKey:`preview:${e.id}`,providerKey:"preview",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(e.id,"queued",{operationId:n.id}),n}cleanup(e={}){let t=e.now??new Date,r=new Map,n=this.previews.listInstances().filter((p)=>!["destroyed","destroying"].includes(p.status)),o=(p,E)=>{let g=r.get(p.id)??{preview:p,reasons:[]};if(!g.reasons.includes(E))g.reasons.push(E);r.set(p.id,g)};for(let p of n){if(new Date(p.expiresAt)<=t)o(p,"ttl_expired");if(e.maxAgeHours&&t.getTime()-new Date(p.createdAt).getTime()>=e.maxAgeHours*3600000)o(p,"max_age")}let a=new Map;for(let p of n)a.set(p.definitionId,[...a.get(p.definitionId)??[],p]);for(let[p,E]of a){let g=this.previews.getDefinition(p),m=e.keepCount??g?.keepCount;if(!m)continue;E.sort((T,h)=>h.createdAt.localeCompare(T.createdAt)).slice(m).forEach((T)=>o(T,"keep_count"))}let l=[...r.values()].sort((p,E)=>p.preview.createdAt.localeCompare(E.preview.createdAt)),u=e.dryRun?[]:l.map((p)=>this.enqueueDestroy(p.preview,p.reasons.sort().join("+"),e.actorId));if(l.length)this.controlPlane.appendEvent({actorId:e.actorId,type:e.dryRun?"preview.cleanup.planned":"preview.cleanup.queued",payload:{previewIds:l.map((p)=>p.preview.id),reasons:Object.fromEntries(l.map((p)=>[p.preview.id,p.reasons])),dryRun:!!e.dryRun}});return{candidates:l,operations:u,dryRun:!!e.dryRun}}reconcile(e){let t=[],r=[],n=[];for(let o of e){let a=o.tags["ts-cloud:preview"],l=o.tags["ts-cloud:project"],u=o.tags["ts-cloud:expires-at"];if(!a||!l||!u){n.push(o.providerResourceId);continue}let p=this.previews.getInstance(a);if(!p||p.projectId!==l||p.expiresAt!==u){r.push(o.providerResourceId);continue}if(this.previews.recordResource({...o,previewId:p.id}),o.estimatedMonthlyCost!==void 0)this.previews.transition(p.id,p.status,{costEstimate:o.estimatedMonthlyCost,observedState:{...p.observedState,lastReconciledAt:new Date().toISOString()}});t.push(o.providerResourceId)}if(r.length)this.controlPlane.appendEvent({type:"preview.reconciliation.leaks",level:"error",payload:{providerResourceIds:r}});return{matched:t,unknownPreviewResources:r,ignoredUntagged:n}}}var _f=["deployment.create","deployment.rollback","application.create","deploy.source","deploy.preview","preview.create","preview.update","preview.destroy","compose.deploy","compose.redeploy","compose.start","compose.stop","compose.delete","compose.scale"];function Me(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function xf(e,t){if(!t.projectId||!t.environmentId)throw Error(`Queued ${t.kind} operation is missing its project or environment scope`);let r=e.listEnvironments(t.projectId).find((l)=>l.id===t.environmentId);if(!r)throw Error(`Environment ${t.environmentId} was not found for queued ${t.kind} operation`);let n=t.resourceId?e.getResource(t.resourceId):void 0;if(t.resourceId&&(!n||n.projectId!==t.projectId||n.environmentId!==t.environmentId))throw Error(`Resource ${t.resourceId} was not found in the queued deployment scope`);let o=Me(t.input);if(t.kind.startsWith("compose.")){let l=typeof o.applicationId==="string"?o.applicationId:void 0,u=l?new Ut(e).get(l):t.resourceId?new Ut(e).getByResource(t.resourceId):void 0;if(!u||u.projectId!==t.projectId||u.environmentId!==t.environmentId||u.resourceId!==t.resourceId)throw Error("Queued Compose application does not match the operation scope");let p=t.kind.slice(8),E=["compose:apply",u.id,"--action",p,"--env",r.slug];if(typeof o.service==="string"&&o.service)E.push("--service",o.service);if(typeof o.replicas==="number")E.push("--replicas",String(o.replicas));if(o.removeVolumes===!0)E.push("--remove-volumes");return{id:`queue:${t.id}`,label:`${p[0].toUpperCase()}${p.slice(1)} Compose application`,description:`${p} ${u.name}.`,command:E,mutates:!0,target:{environment:r.slug,resource:n?.slug,composeId:u.id}}}if(t.kind.startsWith("preview.")){let l=typeof o.previewId==="string"?o.previewId:void 0,u=l?new Ve(e).getInstance(l):void 0;if(!u)throw Error(`Preview ${l??"(missing)"} was not found for queued ${t.kind}`);if(u.projectId!==t.projectId||u.resourceId!==t.resourceId)throw Error("Queued preview does not match the operation scope");if(t.kind==="preview.destroy")return{id:`queue:${t.id}`,label:"Destroy preview",description:`Destroy ${u.name}.`,command:["stack:delete",u.stackName,"--yes"],mutates:!0,target:{environment:r.slug,resource:n?.slug,previewId:u.id}};return{id:`queue:${t.id}`,label:t.kind==="preview.create"?"Create preview":"Update preview",description:`Deploy ${u.name} at ${u.commitSha}.`,command:["deploy","--stack",u.stackName,"--env",r.slug,"--yes","--skip-dns-verification",...n?["--site",n.slug]:[]],mutates:!0,target:{environment:r.slug,resource:n?.slug,previewId:u.id}}}if(t.kind==="deployment.rollback"){let l=["deploy:rollback"];if(n)l.push(n.slug);if(l.push("--env",r.slug),typeof o.revision==="string"&&o.revision)l.push("--to",o.revision);return{id:`queue:${t.id}`,label:"Rollback deployment",description:`Roll back ${n?.slug??r.slug}.`,command:l,mutates:!0,target:{environment:r.slug,resource:n?.slug}}}let a=["deploy","--env",r.slug,"--yes"];if(n)a.push("--site",n.slug);return{id:`queue:${t.id}`,label:t.kind==="deploy.preview"?"Deploy preview":"Deploy release",description:`Deploy ${n?.slug??r.slug}.`,command:a,mutates:!0,target:{environment:r.slug,resource:n?.slug}}}function ki(e){let t=e.stderr?.trim()||`Deployment process exited with code ${e.exitCode}`;if(/\b(?:429|rate.?limit|throttl)/i.test(t))return new Z(t,"provider_throttled");if(/\b(?:502|503|504|temporar(?:y|ily)|unavailable|provider.?error)/i.test(t))return new Z(t,"provider_unavailable");if(/\b(?:network|econn|enotfound|socket|timed?\s*out|fetch failed|dns)\b/i.test(t))return new Z(t,"network");return Error(t)}function Kc(e){let t=async(r)=>{r.checkpoint("prepare","Resolving the persisted deployment target.");let n=xf(e.store,r.operation),o=n.target.previewId?new Ve(e.store):void 0,a=n.target.composeId?new Ut(e.store):void 0;if(o&&n.target.previewId)o.transition(n.target.previewId,r.operation.kind==="preview.destroy"?"destroying":r.operation.kind==="preview.update"?"updating":"deploying",{operationId:r.operation.id});if(a&&n.target.composeId)a.transition(n.target.composeId,r.operation.kind==="compose.delete"?"deleting":r.operation.kind==="compose.stop"?"stopped":"deploying",{operationId:r.operation.id});r.log(`Target: ${n.target.resource??"all resources"} in ${n.target.environment}.`,{stream:"system"}),r.throwIfCancellationRequested(),r.checkpoint("execute",`Running cloud ${n.command.join(" ")}.`);let l=await e.execute(n,r);if(!l.ok){if(o&&n.target.previewId)o.transition(n.target.previewId,r.operation.kind==="preview.destroy"?"cleanup_failed":"failed",{operationId:r.operation.id,teardownError:r.operation.kind==="preview.destroy"?l.stderr?.trim()||`Process exited with ${l.exitCode}`:void 0});if(a&&n.target.composeId)a.transition(n.target.composeId,r.operation.kind==="compose.delete"?"degraded":"failed",{operationId:r.operation.id,error:l.stderr?.trim()||`Process exited with ${l.exitCode}`});throw ki(l)}if(r.throwIfCancellationRequested(),o&&n.target.previewId){let u=o.getInstance(n.target.previewId);if(r.operation.kind==="preview.destroy")o.markResourcesDeleted(u.id),o.transition(u.id,"destroyed",{operationId:r.operation.id,observedState:{reconciledResourceIds:o.listResources(u.id).map((p)=>p.providerResourceId),exactCommitSha:u.commitSha}});else{let p=e.store.getResource(u.resourceId)?.provider??"default";o.recordResource({previewId:u.id,provider:p,providerResourceId:u.stackName,kind:"stack",tags:{"ts-cloud:preview":u.id,"ts-cloud:project":u.projectId,"ts-cloud:expires-at":u.expiresAt},observedState:{command:l.command??null,exactCommitSha:u.commitSha}}),o.transition(u.id,"active",{operationId:r.operation.id,observedState:{url:u.url??null,stackName:u.stackName,exactCommitSha:u.commitSha,providerStatus:"deployed"}})}}if(a&&n.target.composeId){let u=a.get(n.target.composeId),p=typeof Me(r.operation.input).service==="string"?String(Me(r.operation.input).service):void 0,E=r.operation.kind==="compose.delete"?"deleted":r.operation.kind==="compose.stop"?"stopped":"running",g=a.transition(u.id,E,{operationId:r.operation.id,services:Object.values(u.manifest.spec.services).filter((m)=>!p||m.name===p).map((m)=>({name:m.name,status:E==="stopped"||E==="deleted"?"stopped":"running",replicas:E==="deleted"?0:m.replicas,healthyReplicas:E==="running"?m.replicas:0,observedState:{command:l.command??null,healthGatePassed:E==="running"}}))});if(E==="deleted")Qp(e.store,g,Me(r.operation.input).removeVolumes===!0)}return r.checkpoint("finalize","Deployment command completed; persisting the terminal result."),{command:l.command??`cloud ${n.command.join(" ")}`,exitCode:l.exitCode,environment:n.target.environment,resource:n.target.resource??null}};return Object.fromEntries(_f.map((r)=>[r,t]))}class i extends Error{code;status;details;constructor(e,t,r,n){super(t);this.code=e;this.status=r;this.details=n}}function Nt(e,t){if(e.organizationId!==t.organizationId)return!1;if(e.projectId&&e.projectId!==t.projectId)return!1;if(e.environmentId&&e.environmentId!==t.environmentId)return!1;if(e.resourceId&&e.resourceId!==t.resourceId)return!1;return!0}function iA(e,t,r){return Xi("sha256").update(`${e.toUpperCase()}
+`).find((n)=>n.includes(`"Name":"${e.providerId}"`));if(!r)return{};try{let n=JSON.parse(r);return{usedBytes:typeof n.Size==="number"?n.Size:void 0}}catch{return{}}}}class zs{provider="server";type="server_path";root;constructor(e){this.root=mr(e)}capabilities(){return Vs(["create","attach","detach","delete","adopt","usage"],{resize:{supported:!1,reason:"Server paths use the capacity of their containing filesystem."},snapshot:{supported:!1,reason:"Attach a filesystem backup policy for verified recovery points."},restore:{supported:!1,reason:"Restore a filesystem recovery point into a new managed path."}})}path(e){if(!ee.test(e))throw Error("Server path volume name is invalid.");let t=mr(this.root,e);if(!t.startsWith(`${this.root}${gi}`)||mi(t)!==e)throw Error("Server path escaped the managed volume root.");return t}async discover(e,t){return await lt(this.root,{recursive:!0,mode:488}),(await li(this.root,{withFileTypes:!0})).filter((n)=>n.isDirectory()&&ee.test(n.name)).map((n)=>({providerId:n.name,raw:{path:this.path(n.name)}}))}async create(e){let t=typeof e.desiredState.nativeName==="string"?e.desiredState.nativeName:e.name,r=this.path(t);return await lt(this.root,{recursive:!0,mode:488}),await lt(r,{recursive:!1,mode:488}),{providerId:t,filesystem:"host",raw:{path:r}}}async attach(e,t){}async detach(e,t){}async resize(){throw Error(this.capabilities().resize.reason)}async snapshot(){throw Error(this.capabilities().snapshot.reason)}async restore(e,t,r){throw Error(this.capabilities().restore.reason)}async delete(e){if(!e.providerId)throw Error("Server path provider identity is unavailable.");await ui(this.path(e.providerId),{recursive:!0,force:!1})}async usage(e){if(!e.providerId)return{};return{usedBytes:(await pi(this.path(e.providerId))).size}}}class Mf{provider;transport;type="ebs";constructor(e,t){this.provider=e;this.transport=t}capabilities(){return Vs(["create","attach","detach","resize","snapshot","restore","delete","adopt","usage"],{resize:{supported:!0,online:!0,minimumBytes:1073741824}})}discover(e,t){return this.transport.list(e,t)}create(e){return this.transport.create({name:e.name,projectId:e.projectId,environmentId:e.environmentId,capacityBytes:e.capacityBytes,encrypted:e.encrypted,filesystem:e.filesystem})}resource(e,t){let r=e.resourceId===t.resourceId?e.observedState.resourceProviderId:void 0,n=typeof r==="string"?r:t.driverOptions.resourceProviderId;if(typeof n!=="string"||!n)throw Error("Cloud attachment requires a reviewed resourceProviderId driver option.");return n}attach(e,t){return this.transport.attach(e.providerId,this.resource(e,t),t.targetPath,t.readOnly)}detach(e,t,r){return this.transport.detach(e.providerId,this.resource(e,t),r.force)}resize(e,t){return this.transport.resize(e.providerId,t)}snapshot(e,t){return this.transport.snapshot(e.providerId,t.name)}restore(e,t,r){if(!t.providerId)throw Error("Cloud snapshot provider identity is unavailable.");return this.transport.restore(e.providerId,t.providerId,r.name)}delete(e){return this.transport.delete(e.providerId)}usage(e){return this.transport.usage(e.providerId)}}var j=(e)=>e==null?void 0:String(e),ge=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},pt=(e)=>Number(e)===1,te=(e)=>e().toISOString();function Tr(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:j(e.environment_id),resourceId:j(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:j(e.provider_id),type:String(e.type),status:String(e.status),capacityBytes:e.capacity_bytes==null?void 0:Number(e.capacity_bytes),usedBytes:e.used_bytes==null?void 0:Number(e.used_bytes),filesystem:j(e.filesystem),encrypted:pt(e.encrypted),capabilities:ge(e.capabilities,{}),desiredState:ge(e.desired_state,{}),observedState:ge(e.observed_state,{}),backupPolicyId:j(e.backup_policy_id),lastBackupAt:j(e.last_backup_at),orphanedAt:j(e.orphaned_at),adoptedAt:j(e.adopted_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deletedAt:j(e.deleted_at)}}function ut(e){return{id:String(e.id),volumeId:String(e.volume_id),resourceId:String(e.resource_id),targetPath:String(e.target_path),readOnly:pt(e.read_only),uid:e.uid==null?void 0:Number(e.uid),gid:e.gid==null?void 0:Number(e.gid),mode:j(e.mode),propagation:String(e.propagation),driverOptions:ge(e.driver_options,{}),desiredState:String(e.desired_state),observedState:String(e.observed_state),operationId:j(e.operation_id),lastError:j(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function gr(e){return{id:String(e.id),volumeId:String(e.volume_id),recoveryPointId:j(e.recovery_point_id),providerId:j(e.provider_id),name:String(e.name),status:String(e.status),sizeBytes:e.size_bytes==null?void 0:Number(e.size_bytes),encrypted:pt(e.encrypted),checksum:j(e.checksum),metadata:ge(e.metadata,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deletedAt:j(e.deleted_at)}}class Ft{controlPlane;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.controlPlane=e;this.now=t;this.id=r}get(e){let t=this.controlPlane.database.query("SELECT * FROM persistent_volumes WHERE id=?").get(e);return t?Tr(t):void 0}list(e){let t=["project_id=?"],r=[e.projectId];if(e.environmentId)t.push("environment_id=?"),r.push(e.environmentId);if(!e.includeDeleted)t.push("deleted_at IS NULL");return this.controlPlane.database.query(`SELECT * FROM persistent_volumes WHERE ${t.join(" AND ")} ORDER BY name`).all(...r).map(Tr)}create(e){let t=te(this.now),r=e.id??this.id();return this.controlPlane.database.run("INSERT INTO persistent_volumes (id,organization_id,project_id,environment_id,resource_id,name,provider,provider_id,type,status,capacity_bytes,used_bytes,filesystem,encrypted,capabilities,desired_state,observed_state,backup_policy_id,last_backup_at,orphaned_at,adopted_at,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.provider,e.providerId??null,e.type,e.status,e.capacityBytes??null,e.usedBytes??null,e.filesystem??null,e.encrypted?1:0,JSON.stringify(e.capabilities),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),e.backupPolicyId??null,e.lastBackupAt??null,e.orphanedAt??null,e.adoptedAt??null,t,t,e.deletedAt??null]),this.get(r)}update(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error("Volume changed before this operation could be applied.");let o={...n,...r,updatedAt:te(this.now)};if(this.controlPlane.database.run("UPDATE persistent_volumes SET environment_id=?,resource_id=?,name=?,provider=?,provider_id=?,type=?,status=?,capacity_bytes=?,used_bytes=?,filesystem=?,encrypted=?,capabilities=?,desired_state=?,observed_state=?,backup_policy_id=?,last_backup_at=?,orphaned_at=?,adopted_at=?,deleted_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[o.environmentId??null,o.resourceId??null,o.name,o.provider,o.providerId??null,o.type,o.status,o.capacityBytes??null,o.usedBytes??null,o.filesystem??null,o.encrypted?1:0,JSON.stringify(o.capabilities),JSON.stringify(o.desiredState),JSON.stringify(o.observedState),o.backupPolicyId??null,o.lastBackupAt??null,o.orphanedAt??null,o.adoptedAt??null,o.deletedAt??null,o.updatedAt,e,t]).changes!==1)throw Error("Volume changed before this operation could be applied.");return this.get(e)}attachments(e){return this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? ORDER BY target_path").all(e).map(ut)}attachment(e){let t=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE id=?").get(e);return t?ut(t):void 0}upsertAttachment(e){let t=this.controlPlane.database.query("SELECT * FROM volume_attachments WHERE volume_id=? AND resource_id=? AND target_path=?").get(e.volumeId,e.resourceId,e.targetPath),r=te(this.now);if(t){let o=ut(t);return this.controlPlane.database.run("UPDATE volume_attachments SET read_only=?,uid=?,gid=?,mode=?,propagation=?,driver_options=?,desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[e.readOnly?1:0,e.uid??null,e.gid??null,e.mode??null,e.propagation,JSON.stringify(e.driverOptions),e.desiredState,e.observedState,e.operationId??null,e.lastError??null,r,o.id]),this.attachment(o.id)}let n=e.id??this.id();return this.controlPlane.database.run("INSERT INTO volume_attachments (id,volume_id,resource_id,target_path,read_only,uid,gid,mode,propagation,driver_options,desired_state,observed_state,operation_id,last_error,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[n,e.volumeId,e.resourceId,e.targetPath,e.readOnly?1:0,e.uid??null,e.gid??null,e.mode??null,e.propagation,JSON.stringify(e.driverOptions),e.desiredState,e.observedState,e.operationId??null,e.lastError??null,r,r]),this.attachment(n)}updateAttachment(e,t){let r=this.attachment(e);if(!r)throw Error("Volume attachment was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE volume_attachments SET desired_state=?,observed_state=?,operation_id=?,last_error=?,version=version+1,updated_at=? WHERE id=?",[n.desiredState,n.observedState,n.operationId??null,n.lastError??null,te(this.now),e]),this.attachment(e)}snapshots(e){return this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE volume_id=? AND deleted_at IS NULL ORDER BY created_at DESC").all(e).map(gr)}snapshot(e){let t=this.controlPlane.database.query("SELECT * FROM volume_snapshots WHERE id=?").get(e);return t?gr(t):void 0}createSnapshot(e){let t=e.id??this.id(),r=te(this.now);return this.controlPlane.database.run("INSERT INTO volume_snapshots (id,volume_id,recovery_point_id,provider_id,name,status,size_bytes,encrypted,checksum,metadata,created_at,updated_at,deleted_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.volumeId,e.recoveryPointId??null,e.providerId??null,e.name,e.status,e.sizeBytes??null,e.encrypted?1:0,e.checksum??null,JSON.stringify(e.metadata),r,r,e.deletedAt??null]),this.snapshot(t)}updateSnapshot(e,t){let r=this.snapshot(e);if(!r)throw Error("Volume snapshot was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE volume_snapshots SET recovery_point_id=?,provider_id=?,name=?,status=?,size_bytes=?,encrypted=?,checksum=?,metadata=?,deleted_at=?,updated_at=? WHERE id=?",[n.recoveryPointId??null,n.providerId??null,n.name,n.status,n.sizeBytes??null,n.encrypted?1:0,n.checksum??null,JSON.stringify(n.metadata),n.deletedAt??null,te(this.now),e]),this.snapshot(e)}inventory(e,t){return this.list({projectId:e,environmentId:t}).map((r)=>{let n=this.attachments(r.id),o=this.snapshots(r.id),a=r.lastBackupAt?Date.now()-new Date(r.lastBackupAt).getTime():1/0;return{...r,attachments:n,snapshots:o,orphaned:r.status==="orphaned",usagePercent:r.capacityBytes&&r.usedBytes!=null?Math.round(r.usedBytes/r.capacityBytes*1000)/10:void 0,backupState:r.backupPolicyId?a<=86400000?"protected":"stale":"unprotected"}})}audit(e){this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,resourceId:this.get(e.volumeId)?.resourceId,actorId:e.actorId,type:e.type,level:"warning",payload:{volumeId:e.volumeId,environmentId:e.environmentId??null,...e.payload}})}}function Jc(e,t){let r=e.getProject(t.projectId);if(!r?.organizationId)return;let n=new Ft(e),o=new Or,a=new Set(t.manifest.spec.volumes),l=new Set;for(let u of a){let p=`${t.slug}-${u}`.toLowerCase().replace(/[^a-z0-9_.-]/g,"-").slice(0,63),E=n.list({projectId:t.projectId,environmentId:t.environmentId,includeDeleted:!0}).find((h)=>h.name===p);if(E?.deletedAt)throw Error(`Compose volume ${p} was permanently deleted; rename it before redeploying.`);let g=E?.resourceId?e.getResource(E.resourceId):e.createResource({projectId:t.projectId,environmentId:t.environmentId,kind:"volume",slug:p,name:p,provider:"docker",providerId:p,desiredState:{composeApplicationId:t.id,composeVolume:u}}),m=E??n.create({organizationId:r.organizationId,projectId:t.projectId,environmentId:t.environmentId,resourceId:g?.id,name:p,provider:"docker",providerId:p,type:"docker",status:"available",encrypted:!1,capabilities:o.capabilities(),desiredState:{composeApplicationId:t.id,composeVolume:u,nativeName:p},observedState:{}});l.add(m.id);let T=new Map;for(let h of Object.values(t.manifest.spec.services))for(let _ of h.volumes.filter((N)=>N.source===u)){let N=T.get(_.target)??[];N.push(h.name),T.set(_.target,N),n.upsertAttachment({volumeId:m.id,resourceId:t.resourceId,targetPath:_.target,readOnly:_.readOnly,propagation:"private",driverOptions:{composeServices:N},desiredState:"attached",observedState:"pending"})}}for(let u of n.list({projectId:t.projectId,environmentId:t.environmentId}).filter((p)=>p.desiredState.composeApplicationId===t.id&&!l.has(p.id)))for(let p of n.attachments(u.id))n.updateAttachment(p.id,{desiredState:"detached"})}function Qp(e,t,r){let n=new Ft(e);for(let o of n.list({projectId:t.projectId,environmentId:t.environmentId}).filter((a)=>a.desiredState.composeApplicationId===t.id)){for(let a of n.attachments(o.id))n.updateAttachment(a.id,{desiredState:"detached",observedState:"detached"});n.update(o.id,o.version,{status:r?"deleted":"available",deletedAt:r?new Date().toISOString():void 0})}}function re(e){return typeof e==="string"&&e?e:void 0}function Et(e,t){try{return JSON.parse(String(e))}catch{return t}}function xe(e){return{id:String(e.id),resourceId:String(e.resource_id),projectId:String(e.project_id),environmentId:String(e.environment_id),name:String(e.name),slug:String(e.slug),status:String(e.status),sourceKind:String(e.source_kind),sourceHash:String(e.source_hash),redactedSource:String(e.redacted_source),manifest:Et(e.manifest,{}),diagnostics:Et(e.diagnostics,[]),templateId:re(e.template_id),templateVersion:re(e.template_version),latestOperationId:re(e.latest_operation_id),createdByActorId:re(e.created_by_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at),deletedAt:re(e.deleted_at)}}function Ni(e){return{applicationId:String(e.application_id),serviceName:String(e.service_name),status:String(e.status),replicas:Number(e.replicas),healthyReplicas:Number(e.healthy_replicas),latestOperationId:re(e.latest_operation_id),observedState:Et(e.observed_state,{}),updatedAt:String(e.updated_at)}}class Ut{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}persist(e,t){if(!e.valid)throw Error(`Compose definition contains ${e.diagnostics.filter((_)=>_.severity==="error").length} blocking diagnostic(s)`);let{projectId:r,environmentId:n,name:o,slug:a}=e.manifest.metadata;if(!this.controlPlane.listEnvironments(r).find((_)=>_.id===n))throw Error("Compose project and environment scope was not found");let u=this.getBySlug(r,n,a),p=this.now().toISOString(),E=JSON.stringify(e.manifest),g=JSON.stringify(s(e.diagnostics));if(u){if(u.status==="deleted")throw Error("A deleted Compose application cannot be overwritten; choose another slug");let _=this.controlPlane.getResource(u.resourceId);if(!_)throw Error("Compose application resource was not found");this.controlPlane.updateResource(_.id,_.version,{name:o,provider:_.provider,providerId:_.providerId,desiredState:e.manifest,discoveredState:_.discoveredState,metadata:{sourceKind:t.sourceKind,templateId:t.templateId??null,templateVersion:t.templateVersion??null,sourceHash:e.sourceHash}}),this.controlPlane.database.run("UPDATE compose_applications SET name=?, status='ready', source_kind=?, source_hash=?, redacted_source=?, manifest=?, diagnostics=?, template_id=?, template_version=?, version=version+1, updated_at=? WHERE id=?",[o,t.sourceKind,e.sourceHash,e.redactedSource,E,g,t.templateId??null,t.templateVersion??null,p,u.id]);let N=Object.keys(e.manifest.spec.services);if(N.length)this.controlPlane.database.run(`DELETE FROM compose_service_states WHERE application_id=? AND service_name NOT IN (${N.map(()=>"?").join(",")})`,[u.id,...N]);for(let v of Object.values(e.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?) ON CONFLICT(application_id, service_name) DO UPDATE SET replicas=excluded.replicas, updated_at=excluded.updated_at",[u.id,v.name,v.replicas,p]);this.controlPlane.appendEvent({projectId:r,resourceId:u.resourceId,actorId:t.createdByActorId,type:"compose.application.updated",payload:{applicationId:u.id,sourceHash:e.sourceHash,diagnosticCount:e.diagnostics.length,templateId:t.templateId??null,templateVersion:t.templateVersion??null}});let y=this.get(u.id);return Jc(this.controlPlane,y),y}let m=this.controlPlane.createResource({projectId:r,environmentId:n,kind:"compose_application",slug:a,name:o,desiredState:e.manifest,metadata:{sourceKind:t.sourceKind,templateId:t.templateId??null,templateVersion:t.templateVersion??null,sourceHash:e.sourceHash}}),T=this.id();this.controlPlane.database.run("INSERT INTO compose_applications (id, resource_id, project_id, environment_id, name, slug, status, source_kind, source_hash, redacted_source, manifest, diagnostics, template_id, template_version, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, 'ready', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[T,m.id,r,n,o,a,t.sourceKind,e.sourceHash,e.redactedSource,E,g,t.templateId??null,t.templateVersion??null,t.createdByActorId??null,p,p]);for(let _ of Object.values(e.manifest.spec.services))this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, observed_state, updated_at) VALUES (?, ?, 'pending', ?, 0, '{}', ?)",[T,_.name,_.replicas,p]);this.controlPlane.appendEvent({projectId:r,resourceId:m.id,actorId:t.createdByActorId,type:"compose.application.created",payload:{applicationId:T,sourceHash:e.sourceHash,serviceNames:Object.keys(e.manifest.spec.services),templateId:t.templateId??null}});let h=this.get(T);return Jc(this.controlPlane,h),h}import(e,t){let r=kr(e,t);return{application:this.persist(r,{sourceKind:"compose",createdByActorId:t.createdByActorId}),parsed:r}}fromTemplate(e,t,r){let n=Vc(e,t,r,r.version);return{application:this.persist(n,{sourceKind:"template",templateId:e,templateVersion:r.version??"1.0.0",createdByActorId:r.createdByActorId}),parsed:n}}preview(e,t){return kr(e,t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE id=?").get(e);return t?xe(t):void 0}getByResource(e){let t=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE resource_id=?").get(e);return t?xe(t):void 0}getBySlug(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM compose_applications WHERE project_id=? AND environment_id=? AND slug=?").get(e,t,r);return n?xe(n):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM compose_applications ORDER BY updated_at DESC").all().map(xe).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(e.includeDeleted||t.status!=="deleted"))}services(e){return this.controlPlane.database.query("SELECT * FROM compose_service_states WHERE application_id=? ORDER BY service_name").all(e).map(Ni)}transition(e,t,r={}){let n=this.get(e);if(!n)throw Error(`Compose application ${e} was not found`);let o=this.now().toISOString(),a=t==="deleted"?o:null;this.controlPlane.database.run("UPDATE compose_applications SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), version=version+1, updated_at=?, deleted_at=? WHERE id=?",[t,r.operationId??null,o,a,e]);for(let l of r.services??[])if(n.manifest.spec.services[l.name])this.controlPlane.database.run("INSERT INTO compose_service_states (application_id, service_name, status, replicas, healthy_replicas, latest_operation_id, observed_state, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(application_id, service_name) DO UPDATE SET status=excluded.status, replicas=excluded.replicas, healthy_replicas=excluded.healthy_replicas, latest_operation_id=excluded.latest_operation_id, observed_state=excluded.observed_state, updated_at=excluded.updated_at",[e,l.name,l.status,l.replicas??n.manifest.spec.services[l.name].replicas,l.healthyReplicas??0,r.operationId??null,JSON.stringify(s(l.observedState??{})),o]);return this.controlPlane.appendEvent({projectId:n.projectId,resourceId:n.resourceId,operationId:r.operationId,type:`compose.application.${t}`,level:t==="failed"||t==="degraded"?"error":"info",payload:{applicationId:e,error:r.error??null}}),this.get(e)}}class xr{controlPlane;applications;queue;constructor(e){this.controlPlane=e;this.applications=new Ut(e),this.queue=new c(e)}enqueue(e,t,r={}){if(e.status==="deleted")throw Error("Deleted Compose applications cannot be operated");if(r.service&&!e.manifest.spec.services[r.service])throw Error(`Compose service ${r.service} was not found`);if(t==="delete"){let o=r.removeVolumes?`${e.slug} delete volumes`:e.slug;if(r.confirmation!==o)throw Error(`Type ${o} to confirm ${r.removeVolumes?"persistent data removal":"stack deletion"}`)}if(t==="scale"&&(!r.service||!Number.isInteger(r.replicas)||r.replicas<0||r.replicas>100))throw Error("Scale requires a service and 0-100 replicas");let n=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:r.actorId,kind:`compose.${t}`,idempotencyKey:`compose:${e.id}:${t}:${r.service??"stack"}:${r.replicas??""}:${e.version}`,correlationId:`compose:${e.id}`,input:{applicationId:e.id,service:r.service??null,replicas:r.replicas??null,removeVolumes:!!r.removeVolumes},lockKey:`compose:${e.id}`,providerKey:this.controlPlane.getResource(e.resourceId)?.provider??"default",buildSlot:t==="deploy"||t==="redeploy",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.applications.transition(e.id,t==="delete"?"deleting":t==="stop"?"stopped":t==="start"?"deploying":t==="scale"?e.status:"deploying",{operationId:n.id}),n}}import{createHash as Li}from"node:crypto";var Oi=/^[a-f0-9]{40,64}$/i,Ui=/^[A-Z][A-Z0-9_]{1,127}$/;function V(e){return typeof e==="string"&&e?e:void 0}function ne(e){try{return JSON.parse(String(e))}catch{return{}}}function Di(e){let t=ne(e);return Array.isArray(t)?t.map(String):[]}function Tt(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:String(e.resource_id),baseEnvironmentId:String(e.base_environment_id),enabled:Number(e.enabled)===1,branchRule:V(e.branch_rule),domainPattern:String(e.domain_pattern),ttlHours:Number(e.ttl_hours),keepCount:Number(e.keep_count),publicAccess:Number(e.public_access)===1,authenticationRequired:Number(e.authentication_required)===1,allowForks:Number(e.allow_forks)===1,inheritedSecrets:Di(e.inherited_secrets),resourceOverrides:ne(e.resource_overrides),databaseStrategy:String(e.database_strategy),maxMonthlyCost:Number(e.max_monthly_cost),maxCpu:Number(e.max_cpu),maxMemoryMb:Number(e.max_memory_mb),cleanupOnClose:Number(e.cleanup_on_close)===1,version:Number(e.version),createdByActorId:V(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function _e(e){return{id:String(e.id),definitionId:String(e.definition_id),projectId:String(e.project_id),resourceId:String(e.resource_id),baseEnvironmentId:String(e.base_environment_id),identityKey:String(e.identity_key),sourceProvider:V(e.source_provider),repository:V(e.repository),branch:String(e.branch),pullRequestNumber:e.pull_request_number==null?void 0:Number(e.pull_request_number),fork:Number(e.fork)===1,commitSha:String(e.commit_sha),name:String(e.name),stackName:String(e.stack_name),url:V(e.url),status:String(e.status),expiresAt:String(e.expires_at),latestOperationId:V(e.latest_operation_id),createdByActorId:V(e.created_by_actor_id),costEstimate:e.cost_estimate==null?void 0:Number(e.cost_estimate),desiredState:ne(e.desired_state),observedState:ne(e.observed_state),teardownError:V(e.teardown_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at),destroyedAt:V(e.destroyed_at)}}function hr(e){return{id:String(e.id),previewId:String(e.preview_id),provider:String(e.provider),providerResourceId:String(e.provider_resource_id),kind:String(e.kind),tags:ne(e.tags),observedState:ne(e.observed_state),discoveredAt:String(e.discovered_at),deletedAt:V(e.deleted_at)}}function K(e,t,r,n){return Number.isFinite(e)?Math.min(n,Math.max(r,Math.floor(e))):t}function Fe(e,t,r,n){return Number.isFinite(e)?Math.min(n,Math.max(r,e)):t}function _t(e){return e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-|-$/g,"").slice(0,28)||"preview"}class Ve{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}createDefinition(e){let t=this.controlPlane.getResource(e.resourceId),r=this.controlPlane.listEnvironments(e.projectId).find((E)=>E.id===e.baseEnvironmentId);if(!t||t.projectId!==e.projectId||t.environmentId!==r?.id)throw Error("Preview resource and base environment must belong to the same project scope");if(t.kind!=="application")throw Error("Preview environments currently support application resources only");if(!/^https:\/\//.test(e.domainPattern)||!e.domainPattern.includes("{name}"))throw Error("Preview domainPattern must be HTTPS and include {name}");let n=this.getDefinitionForResource(e.resourceId),o=e.publicAccess??n?.publicAccess??!1,a=e.authenticationRequired??n?.authenticationRequired??!0;if(o&&!a)throw Error("Public preview environments require an authentication policy");let l=[...new Set(e.inheritedSecrets??[])];if(l.some((E)=>!Ui.test(E)))throw Error("Inherited preview secret names must use uppercase environment-variable identifiers");let u=this.now().toISOString();if(n)return this.controlPlane.database.run("UPDATE preview_definitions SET base_environment_id=?, enabled=1, branch_rule=?, domain_pattern=?, ttl_hours=?, keep_count=?, public_access=?, authentication_required=?, allow_forks=?, inherited_secrets=?, resource_overrides=?, database_strategy=?, max_monthly_cost=?, max_cpu=?, max_memory_mb=?, cleanup_on_close=?, version=version+1, updated_at=? WHERE id=?",[e.baseEnvironmentId,e.branchRule??null,e.domainPattern,K(e.ttlHours,n.ttlHours,1,720),K(e.keepCount,n.keepCount,1,100),o?1:0,a?1:0,e.allowForks??n.allowForks?1:0,JSON.stringify(e.inheritedSecrets===void 0?n.inheritedSecrets:l),JSON.stringify(s(e.resourceOverrides??n.resourceOverrides)),e.databaseStrategy??n.databaseStrategy,Fe(e.maxMonthlyCost,n.maxMonthlyCost,0,1e4),Fe(e.maxCpu,n.maxCpu,0.1,64),K(e.maxMemoryMb,n.maxMemoryMb,128,131072),e.cleanupOnClose??n.cleanupOnClose?1:0,u,n.id]),this.controlPlane.appendEvent({projectId:e.projectId,resourceId:e.resourceId,actorId:e.createdByActorId,type:"preview.definition.updated",payload:{definitionId:n.id,baseEnvironmentId:e.baseEnvironmentId,version:n.version+1}}),this.getDefinition(n.id);let p=this.id();return this.controlPlane.database.run("INSERT INTO preview_definitions (id, project_id, resource_id, base_environment_id, enabled, branch_rule, domain_pattern, ttl_hours, keep_count, public_access, authentication_required, allow_forks, inherited_secrets, resource_overrides, database_strategy, max_monthly_cost, max_cpu, max_memory_mb, cleanup_on_close, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[p,e.projectId,e.resourceId,e.baseEnvironmentId,e.branchRule??null,e.domainPattern,K(e.ttlHours,24,1,720),K(e.keepCount,10,1,100),e.publicAccess?1:0,e.authenticationRequired===!1?0:1,e.allowForks?1:0,JSON.stringify(l),JSON.stringify(s(e.resourceOverrides??{})),e.databaseStrategy??"disabled",Fe(e.maxMonthlyCost,25,0,1e4),Fe(e.maxCpu,1,0.1,64),K(e.maxMemoryMb,1024,128,131072),e.cleanupOnClose===!1?0:1,e.createdByActorId??null,u,u]),this.controlPlane.appendEvent({projectId:e.projectId,resourceId:e.resourceId,actorId:e.createdByActorId,type:"preview.definition.created",payload:{definitionId:p,baseEnvironmentId:e.baseEnvironmentId,ttlHours:K(e.ttlHours,24,1,720),inheritedSecretNames:l}}),this.getDefinition(p)}getDefinition(e){let t=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE id=?").get(e);return t?Tt(t):void 0}getDefinitionForResource(e){let t=this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE resource_id=?").get(e);return t?Tt(t):void 0}listDefinitions(e){return this.controlPlane.database.query("SELECT * FROM preview_definitions WHERE project_id=? ORDER BY updated_at DESC").all(e).map(Tt)}listInstances(e={}){return this.controlPlane.database.query("SELECT * FROM preview_instances ORDER BY created_at DESC").all().map(_e).filter((r)=>(!e.projectId||r.projectId===e.projectId)&&(!e.definitionId||r.definitionId===e.definitionId)&&(!e.status||r.status===e.status))}getInstance(e){let t=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE id=?").get(e);return t?_e(t):void 0}findForPullRequest(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(e,`pr:${t}:${r}`);return n?_e(n):void 0}findForBranch(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(e,`branch:${t}:${r}`);return n?_e(n):void 0}upsert(e){let t=this.getDefinition(e.definitionId);if(!t?.enabled)throw Error("Preview environments are not enabled for this application");if(!Oi.test(e.commitSha))throw Error("Preview deployment requires an immutable 40-64 character commit SHA");if(e.fork&&!t.allowForks)throw Error("Untrusted fork previews are disabled");let r=e.pullRequestNumber?`pr:${e.repository??"unknown"}:${e.pullRequestNumber}`:`branch:${e.repository??"local"}:${e.branch}`,n=Li("sha256").update(`${t.id}:${r}`).digest("hex").slice(0,8),a=`${(e.pullRequestNumber?`pr-${e.pullRequestNumber}`:_t(e.branch)).slice(0,28)}-${n}`,l=`preview-${a}`.slice(0,63),u=t.domainPattern.replaceAll("{name}",a).replaceAll("{project}",_t(t.projectId)).replaceAll("{branch}",_t(e.branch)).replaceAll("{pr}",String(e.pullRequestNumber??"branch")),p=e.now??this.now(),E=p.toISOString(),g=new Date(p.getTime()+t.ttlHours*60*60*1000).toISOString(),m=this.controlPlane.database.query("SELECT * FROM preview_instances WHERE definition_id=? AND identity_key=?").get(t.id,r);if(m){let _=_e(m),N=_.commitSha!==e.commitSha||_.status==="destroyed";if(N)this.controlPlane.database.run("UPDATE preview_instances SET commit_sha=?, branch=?, fork=?, status='queued', expires_at=?, url=?, teardown_error=NULL, destroyed_at=NULL, version=version+1, updated_at=? WHERE id=?",[e.commitSha,e.branch,e.fork?1:0,g,u,E,_.id]);return{preview:this.getInstance(_.id),created:!1,changed:N,inheritedSecrets:e.fork?[]:t.inheritedSecrets}}let T=this.id(),h=s({source:{provider:e.sourceProvider??null,repository:e.repository??null,branch:e.branch,commitSha:e.commitSha,pullRequestNumber:e.pullRequestNumber??null,fork:!!e.fork},policy:{databaseStrategy:t.databaseStrategy,resourceOverrides:t.resourceOverrides,maxMonthlyCost:t.maxMonthlyCost,maxCpu:t.maxCpu,maxMemoryMb:t.maxMemoryMb,publicAccess:t.publicAccess,authenticationRequired:t.authenticationRequired},inheritedSecretNames:e.fork?[]:t.inheritedSecrets});return this.controlPlane.database.run("INSERT INTO preview_instances (id, definition_id, project_id, resource_id, base_environment_id, identity_key, source_provider, repository, branch, pull_request_number, fork, commit_sha, name, stack_name, url, status, expires_at, created_by_actor_id, desired_state, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?, ?, ?)",[T,t.id,t.projectId,t.resourceId,t.baseEnvironmentId,r,e.sourceProvider??null,e.repository??null,e.branch,e.pullRequestNumber??null,e.fork?1:0,e.commitSha,a,l,u,g,e.createdByActorId??null,JSON.stringify(h),E,E]),this.controlPlane.appendEvent({projectId:t.projectId,resourceId:t.resourceId,actorId:e.createdByActorId,type:"preview.created",payload:{previewId:T,identityKey:r,commitSha:e.commitSha,expiresAt:g,fork:!!e.fork}}),{preview:this.getInstance(T),created:!0,changed:!0,inheritedSecrets:e.fork?[]:t.inheritedSecrets}}transition(e,t,r={}){let n=this.getInstance(e);if(!n)throw Error(`Preview ${e} was not found`);let o=this.now().toISOString(),a=t==="destroyed"?o:null;return this.controlPlane.database.run("UPDATE preview_instances SET status=?, latest_operation_id=COALESCE(?, latest_operation_id), observed_state=?, teardown_error=?, cost_estimate=COALESCE(?, cost_estimate), destroyed_at=?, version=version+1, updated_at=? WHERE id=?",[t,r.operationId??null,JSON.stringify(s(r.observedState??n.observedState)),r.teardownError??null,r.costEstimate??null,a,o,e]),this.controlPlane.appendEvent({projectId:n.projectId,resourceId:n.resourceId,operationId:r.operationId,type:`preview.${t}`,level:t==="failed"||t==="cleanup_failed"?"error":"info",payload:{previewId:e,commitSha:n.commitSha,teardownError:r.teardownError??null}}),this.getInstance(e)}extend(e,t){let r=this.getInstance(e),n=r?this.getDefinition(r.definitionId):void 0;if(!r||!n)throw Error(`Preview ${e} was not found`);let o=this.now(),a=K(t,n.ttlHours,1,720),l=new Date(Math.max(o.getTime(),new Date(r.expiresAt).getTime())+a*3600000).toISOString();return this.controlPlane.database.run("UPDATE preview_instances SET expires_at=?, version=version+1, updated_at=? WHERE id=?",[l,o.toISOString(),e]),this.getInstance(e)}expired(e=this.now()){return this.listInstances().filter((t)=>["queued","deploying","active","updating","failed","cleanup_failed"].includes(t.status)&&new Date(t.expiresAt)<=e)}recordResource(e){let t=this.getInstance(e.previewId);if(!t)throw Error(`Preview ${e.previewId} was not found`);let r={"ts-cloud:preview":t.id,"ts-cloud:project":t.projectId,"ts-cloud:expires-at":t.expiresAt};for(let[l,u]of Object.entries(r))if(e.tags[l]!==u)throw Error(`Preview resource is missing immutable tag ${l}`);let n=this.id(),o=this.now().toISOString();this.controlPlane.database.run("INSERT INTO preview_resources (id, preview_id, provider, provider_resource_id, kind, tags, observed_state, discovered_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(preview_id, provider, provider_resource_id) DO UPDATE SET kind=excluded.kind, tags=excluded.tags, observed_state=excluded.observed_state, deleted_at=NULL",[n,t.id,e.provider,e.providerResourceId,e.kind,JSON.stringify(e.tags),JSON.stringify(s(e.observedState??{})),o]);let a=this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? AND provider=? AND provider_resource_id=?").get(t.id,e.provider,e.providerResourceId);return hr(a)}listResources(e){return this.controlPlane.database.query("SELECT * FROM preview_resources WHERE preview_id=? ORDER BY kind, provider_resource_id").all(e).map(hr)}markResourcesDeleted(e){if(!this.getInstance(e))throw Error(`Preview ${e} was not found`);return this.controlPlane.database.run("UPDATE preview_resources SET deleted_at=? WHERE preview_id=? AND deleted_at IS NULL",[this.now().toISOString(),e]).changes}}class _r{controlPlane;previews;queue;constructor(e){this.controlPlane=e;this.previews=new Ve(e),this.queue=new c(e)}enqueueDeploy(e,t={}){let r=t.created?"preview.create":"preview.update",n=t.reason==="manual_rebuild"?`:${crypto.randomUUID()}`:"",o=this.queue.enqueue({projectId:e.projectId,environmentId:e.baseEnvironmentId,resourceId:e.resourceId,actorId:t.actorId,kind:r,correlationId:`preview:${e.id}`,idempotencyKey:`preview:${e.id}:${e.commitSha}${n}`,input:{previewId:e.id,reason:t.reason??(t.created?"create":"commit_update"),source:{repository:e.repository??null,branch:e.branch,commitSha:e.commitSha,pullRequestNumber:e.pullRequestNumber??null,fork:e.fork}},lockKey:`preview:${e.id}`,providerKey:"preview",buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(e.id,"queued",{operationId:o.id}),o}enqueueDestroy(e,t,r){if(e.status==="destroyed")throw Error("Preview is already destroyed");let n=this.queue.enqueue({projectId:e.projectId,environmentId:e.baseEnvironmentId,resourceId:e.resourceId,actorId:r,kind:"preview.destroy",correlationId:`preview:${e.id}`,idempotencyKey:`preview:${e.id}:destroy:${t}`,input:{previewId:e.id,reason:t},lockKey:`preview:${e.id}`,providerKey:"preview",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.previews.transition(e.id,"queued",{operationId:n.id}),n}cleanup(e={}){let t=e.now??new Date,r=new Map,n=this.previews.listInstances().filter((p)=>!["destroyed","destroying"].includes(p.status)),o=(p,E)=>{let g=r.get(p.id)??{preview:p,reasons:[]};if(!g.reasons.includes(E))g.reasons.push(E);r.set(p.id,g)};for(let p of n){if(new Date(p.expiresAt)<=t)o(p,"ttl_expired");if(e.maxAgeHours&&t.getTime()-new Date(p.createdAt).getTime()>=e.maxAgeHours*3600000)o(p,"max_age")}let a=new Map;for(let p of n)a.set(p.definitionId,[...a.get(p.definitionId)??[],p]);for(let[p,E]of a){let g=this.previews.getDefinition(p),m=e.keepCount??g?.keepCount;if(!m)continue;E.sort((T,h)=>h.createdAt.localeCompare(T.createdAt)).slice(m).forEach((T)=>o(T,"keep_count"))}let l=[...r.values()].sort((p,E)=>p.preview.createdAt.localeCompare(E.preview.createdAt)),u=e.dryRun?[]:l.map((p)=>this.enqueueDestroy(p.preview,p.reasons.sort().join("+"),e.actorId));if(l.length)this.controlPlane.appendEvent({actorId:e.actorId,type:e.dryRun?"preview.cleanup.planned":"preview.cleanup.queued",payload:{previewIds:l.map((p)=>p.preview.id),reasons:Object.fromEntries(l.map((p)=>[p.preview.id,p.reasons])),dryRun:!!e.dryRun}});return{candidates:l,operations:u,dryRun:!!e.dryRun}}reconcile(e){let t=[],r=[],n=[];for(let o of e){let a=o.tags["ts-cloud:preview"],l=o.tags["ts-cloud:project"],u=o.tags["ts-cloud:expires-at"];if(!a||!l||!u){n.push(o.providerResourceId);continue}let p=this.previews.getInstance(a);if(!p||p.projectId!==l||p.expiresAt!==u){r.push(o.providerResourceId);continue}if(this.previews.recordResource({...o,previewId:p.id}),o.estimatedMonthlyCost!==void 0)this.previews.transition(p.id,p.status,{costEstimate:o.estimatedMonthlyCost,observedState:{...p.observedState,lastReconciledAt:new Date().toISOString()}});t.push(o.providerResourceId)}if(r.length)this.controlPlane.appendEvent({type:"preview.reconciliation.leaks",level:"error",payload:{providerResourceIds:r}});return{matched:t,unknownPreviewResources:r,ignoredUntagged:n}}}var _f=["deployment.create","deployment.rollback","application.create","deploy.source","deploy.preview","preview.create","preview.update","preview.destroy","compose.deploy","compose.redeploy","compose.start","compose.stop","compose.delete","compose.scale"];function Me(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function Of(e,t){if(!t.projectId||!t.environmentId)throw Error(`Queued ${t.kind} operation is missing its project or environment scope`);let r=e.listEnvironments(t.projectId).find((l)=>l.id===t.environmentId);if(!r)throw Error(`Environment ${t.environmentId} was not found for queued ${t.kind} operation`);let n=t.resourceId?e.getResource(t.resourceId):void 0;if(t.resourceId&&(!n||n.projectId!==t.projectId||n.environmentId!==t.environmentId))throw Error(`Resource ${t.resourceId} was not found in the queued deployment scope`);let o=Me(t.input);if(t.kind.startsWith("compose.")){let l=typeof o.applicationId==="string"?o.applicationId:void 0,u=l?new Ut(e).get(l):t.resourceId?new Ut(e).getByResource(t.resourceId):void 0;if(!u||u.projectId!==t.projectId||u.environmentId!==t.environmentId||u.resourceId!==t.resourceId)throw Error("Queued Compose application does not match the operation scope");let p=t.kind.slice(8),E=["compose:apply",u.id,"--action",p,"--env",r.slug];if(typeof o.service==="string"&&o.service)E.push("--service",o.service);if(typeof o.replicas==="number")E.push("--replicas",String(o.replicas));if(o.removeVolumes===!0)E.push("--remove-volumes");return{id:`queue:${t.id}`,label:`${p[0].toUpperCase()}${p.slice(1)} Compose application`,description:`${p} ${u.name}.`,command:E,mutates:!0,target:{environment:r.slug,resource:n?.slug,composeId:u.id}}}if(t.kind.startsWith("preview.")){let l=typeof o.previewId==="string"?o.previewId:void 0,u=l?new Ve(e).getInstance(l):void 0;if(!u)throw Error(`Preview ${l??"(missing)"} was not found for queued ${t.kind}`);if(u.projectId!==t.projectId||u.resourceId!==t.resourceId)throw Error("Queued preview does not match the operation scope");if(t.kind==="preview.destroy")return{id:`queue:${t.id}`,label:"Destroy preview",description:`Destroy ${u.name}.`,command:["stack:delete",u.stackName,"--yes"],mutates:!0,target:{environment:r.slug,resource:n?.slug,previewId:u.id}};return{id:`queue:${t.id}`,label:t.kind==="preview.create"?"Create preview":"Update preview",description:`Deploy ${u.name} at ${u.commitSha}.`,command:["deploy","--stack",u.stackName,"--env",r.slug,"--yes","--skip-dns-verification",...n?["--site",n.slug]:[]],mutates:!0,target:{environment:r.slug,resource:n?.slug,previewId:u.id}}}if(t.kind==="deployment.rollback"){let l=["deploy:rollback"];if(n)l.push(n.slug);if(l.push("--env",r.slug),typeof o.revision==="string"&&o.revision)l.push("--to",o.revision);return{id:`queue:${t.id}`,label:"Rollback deployment",description:`Roll back ${n?.slug??r.slug}.`,command:l,mutates:!0,target:{environment:r.slug,resource:n?.slug}}}let a=["deploy","--env",r.slug,"--yes"];if(n)a.push("--site",n.slug);return{id:`queue:${t.id}`,label:t.kind==="deploy.preview"?"Deploy preview":"Deploy release",description:`Deploy ${n?.slug??r.slug}.`,command:a,mutates:!0,target:{environment:r.slug,resource:n?.slug}}}function ki(e){let t=e.stderr?.trim()||`Deployment process exited with code ${e.exitCode}`;if(/\b(?:429|rate.?limit|throttl)/i.test(t))return new Z(t,"provider_throttled");if(/\b(?:502|503|504|temporar(?:y|ily)|unavailable|provider.?error)/i.test(t))return new Z(t,"provider_unavailable");if(/\b(?:network|econn|enotfound|socket|timed?\s*out|fetch failed|dns)\b/i.test(t))return new Z(t,"network");return Error(t)}function Kc(e){let t=async(r)=>{r.checkpoint("prepare","Resolving the persisted deployment target.");let n=Of(e.store,r.operation),o=n.target.previewId?new Ve(e.store):void 0,a=n.target.composeId?new Ut(e.store):void 0;if(o&&n.target.previewId)o.transition(n.target.previewId,r.operation.kind==="preview.destroy"?"destroying":r.operation.kind==="preview.update"?"updating":"deploying",{operationId:r.operation.id});if(a&&n.target.composeId)a.transition(n.target.composeId,r.operation.kind==="compose.delete"?"deleting":r.operation.kind==="compose.stop"?"stopped":"deploying",{operationId:r.operation.id});r.log(`Target: ${n.target.resource??"all resources"} in ${n.target.environment}.`,{stream:"system"}),r.throwIfCancellationRequested(),r.checkpoint("execute",`Running cloud ${n.command.join(" ")}.`);let l=await e.execute(n,r);if(!l.ok){if(o&&n.target.previewId)o.transition(n.target.previewId,r.operation.kind==="preview.destroy"?"cleanup_failed":"failed",{operationId:r.operation.id,teardownError:r.operation.kind==="preview.destroy"?l.stderr?.trim()||`Process exited with ${l.exitCode}`:void 0});if(a&&n.target.composeId)a.transition(n.target.composeId,r.operation.kind==="compose.delete"?"degraded":"failed",{operationId:r.operation.id,error:l.stderr?.trim()||`Process exited with ${l.exitCode}`});throw ki(l)}if(r.throwIfCancellationRequested(),o&&n.target.previewId){let u=o.getInstance(n.target.previewId);if(r.operation.kind==="preview.destroy")o.markResourcesDeleted(u.id),o.transition(u.id,"destroyed",{operationId:r.operation.id,observedState:{reconciledResourceIds:o.listResources(u.id).map((p)=>p.providerResourceId),exactCommitSha:u.commitSha}});else{let p=e.store.getResource(u.resourceId)?.provider??"default";o.recordResource({previewId:u.id,provider:p,providerResourceId:u.stackName,kind:"stack",tags:{"ts-cloud:preview":u.id,"ts-cloud:project":u.projectId,"ts-cloud:expires-at":u.expiresAt},observedState:{command:l.command??null,exactCommitSha:u.commitSha}}),o.transition(u.id,"active",{operationId:r.operation.id,observedState:{url:u.url??null,stackName:u.stackName,exactCommitSha:u.commitSha,providerStatus:"deployed"}})}}if(a&&n.target.composeId){let u=a.get(n.target.composeId),p=typeof Me(r.operation.input).service==="string"?String(Me(r.operation.input).service):void 0,E=r.operation.kind==="compose.delete"?"deleted":r.operation.kind==="compose.stop"?"stopped":"running",g=a.transition(u.id,E,{operationId:r.operation.id,services:Object.values(u.manifest.spec.services).filter((m)=>!p||m.name===p).map((m)=>({name:m.name,status:E==="stopped"||E==="deleted"?"stopped":"running",replicas:E==="deleted"?0:m.replicas,healthyReplicas:E==="running"?m.replicas:0,observedState:{command:l.command??null,healthGatePassed:E==="running"}}))});if(E==="deleted")Qp(e.store,g,Me(r.operation.input).removeVolumes===!0)}return r.checkpoint("finalize","Deployment command completed; persisting the terminal result."),{command:l.command??`cloud ${n.command.join(" ")}`,exitCode:l.exitCode,environment:n.target.environment,resource:n.target.resource??null}};return Object.fromEntries(_f.map((r)=>[r,t]))}class i extends Error{code;status;details;constructor(e,t,r,n){super(t);this.code=e;this.status=r;this.details=n}}function Nt(e,t){if(e.organizationId!==t.organizationId)return!1;if(e.projectId&&e.projectId!==t.projectId)return!1;if(e.environmentId&&e.environmentId!==t.environmentId)return!1;if(e.resourceId&&e.resourceId!==t.resourceId)return!1;return!0}function iA(e,t,r){return Xi("sha256").update(`${e.toUpperCase()}
 ${t}
-${JSON.stringify(r)}`).digest("hex")}class Ri{controlPlane;identities;queue;spendGate;constructor(e,t){this.controlPlane=e;this.identities=t;this.queue=new c(e),this.spendGate=new Fr(e)}target(e,t){let r=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,t),n=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,e.token.scope);if(!r||!n||!Nt(n,r))throw new i("forbidden","The token does not grant access to this resource.",403);return r}authorize(e,t,r){if(!e.token.capabilities.includes(t))throw new i("forbidden",`The token is missing the ${t} capability.`,403);let n=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,r),o=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,e.token.scope),a=t==="project:read"&&!!n&&!!o&&Nt(n,o);if(!n||!o||!Nt(o,n)&&!a)throw new i("forbidden","The token does not grant access to this resource.",403);let l=a?o:n;if(!D({membership:e.membership,grants:this.controlPlane.listGrants(e.membership.id),capability:t,target:l}).allowed)throw new i("forbidden","The service account does not have access to this resource.",403);return n}listProjects(e){return this.controlPlane.listProjects().filter((t)=>t.organizationId===e.serviceAccount.organizationId).filter((t)=>{try{return this.authorize(e,"project:read",{type:"project",id:t.id}),!0}catch{return!1}}).map((t)=>({id:t.id,slug:t.slug,name:t.name,description:t.description,version:t.version,createdAt:t.createdAt,updatedAt:t.updatedAt}))}listEnvironments(e,t){let r=this.controlPlane.getProject(t);if(!r||r.organizationId!==e.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);return this.controlPlane.listEnvironments(t).filter((n)=>{try{return this.authorize(e,"project:read",{type:"environment",id:n.id}),!0}catch{return!1}}).map((n)=>({id:n.id,projectId:n.projectId,slug:n.slug,name:n.name,kind:n.kind,region:n.region,version:n.version,createdAt:n.createdAt,updatedAt:n.updatedAt}))}listServices(e,t,r){let n=new Set(this.listEnvironments(e,t).map((o)=>String(o.id)));if(r&&!n.has(r))throw new i("not_found","Environment was not found.",404);return this.controlPlane.listResources(t,r).filter((o)=>!o.environmentId||n.has(o.environmentId)).filter((o)=>{try{return this.authorize(e,"project:read",{type:"resource",id:o.id}),!0}catch{return!1}}).map((o)=>({id:o.id,projectId:o.projectId,environmentId:o.environmentId,kind:o.kind,slug:o.slug,name:o.name,provider:o.provider,providerId:o.providerId,metadata:s(o.metadata),version:o.version,createdAt:o.createdAt,updatedAt:o.updatedAt}))}listOperations(e,t){return this.controlPlane.listOperations({projectId:t,limit:500}).filter((n)=>{let o=n.resourceId?{type:"resource",id:n.resourceId}:n.environmentId?{type:"environment",id:n.environmentId}:n.projectId?{type:"project",id:n.projectId}:{type:"organization"};try{return this.authorize(e,"deployments:read",o),!0}catch{return!1}}).map((n)=>this.operation(n))}listEvents(e,t,r){if(t)this.authorize(e,"audit:read",{type:"project",id:t});else this.authorize(e,"audit:read",e.token.scope);return this.controlPlane.listEvents({organizationId:e.serviceAccount.organizationId,projectId:t,afterSequence:r,limit:500}).filter((n)=>{let o=n.resourceId?{type:"resource",id:n.resourceId}:n.projectId?{type:"project",id:n.projectId}:{type:"organization"};try{return this.target(e,o),!0}catch{return!1}}).map((n)=>({id:n.id,sequence:n.sequence,projectId:n.projectId,operationId:n.operationId,resourceId:n.resourceId,correlationId:n.correlationId,type:n.type,level:n.level,payload:s(n.payload),createdAt:n.createdAt}))}createDeployment(e,t,r){if(!this.controlPlane.listEnvironments(t.projectId).find((g)=>g.id===t.environmentId))throw new i("not_found","Environment was not found in this project.",404);let o=t.serviceId?{type:"resource",id:t.serviceId}:{type:"environment",id:t.environmentId};this.authorize(e,"deployments:create",o);let a=this.spendGate.check("deploy",{organizationId:e.serviceAccount.organizationId,projectId:t.projectId,environmentId:t.environmentId});if(!a.allowed)throw new i("spend_cap_exceeded",a.reason??"A spend cap is blocking deployments.",402,{action:a.action,budgetId:a.budgetId});let l=iA("POST","/api/v1/deployments",t),u=this.identities.getIdempotency(e.token.id,r);if(u){if(u.requestHash!==l)throw new i("idempotency_conflict","Idempotency-Key was already used for another request.",409);let g=u.operationId?this.controlPlane.getOperation(u.operationId):void 0;if(!g)throw new i("idempotency_unavailable","The original operation is no longer available.",409);return{operation:this.operation(g),replay:!0}}if(t.serviceId){let g=this.controlPlane.getResource(t.serviceId);if(!g||g.projectId!==t.projectId||g.environmentId!==t.environmentId)throw new i("not_found","Service was not found in this environment.",404)}let p=t.serviceId?this.controlPlane.getResource(t.serviceId):void 0,E=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.serviceId,actorId:e.actor.id,kind:t.action==="rollback"?"deployment.rollback":"deployment.create",idempotencyKey:`api:${e.token.id}:${r}`,input:s({action:t.action??"deploy",revision:t.revision??null}),lockKey:t.serviceId?`resource:${t.serviceId}`:`environment:${t.environmentId}`,providerKey:p?.provider??"default",buildSlot:t.action!=="rollback",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.identities.saveIdempotency({tokenId:e.token.id,key:r,requestHash:l,operationId:E.id,responseStatus:202,responseBody:{operationId:E.id}}),{operation:this.operation(E),replay:!1}}operation(e){return{id:e.id,state:e.state,kind:e.kind,projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:e.actorId,correlationId:e.correlationId,input:s(e.input),output:s(e.output),error:e.error,attempt:e.attempt,createdAt:e.createdAt,updatedAt:e.updatedAt,startedAt:e.startedAt,finishedAt:e.finishedAt}}}function ze(e){return e.serviceAccount.organizationId}function Nr(e){if(e==null)return;if(e==="daily"||e==="weekly"||e==="monthly")return e;throw new i("validation_error","period must be daily, weekly, or monthly.",422)}function ie(e,t){if(e==null)return;let r=Number(e);if(!Number.isFinite(r)||r<0||!Number.isInteger(r))throw new i("validation_error",`${t} must be a non-negative integer.`,422);return r}function x(e,t,r,n,o){if(o)e.authorization.authorize(t,r,{type:"environment",id:o});else if(n)e.authorization.authorize(t,r,{type:"project",id:n});else e.authorization.authorize(t,r,{type:"organization"});return{organizationId:ze(t),projectId:n,environmentId:o}}async function co(e,t,r){let{method:n,url:o}=r,a=e.now?.()??new Date,l=o.searchParams.get("projectId")??void 0,u=o.searchParams.get("environmentId")??void 0;if(n==="GET"&&o.pathname==="/api/v1/usage"){let T=x(e,t,"billing:read",l,u);return e.service.usageReport({...T,period:Nr(o.searchParams.get("period")),timezone:o.searchParams.get("timezone")??void 0,now:a})}if(n==="GET"&&o.pathname==="/api/v1/usage/rollups"){let T=x(e,t,"billing:read",l,u),h=o.searchParams.get("from"),_=o.searchParams.get("to");if(!h||!_)throw new i("validation_error","from and to are required.",422);if(Number.isNaN(Date.parse(h))||Number.isNaN(Date.parse(_)))throw new i("validation_error","from and to must be ISO-8601 timestamps.",422);let N=o.searchParams.getAll("meter");return{data:e.store.listRollups({...T,from:h,to:_,meters:N.length>0?N:void 0},ie(o.searchParams.get("limit"),"limit")??1000)}}if(n==="GET"&&o.pathname==="/api/v1/usage/focus"){let T=x(e,t,"billing:read",l,u),h=o.searchParams.get("from"),_=o.searchParams.get("to");if(!h||!_)throw new i("validation_error","from and to are required.",422);if(Number.isNaN(Date.parse(h))||Number.isNaN(Date.parse(_)))throw new i("validation_error","from and to must be ISO-8601 timestamps.",422);if(new Date(_).getTime()-new Date(h).getTime()>31622400000)throw new i("validation_error","The range must not exceed one year.",422);let N=o.searchParams.get("granularity")==="hourly"?"hourly":"daily",y=e.store.listRollups({...T,from:h,to:_},1e4),v=pd(y,{billingPeriodStart:h,billingPeriodEnd:_,currency:e.store.priceBook.currency,granularity:N});return{contentType:"application/x-ndjson",body:io(v),recordCount:v.length}}if(n==="GET"&&o.pathname==="/api/v1/spend/budgets"){let T=x(e,t,"billing:read",l,u);return{data:e.store.listBudgets({organizationId:T.organizationId,projectId:T.projectId})}}if(n==="POST"&&o.pathname==="/api/v1/spend/budgets"){let T=await r.body?.()??{},_={organizationId:x(e,t,"billing:manage",T.projectId,T.environmentId).organizationId,projectId:T.projectId,environmentId:T.environmentId,name:String(T.name??"").trim(),period:Nr(T.period??"monthly")??"monthly",timezone:T.timezone,currency:T.currency,softLimitCents:ie(T.softLimitCents,"softLimitCents"),hardLimitCents:ie(T.hardLimitCents,"hardLimitCents"),thresholds:T.thresholds,meters:T.meters,graceSeconds:ie(T.graceSeconds,"graceSeconds"),hysteresisPercent:T.hysteresisPercent,dryRun:T.dryRun!==!1,enabled:T.enabled};try{return{data:e.store.createBudget(_)}}catch(N){throw new i("validation_error",N instanceof Error?N.message:String(N),422)}}let p=/^\/api\/v1\/spend\/budgets\/([^/]+)$/.exec(o.pathname);if(p&&(n==="PATCH"||n==="DELETE")){let T=e.store.getBudget(decodeURIComponent(p[1]));if(!T||T.organizationId!==ze(t))throw new i("not_found","Budget was not found.",404);if(x(e,t,"billing:manage",T.projectId,T.environmentId),n==="DELETE")return{data:{deleted:e.store.deleteBudget(T.id)}};let h=await r.body?.()??{};try{return{data:e.store.updateBudget(T.id,h,ie(h.expectedVersion,"expectedVersion"))}}catch(_){let N=_ instanceof Error?_.message:String(_);throw new i(N.includes("concurrently")?"conflict":"validation_error",N,N.includes("concurrently")?409:422)}}if(n==="GET"&&o.pathname==="/api/v1/spend/anomalies"){let T=x(e,t,"billing:read",l,u);return{data:e.store.listAnomalies({organizationId:T.organizationId,projectId:T.projectId,since:o.searchParams.get("since")??void 0,unacknowledgedOnly:o.searchParams.get("unacknowledged")==="true",limit:ie(o.searchParams.get("limit"),"limit")})}}let E=/^\/api\/v1\/spend\/anomalies\/([^/]+)\/acknowledge$/.exec(o.pathname);if(E&&n==="POST"){let T=e.store.getAnomaly(decodeURIComponent(E[1]));if(!T||T.organizationId!==ze(t))throw new i("not_found","Anomaly was not found.",404);return x(e,t,"billing:manage",T.projectId,T.environmentId),{data:{acknowledged:e.store.acknowledgeAnomaly(T.id)}}}if(n==="GET"&&o.pathname==="/api/v1/spend/signals")return x(e,t,"billing:read",l,u),{data:Mr};if(o.pathname==="/api/v1/spend/anomaly-configs"){if(n==="GET"){let T=x(e,t,"billing:read",l,u);return{data:e.service.anomalyConfigs.list({organizationId:T.organizationId,projectId:T.projectId})}}if(n==="POST"){let T=await r.body?.()??{},h=x(e,t,"billing:manage",T.projectId,T.environmentId);try{return{data:e.service.anomalyConfigs.upsert({organizationId:h.organizationId,projectId:T.projectId,environmentId:T.environmentId,signal:String(T.signal??""),enabled:T.enabled,sensitivity:T.sensitivity,seasonLength:T.seasonLength==null?void 0:Number(T.seasonLength),minAbsoluteDelta:T.minAbsoluteDelta==null?void 0:Number(T.minAbsoluteDelta),detectDrops:T.detectDrops,severity:T.severity})}}catch(_){throw new i("validation_error",_ instanceof Error?_.message:String(_),422)}}}let g=/^\/api\/v1\/spend\/anomaly-configs\/([^/]+)$/.exec(o.pathname);if(g&&n==="DELETE"){let T=e.service.anomalyConfigs.get(decodeURIComponent(g[1]));if(!T||T.organizationId!==ze(t))throw new i("not_found","Anomaly config was not found.",404);return x(e,t,"billing:manage",T.projectId,T.environmentId),{data:{deleted:e.service.anomalyConfigs.delete(T.id)}}}if(o.pathname==="/api/v1/spend/anomaly-silences"){if(n==="GET"){let T=x(e,t,"billing:read",l,u);return{data:e.service.anomalyConfigs.listSilences({organizationId:T.organizationId,projectId:T.projectId,includeExpired:o.searchParams.get("includeExpired")==="true"})}}if(n==="POST"){let T=await r.body?.()??{},h=x(e,t,"billing:manage",T.projectId);try{return{data:e.service.anomalyConfigs.silence({organizationId:h.organizationId,projectId:T.projectId,signal:T.signal,routePattern:T.routePattern,statusCode:T.statusCode==null?void 0:Number(T.statusCode),reason:String(T.reason??""),expiresAt:T.expiresAt})}}catch(_){throw new i("validation_error",_ instanceof Error?_.message:String(_),422)}}}let m=/^\/api\/v1\/spend\/anomaly-silences\/([^/]+)$/.exec(o.pathname);if(m&&n==="DELETE")return x(e,t,"billing:manage",l),{data:{deleted:e.service.anomalyConfigs.removeSilence(decodeURIComponent(m[1]))}};if(n==="GET"&&o.pathname==="/api/v1/spend/enforcement"){let T=x(e,t,"billing:read",l,u);return{data:e.store.listEnforcements({organizationId:T.organizationId,activeOnly:o.searchParams.get("active")!=="false"})}}if(n==="GET"&&o.pathname==="/api/v1/spend/allowance"){let T=x(e,t,"billing:read",l,u),h=o.searchParams.get("operation")??"deploy";if(!["build","deploy","function_invoke","request"].includes(h))throw new i("validation_error","operation must be build, deploy, function_invoke, or request.",422);let N=e.store.listEnforcements({organizationId:T.organizationId,activeOnly:!0}).filter((S)=>(!S.projectId||S.projectId===T.projectId)&&(!S.environmentId||S.environmentId===T.environmentId)),y=dd(h,N),I=e.store.budgetsForScope(T.organizationId,T.projectId,T.environmentId).map((S)=>e.service.status(S,a));return{operation:h,allowed:y.allowed,blockedBy:y.blockedBy??null,reason:y.reason??null,budgets:I.map((S)=>({id:S.budget.id,name:S.budget.name,usedPercent:S.decision.usedPercent,projectedPercent:S.decision.projectedPercent,level:S.decision.level,timeToCap:S.timeToCap}))}}return}function lo(){let e=[{name:"projectId",in:"query",schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}}];return{"/api/v1/usage":{get:{summary:"Current usage, cost, and every budget governing the scope.",parameters:[...e,{name:"period",in:"query",schema:{type:"string",enum:["daily","weekly","monthly"]}},{name:"timezone",in:"query",schema:{type:"string"}}],responses:{"200":{description:"Usage totals, per-meter breakdown, hourly series, and budget status."}}}},"/api/v1/usage/rollups":{get:{summary:"Itemized hourly usage rollups.",parameters:[...e,{name:"from",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"to",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"meter",in:"query",schema:{type:"array",items:{type:"string"}}},{name:"limit",in:"query",schema:{type:"integer"}}],responses:{"200":{description:"Hourly rollups, newest first."}}}},"/api/v1/usage/focus":{get:{summary:"Usage and cost in FOCUS v1.3 format, newline-delimited JSON.",parameters:[...e,{name:"from",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"to",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"granularity",in:"query",schema:{type:"string",enum:["daily","hourly"]}}],responses:{"200":{description:"FOCUS records, one JSON object per line."}}}},"/api/v1/spend/budgets":{get:{summary:"Budgets governing a scope.",parameters:e,responses:{"200":{description:"Budgets."}}},post:{summary:"Create a budget. Starts in dry run unless dryRun is explicitly false.",responses:{"201":{description:"The created budget."},"422":{description:"Validation error."}}}},"/api/v1/spend/budgets/{budgetId}":{patch:{summary:"Update a budget. Pass expectedVersion for optimistic concurrency.",responses:{"200":{description:"The updated budget."},"409":{description:"Version conflict."}}},delete:{summary:"Delete a budget.",responses:{"200":{description:"Deletion result."}}}},"/api/v1/spend/anomalies":{get:{summary:"Detected spend anomalies.",parameters:[...e,{name:"since",in:"query",schema:{type:"string",format:"date-time"}},{name:"unacknowledged",in:"query",schema:{type:"boolean"}}],responses:{"200":{description:"Anomalies, newest first."}}}},"/api/v1/spend/anomalies/{anomalyId}/acknowledge":{post:{summary:"Acknowledge an anomaly.",responses:{"200":{description:"Acknowledgement result."}}}},"/api/v1/spend/signals":{get:{summary:"Signals anomaly detection can run on, with their gap and sample rules.",responses:{"200":{description:"Signal catalog."}}}},"/api/v1/spend/anomaly-configs":{get:{summary:"Anomaly detection configuration.",parameters:e,responses:{"200":{description:"Configs."}}},post:{summary:"Create or update the config for a signal.",responses:{"200":{description:"The config."}}}},"/api/v1/spend/anomaly-configs/{configId}":{delete:{summary:"Delete an anomaly config, returning the signal to its default.",responses:{"200":{description:"Result."}}}},"/api/v1/spend/anomaly-silences":{get:{summary:"Active anomaly silences.",parameters:e,responses:{"200":{description:"Silences."}}},post:{summary:"Silence a signal, route, or status code. A reason is required.",responses:{"200":{description:"The silence."}}}},"/api/v1/spend/anomaly-silences/{silenceId}":{delete:{summary:"Remove a silence.",responses:{"200":{description:"Result."}}}},"/api/v1/spend/enforcement":{get:{summary:"Enforcement actions in force.",parameters:[...e,{name:"active",in:"query",schema:{type:"boolean"}}],responses:{"200":{description:"Enforcement records."}}}},"/api/v1/spend/allowance":{get:{summary:"Whether an operation is allowed under current spend enforcement.",parameters:[...e,{name:"operation",in:"query",schema:{type:"string",enum:["build","deploy","function_invoke","request"]}}],responses:{"200":{description:"Allowance verdict and the budgets behind it."}}}}}}export{qe,Fc,pe,$t,Uc,D,Mt,gt,Qc,Us,kf,Up,Hc,s,hi,Qs,kr,Gc,qc,Br,Bf,Vc,lI,uI,Hs,pI,gI,jc,zc,fi,Gs,Z,c,qs,Ve,_r,_f,xf,Kc,Ft,Of,Vs,Lf,$f,js,Wc,xr,zs,Mf,Jc,Qp,Ut,Or,Ff,Ks,Uf,P,Qf,Xc,Hp,Ws,Hf,Gf,qf,Yc,Ai,Js,Zc,Qt,mt,Vf,Lr,jf,ed,Gp,qp,Xs,td,rd,ht,Vp,yi,nd,Ys,$r,jp,Ii,id,sd,Si,zp,od,ad,cd,dd,Zs,Kp,Wp,zf,Jp,ld,Ci,Xp,Yp,eo,Mr,to,ro,no,ud,Zp,pd,io,Kf,Ht,Wf,gd,Fr,md,Jf,hd,eg,Ei,Ur,so,bi,je,Xf,tg,rg,Gt,fd,Ad,yd,vi,Ti,wi,Yf,Zf,ft,oo,eA,Qr,ng,ao,tA,ig,sg,og,rA,ag,cg,nA,i,iA,Ri,co,lo};
+${JSON.stringify(r)}`).digest("hex")}class Ri{controlPlane;identities;queue;spendGate;constructor(e,t){this.controlPlane=e;this.identities=t;this.queue=new c(e),this.spendGate=new Fr(e)}target(e,t){let r=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,t),n=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,e.token.scope);if(!r||!n||!Nt(n,r))throw new i("forbidden","The token does not grant access to this resource.",403);return r}authorize(e,t,r){if(!e.token.capabilities.includes(t))throw new i("forbidden",`The token is missing the ${t} capability.`,403);let n=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,r),o=this.controlPlane.resolveAuthorizationTarget(e.serviceAccount.organizationId,e.token.scope),a=t==="project:read"&&!!n&&!!o&&Nt(n,o);if(!n||!o||!Nt(o,n)&&!a)throw new i("forbidden","The token does not grant access to this resource.",403);let l=a?o:n;if(!D({membership:e.membership,grants:this.controlPlane.listGrants(e.membership.id),capability:t,target:l}).allowed)throw new i("forbidden","The service account does not have access to this resource.",403);return n}listProjects(e){return this.controlPlane.listProjects().filter((t)=>t.organizationId===e.serviceAccount.organizationId).filter((t)=>{try{return this.authorize(e,"project:read",{type:"project",id:t.id}),!0}catch{return!1}}).map((t)=>({id:t.id,slug:t.slug,name:t.name,description:t.description,version:t.version,createdAt:t.createdAt,updatedAt:t.updatedAt}))}listEnvironments(e,t){let r=this.controlPlane.getProject(t);if(!r||r.organizationId!==e.serviceAccount.organizationId)throw new i("not_found","Project was not found.",404);return this.controlPlane.listEnvironments(t).filter((n)=>{try{return this.authorize(e,"project:read",{type:"environment",id:n.id}),!0}catch{return!1}}).map((n)=>({id:n.id,projectId:n.projectId,slug:n.slug,name:n.name,kind:n.kind,region:n.region,version:n.version,createdAt:n.createdAt,updatedAt:n.updatedAt}))}listServices(e,t,r){let n=new Set(this.listEnvironments(e,t).map((o)=>String(o.id)));if(r&&!n.has(r))throw new i("not_found","Environment was not found.",404);return this.controlPlane.listResources(t,r).filter((o)=>!o.environmentId||n.has(o.environmentId)).filter((o)=>{try{return this.authorize(e,"project:read",{type:"resource",id:o.id}),!0}catch{return!1}}).map((o)=>({id:o.id,projectId:o.projectId,environmentId:o.environmentId,kind:o.kind,slug:o.slug,name:o.name,provider:o.provider,providerId:o.providerId,metadata:s(o.metadata),version:o.version,createdAt:o.createdAt,updatedAt:o.updatedAt}))}listOperations(e,t){return this.controlPlane.listOperations({projectId:t,limit:500}).filter((n)=>{let o=n.resourceId?{type:"resource",id:n.resourceId}:n.environmentId?{type:"environment",id:n.environmentId}:n.projectId?{type:"project",id:n.projectId}:{type:"organization"};try{return this.authorize(e,"deployments:read",o),!0}catch{return!1}}).map((n)=>this.operation(n))}listEvents(e,t,r){if(t)this.authorize(e,"audit:read",{type:"project",id:t});else this.authorize(e,"audit:read",e.token.scope);return this.controlPlane.listEvents({organizationId:e.serviceAccount.organizationId,projectId:t,afterSequence:r,limit:500}).filter((n)=>{let o=n.resourceId?{type:"resource",id:n.resourceId}:n.projectId?{type:"project",id:n.projectId}:{type:"organization"};try{return this.target(e,o),!0}catch{return!1}}).map((n)=>({id:n.id,sequence:n.sequence,projectId:n.projectId,operationId:n.operationId,resourceId:n.resourceId,correlationId:n.correlationId,type:n.type,level:n.level,payload:s(n.payload),createdAt:n.createdAt}))}createDeployment(e,t,r){if(!this.controlPlane.listEnvironments(t.projectId).find((g)=>g.id===t.environmentId))throw new i("not_found","Environment was not found in this project.",404);let o=t.serviceId?{type:"resource",id:t.serviceId}:{type:"environment",id:t.environmentId};this.authorize(e,"deployments:create",o);let a=this.spendGate.check("deploy",{organizationId:e.serviceAccount.organizationId,projectId:t.projectId,environmentId:t.environmentId});if(!a.allowed)throw new i("spend_cap_exceeded",a.reason??"A spend cap is blocking deployments.",402,{action:a.action,budgetId:a.budgetId});let l=iA("POST","/api/v1/deployments",t),u=this.identities.getIdempotency(e.token.id,r);if(u){if(u.requestHash!==l)throw new i("idempotency_conflict","Idempotency-Key was already used for another request.",409);let g=u.operationId?this.controlPlane.getOperation(u.operationId):void 0;if(!g)throw new i("idempotency_unavailable","The original operation is no longer available.",409);return{operation:this.operation(g),replay:!0}}if(t.serviceId){let g=this.controlPlane.getResource(t.serviceId);if(!g||g.projectId!==t.projectId||g.environmentId!==t.environmentId)throw new i("not_found","Service was not found in this environment.",404)}let p=t.serviceId?this.controlPlane.getResource(t.serviceId):void 0,E=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,resourceId:t.serviceId,actorId:e.actor.id,kind:t.action==="rollback"?"deployment.rollback":"deployment.create",idempotencyKey:`api:${e.token.id}:${r}`,input:s({action:t.action??"deploy",revision:t.revision??null}),lockKey:t.serviceId?`resource:${t.serviceId}`:`environment:${t.environmentId}`,providerKey:p?.provider??"default",buildSlot:t.action!=="rollback",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return this.identities.saveIdempotency({tokenId:e.token.id,key:r,requestHash:l,operationId:E.id,responseStatus:202,responseBody:{operationId:E.id}}),{operation:this.operation(E),replay:!1}}operation(e){return{id:e.id,state:e.state,kind:e.kind,projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:e.actorId,correlationId:e.correlationId,input:s(e.input),output:s(e.output),error:e.error,attempt:e.attempt,createdAt:e.createdAt,updatedAt:e.updatedAt,startedAt:e.startedAt,finishedAt:e.finishedAt}}}function ze(e){return e.serviceAccount.organizationId}function Nr(e){if(e==null)return;if(e==="daily"||e==="weekly"||e==="monthly")return e;throw new i("validation_error","period must be daily, weekly, or monthly.",422)}function ie(e,t){if(e==null)return;let r=Number(e);if(!Number.isFinite(r)||r<0||!Number.isInteger(r))throw new i("validation_error",`${t} must be a non-negative integer.`,422);return r}function x(e,t,r,n,o){if(o)e.authorization.authorize(t,r,{type:"environment",id:o});else if(n)e.authorization.authorize(t,r,{type:"project",id:n});else e.authorization.authorize(t,r,{type:"organization"});return{organizationId:ze(t),projectId:n,environmentId:o}}async function co(e,t,r){let{method:n,url:o}=r,a=e.now?.()??new Date,l=o.searchParams.get("projectId")??void 0,u=o.searchParams.get("environmentId")??void 0;if(n==="GET"&&o.pathname==="/api/v1/usage"){let T=x(e,t,"billing:read",l,u);return e.service.usageReport({...T,period:Nr(o.searchParams.get("period")),timezone:o.searchParams.get("timezone")??void 0,now:a})}if(n==="GET"&&o.pathname==="/api/v1/usage/rollups"){let T=x(e,t,"billing:read",l,u),h=o.searchParams.get("from"),_=o.searchParams.get("to");if(!h||!_)throw new i("validation_error","from and to are required.",422);if(Number.isNaN(Date.parse(h))||Number.isNaN(Date.parse(_)))throw new i("validation_error","from and to must be ISO-8601 timestamps.",422);let N=o.searchParams.getAll("meter");return{data:e.store.listRollups({...T,from:h,to:_,meters:N.length>0?N:void 0},ie(o.searchParams.get("limit"),"limit")??1000)}}if(n==="GET"&&o.pathname==="/api/v1/usage/focus"){let T=x(e,t,"billing:read",l,u),h=o.searchParams.get("from"),_=o.searchParams.get("to");if(!h||!_)throw new i("validation_error","from and to are required.",422);if(Number.isNaN(Date.parse(h))||Number.isNaN(Date.parse(_)))throw new i("validation_error","from and to must be ISO-8601 timestamps.",422);if(new Date(_).getTime()-new Date(h).getTime()>31622400000)throw new i("validation_error","The range must not exceed one year.",422);let N=o.searchParams.get("granularity")==="hourly"?"hourly":"daily",y=e.store.listRollups({...T,from:h,to:_},1e4),v=pd(y,{billingPeriodStart:h,billingPeriodEnd:_,currency:e.store.priceBook.currency,granularity:N});return{contentType:"application/x-ndjson",body:io(v),recordCount:v.length}}if(n==="GET"&&o.pathname==="/api/v1/spend/budgets"){let T=x(e,t,"billing:read",l,u);return{data:e.store.listBudgets({organizationId:T.organizationId,projectId:T.projectId})}}if(n==="POST"&&o.pathname==="/api/v1/spend/budgets"){let T=await r.body?.()??{},_={organizationId:x(e,t,"billing:manage",T.projectId,T.environmentId).organizationId,projectId:T.projectId,environmentId:T.environmentId,name:String(T.name??"").trim(),period:Nr(T.period??"monthly")??"monthly",timezone:T.timezone,currency:T.currency,softLimitCents:ie(T.softLimitCents,"softLimitCents"),hardLimitCents:ie(T.hardLimitCents,"hardLimitCents"),thresholds:T.thresholds,meters:T.meters,graceSeconds:ie(T.graceSeconds,"graceSeconds"),hysteresisPercent:T.hysteresisPercent,dryRun:T.dryRun!==!1,enabled:T.enabled};try{return{data:e.store.createBudget(_)}}catch(N){throw new i("validation_error",N instanceof Error?N.message:String(N),422)}}let p=/^\/api\/v1\/spend\/budgets\/([^/]+)$/.exec(o.pathname);if(p&&(n==="PATCH"||n==="DELETE")){let T=e.store.getBudget(decodeURIComponent(p[1]));if(!T||T.organizationId!==ze(t))throw new i("not_found","Budget was not found.",404);if(x(e,t,"billing:manage",T.projectId,T.environmentId),n==="DELETE")return{data:{deleted:e.store.deleteBudget(T.id)}};let h=await r.body?.()??{};try{return{data:e.store.updateBudget(T.id,h,ie(h.expectedVersion,"expectedVersion"))}}catch(_){let N=_ instanceof Error?_.message:String(_);throw new i(N.includes("concurrently")?"conflict":"validation_error",N,N.includes("concurrently")?409:422)}}if(n==="GET"&&o.pathname==="/api/v1/spend/anomalies"){let T=x(e,t,"billing:read",l,u);return{data:e.store.listAnomalies({organizationId:T.organizationId,projectId:T.projectId,since:o.searchParams.get("since")??void 0,unacknowledgedOnly:o.searchParams.get("unacknowledged")==="true",limit:ie(o.searchParams.get("limit"),"limit")})}}let E=/^\/api\/v1\/spend\/anomalies\/([^/]+)\/acknowledge$/.exec(o.pathname);if(E&&n==="POST"){let T=e.store.getAnomaly(decodeURIComponent(E[1]));if(!T||T.organizationId!==ze(t))throw new i("not_found","Anomaly was not found.",404);return x(e,t,"billing:manage",T.projectId,T.environmentId),{data:{acknowledged:e.store.acknowledgeAnomaly(T.id)}}}if(n==="GET"&&o.pathname==="/api/v1/spend/signals")return x(e,t,"billing:read",l,u),{data:Mr};if(o.pathname==="/api/v1/spend/anomaly-configs"){if(n==="GET"){let T=x(e,t,"billing:read",l,u);return{data:e.service.anomalyConfigs.list({organizationId:T.organizationId,projectId:T.projectId})}}if(n==="POST"){let T=await r.body?.()??{},h=x(e,t,"billing:manage",T.projectId,T.environmentId);try{return{data:e.service.anomalyConfigs.upsert({organizationId:h.organizationId,projectId:T.projectId,environmentId:T.environmentId,signal:String(T.signal??""),enabled:T.enabled,sensitivity:T.sensitivity,seasonLength:T.seasonLength==null?void 0:Number(T.seasonLength),minAbsoluteDelta:T.minAbsoluteDelta==null?void 0:Number(T.minAbsoluteDelta),detectDrops:T.detectDrops,severity:T.severity})}}catch(_){throw new i("validation_error",_ instanceof Error?_.message:String(_),422)}}}let g=/^\/api\/v1\/spend\/anomaly-configs\/([^/]+)$/.exec(o.pathname);if(g&&n==="DELETE"){let T=e.service.anomalyConfigs.get(decodeURIComponent(g[1]));if(!T||T.organizationId!==ze(t))throw new i("not_found","Anomaly config was not found.",404);return x(e,t,"billing:manage",T.projectId,T.environmentId),{data:{deleted:e.service.anomalyConfigs.delete(T.id)}}}if(o.pathname==="/api/v1/spend/anomaly-silences"){if(n==="GET"){let T=x(e,t,"billing:read",l,u);return{data:e.service.anomalyConfigs.listSilences({organizationId:T.organizationId,projectId:T.projectId,includeExpired:o.searchParams.get("includeExpired")==="true"})}}if(n==="POST"){let T=await r.body?.()??{},h=x(e,t,"billing:manage",T.projectId);try{return{data:e.service.anomalyConfigs.silence({organizationId:h.organizationId,projectId:T.projectId,signal:T.signal,routePattern:T.routePattern,statusCode:T.statusCode==null?void 0:Number(T.statusCode),reason:String(T.reason??""),expiresAt:T.expiresAt})}}catch(_){throw new i("validation_error",_ instanceof Error?_.message:String(_),422)}}}let m=/^\/api\/v1\/spend\/anomaly-silences\/([^/]+)$/.exec(o.pathname);if(m&&n==="DELETE")return x(e,t,"billing:manage",l),{data:{deleted:e.service.anomalyConfigs.removeSilence(decodeURIComponent(m[1]))}};if(n==="GET"&&o.pathname==="/api/v1/spend/enforcement"){let T=x(e,t,"billing:read",l,u);return{data:e.store.listEnforcements({organizationId:T.organizationId,activeOnly:o.searchParams.get("active")!=="false"})}}if(n==="GET"&&o.pathname==="/api/v1/spend/allowance"){let T=x(e,t,"billing:read",l,u),h=o.searchParams.get("operation")??"deploy";if(!["build","deploy","function_invoke","request"].includes(h))throw new i("validation_error","operation must be build, deploy, function_invoke, or request.",422);let N=e.store.listEnforcements({organizationId:T.organizationId,activeOnly:!0}).filter((S)=>(!S.projectId||S.projectId===T.projectId)&&(!S.environmentId||S.environmentId===T.environmentId)),y=dd(h,N),I=e.store.budgetsForScope(T.organizationId,T.projectId,T.environmentId).map((S)=>e.service.status(S,a));return{operation:h,allowed:y.allowed,blockedBy:y.blockedBy??null,reason:y.reason??null,budgets:I.map((S)=>({id:S.budget.id,name:S.budget.name,usedPercent:S.decision.usedPercent,projectedPercent:S.decision.projectedPercent,level:S.decision.level,timeToCap:S.timeToCap}))}}return}function lo(){let e=[{name:"projectId",in:"query",schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}}];return{"/api/v1/usage":{get:{summary:"Current usage, cost, and every budget governing the scope.",parameters:[...e,{name:"period",in:"query",schema:{type:"string",enum:["daily","weekly","monthly"]}},{name:"timezone",in:"query",schema:{type:"string"}}],responses:{"200":{description:"Usage totals, per-meter breakdown, hourly series, and budget status."}}}},"/api/v1/usage/rollups":{get:{summary:"Itemized hourly usage rollups.",parameters:[...e,{name:"from",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"to",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"meter",in:"query",schema:{type:"array",items:{type:"string"}}},{name:"limit",in:"query",schema:{type:"integer"}}],responses:{"200":{description:"Hourly rollups, newest first."}}}},"/api/v1/usage/focus":{get:{summary:"Usage and cost in FOCUS v1.3 format, newline-delimited JSON.",parameters:[...e,{name:"from",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"to",in:"query",required:!0,schema:{type:"string",format:"date-time"}},{name:"granularity",in:"query",schema:{type:"string",enum:["daily","hourly"]}}],responses:{"200":{description:"FOCUS records, one JSON object per line."}}}},"/api/v1/spend/budgets":{get:{summary:"Budgets governing a scope.",parameters:e,responses:{"200":{description:"Budgets."}}},post:{summary:"Create a budget. Starts in dry run unless dryRun is explicitly false.",responses:{"201":{description:"The created budget."},"422":{description:"Validation error."}}}},"/api/v1/spend/budgets/{budgetId}":{patch:{summary:"Update a budget. Pass expectedVersion for optimistic concurrency.",responses:{"200":{description:"The updated budget."},"409":{description:"Version conflict."}}},delete:{summary:"Delete a budget.",responses:{"200":{description:"Deletion result."}}}},"/api/v1/spend/anomalies":{get:{summary:"Detected spend anomalies.",parameters:[...e,{name:"since",in:"query",schema:{type:"string",format:"date-time"}},{name:"unacknowledged",in:"query",schema:{type:"boolean"}}],responses:{"200":{description:"Anomalies, newest first."}}}},"/api/v1/spend/anomalies/{anomalyId}/acknowledge":{post:{summary:"Acknowledge an anomaly.",responses:{"200":{description:"Acknowledgement result."}}}},"/api/v1/spend/signals":{get:{summary:"Signals anomaly detection can run on, with their gap and sample rules.",responses:{"200":{description:"Signal catalog."}}}},"/api/v1/spend/anomaly-configs":{get:{summary:"Anomaly detection configuration.",parameters:e,responses:{"200":{description:"Configs."}}},post:{summary:"Create or update the config for a signal.",responses:{"200":{description:"The config."}}}},"/api/v1/spend/anomaly-configs/{configId}":{delete:{summary:"Delete an anomaly config, returning the signal to its default.",responses:{"200":{description:"Result."}}}},"/api/v1/spend/anomaly-silences":{get:{summary:"Active anomaly silences.",parameters:e,responses:{"200":{description:"Silences."}}},post:{summary:"Silence a signal, route, or status code. A reason is required.",responses:{"200":{description:"The silence."}}}},"/api/v1/spend/anomaly-silences/{silenceId}":{delete:{summary:"Remove a silence.",responses:{"200":{description:"Result."}}}},"/api/v1/spend/enforcement":{get:{summary:"Enforcement actions in force.",parameters:[...e,{name:"active",in:"query",schema:{type:"boolean"}}],responses:{"200":{description:"Enforcement records."}}}},"/api/v1/spend/allowance":{get:{summary:"Whether an operation is allowed under current spend enforcement.",parameters:[...e,{name:"operation",in:"query",schema:{type:"string",enum:["build","deploy","function_invoke","request"]}}],responses:{"200":{description:"Allowance verdict and the budgets behind it."}}}}}}export{qe,Fc,pe,$t,Uc,D,Mt,gt,Qc,Us,kf,Up,Hc,s,hi,Qs,kr,Gc,qc,Br,Bf,Vc,lI,uI,Hs,pI,gI,jc,zc,fi,Gs,Z,c,qs,Ve,_r,_f,Of,Kc,Ft,xf,Vs,Lf,$f,js,Wc,Or,zs,Mf,Jc,Qp,Ut,xr,Ff,Ks,Uf,P,Qf,Xc,Hp,Ws,Hf,Gf,qf,Yc,Ai,Js,Zc,Qt,mt,Vf,Lr,jf,ed,Gp,qp,Xs,td,rd,ht,Vp,yi,nd,Ys,$r,jp,Ii,id,sd,Si,zp,od,ad,cd,dd,Zs,Kp,Wp,zf,Jp,ld,Ci,Xp,Yp,eo,Mr,to,ro,no,ud,Zp,pd,io,Kf,Ht,Wf,gd,Fr,md,Jf,hd,eg,Ei,Ur,so,bi,je,Xf,tg,rg,Gt,fd,Ad,yd,vi,Ti,wi,Yf,Zf,ft,oo,eA,Qr,ng,ao,tA,ig,sg,og,rA,ag,cg,nA,i,iA,Ri,co,lo};