@stacksjs/ts-cloud 0.16.35 → 0.16.36

package/dist/bin/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import{C,jt,n,r,a,Er,e,p,i,o,R,d,ws,c,an,ve,_o,Oo,$o,Lo,f}from"./chunk-r3gxhy1k.js";import{ra,H,xr,w,B,$s,l,s,T,sa,oa,aa,ke,Fe,tt,Ms,fn,Pi,hn,Us,ua,pa,ma,ga,ha,j,b,L,rt,N,ge,Bs,je,Gt,Di,we,js,Ni,qt,At,ya,ba}from"./chunk-qbagghsb.js";import"./chunk-svrgx20b.js";import{_e,x,An,y,Rn,Bi,In,Js,Mr,it,De,Pn,Dn,Nn,kn,xn,_n,On,$n,ie,Zt,er,Ln,Ur,Mn,Un,Bn,jn,Vn,zn,Hn,Gn,st,tr,rr,Dt,Fr,nr,ir,ji,Nt,qn,ce,Wn,Kn,Jn,Br,jr,Xn,Vr,sr,or,ot,kt,xt,zr,le,Qn,nc,ic,ar,sc,G,Vi,Ve,at,ct,Yn,Hr,Gr,Zn,ei,ti,qr,Xs,de,ye,Oe,be,ri,cr}from"./chunk-16kx70x7.js";import{u,Qo}from"./chunk-7rwc5bvv.js";import{ae,h,kr}from"./chunk-twmeg17s.js";import{Rr,Tt,Ir,Pr,Dr,Nr,un}from"./chunk-r8e263ne.js";import{S,Ot,li,uo,hr,mc,gc,fc,di,ui,mt,en,$t,tn,gt,Ke,Le,Je,ft,yr,Me,Xe,pi,mi,Qe,rn,nn,rs,is,vr,Lt,ht,Mt,ee,cs,hi,yi,Eo}from"./chunk-exc2mqcc.js";import{Ye,Ut,Ro,Io,Ze,ps,ms,gs,fs,hs,ys,W,Ft,M,bi}from"./chunk-gbpmgae9.js";import{J,P,As,Bo,jo,Uc,Fc,Ci,vt,Ti}from"./chunk-v3prk467.js";import{v}from"./chunk-v4gpkkzh.js";import{Q}from"./chunk-y2qz4vw1.js";import{Ct,g}from"./chunk-d5q09rxb.js";import{He,Qs,ue,zi,ii,Hi,Gi,Wr,qi,Wi,Se,Z,Ge,Ne,Kr,lr,qe,dr,Jr,dt,pe,ut,pr,mr,gr,Xr,fr,O,Ji,Xi,si,Ys,Qr,Zs,eo,cc,Qi,to,ro,no,io,pt,so,Yi,Zi}from"./chunk-cn5tfp7t.js";import"./chunk-cnwncp50.js";import{I}from"./chunk-j01jx36v.js";import{me}from"./chunk-yt95wsqg.js";import{K,bt,Ts}from"./chunk-bqcqzc30.js";import{se,q,oc,ac,ze}from"./chunk-27mfrb34.js";import{Qt,En,Yt,Ui,wn,Ks}from"./chunk-vkdw6sxn.js";import"./chunk-ar6bxdv4.js";import{E}from"./chunk-71jh460j.js";import{lt}from"./chunk-haqap7d1.js";import{te,Ce}from"./chunk-a0cvd2ez.js";import{V}from"./chunk-s7f24j6k.js";import"./chunk-4mt7rspg.js";import{Fi}from"./chunk-cm1dsffd.js";import"./chunk-v3dck0e4.js";import"./chunk-c8439azc.js";import{ci}from"./chunk-9n3wmdd6.js";import{Cr}from"./chunk-bfzdbe4g.js";import{yt}from"./chunk-2qdktx9h.js";import{F}from"./chunk-ymfnqae6.js";import{k}from"./chunk-tv0rtc0s.js";import{existsSync as Jd}from"node:fs";import ta from"node:fs/promises";import ml from"node:os";import na from"node:path";import ao from"node:process";import{EventEmitter as Yd}from"node:events";import Ei from"node:process";import fl from"node:process";import la from"node:process";import ls from"node:process";import No from"node:process";import vl from"node:tty";import Bu,{stdin as Bg,stdout as Mg}from"node:process";class bl{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let D=ml.homedir(),t=na.join(D,".config","clapp");this.configPath=na.join(t,"telemetry.json")}async isEnabled(){if(ao.env.DO_NOT_TRACK==="1"||ao.env.DO_NOT_TRACK==="true")return!1;if(ao.env.NO_TELEMETRY==="1"||ao.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let D=await this.loadConfig();if(D.enabled=!0,!D.userId)D.userId=this.generateUserId();await this.saveConfig(D)}async disable(){let D=await this.loadConfig();D.enabled=!1,await this.saveConfig(D)}async track(D,t){if(!await this.isEnabled())return;let A={event:D,...t,timestamp:Date.now(),platform:ml.platform(),nodeVersion:ao.version};if(this.events.push(A),this.events.length>=10)await this.send()}async trackCommand(D,t){await this.track("command",{command:D,duration:t})}async trackError(D,t){await this.track("error",{error:D,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(D){return new Promise((t)=>setTimeout(t,D))}async status(){let D=await this.loadConfig();return{enabled:D.enabled,doNotTrack:ao.env.DO_NOT_TRACK==="1"||ao.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:D.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Jd(this.configPath)){let D=await ta.readFile(this.configPath,"utf-8");return this.config=JSON.parse(D),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(D){this.config=D;try{let t=na.dirname(this.configPath);await ta.mkdir(t,{recursive:!0}),await ta.writeFile(this.configPath,JSON.stringify(D,null,2),"utf-8")}catch{}}generateUserId(){let D=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${D}-${t}`}}var kg=new bl;function ca(D){return D.replace(/[<[].+/,"").trim()}function Zd(D){let t=/<([^>]+)>/g,m=/\[([^\]]+)\]/g,A=[],_=(Y)=>{let X=!1,ne=Y[1];if(ne.startsWith("..."))ne=ne.slice(3),X=!0;return{required:Y[0].startsWith("<"),value:ne,variadic:X}},z;while(z=t.exec(D))A.push(_(z));let U;while(U=m.exec(D))A.push(_(U));return A}function Qd(D){let t={alias:{},boolean:[]};for(let[m,A]of D.entries()){if(A.names.length>1)t.alias[A.names[0]]=A.names.slice(1);if(A.isBoolean)if(A.negated){if(!D.some((z,U)=>U!==m&&z.names.some((Y)=>A.names.includes(Y))&&typeof z.required==="boolean"))t.boolean.push(A.names[0])}else t.boolean.push(A.names[0])}return t}function gl(D){return D.reduce((t,m)=>t.length>=m.length?t:m,"")}function ia(D,t){return D.length>=t?D:`${D}${" ".repeat(t-D.length)}`}function as(D){return D.replace(/([a-z])-([a-z])/g,(t,m,A)=>m+A.toUpperCase())}function Xd(D,t,m){let A=0,_=t.length,z=D,U;for(;A<_;++A)U=z[t[A]],z=z[t[A]]=A===_-1?m:U!=null?U:!!~t[A+1].indexOf(".")||!(+t[A+1]>-1)?{}:[]}function eu(D,t){for(let m of Object.keys(t)){let A=t[m];if(A.shouldTransform){if(D[m]=Array.prototype.concat.call([],D[m]),typeof A.transformFunction==="function")D[m]=D[m].map(A.transformFunction)}}}function tu(D){let t=/([^\\/]+)$/.exec(D);return t?t[1]:""}function Fo(D){return D.split(".").map((t,m)=>m===0?as(t):t).join(".")}class Mo extends Error{exitCode=2;isUsageError=!0;usage;constructor(D,t){super(D);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(D).stack}format(D=!1){if(D&&this.stack)return`${this.message}
+import{C,jt,n,r,a,Er,e,p,i,o,R,d,ws,c,an,ve,_o,Oo,$o,Lo,f}from"./chunk-r3gxhy1k.js";import{ra,H,xr,w,B,$s,l,s,T,sa,oa,aa,ke,Fe,tt,Ms,fn,Pi,hn,Us,ua,pa,ma,ga,ha,j,b,L,rt,N,ge,Bs,je,Gt,Di,we,js,Ni,qt,At,ya,ba}from"./chunk-qbagghsb.js";import"./chunk-svrgx20b.js";import{_e,x,An,y,Rn,Bi,In,Js,Mr,it,De,Pn,Dn,Nn,kn,xn,_n,On,$n,ie,Zt,er,Ln,Ur,Mn,Un,Bn,jn,Vn,zn,Hn,Gn,st,tr,rr,Dt,Fr,nr,ir,ji,Nt,qn,ce,Wn,Kn,Jn,Br,jr,Xn,Vr,sr,or,ot,kt,xt,zr,le,Qn,nc,ic,ar,sc,G,Vi,Ve,at,ct,Yn,Hr,Gr,Zn,ei,ti,qr,Xs,de,ye,Oe,be,ri,cr}from"./chunk-0870bs4x.js";import{u,Qo}from"./chunk-7rwc5bvv.js";import{ae,h,kr}from"./chunk-twmeg17s.js";import{Rr,Tt,Ir,Pr,Dr,Nr,un}from"./chunk-r8e263ne.js";import{S,Ot,li,uo,hr,mc,gc,fc,di,ui,mt,en,$t,tn,gt,Ke,Le,Je,ft,yr,Me,Xe,pi,mi,Qe,rn,nn,rs,is,vr,Lt,ht,Mt,ee,cs,hi,yi,Eo}from"./chunk-exc2mqcc.js";import{Ye,Ut,Ro,Io,Ze,ps,ms,gs,fs,hs,ys,W,Ft,M,bi}from"./chunk-gbpmgae9.js";import{J,P,As,Bo,jo,Uc,Fc,Ci,vt,Ti}from"./chunk-v3prk467.js";import{v}from"./chunk-v4gpkkzh.js";import{Q}from"./chunk-y2qz4vw1.js";import{Ct,g}from"./chunk-f76wtb7d.js";import{He,Qs,ue,zi,ii,Hi,Gi,Wr,qi,Wi,Se,Z,Ge,Ne,Kr,lr,qe,dr,Jr,dt,pe,ut,pr,mr,gr,Xr,fr,O,Ji,Xi,si,Ys,Qr,Zs,eo,cc,Qi,to,ro,no,io,pt,so,Yi,Zi}from"./chunk-8p2v1gat.js";import"./chunk-cnwncp50.js";import{I}from"./chunk-j01jx36v.js";import{me}from"./chunk-yt95wsqg.js";import{K,bt,Ts}from"./chunk-kcsjaam6.js";import{se,q,oc,ac,ze}from"./chunk-h42xsxhm.js";import{Qt,En,Yt,Ui,wn,Ks}from"./chunk-vkdw6sxn.js";import"./chunk-ar6bxdv4.js";import{E}from"./chunk-71jh460j.js";import{lt}from"./chunk-haqap7d1.js";import{te,Ce}from"./chunk-bpw8m7rw.js";import{V}from"./chunk-s7f24j6k.js";import"./chunk-4mt7rspg.js";import{Fi}from"./chunk-4f5hhqh9.js";import"./chunk-2ax1rm70.js";import"./chunk-c8439azc.js";import{ci}from"./chunk-9n3wmdd6.js";import{Cr}from"./chunk-bfzdbe4g.js";import{yt}from"./chunk-2qdktx9h.js";import{F}from"./chunk-ymfnqae6.js";import{k}from"./chunk-tv0rtc0s.js";import{existsSync as Jd}from"node:fs";import ta from"node:fs/promises";import ml from"node:os";import na from"node:path";import ao from"node:process";import{EventEmitter as Yd}from"node:events";import Ei from"node:process";import fl from"node:process";import la from"node:process";import ls from"node:process";import No from"node:process";import vl from"node:tty";import Bu,{stdin as Bg,stdout as Mg}from"node:process";class bl{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let D=ml.homedir(),t=na.join(D,".config","clapp");this.configPath=na.join(t,"telemetry.json")}async isEnabled(){if(ao.env.DO_NOT_TRACK==="1"||ao.env.DO_NOT_TRACK==="true")return!1;if(ao.env.NO_TELEMETRY==="1"||ao.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let D=await this.loadConfig();if(D.enabled=!0,!D.userId)D.userId=this.generateUserId();await this.saveConfig(D)}async disable(){let D=await this.loadConfig();D.enabled=!1,await this.saveConfig(D)}async track(D,t){if(!await this.isEnabled())return;let A={event:D,...t,timestamp:Date.now(),platform:ml.platform(),nodeVersion:ao.version};if(this.events.push(A),this.events.length>=10)await this.send()}async trackCommand(D,t){await this.track("command",{command:D,duration:t})}async trackError(D,t){await this.track("error",{error:D,command:t})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let t=await this.loadConfig();return t.lastSent=Date.now(),await this.saveConfig(t),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let t=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(t),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(D){return new Promise((t)=>setTimeout(t,D))}async status(){let D=await this.loadConfig();return{enabled:D.enabled,doNotTrack:ao.env.DO_NOT_TRACK==="1"||ao.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:D.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Jd(this.configPath)){let D=await ta.readFile(this.configPath,"utf-8");return this.config=JSON.parse(D),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(D){this.config=D;try{let t=na.dirname(this.configPath);await ta.mkdir(t,{recursive:!0}),await ta.writeFile(this.configPath,JSON.stringify(D,null,2),"utf-8")}catch{}}generateUserId(){let D=Math.random().toString(36).substring(2,15),t=Date.now().toString(36);return`${D}-${t}`}}var kg=new bl;function ca(D){return D.replace(/[<[].+/,"").trim()}function Zd(D){let t=/<([^>]+)>/g,m=/\[([^\]]+)\]/g,A=[],_=(Y)=>{let X=!1,ne=Y[1];if(ne.startsWith("..."))ne=ne.slice(3),X=!0;return{required:Y[0].startsWith("<"),value:ne,variadic:X}},z;while(z=t.exec(D))A.push(_(z));let U;while(U=m.exec(D))A.push(_(U));return A}function Qd(D){let t={alias:{},boolean:[]};for(let[m,A]of D.entries()){if(A.names.length>1)t.alias[A.names[0]]=A.names.slice(1);if(A.isBoolean)if(A.negated){if(!D.some((z,U)=>U!==m&&z.names.some((Y)=>A.names.includes(Y))&&typeof z.required==="boolean"))t.boolean.push(A.names[0])}else t.boolean.push(A.names[0])}return t}function gl(D){return D.reduce((t,m)=>t.length>=m.length?t:m,"")}function ia(D,t){return D.length>=t?D:`${D}${" ".repeat(t-D.length)}`}function as(D){return D.replace(/([a-z])-([a-z])/g,(t,m,A)=>m+A.toUpperCase())}function Xd(D,t,m){let A=0,_=t.length,z=D,U;for(;A<_;++A)U=z[t[A]],z=z[t[A]]=A===_-1?m:U!=null?U:!!~t[A+1].indexOf(".")||!(+t[A+1]>-1)?{}:[]}function eu(D,t){for(let m of Object.keys(t)){let A=t[m];if(A.shouldTransform){if(D[m]=Array.prototype.concat.call([],D[m]),typeof A.transformFunction==="function")D[m]=D[m].map(A.transformFunction)}}}function tu(D){let t=/([^\\/]+)$/.exec(D);return t?t[1]:""}function Fo(D){return D.split(".").map((t,m)=>m===0?as(t):t).join(".")}class Mo extends Error{exitCode=2;isUsageError=!0;usage;constructor(D,t){super(D);if(this.name=this.constructor.name,t!==void 0)this.usage=t;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(D).stack}format(D=!1){if(D&&this.stack)return`${this.message}
 
 Stack trace:
 ${this.stack}`;return this.message}}function nu(D){if(D instanceof Mo)return!0;return!!D&&typeof D==="object"&&D.name==="ClappError"&&typeof D.message==="string"}function ru(){let{env:D}=fl,{TERM:t,TERM_PROGRAM:m}=D;if(fl.platform!=="win32")return t!=="linux";return Boolean(D.WT_SESSION)||Boolean(D.TERMINUS_SUBLIME)||D.ConEmuTask==="{cmd::Cmder}"||m==="Terminus-Sublime"||m==="vscode"||t==="xterm-256color"||t==="alacritty"||t==="rxvt-unicode"||t==="rxvt-unicode-256color"||D.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var ds="\x1B",cn=`${ds}[`;var hl={to(D,t){if(!t)return`${cn}${D+1}G`;return`${cn}${t+1};${D+1}H`},move(D,t){let m="";if(D<0)m+=`${cn}${-D}D`;else if(D>0)m+=`${cn}${D}C`;if(t<0)m+=`${cn}${-t}A`;else if(t>0)m+=`${cn}${t}B`;return m},up:(D=1)=>`${cn}${D}A`,down:(D=1)=>`${cn}${D}B`,forward:(D=1)=>`${cn}${D}C`,backward:(D=1)=>`${cn}${D}D`,nextLine:(D=1)=>`${cn}E`.repeat(D),prevLine:(D=1)=>`${cn}F`.repeat(D),left:`${cn}G`,hide:`${cn}?25l`,show:`${cn}?25h`,save:`${ds}7`,restore:`${ds}8`};var xg={screen:`${cn}2J`,up:(D=1)=>`${cn}1J`.repeat(D),down:(D=1)=>`${cn}J`.repeat(D),line:`${cn}2K`,lineEnd:`${cn}K`,lineStart:`${cn}1K`,lines(D){let t="";for(let m=0;m<D;m++)t+=this.line+(m<D-1?hl.up():"");if(D)t+=hl.left;return t}},Dg={screen:`${ds}c`};function iu(D,t){let m=[];for(let A=0;A<=t.length;A++)m[A]=[A];for(let A=0;A<=D.length;A++)m[0][A]=A;for(let A=1;A<=t.length;A++)for(let _=1;_<=D.length;_++)if(t.charAt(A-1)===D.charAt(_-1))m[A][_]=m[A-1][_-1];else m[A][_]=Math.min(m[A-1][_-1]+1,m[A][_-1]+1,m[A-1][_]+1);return m[t.length][D.length]}function wl(D,t,m=2,A=3){return t.map((_)=>({cmd:_,distance:iu(D,_)})).filter(({distance:_})=>_<=m).sort((_,z)=>_.distance-z.distance).slice(0,A).map(({cmd:_})=>_)}function ou(D,t={}){let m={_:[]},A=t.alias||{},_=new Set(t.boolean||[]),z={};for(let X of Object.keys(A))for(let ne of A[X])z[ne]=X;for(let X of _)if(A[X])for(let ne of A[X])_.add(ne);function U(X,ne){if(X===void 0)return ne;if(typeof ne==="boolean")return ne;return Array.isArray(X)?[...X,ne]:[X,ne]}function Y(X,ne){let re=z[X]||X,oe=U(m[re],ne);if(m[re]=oe,A[re])for(let fe of A[re])m[fe]=oe;if(z[X]&&A[z[X]])for(let fe of A[z[X]])m[fe]=oe;m[X]=oe}for(let X=0;X<D.length;X++){let ne=D[X];if(ne==="--"){m._.push(...D.slice(X+1));break}if(ne.startsWith("--")){let re=ne.indexOf("=");if(re!==-1){let oe=as(ne.slice(2,re)),fe=ne.slice(re+1);Y(oe,fe)}else{let oe=ne.slice(2);if(oe.startsWith("no-")){let Ie=as(oe.slice(3));Y(Ie,!1);continue}let fe=as(oe),$e=z[fe]||fe;if(_.has($e)||_.has(fe))Y(fe,!0);else{let Ie=D[X+1];if(Ie!==void 0&&!Ie.startsWith("-"))Y(fe,Ie),X++;else Y(fe,!0)}}}else if(ne.startsWith("-")&&ne.length>1){let re=ne.slice(1);for(let oe=0;oe<re.length;oe++){let fe=re[oe],$e=z[fe]||fe;if(oe===re.length-1&&!_.has($e)&&!_.has(fe)){let Ie=D[X+1];if(Ie!==void 0&&!Ie.startsWith("-"))Y(fe,Ie),X++;else Y(fe,!0)}else Y(fe,!0)}}else m._.push(ne)}return m}class Sl{rawName;description;name;names;isBoolean;required;config;negated;constructor(D,t,m){if(this.rawName=D,this.description=t,this.config=Object.assign({},m),D=D.replace(/\.\*/g,""),this.negated=!1,this.names=ca(D).split(",").map((A)=>{let _=A.trim().replace(/^-{1,2}/,"");if(_.startsWith("no-"))this.negated=!0,_=_.replace(/^no-/,"");return Fo(_)}).sort((A,_)=>A.length>_.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(D.includes("<"))this.required=!0;else if(D.includes("["))this.required=!1;else this.isBoolean=!0}}var Tg=la.argv,su=`${la.platform}-${la.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,yl=ls.argv,au=`${ls.platform}-${ls.arch} node-${ls.version}`;class da{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(D,t,m,A){this.rawName=D,this.description=t,this.config=m,this.cli=A,this.options=[],this.aliasNames=[],this.name=ca(D);let _=ca(D),z=_.indexOf(":");if(z>0)this.namespace=_.substring(0,z),this.name=_.substring(z+1);if(this.args=Zd(D),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!m)this.config={}}usage(D){return this.usageText=D,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(D,t="-v, --version"){return this.versionNumber=D,this.option(t,"Display version number"),this}example(D){return this.examples.push(D),this}option(D,t,m){let A=new Sl(D,t,m);return this.options.push(A),this}alias(D){return this.aliasNames.push(D),this}action(D){return this.commandAction=D,this}before(D){return this.beforeHooks.push(D),this}after(D){return this.afterHooks.push(D),this}use(D){return this.middleware.push(D),this}isMatched(D){if(this.aliasNames.includes(D))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===D;return this.name===D}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof fa}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(D){let t=Fo(D.split(".")[0]);return!!this.options.find((m)=>m.names.some((A)=>Fo(A)===t))}outputHelp(){let{name:D,commands:t}=this.cli,{versionNumber:m,options:A,helpCallback:_}=this.cli.globalCommand,z=[{body:`${D}${m?`/${m}`:""}`}];if(z.push({title:"Usage",body:`  $ ${D} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&t.length>0){let ne=gl(t.map((Ie)=>Ie.rawName)),re=new Map,oe=[];for(let Ie of t)if(Ie.namespace){if(!re.has(Ie.namespace))re.set(Ie.namespace,[]);re.get(Ie.namespace).push(Ie)}else oe.push(Ie);let fe="";if(oe.sort((Ie,he)=>Ie.rawName<he.rawName?-1:Ie.rawName>he.rawName?1:0),oe.length>0)fe+=oe.map((Ie)=>`  ${ia(Ie.rawName,ne.length)}  ${Ie.description}`).join(`
@@ -28,7 +28,7 @@ Received ${m}, cleaning up...`),D)try{await D()}catch(A){console.error("Error du
 `)),this.enableDidYouMean){let t=[];for(let A of this.commands){if(A.displayName)t.push(A.displayName);if(A.aliasNames)t.push(...A.aliasNames)}let m=wl(D,t);if(m.length>0)console.log(To.yellow("Did you mean one of these?")),m.forEach((A)=>console.log(`  ${To.dim("•")} ${this.name} ${A}`)),console.log("")}console.log(To.dim("Run"),`${this.name} --help`,To.dim("to see all available commands")),Ei.exit(1)}async parse(D=yl,t={}){let{run:m=!0,exitOnError:A=!1}=t;if(A)try{return await this.parse(D,{run:m})}catch(X){throw this.handleUsageError(X),X}if(this.rawArgs=D,!this.name)this.name=D[1]?tu(D[1]):"cli";let _=!0,z=D.slice(2),U=z[0];if(U&&!U.startsWith("-")){for(let X of this.commands)if(X.isMatched(U)){let ne=this.mri(z,X);_=!1;let re={...ne,args:ne.args.slice(1)};this.setParsedInfo(re,X,U),this.emit(`command:${U}`,X);break}if(_){let X=z[1];if(X&&!X.startsWith("-")){let ne=`${U}:${X}`;for(let re of this.commands)if(re.isMatched(ne)){let oe=this.mri(z,re);_=!1;let fe={...oe,args:oe.args.slice(2)};this.setParsedInfo(fe,re,ne),this.emit(`command:${ne}`,re);break}}}}if(_){for(let X of this.commands)if(X.name===""){_=!1;let ne=this.mri(z,X);this.setParsedInfo(ne,X),this.emit("command:!",X);break}}if(_){let X=this.mri(D.slice(2));this.setParsedInfo(X)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction||this.options.interaction===!1)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji||this.options.emoji===!1)this.useEmoji=!1;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache||this.options.cache===!1)this.isNoCache=!0;if(this.options.help&&this.showHelpOnExit)this.outputHelp(),m=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),m=!1,this.unsetMatchedCommand();let Y={args:this.args,options:this.options};if(m)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return Y}mri(D,t){let m=[...this.globalCommand.options,...t?t.options:[]],A=Qd(m),_=[],z=D.indexOf("--");if(z>-1)_=D.slice(z+1),D=D.slice(0,z);let U=ou(D,A),Y={_:U._};for(let fe of Object.keys(U))if(fe!=="_")Y[Fo(fe)]=U[fe];let X=Y._,ne={"--":_},re=t&&t.config.ignoreOptionDefaultValue?t.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,oe=Object.create(null);for(let fe of m){if(!re&&fe.config.default!==void 0)for(let $e of fe.names)ne[$e]=fe.config.default;if(Array.isArray(fe.config.type)){if(oe[fe.name]===void 0)oe[fe.name]={shouldTransform:!0,transformFunction:fe.config.type[0]}}}for(let fe of Object.keys(Y))if(fe!=="_"){let $e=fe.split(".");Xd(ne,$e,Y[fe]),eu(ne,oe)}return{args:X,options:ne}}async run(D=yl){return this.parse(D,{run:!0,exitOnError:!0})}handleUsageError(D){if(!nu(D)||D.isUsageError===!1)return;let t=D.message||"command-line error",m=this.name?`${this.name}: `:"",A=/--help/.test(t)?"":D.usage?`
 Usage: ${D.usage}`:`
 Run \`${this.name??"cli"} --help\` for usage.`;Ei.stderr.write(`${m}${t}${A}
-`),Ei.exit(D.exitCode??2)}async runMatchedCommand(){let{args:D,options:t,matchedCommand:m}=this;if(!m||!m.commandAction)return;m.checkUnknownOptions(),m.checkOptionValue(),m.checkRequiredArgs();let A=[];m.args.forEach((Y,X)=>{if(Y.variadic)A.push(D.slice(X));else A.push(D[X])}),A.push(t);let _={command:m,args:A,options:t};for(let Y of m.beforeHooks)await Y(_);let z,U=async()=>{let Y=m.commandAction.apply(this,A);if(Y instanceof Promise)z=await Y;else z=Y;return z};if(m.middleware.length>0){let Y=0,X=async()=>{if(Y<m.middleware.length){let ne=m.middleware[Y++];await ne({..._,next:X})}else await U()};await X()}else await U();for(let Y of m.afterHooks)await Y(_);return z}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return Ei.removeAllListeners("SIGINT"),Ei.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class $l{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(D){if(!this.enabled){this.misses++;return}let t=this.cache.get(D);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(D),this.misses++;return}return this.hits++,t.value}set(D,t,m=5000){if(!this.enabled)return;this.cache.set(D,{value:t,timestamp:Date.now(),ttl:m})}has(D){if(!this.enabled)return!1;let t=this.cache.get(D);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(D),!1;return!0}delete(D){this.cache.delete(D)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let D=Date.now();for(let[t,m]of this.cache.entries())if(D-m.timestamp>m.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Og=new $l;function uu(){if("FORCE_COLOR"in No.env)return No.env.FORCE_COLOR!=="0";if("NO_COLOR"in No.env||No.env.TERM==="dumb")return!1;if(No.platform==="win32")return!0;return vl.isatty(1)&&vl.isatty(2)}var Cl=uu();function sn(D,t){if(!Cl)return(m)=>m;return(m)=>D+m+t}var pu=sn("\x1B[0m","\x1B[0m"),mu=sn("\x1B[31m","\x1B[39m"),fu=sn("\x1B[32m","\x1B[39m"),gu=sn("\x1B[33m","\x1B[39m"),hu=sn("\x1B[34m","\x1B[39m"),yu=sn("\x1B[35m","\x1B[39m"),vu=sn("\x1B[36m","\x1B[39m"),bu=sn("\x1B[37m","\x1B[39m"),wu=sn("\x1B[90m","\x1B[39m"),Su=sn("\x1B[1m","\x1B[22m"),$u=sn("\x1B[3m","\x1B[23m"),Cu=sn("\x1B[4m","\x1B[24m"),Au=sn("\x1B[2m","\x1B[22m"),ku=sn("\x1B[7m","\x1B[27m"),Ru=sn("\x1B[8m","\x1B[28m"),Iu=sn("\x1B[9m","\x1B[29m"),Pu=sn("\x1B[41m","\x1B[49m"),xu=sn("\x1B[42m","\x1B[49m"),Du=sn("\x1B[43m","\x1B[49m"),Eu=sn("\x1B[44m","\x1B[49m"),Tu=sn("\x1B[45m","\x1B[49m"),Nu=sn("\x1B[46m","\x1B[49m"),Ou=sn("\x1B[47m","\x1B[49m"),Lu=Cl,ju={reset:pu,red:mu,green:fu,yellow:gu,blue:hu,magenta:yu,cyan:vu,white:bu,gray:wu,bold:Su,italic:$u,underline:Cu,dim:Au,inverse:ku,hidden:Ru,strikethrough:Iu,bgRed:Pu,bgGreen:xu,bgYellow:Du,bgBlue:Eu,bgMagenta:Tu,bgCyan:Nu,bgWhite:Ou,isColorSupported:Lu},Fu=ju,Mu=["up","down","left","right","space","enter","cancel"],_g={actions:new Set(Mu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var zg=Bu.platform.startsWith("win"),Ug=Symbol("clapp:cancel");var _u=ru();var on=(D,t)=>_u?D:t,Vg=on("◆","*"),Wg=on("■","x"),qg=on("▲","x"),Gg=on("◇","o"),Hg=on("┌","T"),zu=on("│","|"),Kg=on("└","—"),Jg=on("●",">"),Yg=on("○"," "),Zg=on("◻","[•]"),Qg=on("◼","[+]"),Xg=on("◻","[ ]"),eh=on("▪","•"),th=on("─","-"),nh=on("╮","+"),rh=on("├","+"),ih=on("╯","+"),oh=on("●","•"),sh=on("◆","*"),ah=on("▲","!"),ch=on("■","x");var lh={light:on("─","-"),heavy:on("━","="),block:on("█","#")};function Uu(){return`${Fu.gray(zu)}  `}var dh=Uu();var wa="0.16.35";function Al(D,t,m=process.env){let A=t?.options.find((U)=>U.name==="profile");if((!A||/\baws\b/i.test(A.description))&&typeof D.profile==="string"&&D.profile)m.AWS_PROFILE=D.profile,delete m.AWS_ACCESS_KEY_ID,delete m.AWS_SECRET_ACCESS_KEY,delete m.AWS_SESSION_TOKEN;if(!t?.options.some((U)=>U.name==="region")&&typeof D.region==="string"&&D.region)m.AWS_REGION=D.region,m.AWS_DEFAULT_REGION=D.region}import{existsSync as Sa}from"node:fs";import{mkdir as Wu,writeFile as kl}from"node:fs/promises";function $a(D){D.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),Sa("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let m=t?.name||await R("Project name","my-app"),A=t?.mode||await ws("Select deployment mode",["serverless","server"]),_=t?.region||await ws("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),z=new o("Creating configuration file...");z.start();let U=`import { defineConfig } from '@ts-cloud/core'
+`),Ei.exit(D.exitCode??2)}async runMatchedCommand(){let{args:D,options:t,matchedCommand:m}=this;if(!m||!m.commandAction)return;m.checkUnknownOptions(),m.checkOptionValue(),m.checkRequiredArgs();let A=[];m.args.forEach((Y,X)=>{if(Y.variadic)A.push(D.slice(X));else A.push(D[X])}),A.push(t);let _={command:m,args:A,options:t};for(let Y of m.beforeHooks)await Y(_);let z,U=async()=>{let Y=m.commandAction.apply(this,A);if(Y instanceof Promise)z=await Y;else z=Y;return z};if(m.middleware.length>0){let Y=0,X=async()=>{if(Y<m.middleware.length){let ne=m.middleware[Y++];await ne({..._,next:X})}else await U()};await X()}else await U();for(let Y of m.afterHooks)await Y(_);return z}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return Ei.removeAllListeners("SIGINT"),Ei.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class $l{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(D){if(!this.enabled){this.misses++;return}let t=this.cache.get(D);if(!t){this.misses++;return}if(Date.now()-t.timestamp>t.ttl){this.cache.delete(D),this.misses++;return}return this.hits++,t.value}set(D,t,m=5000){if(!this.enabled)return;this.cache.set(D,{value:t,timestamp:Date.now(),ttl:m})}has(D){if(!this.enabled)return!1;let t=this.cache.get(D);if(!t)return!1;if(Date.now()-t.timestamp>t.ttl)return this.cache.delete(D),!1;return!0}delete(D){this.cache.delete(D)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let D=Date.now();for(let[t,m]of this.cache.entries())if(D-m.timestamp>m.ttl)this.cache.delete(t)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var Og=new $l;function uu(){if("FORCE_COLOR"in No.env)return No.env.FORCE_COLOR!=="0";if("NO_COLOR"in No.env||No.env.TERM==="dumb")return!1;if(No.platform==="win32")return!0;return vl.isatty(1)&&vl.isatty(2)}var Cl=uu();function sn(D,t){if(!Cl)return(m)=>m;return(m)=>D+m+t}var pu=sn("\x1B[0m","\x1B[0m"),mu=sn("\x1B[31m","\x1B[39m"),fu=sn("\x1B[32m","\x1B[39m"),gu=sn("\x1B[33m","\x1B[39m"),hu=sn("\x1B[34m","\x1B[39m"),yu=sn("\x1B[35m","\x1B[39m"),vu=sn("\x1B[36m","\x1B[39m"),bu=sn("\x1B[37m","\x1B[39m"),wu=sn("\x1B[90m","\x1B[39m"),Su=sn("\x1B[1m","\x1B[22m"),$u=sn("\x1B[3m","\x1B[23m"),Cu=sn("\x1B[4m","\x1B[24m"),Au=sn("\x1B[2m","\x1B[22m"),ku=sn("\x1B[7m","\x1B[27m"),Ru=sn("\x1B[8m","\x1B[28m"),Iu=sn("\x1B[9m","\x1B[29m"),Pu=sn("\x1B[41m","\x1B[49m"),xu=sn("\x1B[42m","\x1B[49m"),Du=sn("\x1B[43m","\x1B[49m"),Eu=sn("\x1B[44m","\x1B[49m"),Tu=sn("\x1B[45m","\x1B[49m"),Nu=sn("\x1B[46m","\x1B[49m"),Ou=sn("\x1B[47m","\x1B[49m"),Lu=Cl,ju={reset:pu,red:mu,green:fu,yellow:gu,blue:hu,magenta:yu,cyan:vu,white:bu,gray:wu,bold:Su,italic:$u,underline:Cu,dim:Au,inverse:ku,hidden:Ru,strikethrough:Iu,bgRed:Pu,bgGreen:xu,bgYellow:Du,bgBlue:Eu,bgMagenta:Tu,bgCyan:Nu,bgWhite:Ou,isColorSupported:Lu},Fu=ju,Mu=["up","down","left","right","space","enter","cancel"],_g={actions:new Set(Mu),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var zg=Bu.platform.startsWith("win"),Ug=Symbol("clapp:cancel");var _u=ru();var on=(D,t)=>_u?D:t,Vg=on("◆","*"),Wg=on("■","x"),qg=on("▲","x"),Gg=on("◇","o"),Hg=on("┌","T"),zu=on("│","|"),Kg=on("└","—"),Jg=on("●",">"),Yg=on("○"," "),Zg=on("◻","[•]"),Qg=on("◼","[+]"),Xg=on("◻","[ ]"),eh=on("▪","•"),th=on("─","-"),nh=on("╮","+"),rh=on("├","+"),ih=on("╯","+"),oh=on("●","•"),sh=on("◆","*"),ah=on("▲","!"),ch=on("■","x");var lh={light:on("─","-"),heavy:on("━","="),block:on("█","#")};function Uu(){return`${Fu.gray(zu)}  `}var dh=Uu();var wa="0.16.36";function Al(D,t,m=process.env){let A=t?.options.find((U)=>U.name==="profile");if((!A||/\baws\b/i.test(A.description))&&typeof D.profile==="string"&&D.profile)m.AWS_PROFILE=D.profile,delete m.AWS_ACCESS_KEY_ID,delete m.AWS_SECRET_ACCESS_KEY,delete m.AWS_SESSION_TOKEN;if(!t?.options.some((U)=>U.name==="region")&&typeof D.region==="string"&&D.region)m.AWS_REGION=D.region,m.AWS_DEFAULT_REGION=D.region}import{existsSync as Sa}from"node:fs";import{mkdir as Wu,writeFile as kl}from"node:fs/promises";function $a(D){D.command("init","Initialize a new ts-cloud project").option("--mode <mode>","Deployment mode: server or serverless").option("--name <name>","Project name").option("--region <region>","AWS Region").action(async(t)=>{if(i("Initializing ts-cloud Project"),Sa("cloud.config.ts")){if(!await d("cloud.config.ts already exists. Overwrite?",!1)){e("Initialization cancelled");return}}let m=t?.name||await R("Project name","my-app"),A=t?.mode||await ws("Select deployment mode",["serverless","server"]),_=t?.region||await ws("Select AWS region",["us-east-1","us-west-2","eu-west-1","eu-central-1","ap-southeast-1"]),z=new o("Creating configuration file...");z.start();let U=`import { defineConfig } from '@ts-cloud/core'
 
 export default defineConfig({
   project: {
@@ -315,7 +315,7 @@ Resources to create: ${xe}`);let We={};for(let Be of Object.values(ne.Resources|
 No changes detected - infrastructure is up to date`);return}if(e(`
 Changes detected:
 `),Re.length>0){n(`Resources to add (${Re.length}):`);for(let Pe of Re){let xe=$e[Pe].Type;e(`  + ${Pe} (${xe})`)}console.log()}if(Te.length>0){r(`Resources to remove (${Te.length}):`);for(let Pe of Te){let xe=fe[Pe].Type;e(`  - ${Pe} (${xe})`)}console.log()}if(Ae.length>0){a(`Resources to modify (${Ae.length}):`);for(let Pe of Ae){let xe=$e[Pe].Type;e(`  ~ ${Pe} (${xe})`)}console.log()}e("Summary:"),e(`  - Add: ${Re.length}`),e(`  - Remove: ${Te.length}`),e(`  - Modify: ${Ae.length}`),e("\nRun `cloud deploy` to apply these changes")}catch(m){r(`Diff failed: ${m.message}`)}})}function Li(D,t=0){let m=Number(D);return Number.isFinite(m)?m:t}function xa(D){return Li(D)*1024}function $p(D){let t=D?.date?.trim(),m=D?.time?.trim();if(!t||!m)return null;let A=new Date(`${t}T${m}Z`);return Number.isFinite(A.getTime())?A.toISOString():null}function Cp(D,t,m){let A;try{A=JSON.parse(D)}catch{return[]}let _=(A?.sysstat?.hosts??[]).flatMap((U)=>U.statistics??[]),z=[];for(let U of _){let Y=$p(U.timestamp);if(!Y)continue;let X=new Date(Y).getTime();if(X<t.getTime()||X>m.getTime())continue;let ne=U["cpu-load"]?.find((oe)=>oe.cpu==="all")??U["cpu-load"]?.[0],re=Li(ne?.idle,100);z.push({timestamp:Y,cpuUsedPercent:Math.max(0,Math.min(100,100-re)),cpuUserPercent:Li(ne?.user),cpuSystemPercent:Li(ne?.system),cpuIowaitPercent:Li(ne?.iowait),memoryUsedPercent:Li(U.memory?.["memused-percent"]),memoryUsedBytes:xa(U.memory?.memused),memoryAvailableBytes:xa(U.memory?.avail),swapUsedPercent:Li(U.memory?.["swpused-percent"]),swapUsedBytes:xa(U.memory?.swpused)})}return z.sort((U,Y)=>U.timestamp.localeCompare(Y.timestamp))}function Ap(D){return Object.fromEntries(Object.entries(D.time_series??{}).map(([t,m])=>[t,(m.values??[]).map(([A,_])=>({timestamp:new Date(Number(A)*1000).toISOString(),value:Li(_,Number.NaN)})).filter((A)=>Number.isFinite(A.value))]))}function Ml(D){return D.length?D.reduce((t,m)=>t+m,0)/D.length:null}function Da(D){return D.length?Math.max(...D):null}function kp(D){return D.length?Math.min(...D):null}async function _l(D){let[t,m]=await Promise.all([D.client.getServerMetrics(D.serverId,{types:["cpu","disk","network"],start:D.from,end:D.to,step:D.step}),Ne(D.remote.host,"LC_ALL=C sadf -j -- -u -r -S",D.remote).catch(()=>"")]),A=Cp(m,D.from,D.to),_=Ap(t),U=(_.cpu??[]).map((oe)=>Math.max(0,Math.min(100,oe.value/Math.max(1,D.cores)))),Y=A.map((oe)=>oe.cpuUsedPercent),X=U.length?U:Y,ne=A.map((oe)=>oe.memoryUsedPercent),re=A.map((oe)=>oe.swapUsedPercent);return{from:D.from.toISOString(),to:D.to.toISOString(),cores:D.cores,host:A,provider:_,summary:{cpuAveragePercent:Ml(X),cpuPeakPercent:Da(X),memoryAveragePercent:Ml(ne),memoryPeakPercent:Da(ne),memoryMinimumAvailableBytes:kp(A.map((oe)=>oe.memoryAvailableBytes)),swapPeakPercent:Da(re)}}}function Rp(D){if(D.length===0)throw Error("A server name cannot be empty.");if(D.length>253)throw Error(`'${D}' is longer than the 253 characters a hostname allows.`);for(let t of D.split(".")){if(t.length===0)throw Error(`'${D}' has an empty label — a hostname cannot contain '..'.`);if(t.length>63)throw Error(`'${t}' is longer than the 63 characters a hostname label allows.`);if(!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(t))throw Error(`'${t}' is not a valid hostname label. Use letters, digits and hyphens, not starting or ending with a hyphen.`)}}async function zl(D,t,m){if(Rp(t),D===t)throw Error(`'${D}' is already named that.`);if((await m.takenNames()).some((z)=>z===t&&z!==D))throw Error(`'${t}' is already taken. Server names have to be unique within a provider project.`);let _=[];if(m.providerName&&m.renameProvider){let{providerName:z,renameProvider:U}=m;_.push({id:"provider",title:"Rename the server at the provider",change:{from:D,to:t},satisfied:async()=>await z()===t,apply:()=>U(t)})}if(m.stateName&&m.writeStateName){let{stateName:z,writeStateName:U}=m;_.push({id:"state-pin",title:"Update the recorded name in the local driver state",change:{from:D,to:t},satisfied:async()=>{let Y=await z();return Y===void 0||Y===t},apply:()=>U(t)})}if(m.remoteHostname&&m.setRemoteHostname){let{remoteHostname:z,setRemoteHostname:U}=m;_.push({id:"hostname",title:"Set the hostname on the box",change:{from:D,to:t},satisfied:async()=>await z()===t,apply:()=>U(t)})}return _.push({id:"inventory",title:"Rename the fleet inventory record",change:{from:D,to:t},satisfied:async()=>m.inventoryName()===t,apply:async()=>{await m.renameInventory(t)}}),{operation:"server:rename",target:D,steps:_}}function Ul(D){let t=`'${D.replace(/'/g,`'"'"'`)}'`;return["set -eu",'TS_CLOUD_OLD="$(hostname)"',`hostnamectl set-hostname ${t} 2>/dev/null || { echo ${t} > /etc/hostname && hostname ${t}; }`,'if grep -q "^127.0.1.1" /etc/hosts; then',`  TS_CLOUD_HOSTS="$(sed -E "s/^127\\.0\\.1\\.1.*/127.0.1.1\\t${D}/" /etc/hosts)"`,`  printf '%s\\n' "$TS_CLOUD_HOSTS" > /etc/hosts`,"else",`  printf '127.0.1.1\\t%s\\n' ${t} >> /etc/hosts`,"fi",'printf "%s -> %s\\n" "$TS_CLOUD_OLD" "$(hostname)"'].join(`
-`)}async function Ip(){let D=await Ee(),t=y(process.cwd(),D),m=new De(t.store),A=new Pn(m,[new it("aws"),new it("hetzner"),new it("ssh")]);return{controlPlane:t,store:m,service:A}}async function gi(D){let t=await Ip();try{return await D(t)}finally{t.controlPlane.store.close()}}var Mi=(D,t)=>{let m=D.store.list(D.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!m)throw Error(`Server ${t} was not found.`);return m},vn=(D)=>{r(D instanceof Error?D.message:String(D)),process.exitCode=1};function Ea(D,t){let m=Number.parseInt(D??"",10);return Number.isFinite(m)&&m>=0?m:t}function Pp(D="3h"){let t=D.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let m=Number(t[1])*(t[2]==="h"?3600000:60000);if(m<300000||m>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return m}function Wo(D,t="%"){return D==null?"unavailable":`${D.toFixed(1)}${t}`}async function xp(D,t){let m=await Ee();if(m.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",_=T(m,A),z=await pe(_);if(!z?.serverId)throw Error(`No pinned Hetzner server was found for ${_}.`);if(![z.serverName,String(z.serverId),z.stackName].includes(D))throw Error(`Refusing to read ${D}: project state is pinned to ${z.serverName}.`);let U=lr(m),Y=new qe({apiToken:dr(U.apiToken,m)}),X=await Y.getServer(z.serverId),ne=z.publicIp??X.public_net.ipv4?.ip;if(!ne)throw Error(`Server ${X.name} has no public IPv4 address.`);let re=new Date,oe=new Date(re.getTime()-Pp(t.range)),fe=Math.min(3600,Math.max(60,Ea(t.step,60))),$e=await _l({client:Y,serverId:X.id,cores:Math.max(1,Number(X.server_type.cores)||1),from:oe,to:re,step:fe,remote:{host:ne,user:z.sshUser??U.sshUser,identityFile:U.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:X.name,result:$e},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[X.name,`${$e.from} to ${$e.to}`,`${Wo($e.summary.cpuAveragePercent)} / ${Wo($e.summary.cpuPeakPercent)}`,`${Wo($e.summary.memoryAveragePercent)} / ${Wo($e.summary.memoryPeakPercent)}`,$e.summary.memoryMinimumAvailableBytes==null?"unavailable":`${($e.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,Wo($e.summary.swapPeakPercent)]])}function Vl(D){let t=D.targetType.prices?.find((m)=>m.location===D.location);return{serverId:D.serverId,serverName:D.serverName,location:D.location,from:D.currentType.name,to:D.targetType.name,capacityAvailable:D.capacityAvailable,alreadyComplete:D.alreadyComplete,upgradeDisk:D.upgradeDisk,target:{cores:D.targetType.cores,memoryGb:D.targetType.memory,diskGb:D.targetType.disk,architecture:D.targetType.architecture,cpuType:D.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function Dp(D){let t=Vl(D);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function Ep(D,t,m){let A=await Ee();if(A.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let _=m.env??process.env.CLOUD_ENV??"production",z=T(A,_),U=await pe(z),Y=lr(A),X=new qe({apiToken:dr(Y.apiToken,A)}),re=U&&(D===U.serverName||D===String(U.serverId)||D===U.stackName)?await X.getServer(U.serverId):(await X.listServers()).find((Be)=>Be.name===D||String(Be.id)===D);if(!re)throw Error(`Hetzner server ${D} was not found.`);if(U?.serverId&&U.serverId!==re.id)throw Error(`Refusing to resize ${D}: project state is pinned to server ${U.serverId}.`);let oe=dt(t),fe=m.upgradeDisk!==!1,$e=await si(X,re.id,oe,fe);if(m.json)console.log(JSON.stringify({schemaVersion:1,plan:Vl($e)},null,2));else Dp($e);if(!m.apply){if(!m.json)e(`Preview only. Re-run with --apply --confirm ${re.name} to execute.`);return}if(m.confirm!==re.name)throw Error(`Resize requires --confirm ${re.name}.`);let Ie=U?.publicIp??re.public_net.ipv4?.ip;if(!Ie)throw Error(`Server ${re.name} has no public IPv4 address for verification.`);let he={host:Ie,user:U?.sshUser??Y.sshUser,identityFile:Y.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},Re=await io(z),Te=new Date().toISOString(),Ae={schemaVersion:1,operationId:Re?.targetType===oe&&Re.serverId===re.id?Re.operationId:crypto.randomUUID(),stackName:z,serverId:re.id,serverName:re.name,sourceType:$e.currentType.name,targetType:oe,upgradeDisk:fe,phase:"planning",status:"running",attempts:Re?.targetType===oe?Re.attempts:0,startedAt:Re?.targetType===oe?Re.startedAt:Te,updatedAt:Te,manifest:Re?.targetType===oe?Re.manifest:void 0};await pt(Ae);let Pe=Ea(m.pollSeconds,900)*1000,xe=Ea(m.maxWaitMinutes,0)*60000,We=Date.now();for(;;){let Be=await si(X,re.id,oe,fe);if(!Be.capacityAvailable&&!Be.alreadyComplete){if(Ae={...Ae,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await pt(Ae),!m.wait){if(!m.json)e(`${oe} has no capacity in ${Be.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(xe>0&&Date.now()-We>=xe)throw Error(`Timed out waiting for ${oe} capacity in ${Be.location}.`);if(!m.json)e(`Waiting ${Math.round(Pe/1000)} seconds for ${oe} capacity...`);await Bun.sleep(Pe);continue}let Ue=await so(z);try{let et=await(async()=>{try{return Ae={...Ae,status:"running",attempts:Ae.attempts+1,updatedAt:new Date().toISOString()},await pt(Ae),await Ys({client:X,serverId:re.id,targetType:oe,upgradeDisk:fe,resumeFromOff:Ae.phase==="shutting-down"||Ae.phase==="resizing"||Ae.phase==="powering-on"||Ae.phase==="verifying",manifest:Ae.manifest,hooks:{preflight:async()=>{let Rt=await Zs(he);return Ae={...Ae,manifest:Rt,updatedAt:new Date().toISOString()},await pt(Ae),Rt},afterBoot:async(Rt,Et,wt,Pt)=>eo(he,Et,wt,Pt),onPhase:async(Rt,Et)=>{if(Ae={...Ae,phase:Rt,status:Rt==="waiting-capacity"?"waiting-capacity":Rt==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await pt(Ae),!m.json)e(`${Rt}${Et?` ${JSON.stringify(Et)}`:""}`)}}})}finally{await Ue()}})();if(Ae={...Ae,status:et.status==="completed"||et.status==="already-complete"?"completed":et.status==="recovered"?"recovered":"waiting-capacity",lastError:et.status==="recovered"?et.error:void 0,updatedAt:new Date().toISOString()},await pt(Ae),m.json)console.log(JSON.stringify({schemaVersion:1,result:et},null,2));else if(et.status==="completed"||et.status==="already-complete")n(`${re.name} is on ${oe} and passed full post-boot verification.`);else if(et.status==="recovered"&&et.retryable&&m.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Pe/1000)} seconds before retry.`),await Bun.sleep(Pe);continue}else if(et.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${et.error}`);return}catch(et){throw Ae={...Ae,status:"failed",lastError:et instanceof Error?et.message:String(et),updatedAt:new Date().toISOString()},await pt(Ae),et}}}async function Tp(D,t){let m=await Ee();if(m.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",_=T(m,A),z=await pe(_);if(!z?.serverId)throw Error(`No pinned Hetzner server was found for ${_}.`);if(![z.serverName,String(z.serverId),z.stackName].includes(D))throw Error(`Refusing to optimize ${D}: project state is pinned to ${z.serverName}.`);let U=lr(m),Y=new qe({apiToken:dr(U.apiToken,m)}),X=await Y.getServer(z.serverId),ne=z.publicIp??X.public_net.ipv4?.ip;if(!ne)throw Error(`Server ${X.name} has no public IPv4 address.`);let re=Qi(m);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:X.name,plan:re},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[X.name,re.firewallPorts.join(","),re.monitoring?"on":"off",re.autoUpdates?"on":"off",`${re.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${X.name} to execute.`);return}if(t.confirm!==X.name)throw Error(`Optimization requires --confirm ${X.name}.`);let oe={host:ne,user:z.sshUser??U.sshUser,identityFile:U.sshPrivateKeyPath,connectTimeoutSec:15},fe=await Qr(oe),$e=fe.routeProbes.filter((wt)=>!wt.ok),Ie=m.infrastructure?.compute,he=Z(Ie)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,Re=fe.failedUnits.filter((wt)=>!he.has(wt));if(Re.length>0)throw Error(`Preflight found failed services: ${Re.join(", ")}`);if($e.length>0)throw Error(`Preflight found unhealthy routes: ${$e.map((wt)=>wt.domain).join(", ")}`);let Te=Z(Ie)?[]:Object.values(m.sites??{}).flatMap((wt)=>typeof wt?.port==="number"&&![80,443].includes(wt.port)?[wt.port]:[]),Ae=Jr({allowSsh:Ie?.allowSsh!==!1,sitePorts:Te,allowedPorts:Ie?.firewall?.allowedPorts}),Pe=(z.firewallId?(await Y.listFirewalls()).find((wt)=>wt.id===z.firewallId):void 0)??(await Y.listFirewalls()).find((wt)=>wt.name===`${m.project.slug}-${A}-app-fw`);if(!Pe)throw Error(`Managed firewall for ${X.name} was not found.`);let xe=await Y.setFirewallRules(Pe.id,Ae);await Promise.all(xe.map((wt)=>Y.waitForAction(wt.id))),await to(m,oe);let[We,Be]=await Promise.all([Qr(oe),ro(oe)]),Ue=no(re,Be),et=cc(fe,We),Rt=We.routeProbes.filter((wt)=>!wt.ok);if(et.stoppedServices.length>0)Ue.push(`services stopped: ${et.stoppedServices.join(", ")}`);if(et.changedRouteFragments.length>0)Ue.push(`route fragments changed: ${et.changedRouteFragments.join(", ")}`);if(et.missingRouteIds.length>0)Ue.push(`routes disappeared: ${et.missingRouteIds.join(", ")}`);if(et.changedReleaseLinks.length>0)Ue.push(`release links changed: ${et.changedReleaseLinks.join(", ")}`);if(et.missingData.length>0)Ue.push(`databases or volumes disappeared: ${et.missingData.join(", ")}`);if(Rt.length>0)Ue.push(`unhealthy routes: ${Rt.map((wt)=>wt.domain).join(", ")}`);if(Ue.length>0)throw Error(`Host optimization verification failed: ${Ue.join("; ")}`);let Et={serverId:X.id,serverName:X.name,services:We.runningServices.length,routes:We.routeIds.length,healthyDomains:We.routeProbes.length,releaseLinks:We.releaseLinks.length,databasesAndVolumes:We.dataCatalog.length,report:Be};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:Et},null,2));else n(`${X.name} passed full host, rpx route, service, release, and data verification.`)}async function Np(D,t,m){let A=await Ee(),_=m.env??"production",z=T(A,_);await gi(async(U)=>{let Y=Mi(U,D),X=U.store.list(U.controlPlane.project.id,!0),ne=Y.provider==="hetzner"&&Y.providerId?(()=>{try{let Pe=lr(A);return new qe({apiToken:dr(Pe.apiToken,A)})}catch{return null}})():null,re=Y.providerId?Number(Y.providerId):Number.NaN,oe=await pe(z),fe=oe!=null&&oe.serverId===re,$e=new Mr,Ie=Y.trustState==="pinned",he={takenNames:async()=>{let Pe=X.map((xe)=>xe.name);if(ne)Pe.push(...(await ne.listServers()).map((xe)=>xe.name));return Pe},inventoryName:()=>U.store.get(Y.id)?.name??Y.name,renameInventory:(Pe)=>{U.store.update(Y.id,{name:Pe})},...ne&&Number.isFinite(re)?{providerName:async()=>(await ne.getServer(re)).name,renameProvider:async(Pe)=>{await ne.renameServer(re,Pe)}}:{},...fe?{stateName:async()=>(await pe(z))?.serverName,writeStateName:async(Pe)=>{let xe=await pe(z);if(xe)await ut(z,{...xe,serverName:Pe})}}:{},...Ie?{remoteHostname:async()=>{let Pe=await $e.exec(Y,"hostname");return Pe.code===0?Pe.stdout.trim():void 0},setRemoteHostname:async(Pe)=>{let xe=await $e.exec(Y,Ul(Pe));if(xe.code!==0)throw Error(xe.stderr.trim()||`hostname exited ${xe.code}`)}}:{}},Re=await zl(Y.name,t,he),Te=await vs(Re);if(!m.apply){let Pe=[ne?"":"provider record (no provider id or no API token)",fe?"":"local state pin (none points at this server)",Ie?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(m.json){console.log(JSON.stringify({schemaVersion:1,operation:Re.operation,target:Re.target,rename:{from:Y.name,to:t},notCovered:Pe,steps:Te.map((xe)=>({id:xe.step.id,title:xe.step.title,state:xe.state,change:xe.step.change,reason:xe.reason}))},null,2));return}for(let xe of bs(Re,Te))console.log(xe);for(let xe of Pe)console.log(`  not covered: ${xe}`);console.log("  Re-run with --apply to perform it.");return}let Ae=await Ss(Re,Te,{log:(Pe)=>e(Pe),audit:(Pe)=>U.controlPlane.store.appendEvent({projectId:U.controlPlane.project.id,resourceId:Y.resourceId,type:`${Pe.operation}.${Pe.step}.${Pe.state}`,level:Pe.state==="failed"?"error":"info",payload:{target:Pe.target,renameTo:t,...Pe.error?{error:Pe.error}:{}}})});if(m.json)console.log(JSON.stringify({schemaVersion:1,outcome:Ae},null,2));if(!Ae.success){let Pe=Ae.steps.find((xe)=>xe.state==="failed");throw Error(`${Re.operation} stopped at '${Pe?.title}': ${Pe?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!m.json)n(`Renamed ${Y.name} to ${t}.`)})}function Ta(D){D.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,m)=>{try{await gi(async(A)=>{let _=t?[Mi(A,t)]:A.store.list(A.controlPlane.project.id),z=_.flatMap((U)=>Object.entries(U.capabilities).map(([Y,X])=>({server:U.name,provider:U.provider,action:Y,...X})));if(m.json)console.log(JSON.stringify({schemaVersion:1,targets:z},null,2));else c(["Server","Provider","Action","Support","Explanation"],z.map((U)=>[U.server,U.provider,U.action,U.supported?"supported":"unsupported",U.reason??"—"]))})}catch(A){vn(A)}}),D.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,m,A)=>{try{await Ep(t,m,A)}catch(_){vn(_)}}),D.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,m)=>{try{await Tp(t,m)}catch(A){vn(A)}}),D.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,m)=>{try{await xp(t,m)}catch(A){vn(A)}}),D.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await gi(async(m)=>{let A=m.store.list(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],A.map((_)=>[_.name,_.providerId??"—",`${_.provider} / ${_.region??"external"}`,`${_.status} / ${_.trustState}`,_.roles.join(","),`${_.capacity.cpu??0} / ${_.capacity.memoryBytes??0}`,_.heartbeatAt??"never"]))})}catch(m){vn(m)}}),D.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,m)=>{try{await gi(async(A)=>{let _=m.provider;if(!["aws","hetzner","ssh"].includes(_)||!m.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let z=A.service.enroll({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,provider:_,providerId:m.providerId,endpoint:m.endpoint,sshUser:m.user??"deploy",credentialRef:m.credentialRef??"secret://fleet/agent",region:m.region,roles:String(m.roles??"application").split(","),labels:Object.fromEntries(String(m.labels??"").split(",").map((U)=>U.split("=")).filter((U)=>U[0]&&U[1]))});n(`Enrolled ${z.name} as ${z.id}; no remote mutation was performed.`)})}catch(A){vn(A)}}),D.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,m)=>{try{await gi(async(A)=>{let _=Mi(A,t);if(_=await A.service.test(_.id),_.trustState==="rotation_pending"){if(!m.acceptHostKey)throw Error(`Host key changed to ${_.pendingHostKey}; review it first.`);_=A.service.reviewHostKey(_.id,m.acceptHostKey)}let z=await A.service.validate(_.id);if(m.json)console.log(JSON.stringify(z.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(z.validation?.findings??[]).map((U)=>[U.severity,U.code,U.message,U.remediation??"—"]));if(!z.validation?.valid)process.exitCode=1})}catch(A){vn(A)}}),D.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,m)=>{try{await gi(async(A)=>{let _=A.service.bootstrap(Mi(A,t).id,!!m.apply);if(_.preview)c(["Step"],_.steps.map((z)=>[z]));else n(`Bootstrap queued: ${_.operation?.id}`)})}catch(A){vn(A)}}),D.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,m,A)=>{try{await Np(t,m,A)}catch(_){vn(_)}}),D.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,m)=>{try{await gi(async(A)=>n(A.service.drain(Mi(A,t).id,!!m.complete).status))}catch(A){vn(A)}}),D.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await gi(async(m)=>{m.service.uncordon(Mi(m,t).id),n(`Uncordoned ${t}.`)})}catch(m){vn(m)}}),D.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,m)=>{try{await gi(async(A)=>{A.service.archive(Mi(A,t).id,m.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(A){vn(A)}}),D.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await gi(async(m)=>{let A=Mi(m,t);if(A.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let _=Bun.spawn(["ssh","-p",String(A.sshPort),"-o","StrictHostKeyChecking=yes",`${A.sshUser}@${A.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),z=await _.exited;if(z)process.exitCode=z})}catch(m){vn(m)}});for(let[t,m]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])D.command(t,m).action(async(...A)=>Fn(t.split(" ")[0],{target:String(A[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as Wl,mkdirSync as Op,readFileSync as Lp,writeFileSync as jp}from"node:fs";import{join as ql,resolve as Fp}from"node:path";var Na=(D)=>{r(D instanceof Error?D.message:String(D)),process.exitCode=1};async function Bp(){try{return await Ee()}catch{return}}function Mp(D){if(D===void 0)return;let t=Number(D);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${D}'.`);return t}function Gl(D,t,m){let A=D?.ssh?.hosts?.find((_)=>_.host===t);return new fr({hosts:t?[A??{host:t}]:D?.ssh?.hosts,user:m.user,port:Mp(m.port),privateKeyPath:m.key,hostKey:D?.ssh?.hostKey,sudo:D?.ssh?.sudo,profile:m.profile??D?.ssh?.profile,publicIp:D?.ssh?.publicIp,lan:D?.ssh?.lan})}var Hl=1073741824;function Oa(D){D.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,m)=>{try{let A=await Bp(),_=Gl(A,t,m),z=t??_.targetHost(),U=await _.ensureHostKey(z),{facts:Y,findings:X}=await _.preflight(z);if(m.json)console.log(JSON.stringify({schemaVersion:1,host:z,hostKeyFingerprint:U.fingerprint,facts:Y,findings:X},null,2));else{if(i(`Preflight ${z}`),U.pinnedNow)e(`Pinned host key ${U.fingerprint}`);if(e(`${Y.os} on ${Y.arch}, ${Y.cpuCores} cores, ${(Y.memoryBytes/Hl).toFixed(1)} GiB memory, ${(Y.diskFreeBytes/Hl).toFixed(1)} GiB free`),Y.piModel)e(Y.piModel);if(Y.lanIp)e(`LAN address ${Y.lanIp}`);if(console.log(Xr(X)),gr(X))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(gr(X))process.exitCode=1}catch(A){Na(A)}}),D.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let m=await Ee(),A=t.env??"production";if(t.dryRun){let U=mr(m),[Y]=U.hosts;console.log(pr({config:m,environment:A,profile:U.profile,sudoUser:Y.user!=="root"?Y.user:void 0,lan:U.lan}));return}let _=Gl(m,void 0,{});i(`Adopt ${_.targetHost()}`);let z=await _.provisionComputeInfrastructure({config:m,environment:A});n(`${z.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${A}`)}catch(m){Na(m)}}),D.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let m=t.os??"raspberry-pi-os";if(!(m in Ji))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${m}'.`);let A=await Ee(),_=t.env??"production",z=mr(A,{hosts:A.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:m==="raspberry-pi-os"?"raspberry-pi":void 0}),U=t.user??(A.ssh?.hosts?.[0]?.user??"pi"),Y=Kr(t.key??"~/.ssh/id_ed25519.pub");if(!Wl(Y))throw Error(`Public key not found at ${Y}; pass --key <path to a .pub file>.`);let X=Lp(Y,"utf8").trim(),ne;if(t.wifiSsid){let Ie=t.wifiPassphraseEnv??"WIFI_PASSWORD",he=process.env[Ie];if(!he)throw Error(`--wifi-ssid needs the passphrase in $${Ie} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");ne={ssid:t.wifiSsid,passphrase:he,country:t.wifiCountry}}let re=pr({config:A,environment:_,profile:z.profile,sudoUser:U!=="root"?U:void 0,lan:z.lan}),oe=Xi({hostname:t.hostname,user:U,publicKey:X,timezone:t.timezone,locale:t.locale,wifi:ne},re,{os:m}),fe=Fp(t.out);Op(fe,{recursive:!0});let $e=Object.keys(oe.files).filter((Ie)=>Wl(ql(fe,Ie)));if($e.length>0&&!t.force)throw Error(`${$e.join(", ")} already exist in ${fe}; pass --force to overwrite.`);for(let[Ie,he]of Object.entries(oe.files))jp(ql(fe,Ie),he,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(oe.files).join(", ")} to ${fe}`),console.log(oe.instructions)}catch(m){Na(m)}})}async function _p(){let D=await Ee(),t=y(process.cwd(),D),m=new Dn(t.store),A=new Nn(m,new De(t.store));return{controlPlane:t,store:m,service:A}}async function qo(D){let t=await _p();try{await D(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Cs=(D)=>Object.fromEntries(String(D??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Kl=(D)=>Object.fromEntries(Object.entries(Cs(D)).map(([t,m])=>[t,Number(m)]));function La(D){D.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>qo((m)=>{let A=m.store.listPools(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],A.map((_)=>[_.name,_.purpose,_.backend,`${_.region??"any"} / ${_.architecture??"any"}`,_.status,JSON.stringify(_.capacity),String(_.concurrency)]))})),D.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,m)=>qo((A)=>{let{purpose:_,backend:z}=m;if(!["application","build","worker","monitoring","backup"].includes(_)||!["server","ecs","asg"].includes(z))throw Error("Unsupported pool purpose or backend.");let U=A.store.createPool({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,purpose:_,backend:z,region:m.region,architecture:m.arch,labels:Cs(m.labels),requiredServerLabels:Cs(m.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Kl(m.capacity)},maxWorkloads:Number(m.max),costWeight:1,concurrency:Number(m.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${U.name} (${U.id}).`)})),D.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,m)=>qo((A)=>{let _=A.store.listPools(A.controlPlane.project.id).find((U)=>U.id===t||U.name===t),z=new De(A.controlPlane.store).list(A.controlPlane.project.id).find((U)=>U.id===m||U.name===m);if(!_||!z)throw Error("Pool or server was not found.");A.store.addMember(_.id,z.id),n(`Attached ${z.name} to ${_.name}.`)})),D.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>qo((m)=>{let A=m.service.explain(m.controlPlane.project.id,{purpose:t.purpose,resources:Kl(t.resources),region:t.region,architecture:t.arch,labels:Cs(t.labels)});if(t.json)console.log(JSON.stringify(A,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],A.map((_)=>[_.poolName,_.serverId??"provider-managed",_.eligible?"yes":"no",JSON.stringify(_.available),`${_.score.fit.toFixed(2)} / ${_.score.spread} / ${_.score.cost}`,_.reasons.join("; ")||"eligible"]))})),D.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>qo((m)=>{let A=m.store.listPools(m.controlPlane.project.id).find((z)=>z.id===t||z.name===t);if(!A)throw Error("Pool was not found.");let _=m.service.drainPool(A.id);n(`Draining ${A.name}: moved ${_.moved.length}, blocked ${_.blocked.length} stateful placement(s).`)}))}async function zp(){let D=await Ee(),t=y(process.cwd(),D),m=new kn(t.store),A=new xn(m);return{controlPlane:t,store:m,service:A}}async function lo(D){let t=await zp();try{await D(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Go=(D,t)=>{let m=D.store.list(D.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!m)throw Error("Regional topology was not found.");return m},Up=(D)=>D.split(",").map((t,m)=>{let[A,_="aws"]=t.split(":");return{region:String(A),provider:_,role:m===0?"primary":"secondary"}}),Vp=(D)=>{let t=new Set(["s3","dynamodb","secrets"]),m=D.split(",").map((_)=>_.trim()),A=m.find((_)=>!t.has(_));if(A)throw Error(`Unsupported replication kind: ${A}`);return m};function ja(D){D.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>lo((m)=>{let A=m.store.list(m.controlPlane.project.id).map((_)=>({topology:_,targets:m.store.targets(_.id),channels:m.store.channels(_.id),route:m.store.route(_.id),executions:m.store.executions(_.id)}));if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],A.map((_)=>[_.topology.name,_.topology.hostname,_.topology.activeRegion,_.topology.status,_.topology.revision??"—",`${_.channels.filter((z)=>z.status==="in_sync").length}/${_.channels.length} in sync`]))})),D.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,m)=>lo((A)=>{if(!m.hostname||!m.regions)throw Error("--hostname and --regions are required.");let _=A.service.create({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,hostname:m.hostname,regions:Up(m.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Vp(String(m.replicate)),maxLagSeconds:Number(m.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!m.cdn,wafEnabled:!!m.waf});n(`Created ${_.name} (${_.id}); run region:rollout with an immutable manifest.`)})),D.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,m,A)=>lo((_)=>c(["Step"],_.service.plan(Go(_,t).id,m,A.target).map((z)=>[z])))),D.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,m,A)=>lo(async(_)=>{let z=A.manifest?await Bun.file(A.manifest).json():{},U=_.service.enqueue({topologyId:Go(_,t).id,kind:"rollout",revision:m,manifest:z});n(`Regional rollout queued: ${U.operation.id}`)})),D.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,m)=>lo((A)=>{let _=A.service.enqueue({topologyId:Go(A,t).id,kind:"failover",targetRegion:m});n(`Failover queued: ${_.operation.id}`)})),D.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,m)=>lo((A)=>{let _=A.service.enqueue({topologyId:Go(A,t).id,kind:"failback",targetRegion:m});n(`Failback queued: ${_.operation.id}`)})),D.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,m)=>lo((A)=>{let _=A.service.enqueue({topologyId:Go(A,t).id,kind:"destroy",confirmation:m.confirm});n(`Regional teardown queued: ${_.operation.id}; replicated data remains retained.`)}))}var Ho="0.16.35";async function qp(){let D=await Ee(),t=y(process.cwd(),D),m=new _n(t.store),A=new On(m),_=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((z)=>new $n(z,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:m,service:A,cleanup:_}}async function $i(D){let t=await qp();try{await D(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}function Fa(D){D.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>$i((m)=>{let A={manifests:m.store.manifests(m.controlPlane.organization.id),windows:m.store.windows(m.controlPlane.project.id),campaigns:m.store.campaigns(m.controlPlane.project.id),cleanups:m.store.cleanups(m.controlPlane.project.id),drills:m.store.drills(m.controlPlane.project.id)},_=[...A.manifests.map((z)=>["update",z.version,z.compatibility.compatible?"compatible":"blocked",z.compatibility.reasons.join("; ")||z.channel]),...A.campaigns.map((z)=>["upgrade",z.id,z.status,z.currentStage??z.fromVersion]),...A.cleanups.map((z)=>["cleanup",z.kind,z.status,`${z.candidates.length} items / ${z.estimatedBytes} bytes`]),...A.drills.map((z)=>["DR drill",z.scenario,z.status,z.isolatedTarget])];if(t.json)console.log(JSON.stringify(A,null,2));else c(["Area","Name / version","Status","Detail"],_)})),D.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,m)=>$i(async(A)=>{let _=A.store.addTrustedKey({organizationId:A.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(m).text()});n(`Trusted ${_.name}: ${_.fingerprint}`)})),D.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,m,A)=>$i(async(_)=>{let z=await Bun.file(t).json(),U=(await Bun.file(m).text()).trim(),Y=_.store.importManifest({organizationId:_.controlPlane.organization.id,keyId:A,document:z,signature:U,current:{schemaVersion:_.controlPlane.store.health().schemaVersion,currentVersion:Ho,platform:process.platform,architecture:process.arch}});n(`Verified ${Y.version}; ${Y.compatibility.compatible?"compatible":"blocked: "+Y.compatibility.reasons.join("; ")}`)})),D.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,m,A)=>$i((_)=>{let z=_.store.createWindow({projectId:_.controlPlane.project.id,name:t,schedule:m,timezone:A.timezone,durationMinutes:Number(A.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${z.name} (${z.id}).`)})),D.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,m,A)=>$i((_)=>{let z=new De(_.controlPlane.store).list(_.controlPlane.project.id).filter((X)=>X.status==="ready").map((X)=>({serverId:X.id,target:X.name,previousVersion:X.bootstrapVersion??Ho}));if(!z.length)z.push({target:"control-plane",previousVersion:Ho});let U=_.store.createCampaign({projectId:_.controlPlane.project.id,manifestId:t,fromVersion:Ho,strategy:A.strategy==="rolling"?"rolling":"canary",batchSize:Number(A.batch),healthGate:{kind:"platform"},backupId:m,targets:z}),Y=_.service.enqueueCampaign(U.id);n(`Staged upgrade queued: ${Y.operation.id}`)})),D.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,m)=>$i(async(A)=>{let _=await A.service.previewCleanup({projectId:A.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(m.olderThan)}},A.cleanup);c(["ID","Candidate","Bytes"],_.candidates.map((z)=>[z.id,z.label,String(z.bytes)])),e(`Apply with: cloud cleanup:apply ${_.id} --confirm "DELETE ${_.candidates.length} ${_.kind}"`)})),D.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,m)=>$i((A)=>{let _=A.service.enqueueCleanup(t,String(m.confirm??""));n(`Cleanup queued: ${_.operation.id}`)})),D.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,m,A)=>$i((_)=>{let z=_.store.createDrill({projectId:_.controlPlane.project.id,scenario:t,isolatedTarget:m,expectedRpoMinutes:Number(A.rpo),expectedRtoMinutes:Number(A.rto),recoveryPointId:A.recoveryPoint,topologyId:A.topology});n(`Planned isolated drill ${z.id}.`)})),D.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>$i((m)=>{let A=m.service.enqueueDrill(t);n(`DR drill queued: ${A.operation.id}`)}))}async function Ba(){try{return(await Ee()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Ma(D){D.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let m=t?.region||await Ba(),A=new I(m);try{let{Functions:_=[]}=await A.listFunctions({MaxItems:50});if(!_.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],_.map((z)=>[z.FunctionName??"-",z.Runtime??"-",z.MemorySize?`${z.MemorySize} MB`:"-",z.Timeout?`${z.Timeout}s`:"-",z.LastModified??"-"]))}catch(_){r(`Failed to list functions: ${_.message}`),process.exitCode=1}}),D.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,m)=>{i(`Invoking ${t}`);let A=m?.region||await Ba(),_=new I(A),z=new o("Invoking function...");z.start();try{let U=await _.invoke({FunctionName:t,InvocationType:m?.async?"Event":"RequestResponse",Payload:m?.payload||"{}",LogType:m?.async?"None":"Tail"});if(U.FunctionError){if(z.fail(`Function returned an error (${U.FunctionError})`),U.Payload)e(U.Payload);process.exitCode=1;return}if(z.succeed(`Invoked (status ${U.StatusCode})`),U.Payload)e(`
+`)}async function Ip(){let D=await Ee(),t=y(process.cwd(),D),m=new De(t.store),A=new Pn(m,[new it("aws"),new it("hetzner"),new it("ssh")]);return{controlPlane:t,store:m,service:A}}async function gi(D){let t=await Ip();try{return await D(t)}finally{t.controlPlane.store.close()}}var Mi=(D,t)=>{let m=D.store.list(D.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!m)throw Error(`Server ${t} was not found.`);return m},vn=(D)=>{r(D instanceof Error?D.message:String(D)),process.exitCode=1};function Ea(D,t){let m=Number.parseInt(D??"",10);return Number.isFinite(m)&&m>=0?m:t}function Pp(D="3h"){let t=D.match(/^(\d+)(m|h)$/);if(!t)throw Error("--range must use minutes or hours, for example 30m or 3h.");let m=Number(t[1])*(t[2]==="h"?3600000:60000);if(m<300000||m>86400000)throw Error("--range must be between 5 minutes and 24 hours.");return m}function Wo(D,t="%"){return D==null?"unavailable":`${D.toFixed(1)}${t}`}async function xp(D,t){let m=await Ee();if(m.cloud?.provider!=="hetzner")throw Error("server:monitoring currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",_=T(m,A),z=await pe(_);if(!z?.serverId)throw Error(`No pinned Hetzner server was found for ${_}.`);if(![z.serverName,String(z.serverId),z.stackName].includes(D))throw Error(`Refusing to read ${D}: project state is pinned to ${z.serverName}.`);let U=lr(m),Y=new qe({apiToken:dr(U.apiToken,m)}),X=await Y.getServer(z.serverId),ne=z.publicIp??X.public_net.ipv4?.ip;if(!ne)throw Error(`Server ${X.name} has no public IPv4 address.`);let re=new Date,oe=new Date(re.getTime()-Pp(t.range)),fe=Math.min(3600,Math.max(60,Ea(t.step,60))),$e=await _l({client:Y,serverId:X.id,cores:Math.max(1,Number(X.server_type.cores)||1),from:oe,to:re,step:fe,remote:{host:ne,user:z.sshUser??U.sshUser,identityFile:U.sshPrivateKeyPath,connectTimeoutSec:15}});if(t.json){console.log(JSON.stringify({schemaVersion:1,server:X.name,result:$e},null,2));return}c(["Server","Window","CPU average / peak","RAM average / peak","Minimum available","Swap peak"],[[X.name,`${$e.from} to ${$e.to}`,`${Wo($e.summary.cpuAveragePercent)} / ${Wo($e.summary.cpuPeakPercent)}`,`${Wo($e.summary.memoryAveragePercent)} / ${Wo($e.summary.memoryPeakPercent)}`,$e.summary.memoryMinimumAvailableBytes==null?"unavailable":`${($e.summary.memoryMinimumAvailableBytes/1073741824).toFixed(2)} GB`,Wo($e.summary.swapPeakPercent)]])}function Vl(D){let t=D.targetType.prices?.find((m)=>m.location===D.location);return{serverId:D.serverId,serverName:D.serverName,location:D.location,from:D.currentType.name,to:D.targetType.name,capacityAvailable:D.capacityAvailable,alreadyComplete:D.alreadyComplete,upgradeDisk:D.upgradeDisk,target:{cores:D.targetType.cores,memoryGb:D.targetType.memory,diskGb:D.targetType.disk,architecture:D.targetType.architecture,cpuType:D.targetType.cpu_type},price:t?{hourlyNet:t.price_hourly.net,hourlyGross:t.price_hourly.gross,monthlyNet:t.price_monthly.net,monthlyGross:t.price_monthly.gross}:void 0}}function Dp(D){let t=Vl(D);c(["Server","Location","Resize","Capacity","CPU / RAM / disk","Monthly"],[[`${t.serverName} (${t.serverId})`,t.location,`${t.from} -> ${t.to}`,t.capacityAvailable?"available":"waiting",`${t.target.cores??0} / ${t.target.memoryGb??0} GB / ${t.target.diskGb??0} GB`,t.price?.monthlyGross??t.price?.monthlyNet??"not reported"]])}async function Ep(D,t,m){let A=await Ee();if(A.cloud?.provider!=="hetzner")throw Error("server:resize currently requires the Hetzner provider.");let _=m.env??process.env.CLOUD_ENV??"production",z=T(A,_),U=await pe(z),Y=lr(A),X=new qe({apiToken:dr(Y.apiToken,A)}),re=U&&(D===U.serverName||D===String(U.serverId)||D===U.stackName)?await X.getServer(U.serverId):(await X.listServers()).find((Be)=>Be.name===D||String(Be.id)===D);if(!re)throw Error(`Hetzner server ${D} was not found.`);if(U?.serverId&&U.serverId!==re.id)throw Error(`Refusing to resize ${D}: project state is pinned to server ${U.serverId}.`);let oe=dt(t),fe=m.upgradeDisk!==!1,$e=await si(X,re.id,oe,fe);if(m.json)console.log(JSON.stringify({schemaVersion:1,plan:Vl($e)},null,2));else Dp($e);if(!m.apply){if(!m.json)e(`Preview only. Re-run with --apply --confirm ${re.name} to execute.`);return}if(m.confirm!==re.name)throw Error(`Resize requires --confirm ${re.name}.`);let Ie=U?.publicIp??re.public_net.ipv4?.ip;if(!Ie)throw Error(`Server ${re.name} has no public IPv4 address for verification.`);let he={host:Ie,user:U?.sshUser??Y.sshUser,identityFile:Y.sshPrivateKeyPath,connectTimeoutSec:15,sshTimeoutMs:600000,routeTimeoutMs:20000},Re=await io(z),Te=new Date().toISOString(),Ae={schemaVersion:1,operationId:Re?.targetType===oe&&Re.serverId===re.id?Re.operationId:crypto.randomUUID(),stackName:z,serverId:re.id,serverName:re.name,sourceType:$e.currentType.name,targetType:oe,upgradeDisk:fe,phase:"planning",status:"running",attempts:Re?.targetType===oe?Re.attempts:0,startedAt:Re?.targetType===oe?Re.startedAt:Te,updatedAt:Te,manifest:Re?.targetType===oe?Re.manifest:void 0};await pt(Ae);let Pe=Ea(m.pollSeconds,900)*1000,xe=Ea(m.maxWaitMinutes,0)*60000,We=Date.now();for(;;){let Be=await si(X,re.id,oe,fe);if(!Be.capacityAvailable&&!Be.alreadyComplete){if(Ae={...Ae,phase:"waiting-capacity",status:"waiting-capacity",updatedAt:new Date().toISOString()},await pt(Ae),!m.wait){if(!m.json)e(`${oe} has no capacity in ${Be.location}. The server remains running and unchanged. Use --wait to poll safely.`);return}if(xe>0&&Date.now()-We>=xe)throw Error(`Timed out waiting for ${oe} capacity in ${Be.location}.`);if(!m.json)e(`Waiting ${Math.round(Pe/1000)} seconds for ${oe} capacity...`);await Bun.sleep(Pe);continue}let Ue=await so(z);try{let et=await(async()=>{try{return Ae={...Ae,status:"running",attempts:Ae.attempts+1,updatedAt:new Date().toISOString()},await pt(Ae),await Ys({client:X,serverId:re.id,targetType:oe,upgradeDisk:fe,resumeFromOff:Ae.phase==="shutting-down"||Ae.phase==="resizing"||Ae.phase==="powering-on"||Ae.phase==="verifying",manifest:Ae.manifest,hooks:{preflight:async()=>{let Rt=await Zs(he);return Ae={...Ae,manifest:Rt,updatedAt:new Date().toISOString()},await pt(Ae),Rt},afterBoot:async(Rt,Et,wt,Pt)=>eo(he,Et,wt,Pt),onPhase:async(Rt,Et)=>{if(Ae={...Ae,phase:Rt,status:Rt==="waiting-capacity"?"waiting-capacity":Rt==="complete"?"completed":"running",updatedAt:new Date().toISOString()},await pt(Ae),!m.json)e(`${Rt}${Et?` ${JSON.stringify(Et)}`:""}`)}}})}finally{await Ue()}})();if(Ae={...Ae,status:et.status==="completed"||et.status==="already-complete"?"completed":et.status==="recovered"?"recovered":"waiting-capacity",lastError:et.status==="recovered"?et.error:void 0,updatedAt:new Date().toISOString()},await pt(Ae),m.json)console.log(JSON.stringify({schemaVersion:1,result:et},null,2));else if(et.status==="completed"||et.status==="already-complete")n(`${re.name} is on ${oe} and passed full post-boot verification.`);else if(et.status==="recovered"&&et.retryable&&m.wait){e(`Capacity race recovered safely. Waiting ${Math.round(Pe/1000)} seconds before retry.`),await Bun.sleep(Pe);continue}else if(et.status==="recovered")throw Error(`Resize did not complete and the original server was recovered: ${et.error}`);return}catch(et){throw Ae={...Ae,status:"failed",lastError:et instanceof Error?et.message:String(et),updatedAt:new Date().toISOString()},await pt(Ae),et}}}async function Tp(D,t){let m=await Ee();if(m.cloud?.provider!=="hetzner")throw Error("server:optimize currently requires the Hetzner provider.");let A=t.env??process.env.CLOUD_ENV??"production",_=T(m,A),z=await pe(_);if(!z?.serverId)throw Error(`No pinned Hetzner server was found for ${_}.`);if(![z.serverName,String(z.serverId),z.stackName].includes(D))throw Error(`Refusing to optimize ${D}: project state is pinned to ${z.serverName}.`);let U=lr(m),Y=new qe({apiToken:dr(U.apiToken,m)}),X=await Y.getServer(z.serverId),ne=z.publicIp??X.public_net.ipv4?.ip;if(!ne)throw Error(`Server ${X.name} has no public IPv4 address.`);let re=Qi(m);if(t.json)console.log(JSON.stringify({schemaVersion:1,server:X.name,plan:re},null,2));else c(["Server","Firewall ports","Monitoring","Auto updates","Swap","SSH passwords"],[[X.name,re.firewallPorts.join(","),re.monitoring?"on":"off",re.autoUpdates?"on":"off",`${re.swapGb} GB`,"disabled"]]);if(!t.apply){if(!t.json)e(`Preview only. Re-run with --apply --confirm ${X.name} to execute.`);return}if(t.confirm!==X.name)throw Error(`Optimization requires --confirm ${X.name}.`);let oe={host:ne,user:z.sshUser??U.sshUser,identityFile:U.sshPrivateKeyPath,connectTimeoutSec:15},fe=await Qr(oe),$e=fe.routeProbes.filter((wt)=>!wt.ok),Ie=m.infrastructure?.compute,he=Z(Ie)?new Set(["nginx.service","bun-gateway.service","ts-cloud-nginx.service"]):new Set,Re=fe.failedUnits.filter((wt)=>!he.has(wt));if(Re.length>0)throw Error(`Preflight found failed services: ${Re.join(", ")}`);if($e.length>0)throw Error(`Preflight found unhealthy routes: ${$e.map((wt)=>wt.domain).join(", ")}`);let Te=Z(Ie)?[]:Object.values(m.sites??{}).flatMap((wt)=>typeof wt?.port==="number"&&![80,443].includes(wt.port)?[wt.port]:[]),Ae=Jr({allowSsh:Ie?.allowSsh!==!1,sitePorts:Te,allowedPorts:Ie?.firewall?.allowedPorts}),Pe=(z.firewallId?(await Y.listFirewalls()).find((wt)=>wt.id===z.firewallId):void 0)??(await Y.listFirewalls()).find((wt)=>wt.name===`${m.project.slug}-${A}-app-fw`);if(!Pe)throw Error(`Managed firewall for ${X.name} was not found.`);let xe=await Y.setFirewallRules(Pe.id,Ae);await Promise.all(xe.map((wt)=>Y.waitForAction(wt.id))),await to(m,oe);let[We,Be]=await Promise.all([Qr(oe),ro(oe)]),Ue=no(re,Be),et=cc(fe,We),Rt=We.routeProbes.filter((wt)=>!wt.ok);if(et.stoppedServices.length>0)Ue.push(`services stopped: ${et.stoppedServices.join(", ")}`);if(et.changedRouteFragments.length>0)Ue.push(`route fragments changed: ${et.changedRouteFragments.join(", ")}`);if(et.missingRouteIds.length>0)Ue.push(`routes disappeared: ${et.missingRouteIds.join(", ")}`);if(et.changedReleaseLinks.length>0)Ue.push(`release links changed: ${et.changedReleaseLinks.join(", ")}`);if(et.missingData.length>0)Ue.push(`databases or volumes disappeared: ${et.missingData.join(", ")}`);if(Rt.length>0)Ue.push(`unhealthy routes: ${Rt.map((wt)=>wt.domain).join(", ")}`);if(Ue.length>0)throw Error(`Host optimization verification failed: ${Ue.join("; ")}`);let Et={serverId:X.id,serverName:X.name,services:We.runningServices.length,routes:We.routeIds.length,healthyDomains:We.routeProbes.length,releaseLinks:We.releaseLinks.length,databasesAndVolumes:We.dataCatalog.length,report:Be};if(t.json)console.log(JSON.stringify({schemaVersion:1,result:Et},null,2));else n(`${X.name} passed full host, rpx route, service, release, and data verification.`)}async function Np(D,t,m){let A=await Ee(),_=m.env??"production",z=T(A,_);await gi(async(U)=>{let Y=Mi(U,D),X=U.store.list(U.controlPlane.project.id,!0),ne=Y.provider==="hetzner"&&Y.providerId?(()=>{try{let Pe=lr(A);return new qe({apiToken:dr(Pe.apiToken,A)})}catch{return null}})():null,re=Y.providerId?Number(Y.providerId):Number.NaN,oe=await pe(z),fe=oe!=null&&oe.serverId===re,$e=new Mr,Ie=Y.trustState==="pinned",he={takenNames:async()=>{let Pe=X.map((xe)=>xe.name);if(ne)Pe.push(...(await ne.listServers()).map((xe)=>xe.name));return Pe},inventoryName:()=>U.store.get(Y.id)?.name??Y.name,renameInventory:(Pe)=>{U.store.update(Y.id,{name:Pe})},...ne&&Number.isFinite(re)?{providerName:async()=>(await ne.getServer(re)).name,renameProvider:async(Pe)=>{await ne.renameServer(re,Pe)}}:{},...fe?{stateName:async()=>(await pe(z))?.serverName,writeStateName:async(Pe)=>{let xe=await pe(z);if(xe)await ut(z,{...xe,serverName:Pe})}}:{},...Ie?{remoteHostname:async()=>{let Pe=await $e.exec(Y,"hostname");return Pe.code===0?Pe.stdout.trim():void 0},setRemoteHostname:async(Pe)=>{let xe=await $e.exec(Y,Ul(Pe));if(xe.code!==0)throw Error(xe.stderr.trim()||`hostname exited ${xe.code}`)}}:{}},Re=await zl(Y.name,t,he),Te=await vs(Re);if(!m.apply){let Pe=[ne?"":"provider record (no provider id or no API token)",fe?"":"local state pin (none points at this server)",Ie?"":"box hostname (host key is not pinned — run server:validate first)"].filter(Boolean);if(m.json){console.log(JSON.stringify({schemaVersion:1,operation:Re.operation,target:Re.target,rename:{from:Y.name,to:t},notCovered:Pe,steps:Te.map((xe)=>({id:xe.step.id,title:xe.step.title,state:xe.state,change:xe.step.change,reason:xe.reason}))},null,2));return}for(let xe of bs(Re,Te))console.log(xe);for(let xe of Pe)console.log(`  not covered: ${xe}`);console.log("  Re-run with --apply to perform it.");return}let Ae=await Ss(Re,Te,{log:(Pe)=>e(Pe),audit:(Pe)=>U.controlPlane.store.appendEvent({projectId:U.controlPlane.project.id,resourceId:Y.resourceId,type:`${Pe.operation}.${Pe.step}.${Pe.state}`,level:Pe.state==="failed"?"error":"info",payload:{target:Pe.target,renameTo:t,...Pe.error?{error:Pe.error}:{}}})});if(m.json)console.log(JSON.stringify({schemaVersion:1,outcome:Ae},null,2));if(!Ae.success){let Pe=Ae.steps.find((xe)=>xe.state==="failed");throw Error(`${Re.operation} stopped at '${Pe?.title}': ${Pe?.error}. Earlier steps stayed applied; re-run the same command to continue from here.`)}if(!m.json)n(`Renamed ${Y.name} to ${t}.`)})}function Ta(D){D.command("capabilities [server]","Show provider and target operation support").option("--json","Print structured JSON").action(async(t,m)=>{try{await gi(async(A)=>{let _=t?[Mi(A,t)]:A.store.list(A.controlPlane.project.id),z=_.flatMap((U)=>Object.entries(U.capabilities).map(([Y,X])=>({server:U.name,provider:U.provider,action:Y,...X})));if(m.json)console.log(JSON.stringify({schemaVersion:1,targets:z},null,2));else c(["Server","Provider","Action","Support","Explanation"],z.map((U)=>[U.server,U.provider,U.action,U.supported?"supported":"unsupported",U.reason??"—"]))})}catch(A){vn(A)}}),D.command("server:resize <name> <type>","Safely resize Hetzner compute with full host verification").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Execute the reviewed resize plan").option("--confirm <name>","Exact server name required for mutation").option("--upgrade-disk","Permanently expand the root disk to the target size",{default:!0}).option("--wait","Poll capacity without taking the server offline until placement is available").option("--poll-seconds <seconds>","Capacity retry interval",{default:"900"}).option("--max-wait-minutes <minutes>","Stop waiting after this many minutes; 0 waits indefinitely",{default:"0"}).option("--json","Print structured JSON").action(async(t,m,A)=>{try{await Ep(t,m,A)}catch(_){vn(_)}}),D.command("server:optimize <name>","Reconcile and verify a production Hetzner host").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Apply the reviewed host optimization plan").option("--confirm <name>","Exact server name required for mutation").option("--json","Print structured JSON").action(async(t,m)=>{try{await Tp(t,m)}catch(A){vn(A)}}),D.command("server:monitoring <name>","Read historical Hetzner CPU, RAM, swap, disk, and network metrics").option("--env <environment>","Deployment environment",{default:"production"}).option("--range <duration>","Historical window from 5m to 24h",{default:"3h"}).option("--step <seconds>","Hetzner provider sample interval",{default:"60"}).option("--json","Print structured JSON").action(async(t,m)=>{try{await xp(t,m)}catch(A){vn(A)}}),D.command("server:list","List fleet servers").option("--json","Print structured JSON").action(async(t)=>{try{await gi(async(m)=>{let A=m.store.list(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Provider ID","Provider / region","Status / trust","Roles","CPU / memory","Heartbeat"],A.map((_)=>[_.name,_.providerId??"—",`${_.provider} / ${_.region??"external"}`,`${_.status} / ${_.trustState}`,_.roles.join(","),`${_.capacity.cpu??0} / ${_.capacity.memoryBytes??0}`,_.heartbeatAt??"never"]))})}catch(m){vn(m)}}),D.command("server:create <name>","Enroll a provisioned or existing server").option("--provider <provider>","aws, hetzner, or ssh",{default:"ssh"}).option("--provider-id <id>","Stable provider identity").option("--endpoint <host>","SSH hostname or IP").option("--user <user>","Non-root SSH user",{default:"deploy"}).option("--credential-ref <ref>","Secret reference",{default:"secret://fleet/agent"}).option("--region <region>","Provider region").option("--roles <roles>","Comma-separated roles",{default:"application"}).option("--labels <labels>","Comma-separated key=value labels").action(async(t,m)=>{try{await gi(async(A)=>{let _=m.provider;if(!["aws","hetzner","ssh"].includes(_)||!m.endpoint)throw Error("A supported --provider and --endpoint are required; provisioning and enrollment are separate operations.");let z=A.service.enroll({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,provider:_,providerId:m.providerId,endpoint:m.endpoint,sshUser:m.user??"deploy",credentialRef:m.credentialRef??"secret://fleet/agent",region:m.region,roles:String(m.roles??"application").split(","),labels:Object.fromEntries(String(m.labels??"").split(",").map((U)=>U.split("=")).filter((U)=>U[0]&&U[1]))});n(`Enrolled ${z.name} as ${z.id}; no remote mutation was performed.`)})}catch(A){vn(A)}}),D.command("server:validate <name>","Pin trust and validate a server").option("--accept-host-key <fingerprint>","Accept reviewed rotation").option("--json","Print JSON").action(async(t,m)=>{try{await gi(async(A)=>{let _=Mi(A,t);if(_=await A.service.test(_.id),_.trustState==="rotation_pending"){if(!m.acceptHostKey)throw Error(`Host key changed to ${_.pendingHostKey}; review it first.`);_=A.service.reviewHostKey(_.id,m.acceptHostKey)}let z=await A.service.validate(_.id);if(m.json)console.log(JSON.stringify(z.validation,null,2));else c(["Severity","Code","Finding","Remediation"],(z.validation?.findings??[]).map((U)=>[U.severity,U.code,U.message,U.remediation??"—"]));if(!z.validation?.valid)process.exitCode=1})}catch(A){vn(A)}}),D.command("server:bootstrap <name>","Preview or queue bootstrap").option("--apply","Apply reviewed plan").action(async(t,m)=>{try{await gi(async(A)=>{let _=A.service.bootstrap(Mi(A,t).id,!!m.apply);if(_.preview)c(["Step"],_.steps.map((z)=>[z]));else n(`Bootstrap queued: ${_.operation?.id}`)})}catch(A){vn(A)}}),D.command("server:rename <name> <new-name>","Rename a server in place, without recreating it").option("--env <environment>","Deployment environment",{default:"production"}).option("--apply","Perform the reviewed rename plan").option("--json","Print structured JSON").action(async(t,m,A)=>{try{await Np(t,m,A)}catch(_){vn(_)}}),D.command("server:drain <name>","Drain without terminating").option("--complete","Mark movement complete").action(async(t,m)=>{try{await gi(async(A)=>n(A.service.drain(Mi(A,t).id,!!m.complete).status))}catch(A){vn(A)}}),D.command("server:uncordon <name>","Return a server to scheduling").action(async(t)=>{try{await gi(async(m)=>{m.service.uncordon(Mi(m,t).id),n(`Uncordoned ${t}.`)})}catch(m){vn(m)}}),D.command("server:archive <name>","Archive inventory without termination").option("--confirm <name>","Exact name").action(async(t,m)=>{try{await gi(async(A)=>{A.service.archive(Mi(A,t).id,m.confirm??""),n(`Archived ${t}; provider infrastructure was not terminated.`)})}catch(A){vn(A)}}),D.command("server:ssh <name>","Open strict SSH using the enrolled endpoint").action(async(t)=>{try{await gi(async(m)=>{let A=Mi(m,t);if(A.trustState!=="pinned")throw Error("Validate and pin the server host key first.");let _=Bun.spawn(["ssh","-p",String(A.sshPort),"-o","StrictHostKeyChecking=yes",`${A.sshUser}@${A.endpoint}`],{stdin:"inherit",stdout:"inherit",stderr:"inherit"}),z=await _.exited;if(z)process.exitCode=z})}catch(m){vn(m)}});for(let[t,m]of[["server:logs <name>","Use the runtime log service"],["server:deploy <name>","Use immutable release deployment"],["server:reboot <name>","Reboot provider compute"],["server:destroy <name>","Terminate provider compute"],["server:recipe <name> <recipe>","Apply a server recipe"],["server:firewall:add <name> <rule>","Add firewall rule"],["server:firewall:list <name>","List firewall rules"],["server:firewall:remove <name> <rule>","Remove firewall rule"],["server:ssl:install <domain>","Install TLS"],["server:ssl:renew <domain>","Renew TLS"],["server:snapshot <name>","Create provider snapshot"],["server:snapshot:restore <name> <snapshot-id>","Restore provider snapshot"],["server:update <name>","Update OS packages"],["server:secure <name>","Apply OS hardening"]])D.command(t,m).action(async(...A)=>Fn(t.split(" ")[0],{target:String(A[0]??""),nextAction:"Use the dashboard capability view or the corresponding runtime, release, firewall, backup, or maintenance service."}))}import{existsSync as Wl,mkdirSync as Op,readFileSync as Lp,writeFileSync as jp}from"node:fs";import{join as ql,resolve as Fp}from"node:path";var Na=(D)=>{r(D instanceof Error?D.message:String(D)),process.exitCode=1};async function Bp(){try{return await Ee()}catch{return}}function Mp(D){if(D===void 0)return;let t=Number(D);if(!Number.isInteger(t)||t<1||t>65535)throw Error(`--port must be a port number, not '${D}'.`);return t}function Gl(D,t,m){let A=D?.ssh?.hosts?.find((_)=>_.host===t);return new fr({hosts:t?[A??{host:t}]:D?.ssh?.hosts,user:m.user,port:Mp(m.port),privateKeyPath:m.key,hostKey:D?.ssh?.hostKey,sudo:D?.ssh?.sudo,profile:m.profile??D?.ssh?.profile,publicIp:D?.ssh?.publicIp,lan:D?.ssh?.lan})}var Hl=1073741824;function Oa(D){D.command("ssh:preflight [host]","Check a bring-your-own Linux host before adopting it").option("--user <user>","SSH user (default: ssh.hosts[].user, then root)").option("--port <port>","SSH port (default: ssh.hosts[].port, then 22)").option("--key <path>","SSH private key (default: ssh.hosts[].privateKeyPath, then ~/.ssh/id_ed25519)").option("--profile <profile>","raspberry-pi or generic (default: ssh.profile, then generic)").option("--json","Print the facts and findings as JSON").action(async(t,m)=>{try{let A=await Bp(),_=Gl(A,t,m),z=t??_.targetHost(),U=await _.ensureHostKey(z),{facts:Y,findings:X}=await _.preflight(z);if(m.json)console.log(JSON.stringify({schemaVersion:1,host:z,hostKeyFingerprint:U.fingerprint,facts:Y,findings:X},null,2));else{if(i(`Preflight ${z}`),U.pinnedNow)e(`Pinned host key ${U.fingerprint}`);if(e(`${Y.os} on ${Y.arch}, ${Y.cpuCores} cores, ${(Y.memoryBytes/Hl).toFixed(1)} GiB memory, ${(Y.diskFreeBytes/Hl).toFixed(1)} GiB free`),Y.piModel)e(Y.piModel);if(Y.lanIp)e(`LAN address ${Y.lanIp}`);if(console.log(Xr(X)),gr(X))r("The host is not ready; fix the errors above and run the preflight again.");else n("The host is ready to adopt.")}if(gr(X))process.exitCode=1}catch(A){Na(A)}}),D.command("ssh:bootstrap","Adopt the configured host: pin its key, run the preflight, then bootstrap it").option("--env <environment>","Deployment environment",{default:"production"}).option("--dry-run","Print the bootstrap script instead of running it").action(async(t)=>{try{let m=await Ee(),A=t.env??"production";if(t.dryRun){let U=mr(m),[Y]=U.hosts;console.log(pr({config:m,environment:A,profile:U.profile,sudoUser:Y.user!=="root"?Y.user:void 0,lan:U.lan}));return}let _=Gl(m,void 0,{});i(`Adopt ${_.targetHost()}`);let z=await _.provisionComputeInfrastructure({config:m,environment:A});n(`${z.appPublicIp} is bootstrapped; deploy with: cloud deploy --env ${A}`)}catch(m){Na(m)}}),D.command("ssh:first-boot","Write cloud-init first-boot files for a freshly flashed Raspberry Pi OS or Ubuntu image").option("--os <os>","raspberry-pi-os or ubuntu",{default:"raspberry-pi-os"}).option("--out <dir>","Directory to write user-data, network-config and meta-data into (never a mounted card; copy them yourself)").option("--hostname <name>","Hostname of the new host").option("--user <user>","Deploy user created on first boot (default: ssh.hosts[].user, then pi)").option("--key <path>","Public key authorized for the user",{default:"~/.ssh/id_ed25519.pub"}).option("--wifi-ssid <ssid>","Join this Wi-Fi network on first boot").option("--wifi-passphrase-env <name>","Environment variable holding the Wi-Fi passphrase",{default:"WIFI_PASSWORD"}).option("--wifi-country <cc>","Wi-Fi regulatory domain, e.g. DE").option("--timezone <tz>","IANA timezone, e.g. Europe/Berlin").option("--locale <locale>","System locale, e.g. en_US.UTF-8").option("--env <environment>","Deployment environment the embedded bootstrap is built for",{default:"production"}).option("--force","Overwrite files already in --out").action(async(t)=>{try{if(!t.out)throw Error("--out <dir> is required.");if(!t.hostname)throw Error("--hostname <name> is required.");let m=t.os??"raspberry-pi-os";if(!(m in Ji))throw Error(`--os must be raspberry-pi-os or ubuntu, not '${m}'.`);let A=await Ee(),_=t.env??"production",z=mr(A,{hosts:A.ssh?.hosts?.length?void 0:[{host:t.hostname}],profile:m==="raspberry-pi-os"?"raspberry-pi":void 0}),U=t.user??(A.ssh?.hosts?.[0]?.user??"pi"),Y=Kr(t.key??"~/.ssh/id_ed25519.pub");if(!Wl(Y))throw Error(`Public key not found at ${Y}; pass --key <path to a .pub file>.`);let X=Lp(Y,"utf8").trim(),ne;if(t.wifiSsid){let Ie=t.wifiPassphraseEnv??"WIFI_PASSWORD",he=process.env[Ie];if(!he)throw Error(`--wifi-ssid needs the passphrase in $${Ie} (set it in the environment, not on the command line).`);if(!t.wifiCountry)throw Error("--wifi-country <cc> is required with --wifi-ssid.");ne={ssid:t.wifiSsid,passphrase:he,country:t.wifiCountry}}let re=pr({config:A,environment:_,profile:z.profile,sudoUser:U!=="root"?U:void 0,lan:z.lan}),oe=Xi({hostname:t.hostname,user:U,publicKey:X,timezone:t.timezone,locale:t.locale,wifi:ne},re,{os:m}),fe=Fp(t.out);Op(fe,{recursive:!0});let $e=Object.keys(oe.files).filter((Ie)=>Wl(ql(fe,Ie)));if($e.length>0&&!t.force)throw Error(`${$e.join(", ")} already exist in ${fe}; pass --force to overwrite.`);for(let[Ie,he]of Object.entries(oe.files))jp(ql(fe,Ie),he,{mode:384});i(`First boot for ${t.hostname}`),n(`Wrote ${Object.keys(oe.files).join(", ")} to ${fe}`),console.log(oe.instructions)}catch(m){Na(m)}})}async function _p(){let D=await Ee(),t=y(process.cwd(),D),m=new Dn(t.store),A=new Nn(m,new De(t.store));return{controlPlane:t,store:m,service:A}}async function qo(D){let t=await _p();try{await D(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Cs=(D)=>Object.fromEntries(String(D??"").split(",").map((t)=>t.split("=")).filter((t)=>t[0]&&t[1])),Kl=(D)=>Object.fromEntries(Object.entries(Cs(D)).map(([t,m])=>[t,Number(m)]));function La(D){D.command("pool:list","List capacity pools and reservations").option("--json","Print structured JSON").action(async(t)=>qo((m)=>{let A=m.store.listPools(m.controlPlane.project.id);if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Purpose","Backend","Region / arch","Status","Capacity","Concurrency"],A.map((_)=>[_.name,_.purpose,_.backend,`${_.region??"any"} / ${_.architecture??"any"}`,_.status,JSON.stringify(_.capacity),String(_.concurrency)]))})),D.command("pool:create <name>","Create a capacity pool").option("--purpose <purpose>","application, build, worker, monitoring, or backup",{default:"application"}).option("--backend <backend>","server, ecs, or asg",{default:"server"}).option("--capacity <values>","cpu=4,memoryBytes=8589934592,diskBytes=...").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Pool key=value labels").option("--selector <labels>","Required server labels").option("--max <count>","Maximum workloads",{default:"10"}).option("--concurrency <count>","Build concurrency",{default:"1"}).action(async(t,m)=>qo((A)=>{let{purpose:_,backend:z}=m;if(!["application","build","worker","monitoring","backup"].includes(_)||!["server","ecs","asg"].includes(z))throw Error("Unsupported pool purpose or backend.");let U=A.store.createPool({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,purpose:_,backend:z,region:m.region,architecture:m.arch,labels:Cs(m.labels),requiredServerLabels:Cs(m.selector),toleratedTaints:[],capacity:{cpu:0,memoryBytes:0,diskBytes:0,gpu:0,...Kl(m.capacity)},maxWorkloads:Number(m.max),costWeight:1,concurrency:Number(m.concurrency),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"});n(`Created ${U.name} (${U.id}).`)})),D.command("pool:add-server <pool> <server>","Attach an enrolled server to a pool").action(async(t,m)=>qo((A)=>{let _=A.store.listPools(A.controlPlane.project.id).find((U)=>U.id===t||U.name===t),z=new De(A.controlPlane.store).list(A.controlPlane.project.id).find((U)=>U.id===m||U.name===m);if(!_||!z)throw Error("Pool or server was not found.");A.store.addMember(_.id,z.id),n(`Attached ${z.name} to ${_.name}.`)})),D.command("placement:explain","Explain eligible and rejected placement targets").option("--purpose <purpose>","Workload purpose",{default:"application"}).option("--resources <values>","Requested resources").option("--region <region>","Required region").option("--arch <architecture>","Required architecture").option("--labels <labels>","Required pool labels").option("--json","Print structured JSON").action(async(t)=>qo((m)=>{let A=m.service.explain(m.controlPlane.project.id,{purpose:t.purpose,resources:Kl(t.resources),region:t.region,architecture:t.arch,labels:Cs(t.labels)});if(t.json)console.log(JSON.stringify(A,null,2));else c(["Pool","Server","Eligible","Available","Fit / spread / cost","Reasons"],A.map((_)=>[_.poolName,_.serverId??"provider-managed",_.eligible?"yes":"no",JSON.stringify(_.available),`${_.score.fit.toFixed(2)} / ${_.score.spread} / ${_.score.cost}`,_.reasons.join("; ")||"eligible"]))})),D.command("pool:drain <pool>","Move stateless placements and block stateful placements").action(async(t)=>qo((m)=>{let A=m.store.listPools(m.controlPlane.project.id).find((z)=>z.id===t||z.name===t);if(!A)throw Error("Pool was not found.");let _=m.service.drainPool(A.id);n(`Draining ${A.name}: moved ${_.moved.length}, blocked ${_.blocked.length} stateful placement(s).`)}))}async function zp(){let D=await Ee(),t=y(process.cwd(),D),m=new kn(t.store),A=new xn(m);return{controlPlane:t,store:m,service:A}}async function lo(D){let t=await zp();try{await D(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}var Go=(D,t)=>{let m=D.store.list(D.controlPlane.project.id).find((A)=>A.id===t||A.name===t);if(!m)throw Error("Regional topology was not found.");return m},Up=(D)=>D.split(",").map((t,m)=>{let[A,_="aws"]=t.split(":");return{region:String(A),provider:_,role:m===0?"primary":"secondary"}}),Vp=(D)=>{let t=new Set(["s3","dynamodb","secrets"]),m=D.split(",").map((_)=>_.trim()),A=m.find((_)=>!t.has(_));if(A)throw Error(`Unsupported replication kind: ${A}`);return m};function ja(D){D.command("region:list","List regional topology, traffic, and replication health").option("--json","Print structured JSON").action(async(t)=>lo((m)=>{let A=m.store.list(m.controlPlane.project.id).map((_)=>({topology:_,targets:m.store.targets(_.id),channels:m.store.channels(_.id),route:m.store.route(_.id),executions:m.store.executions(_.id)}));if(t.json)console.log(JSON.stringify(A,null,2));else c(["Name","Hostname","Active","Status","Revision","Replication"],A.map((_)=>[_.topology.name,_.topology.hostname,_.topology.activeRegion,_.topology.status,_.topology.revision??"—",`${_.channels.filter((z)=>z.status==="in_sync").length}/${_.channels.length} in sync`]))})),D.command("region:create <name>","Create a persistent multi-region topology").option("--hostname <hostname>","Traffic hostname").option("--regions <regions>","Comma-separated region[:provider], primary first").option("--replicate <kinds>","s3,dynamodb,secrets",{default:"s3,dynamodb,secrets"}).option("--max-lag <seconds>","Maximum failover lag",{default:"30"}).option("--cdn","Enable CloudFront edge state").option("--waf","Enable WAF edge state").action(async(t,m)=>lo((A)=>{if(!m.hostname||!m.regions)throw Error("--hostname and --regions are required.");let _=A.service.create({organizationId:A.controlPlane.organization.id,projectId:A.controlPlane.project.id,name:t,hostname:m.hostname,regions:Up(m.regions),trafficPolicy:"active_passive",dataPolicy:{replicate:Vp(String(m.replicate)),maxLagSeconds:Number(m.maxLag),retainOnDestroy:!0},dnsProvider:"route53",cdnEnabled:!!m.cdn,wafEnabled:!!m.waf});n(`Created ${_.name} (${_.id}); run region:rollout with an immutable manifest.`)})),D.command("region:plan <name> <operation>","Preview exact regional execution steps").option("--target <region>","Failover or failback region").action(async(t,m,A)=>lo((_)=>c(["Step"],_.service.plan(Go(_,t).id,m,A.target).map((z)=>[z])))),D.command("region:rollout <name> <revision>","Queue secondary-first regional stack rollout").option("--manifest <file>","Regional stack manifest JSON").action(async(t,m,A)=>lo(async(_)=>{let z=A.manifest?await Bun.file(A.manifest).json():{},U=_.service.enqueue({topologyId:Go(_,t).id,kind:"rollout",revision:m,manifest:z});n(`Regional rollout queued: ${U.operation.id}`)})),D.command("region:failover <name> <region>","Queue health and RPO-gated failover").action(async(t,m)=>lo((A)=>{let _=A.service.enqueue({topologyId:Go(A,t).id,kind:"failover",targetRegion:m});n(`Failover queued: ${_.operation.id}`)})),D.command("region:failback <name> <region>","Queue health and RPO-gated failback").action(async(t,m)=>lo((A)=>{let _=A.service.enqueue({topologyId:Go(A,t).id,kind:"failback",targetRegion:m});n(`Failback queued: ${_.operation.id}`)})),D.command("region:destroy <name>","Drain traffic and delete regional stacks while retaining data").option("--confirm <name>","Exact topology name").action(async(t,m)=>lo((A)=>{let _=A.service.enqueue({topologyId:Go(A,t).id,kind:"destroy",confirmation:m.confirm});n(`Regional teardown queued: ${_.operation.id}; replicated data remains retained.`)}))}var Ho="0.16.36";async function qp(){let D=await Ee(),t=y(process.cwd(),D),m=new _n(t.store),A=new On(m),_=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((z)=>new $n(z,t.store,t.project.id,t.organization.id));return{controlPlane:t,store:m,service:A,cleanup:_}}async function $i(D){let t=await qp();try{await D(t)}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}finally{t.controlPlane.store.close()}}function Fa(D){D.command("maintenance:list","List updates, campaigns, cleanup plans, and DR drills").option("--json","Print structured JSON").action(async(t)=>$i((m)=>{let A={manifests:m.store.manifests(m.controlPlane.organization.id),windows:m.store.windows(m.controlPlane.project.id),campaigns:m.store.campaigns(m.controlPlane.project.id),cleanups:m.store.cleanups(m.controlPlane.project.id),drills:m.store.drills(m.controlPlane.project.id)},_=[...A.manifests.map((z)=>["update",z.version,z.compatibility.compatible?"compatible":"blocked",z.compatibility.reasons.join("; ")||z.channel]),...A.campaigns.map((z)=>["upgrade",z.id,z.status,z.currentStage??z.fromVersion]),...A.cleanups.map((z)=>["cleanup",z.kind,z.status,`${z.candidates.length} items / ${z.estimatedBytes} bytes`]),...A.drills.map((z)=>["DR drill",z.scenario,z.status,z.isolatedTarget])];if(t.json)console.log(JSON.stringify(A,null,2));else c(["Area","Name / version","Status","Detail"],_)})),D.command("maintenance:key:add <name> <pem>","Trust an Ed25519 update signing key").action(async(t,m)=>$i(async(A)=>{let _=A.store.addTrustedKey({organizationId:A.controlPlane.organization.id,name:t,publicKeyPem:await Bun.file(m).text()});n(`Trusted ${_.name}: ${_.fingerprint}`)})),D.command("maintenance:manifest <document> <signature> <key>","Verify and import a signed update manifest").action(async(t,m,A)=>$i(async(_)=>{let z=await Bun.file(t).json(),U=(await Bun.file(m).text()).trim(),Y=_.store.importManifest({organizationId:_.controlPlane.organization.id,keyId:A,document:z,signature:U,current:{schemaVersion:_.controlPlane.store.health().schemaVersion,currentVersion:Ho,platform:process.platform,architecture:process.arch}});n(`Verified ${Y.version}; ${Y.compatibility.compatible?"compatible":"blocked: "+Y.compatibility.reasons.join("; ")}`)})),D.command("maintenance:window <name> <schedule>","Create an approved maintenance window").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--minutes <minutes>","Duration",{default:"60"}).action(async(t,m,A)=>$i((_)=>{let z=_.store.createWindow({projectId:_.controlPlane.project.id,name:t,schedule:m,timezone:A.timezone,durationMinutes:Number(A.minutes),allowedOperations:["platform.upgrade"],requireApproval:!0});n(`Created ${z.name} (${z.id}).`)})),D.command("platform:upgrade <manifest> <backup>","Plan and queue a signed staged platform update").option("--strategy <strategy>","canary or rolling",{default:"canary"}).option("--batch <count>","Rolling batch size",{default:"1"}).action(async(t,m,A)=>$i((_)=>{let z=new De(_.controlPlane.store).list(_.controlPlane.project.id).filter((X)=>X.status==="ready").map((X)=>({serverId:X.id,target:X.name,previousVersion:X.bootstrapVersion??Ho}));if(!z.length)z.push({target:"control-plane",previousVersion:Ho});let U=_.store.createCampaign({projectId:_.controlPlane.project.id,manifestId:t,fromVersion:Ho,strategy:A.strategy==="rolling"?"rolling":"canary",batchSize:Number(A.batch),healthGate:{kind:"platform"},backupId:m,targets:z}),Y=_.service.enqueueCampaign(U.id);n(`Staged upgrade queued: ${Y.operation.id}`)})),D.command("cleanup:preview <kind>","Discover a bounded cleanup candidate set without deleting").option("--older-than <days>","Minimum age",{default:"30"}).action(async(t,m)=>$i(async(A)=>{let _=await A.service.previewCleanup({projectId:A.controlPlane.project.id,kind:t,criteria:{olderThanDays:Number(m.olderThan)}},A.cleanup);c(["ID","Candidate","Bytes"],_.candidates.map((z)=>[z.id,z.label,String(z.bytes)])),e(`Apply with: cloud cleanup:apply ${_.id} --confirm "DELETE ${_.candidates.length} ${_.kind}"`)})),D.command("cleanup:apply <plan>","Apply an unchanged cleanup preview").option("--confirm <text>","Exact preview confirmation").action(async(t,m)=>$i((A)=>{let _=A.service.enqueueCleanup(t,String(m.confirm??""));n(`Cleanup queued: ${_.operation.id}`)})),D.command("dr:plan <scenario> <target>","Plan an isolated disaster-recovery drill").option("--rpo <minutes>","RPO objective",{default:"60"}).option("--rto <minutes>","RTO objective",{default:"30"}).option("--recovery-point <id>","Recovery point").option("--topology <id>","Regional topology").action(async(t,m,A)=>$i((_)=>{let z=_.store.createDrill({projectId:_.controlPlane.project.id,scenario:t,isolatedTarget:m,expectedRpoMinutes:Number(A.rpo),expectedRtoMinutes:Number(A.rto),recoveryPointId:A.recoveryPoint,topologyId:A.topology});n(`Planned isolated drill ${z.id}.`)})),D.command("dr:run <drill>","Queue an isolated disaster-recovery drill").action(async(t)=>$i((m)=>{let A=m.service.enqueueDrill(t);n(`DR drill queued: ${A.operation.id}`)}))}async function Ba(){try{return(await Ee()).project.region||process.env.AWS_REGION||"us-east-1"}catch{return process.env.AWS_REGION||"us-east-1"}}function Ma(D){D.command("function:list","List all Lambda functions").option("--region <region>","AWS region").action(async(t)=>{i("Lambda Functions");let m=t?.region||await Ba(),A=new I(m);try{let{Functions:_=[]}=await A.listFunctions({MaxItems:50});if(!_.length){e("No functions found");return}c(["Name","Runtime","Memory","Timeout","Last Modified"],_.map((z)=>[z.FunctionName??"-",z.Runtime??"-",z.MemorySize?`${z.MemorySize} MB`:"-",z.Timeout?`${z.Timeout}s`:"-",z.LastModified??"-"]))}catch(_){r(`Failed to list functions: ${_.message}`),process.exitCode=1}}),D.command("function:invoke <name>","Invoke a Lambda function").option("--payload <json>","Event payload as JSON",{default:"{}"}).option("--async","Fire-and-forget (Event invocation)").option("--region <region>","AWS region").action(async(t,m)=>{i(`Invoking ${t}`);let A=m?.region||await Ba(),_=new I(A),z=new o("Invoking function...");z.start();try{let U=await _.invoke({FunctionName:t,InvocationType:m?.async?"Event":"RequestResponse",Payload:m?.payload||"{}",LogType:m?.async?"None":"Tail"});if(U.FunctionError){if(z.fail(`Function returned an error (${U.FunctionError})`),U.Payload)e(U.Payload);process.exitCode=1;return}if(z.succeed(`Invoked (status ${U.StatusCode})`),U.Payload)e(`
 Response:`),e(U.Payload);if(U.LogResult)e(`
 Logs:`),e(Buffer.from(U.LogResult,"base64").toString("utf-8"))}catch(U){z.fail(`Invocation failed: ${U.message}`),process.exitCode=1}}),D.command("function:logs <name>","View recent function logs").option("--tail","Continuously stream new log events").option("--filter <pattern>","CloudWatch filter pattern").option("--since <minutes>","Look back this many minutes",{default:"15"}).option("--region <region>","AWS region").action(async(t,m)=>{i(`Logs for ${t}`);let A=m?.region||await Ba(),_=new se(A),z=t.startsWith("/aws/lambda/")?t:`/aws/lambda/${t}`,U=Number(m?.since??15),Y=(X)=>{for(let ne of X){let re=ne.timestamp?new Date(ne.timestamp).toISOString():"";e(`${re}  ${(ne.message??"").trimEnd()}`)}};try{let X=Date.now()-U*60000,{events:ne=[]}=await _.filterLogEvents({logGroupName:z,startTime:X,filterPattern:m?.filter,limit:200});if(Y(ne),ne.length)X=(ne[ne.length-1].timestamp??X)+1;if(m?.tail){e(`
 (streaming — Ctrl+C to stop)`);for(;;){await new Promise((oe)=>setTimeout(oe,3000));let{events:re=[]}=await _.filterLogEvents({logGroupName:z,startTime:X,filterPattern:m?.filter,limit:200});if(re.length)Y(re),X=(re[re.length-1].timestamp??X)+1}}}catch(X){r(`Failed to read logs: ${X.message}`),process.exitCode=1}})}async function Jl(D){let t=Bun.spawn(["docker",...D],{stdin:"inherit",stdout:"inherit",stderr:"pipe"}),[m,A]=await Promise.all([t.exited,new Response(t.stderr).text()]);return{ok:m===0,exitCode:m,command:["docker",...D].join(" "),stderr:A.trim()}}function _a(D){D.command("container:build","Build a Docker image").option("--tag <tag>","Image tag",{default:"latest"}).option("--file <dockerfile>","Dockerfile",{default:"Dockerfile"}).option("--dry-run","Print the exact command").option("--json","Print result JSON").action(async(t)=>{let m=["build","--file",t.file??"Dockerfile","--tag",t.tag??"latest","."];if(t.dryRun){console.log(`docker ${m.join(" ")}`);return}let A=await Jl(m);if(t.json)console.log(JSON.stringify(A));if(!A.ok)r(A.stderr||`docker exited ${A.exitCode}`),process.exitCode=A.exitCode;else n(`Built ${t.tag??"latest"}.`)}),D.command("container:push","Push an already-tagged image").option("--image <image>","Full registry image reference").option("--dry-run","Print command").option("--json","Print JSON").action(async(t)=>{if(!t.image){r("--image with a full registry reference is required; credentials must come from docker credential helpers."),process.exitCode=2;return}if(t.dryRun){console.log(`docker push ${t.image}`);return}let m=await Jl(["push",t.image]);if(t.json)console.log(JSON.stringify(m));if(!m.ok)r(m.stderr),process.exitCode=m.exitCode;else n(`Pushed ${t.image}.`)}),D.command("container:deploy","Deploy a container image").action(async()=>Fn("container:deploy",{message:"Direct ECS mutation is not registered as a shared release driver.",nextAction:"Import the image as an application and use the immutable release deployment workflow."}))}function za(D){D.command("domain:list","List all domains").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t)=>{i("Domains");try{let m=oi(t?.provider),A=mn(t?.provider)?.provider||"unknown",_=new o(`Fetching domains from ${A}...`);_.start();let z=await m.listDomains();if(_.succeed(`Found ${z.length} domain(s)`),z.length===0){e("No domains found in this provider");return}let U=z.map((Y)=>[Y,"Active","-",A.charAt(0).toUpperCase()+A.slice(1)]);c(["Domain","Status","SSL","Provider"],U)}catch(m){r(`Failed to list domains: ${m instanceof Error?m.message:String(m)}`)}}),D.command("domain:add <domain>","Add a new domain").option("--provider <provider>","DNS provider: porkbun, godaddy, cloudflare, or route53").action(async(t,m)=>{i(`Adding Domain: ${t}`);try{let A=oi(m?.provider),_=mn(m?.provider)?.provider||"unknown",z=new o(`Checking if ${_} can manage ${t}...`);if(z.start(),await A.canManageDomain(t))z.succeed(`Domain ${t} is already available in ${_}`),e(`
@@ -382,9 +382,9 @@ Recommendations:`),e("  1. Remove any hardcoded credentials from your code"),e("
 ✗ Deployment configuration is invalid:`);for(let St of Y)r(`  • ${St}`);process.exitCode=1;return}if(t?.dryRun){if(t.site&&!U.sites?.[t.site]){r(`Site '${t.site}' was not found. Configured sites: ${Object.keys(U.sites||{}).join(", ")||"none"}`),process.exitCode=1;return}let St=H(U),Bt=t.stack||T(U,A),dn=B(U),pn=U.project.region||"us-east-1",$r=t.site?[t.site]:Object.keys(U.sites||{});i("Deployment Plan"),e(`Cloud provider: ${dn}`),e(`Mode: ${St}`),e(`Stack: ${Bt}`),e(`Region: ${pn}`),e(`Environment: ${A}`),e(`Sites: ${$r.length>0?$r.join(", "):"none"}`),n("Dry run complete. No infrastructure, DNS, certificates, or application files were changed.");return}if(B(U)==="aws"){let St=U.project?.region||"us-east-1";await Om(St)}let ne;if(!t?.skipSecurityScan){let St=Fc(U,t?.site);if(!St)e("This deploy ships no files — every site in scope is a redirect or proxy route, so only gateway routes and certificates change. Scanning an empty artifact.");let{result:Bt}=await Ls({sourceDir:St?process.cwd():jm(),failOnSeverity:t?.securityFailOn||"critical",exclude:U.infrastructure?.security?.scan?.exclude});Fs(Bt),ne=Bt}else a(`Security scan skipped (--skip-security-scan)
 `);let re=Dc(U,A,ne);if(!re.allowed){r(`
 ✗ Deployment blocked by security policy: ${re.explanation}`),e("Remediate the findings or create an authorized, time-limited waiver in the Security posture center."),process.exitCode=1;return}if(n(`✓ Security policy allows this deployment
-`),H(U)==="serverless"){p("Serverless project detected: deploying the Lambda application");let{deployServerlessApp:St}=await import("./chunk-8pnm151y.js");await St(U,A,{}),n("Serverless deployment complete");return}let oe=t?.stack||T(U,A),fe=U.project.region||"us-east-1",$e=U.infrastructure?.deployStack!==!1,Ie=U.sites&&Object.keys(U.sites).length>0,he=U.infrastructure?.dns?.provider;if(Ie&&he){if(await Vm(U,t?.site,he,fe,t?.skipDnsVerification,A,m),!$e){if(U.infrastructure?.compute){let St=Object.values(U.sites).map((Bt)=>Bt.domain).filter((Bt)=>!!Bt);if(St.length>0)p("Syncing CloudFront dynamic HTTP methods for app domains..."),await Os(St)}return}}if(!$e){e("Infrastructure stack deployment disabled (infrastructure.deployStack: false)");return}let Re=B(U);if(e(`Cloud provider: ${Re}`),e(`Stack: ${oe}`),e(`Region: ${fe}`),e(`Environment: ${A}`),(Re==="hetzner"||U.infrastructure?.compute?.mode==="server")&&As(U)){p(`Provisioning ${Re} compute infrastructure...`);let St=O({config:U,provider:Re});if(!St.provisionComputeInfrastructure){r(`${Re} driver does not support compute provisioning`),process.exitCode=1;return}let Bt=await St.provisionComputeInfrastructure({config:U,environment:A});if(n(`${Re} compute infrastructure ready`),Bt.appPublicIp)e(`App server: ${Bt.appPublicIp}`);if(Bt.appInstanceId)e(`Server ID: ${Bt.appInstanceId}`);if(!await xc(U,A,fe,t?.site))r(`App deploy to ${Re} compute reported a failure`),process.exitCode=1;else{if(n(`App deployed to ${Re} compute`),t?.skipDnsVerification)e("DNS verification and record reconciliation skipped (--skip-dns-verification)");else await _m(U,Bt.appPublicIp,he,Bt.appPublicIpv6),await zm(U,he);let pn=await Zi({config:U,environment:A,driver:St,logger:{info:e,warn:a,error:r,step:p,success:n}});if(!pn)r("App deployed, but rpx TLS certificate reconciliation failed");if(!pn)process.exitCode=1;if(!t?.skipDnsVerification)await Um(U,Bt.appPublicIp,Bt.appPublicIpv6)}return}p("Generating CloudFormation template...");let Ae=new wo({config:U,environment:A});Ae.generate();let Pe=Ae.toJSON(),xe=JSON.parse(Pe);if(Object.keys(xe.Resources||{}).length===0){e(`No infrastructure resources to deploy for environment '${A}' — skipping stack ${oe}.`);return}p("Validating template...");let Be=zo(xe),Ue=Uo(Pe),et=Vo(xe),Rt=[...Be.errors,...Ue.errors,...et.errors];if(Rt.length>0){r("Template validation failed:");for(let St of Rt)r(`  - ${St.path}: ${St.message}`);return}let Et=[...Be.warnings,...Ue.warnings,...et.warnings];if(Et.length>0)for(let St of Et)a(`  - ${St.path}: ${St.message}`);n("Template validated successfully");let wt=Object.keys(xe.Resources).length;e(`
+`),H(U)==="serverless"){p("Serverless project detected: deploying the Lambda application");let{deployServerlessApp:St}=await import("./chunk-w68hker6.js");await St(U,A,{}),n("Serverless deployment complete");return}let oe=t?.stack||T(U,A),fe=U.project.region||"us-east-1",$e=U.infrastructure?.deployStack!==!1,Ie=U.sites&&Object.keys(U.sites).length>0,he=U.infrastructure?.dns?.provider;if(Ie&&he){if(await Vm(U,t?.site,he,fe,t?.skipDnsVerification,A,m),!$e){if(U.infrastructure?.compute){let St=Object.values(U.sites).map((Bt)=>Bt.domain).filter((Bt)=>!!Bt);if(St.length>0)p("Syncing CloudFront dynamic HTTP methods for app domains..."),await Os(St)}return}}if(!$e){e("Infrastructure stack deployment disabled (infrastructure.deployStack: false)");return}let Re=B(U);if(e(`Cloud provider: ${Re}`),e(`Stack: ${oe}`),e(`Region: ${fe}`),e(`Environment: ${A}`),(Re==="hetzner"||U.infrastructure?.compute?.mode==="server")&&As(U)){p(`Provisioning ${Re} compute infrastructure...`);let St=O({config:U,provider:Re});if(!St.provisionComputeInfrastructure){r(`${Re} driver does not support compute provisioning`),process.exitCode=1;return}let Bt=await St.provisionComputeInfrastructure({config:U,environment:A});if(n(`${Re} compute infrastructure ready`),Bt.appPublicIp)e(`App server: ${Bt.appPublicIp}`);if(Bt.appInstanceId)e(`Server ID: ${Bt.appInstanceId}`);if(!await xc(U,A,fe,t?.site))r(`App deploy to ${Re} compute reported a failure`),process.exitCode=1;else{if(n(`App deployed to ${Re} compute`),t?.skipDnsVerification)e("DNS verification and record reconciliation skipped (--skip-dns-verification)");else await _m(U,Bt.appPublicIp,he,Bt.appPublicIpv6),await zm(U,he);let pn=await Zi({config:U,environment:A,driver:St,logger:{info:e,warn:a,error:r,step:p,success:n}});if(!pn)r("App deployed, but rpx TLS certificate reconciliation failed");if(!pn)process.exitCode=1;if(!t?.skipDnsVerification)await Um(U,Bt.appPublicIp,Bt.appPublicIpv6)}return}p("Generating CloudFormation template...");let Ae=new wo({config:U,environment:A});Ae.generate();let Pe=Ae.toJSON(),xe=JSON.parse(Pe);if(Object.keys(xe.Resources||{}).length===0){e(`No infrastructure resources to deploy for environment '${A}' — skipping stack ${oe}.`);return}p("Validating template...");let Be=zo(xe),Ue=Uo(Pe),et=Vo(xe),Rt=[...Be.errors,...Ue.errors,...et.errors];if(Rt.length>0){r("Template validation failed:");for(let St of Rt)r(`  - ${St.path}: ${St.message}`);return}let Et=[...Be.warnings,...Ue.warnings,...et.warnings];if(Et.length>0)for(let St of Et)a(`  - ${St.path}: ${St.message}`);n("Template validated successfully");let wt=Object.keys(xe.Resources).length;e(`
 Resources to deploy: ${wt}`);let Pt={};for(let St of Object.values(xe.Resources)){let Bt=St.Type;Pt[Bt]=(Pt[Bt]||0)+1}for(let[St,Bt]of Object.entries(Pt).sort((dn,pn)=>pn[1]-dn[1]).slice(0,5))e(`  - ${St}: ${Bt}`);if(!(m||await d(`
-Deploy now?`,!0))){e("Deployment cancelled");return}let _t=new v(fe),nt=ha(xe);if(nt.length>0){let{ensureFailoverReplicaBuckets:St}=await import("./chunk-th86qyty.js");p("Ensuring failover replica buckets..."),await St(nt,(Bt)=>e(`  ${Bt}`))}p("Checking stack status...");let zt=!1;try{let St=await _t.describeStacks({stackName:oe});zt=St.Stacks&&St.Stacks.length>0}catch(St){zt=!1}if(zt){e("Stack exists, updating...");let St=new o("Updating CloudFormation stack...");St.start();try{await _t.updateStack({stackName:oe,templateBody:Pe,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:U.project.name},{Key:"Environment",Value:A},{Key:"ManagedBy",Value:"ts-cloud"}]}),St.succeed("Update initiated"),p("Waiting for stack update to complete..."),await _t.waitForStack(oe,"stack-update-complete"),n("Stack updated successfully!")}catch(Bt){if(Bt.message.includes("No updates are to be performed"))St.succeed("No changes detected"),e("Stack is already up to date — continuing to app deploy");else throw Bt}}else{e("Creating new stack...");let St=new o("Creating CloudFormation stack...");St.start(),await _t.createStack({stackName:oe,templateBody:Pe,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:U.project.name},{Key:"Environment",Value:A},{Key:"ManagedBy",Value:"ts-cloud"}]}),St.succeed("Stack creation initiated"),p("Waiting for stack creation to complete..."),await _t.waitForStack(oe,"stack-create-complete"),n("Stack created successfully!")}let Wt=await _t.getStackOutputs(oe);if(ve(`Deployment Complete!
+Deploy now?`,!0))){e("Deployment cancelled");return}let _t=new v(fe),nt=ha(xe);if(nt.length>0){let{ensureFailoverReplicaBuckets:St}=await import("./chunk-8bb6kyhm.js");p("Ensuring failover replica buckets..."),await St(nt,(Bt)=>e(`  ${Bt}`))}p("Checking stack status...");let zt=!1;try{let St=await _t.describeStacks({stackName:oe});zt=St.Stacks&&St.Stacks.length>0}catch(St){zt=!1}if(zt){e("Stack exists, updating...");let St=new o("Updating CloudFormation stack...");St.start();try{await _t.updateStack({stackName:oe,templateBody:Pe,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:U.project.name},{Key:"Environment",Value:A},{Key:"ManagedBy",Value:"ts-cloud"}]}),St.succeed("Update initiated"),p("Waiting for stack update to complete..."),await _t.waitForStack(oe,"stack-update-complete"),n("Stack updated successfully!")}catch(Bt){if(Bt.message.includes("No updates are to be performed"))St.succeed("No changes detected"),e("Stack is already up to date — continuing to app deploy");else throw Bt}}else{e("Creating new stack...");let St=new o("Creating CloudFormation stack...");St.start(),await _t.createStack({stackName:oe,templateBody:Pe,capabilities:["CAPABILITY_IAM","CAPABILITY_NAMED_IAM"],tags:[{Key:"Project",Value:U.project.name},{Key:"Environment",Value:A},{Key:"ManagedBy",Value:"ts-cloud"}]}),St.succeed("Stack creation initiated"),p("Waiting for stack creation to complete..."),await _t.waitForStack(oe,"stack-create-complete"),n("Stack created successfully!")}let Wt=await _t.getStackOutputs(oe);if(ve(`Deployment Complete!
 
 Stack: ${oe}
 Region: ${fe}
@@ -393,16 +393,16 @@ Resources: ${wt}
 
 View in console:
 https://console.aws.amazon.com/cloudformation/home?region=${fe}#/stacks/stackinfo?stackId=${encodeURIComponent(oe)}`,"green"),Object.keys(Wt).length>0){e(`
-Stack Outputs:`);for(let[St,Bt]of Object.entries(Wt))e(`  - ${St}: ${Bt}`)}if(nt.length>0){let{grantFailoverReplicaAccess:St}=await import("./chunk-th86qyty.js");p("Granting the distribution read access to its failover replicas..."),await St(nt,Wt,(Bt)=>e(`  ${Bt}`))}if(U.infrastructure?.storage)for(let[St,Bt]of Object.entries(U.infrastructure.storage)){if(!Bt.website||!Bt.root)continue;let dn=Wt[`${St}BucketName`]||Wt.FrontendBucketName,pn=Wt[`${St}CloudFrontDistributionId`];if(!dn){a(`Could not find bucket name for storage '${St}' — skipping file upload`);continue}if(!bn(Bt.root)){a(`Source directory not found: ${Bt.root} — skipping file upload for '${St}'`);continue}p(`Uploading files from ${Bt.root} to s3://${dn}...`);let{uploadStaticFiles:$r,invalidateCache:xi}=await import("./chunk-3pbbc03q.js"),gn=await $r({sourceDir:Bt.root,bucket:dn,region:fe,onProgress:(Ht,Sn,Cn)=>{if(Ht%10===0||Ht===Sn)e(`  ${Ht}/${Sn}: ${Cn}`)}});if(gn.errors.length>0)a(`Upload completed with errors: ${gn.errors.join(", ")}`);else{let Ht=gn.skipped>0?`Uploaded ${gn.uploaded} files (${gn.skipped} unchanged)`:`Uploaded ${gn.uploaded} files`;n(Ht)}if(pn&&gn.uploaded>0){p("Invalidating CloudFront cache...");let{invalidationId:Ht}=await xi(pn);n(`Cache invalidation created: ${Ht}`)}}if(nt.length>0){let{seedFailoverReplicas:St}=await import("./chunk-th86qyty.js");p("Syncing failover replicas..."),await St(nt,(Bt)=>e(`  ${Bt}`))}if(U.infrastructure?.compute)await xc(U,A,fe,t?.site);if(U.infrastructure?.compute&&U.sites){let St=Object.values(U.sites).map((Bt)=>Bt.domain).filter((Bt)=>!!Bt);if(St.length>0)p("Syncing CloudFront dynamic HTTP methods for app domains..."),await Os(St)}}catch(z){if(r(`Deployment failed: ${z.message}`),process.exitCode=1,z.stack)e(`
+Stack Outputs:`);for(let[St,Bt]of Object.entries(Wt))e(`  - ${St}: ${Bt}`)}if(nt.length>0){let{grantFailoverReplicaAccess:St}=await import("./chunk-8bb6kyhm.js");p("Granting the distribution read access to its failover replicas..."),await St(nt,Wt,(Bt)=>e(`  ${Bt}`))}if(U.infrastructure?.storage)for(let[St,Bt]of Object.entries(U.infrastructure.storage)){if(!Bt.website||!Bt.root)continue;let dn=Wt[`${St}BucketName`]||Wt.FrontendBucketName,pn=Wt[`${St}CloudFrontDistributionId`];if(!dn){a(`Could not find bucket name for storage '${St}' — skipping file upload`);continue}if(!bn(Bt.root)){a(`Source directory not found: ${Bt.root} — skipping file upload for '${St}'`);continue}p(`Uploading files from ${Bt.root} to s3://${dn}...`);let{uploadStaticFiles:$r,invalidateCache:xi}=await import("./chunk-h6n5v6rf.js"),gn=await $r({sourceDir:Bt.root,bucket:dn,region:fe,onProgress:(Ht,Sn,Cn)=>{if(Ht%10===0||Ht===Sn)e(`  ${Ht}/${Sn}: ${Cn}`)}});if(gn.errors.length>0)a(`Upload completed with errors: ${gn.errors.join(", ")}`);else{let Ht=gn.skipped>0?`Uploaded ${gn.uploaded} files (${gn.skipped} unchanged)`:`Uploaded ${gn.uploaded} files`;n(Ht)}if(pn&&gn.uploaded>0){p("Invalidating CloudFront cache...");let{invalidationId:Ht}=await xi(pn);n(`Cache invalidation created: ${Ht}`)}}if(nt.length>0){let{seedFailoverReplicas:St}=await import("./chunk-8bb6kyhm.js");p("Syncing failover replicas..."),await St(nt,(Bt)=>e(`  ${Bt}`))}if(U.infrastructure?.compute)await xc(U,A,fe,t?.site);if(U.infrastructure?.compute&&U.sites){let St=Object.values(U.sites).map((Bt)=>Bt.domain).filter((Bt)=>!!Bt);if(St.length>0)p("Syncing CloudFront dynamic HTTP methods for app domains..."),await Os(St)}}catch(z){if(r(`Deployment failed: ${z.message}`),process.exitCode=1,z.stack)e(`
 Stack trace:`),console.error(z.stack)}finally{if(_)await _()}}),D.command("deploy:server","Deploy EC2 infrastructure").option("--env <environment>","Environment (production, staging, development)").option("--site <name>","Deploy specific site only (routes are still regenerated in full)").action(async(t)=>{i("Deploying Server Infrastructure");try{let m=await Ee(),A=t?.env||"production",_=m.project.region||"us-east-1",z=xr(m);if(z){r(z),process.exitCode=1;return}if(!As(m)){r("No `infrastructure.compute` configured — nothing to deploy as a server."),e("Add an EC2 compute block to cloud.config, or use `cloud deploy:serverless` for Lambda apps."),process.exitCode=1;return}if(e(`Region: ${_}`),e(`Environment: ${A}`),!await xc(m,A,_,t?.site)){process.exitCode=1;return}if(m.sites){let Y=Object.values(m.sites).map((X)=>X.domain).filter((X)=>!!X);if(Y.length>0)p("Syncing CloudFront dynamic HTTP methods for app domains..."),await Os(Y)}n(`
-Server deployment complete!`)}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),D.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",_=xr(m);if(_){r(_),process.exitCode=1;return}let{deployServerlessApp:z,redeployServerlessApp:U}=await import("./chunk-8pnm151y.js");if(t?.redeploy){await U(m,A);return}await z(m,A,{skipBuild:t?.skipBuild,skipDeployHooks:t?.skipHooks})}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{rollbackServerlessApp:_}=await import("./chunk-8pnm151y.js");await _(m,A)}catch(m){r(`Rollback failed: ${m.message}`),process.exitCode=1}}),D.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").option("--dry-run","Say which release it would roll back to, and change nothing").option("--all","Every configured site, instead of one").option("--only-if-live <release>","Only roll back a site whose live release is this commit (what a failed deploy switched)").action(async(t,m)=>{i("Rolling Back Release");try{let A=await Ee(),_=m?.env||"production",z=m?.all?Object.keys(A.sites||{}):[t||Object.keys(A.sites||{})[0]].filter(Boolean);if(z.length===0){r("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:U}=await import("./chunk-3gg55dkc.js"),Y=O({config:A});for(let X of z){let ne=await U({driver:Y,slug:A.project.slug,environment:_,logger:f},{siteName:X,to:m?.to,dryRun:m?.dryRun,onlyIfLive:m?.onlyIfLive});for(let re of ne.perInstance||[])e(`  ${X} ${re.instanceId}: ${re.output?.trim()||re.status}`);if(!ne.success)r(`Rollback of ${X} failed: ${ne.error||"unknown error"}`),process.exitCode=1}}catch(A){r(`Rollback failed: ${A.message}`),process.exitCode=1}}),D.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async(t,m)=>{i("Deployment History");try{let A=await Ee(),_=m?.env||"production",z=t||Object.keys(A.sites||{})[0];if(!z){r("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:U}=await import("./chunk-3gg55dkc.js"),Y=await U({driver:O({config:A}),slug:A.project.slug,environment:_,logger:f},{siteName:z,limit:Number.parseInt(m?.limit||"20",10)||20});if(!Y.success){r(`Could not read history: ${Y.error||"unknown error"}`),process.exitCode=1;return}for(let X of Y.perInstance||[])e(`
+Server deployment complete!`)}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),D.command("deploy:serverless","Deploy a serverless application (http/queue/cli Lambda functions)").option("--env <environment>","Environment (production, staging, development)").option("--skip-build","Skip local build hooks").option("--skip-hooks","Skip remote deploy hooks (e.g. migrations)").option("--redeploy","Re-activate the last build without rebuilding").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",_=xr(m);if(_){r(_),process.exitCode=1;return}let{deployServerlessApp:z,redeployServerlessApp:U}=await import("./chunk-w68hker6.js");if(t?.redeploy){await U(m,A);return}await z(m,A,{skipBuild:t?.skipBuild,skipDeployHooks:t?.skipHooks})}catch(m){r(`Deployment failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:rollback","Roll back a serverless app to the previous build").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{rollbackServerlessApp:_}=await import("./chunk-w68hker6.js");await _(m,A)}catch(m){r(`Rollback failed: ${m.message}`),process.exitCode=1}}),D.command("deploy:rollback [site]","Roll a compute site back to a previous release").option("--env <environment>","Environment (production, staging, development)").option("--to <release>","Release id to roll back to (default: the previous release)").option("--dry-run","Say which release it would roll back to, and change nothing").option("--all","Every configured site, instead of one").option("--only-if-live <release>","Only roll back a site whose live release is this commit (what a failed deploy switched)").action(async(t,m)=>{i("Rolling Back Release");try{let A=await Ee(),_=m?.env||"production",z=m?.all?Object.keys(A.sites||{}):[t||Object.keys(A.sites||{})[0]].filter(Boolean);if(z.length===0){r("No site configured to roll back."),process.exitCode=1;return}let{rollbackComputeSite:U}=await import("./chunk-3gg55dkc.js"),Y=O({config:A});for(let X of z){let ne=await U({driver:Y,slug:A.project.slug,environment:_,logger:f},{siteName:X,to:m?.to,dryRun:m?.dryRun,onlyIfLive:m?.onlyIfLive});for(let re of ne.perInstance||[])e(`  ${X} ${re.instanceId}: ${re.output?.trim()||re.status}`);if(!ne.success)r(`Rollback of ${X} failed: ${ne.error||"unknown error"}`),process.exitCode=1}}catch(A){r(`Rollback failed: ${A.message}`),process.exitCode=1}}),D.command("deploy:history [site]","Show a compute site's deployment history").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Number of entries to show",{default:"20"}).action(async(t,m)=>{i("Deployment History");try{let A=await Ee(),_=m?.env||"production",z=t||Object.keys(A.sites||{})[0];if(!z){r("No site configured."),process.exitCode=1;return}let{getComputeDeployHistory:U}=await import("./chunk-3gg55dkc.js"),Y=await U({driver:O({config:A}),slug:A.project.slug,environment:_,logger:f},{siteName:z,limit:Number.parseInt(m?.limit||"20",10)||20});if(!Y.success){r(`Could not read history: ${Y.error||"unknown error"}`),process.exitCode=1;return}for(let X of Y.perInstance||[])e(`
 ${X.instanceId}:`),e(X.output?.trimEnd()||"(no output)")}catch(A){r(`History lookup failed: ${A.message}`),process.exitCode=1}}),D.command("deploy:recipe <name> <script>","Run a reusable server recipe (a local bash file) across servers").option("--env <environment>","Environment (production, staging, development)").option("--user <user>","User to run the recipe as",{default:"root"}).action(async(t,m,A)=>{i(`Running Recipe: ${t}`);try{if(!bn(m)){r(`Recipe script not found: ${m}`),process.exitCode=1;return}let _=await Ee(),z=A?.env||"production",U=Ec(m,"utf8").split(`
 `),{runComputeRecipe:Y}=await import("./chunk-3gg55dkc.js"),X=await Y({driver:O({config:_}),slug:_.project.slug,environment:z,logger:f},{name:t,script:U,user:A?.user});for(let ne of X.perInstance||[])e(`
-${ne.instanceId}:`),e(ne.output?.trimEnd()||"(no output)");if(!X.success)process.exitCode=1}catch(_){r(`Recipe failed: ${_.message}`),process.exitCode=1}}),D.command("db:restore-backup [from]","Restore the app database from an on-box ts-backups dump (latest, or a given file)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{i("Database Restore");try{let A=await Ee(),_=m?.env||"production",{restoreDatabaseBackup:z}=await import("./chunk-3gg55dkc.js"),U=await z({driver:O({config:A}),slug:A.project.slug,environment:_,logger:f},{database:w(A),from:t});for(let Y of U.perInstance||[])e(`  ${Y.instanceId}: ${Y.output?.trim()||Y.status}`);if(!U.success)r(`Restore failed: ${U.error||"unknown error"}`),process.exitCode=1}catch(A){r(`Restore failed: ${A.message}`),process.exitCode=1}}),D.command("quick-deploy","Generate a push-to-deploy CI pipeline for your git provider (Forge Quick Deploy)").option("--env <environment>","Environment to deploy on push",{default:"production"}).option("--provider <provider>","CI provider (github, gitlab, bitbucket); defaults to the origin remote").option("--site <site>","Deploy only this configured site").option("--skip-dns-verification","Generate a deploy that skips DNS verification and record creation").option("--ssh-key-secret <name>","CI secret/variable containing the Hetzner deployment SSH private key",{default:"SSH_PRIVATE_KEY"}).option("--force","Overwrite an existing pipeline file").action(async(t)=>{i("Quick Deploy (push-to-deploy)");try{let m=await Ee(),{buildQuickDeployCi:A,inferQuickDeployProvider:_}=await import("./chunk-5yv95sqs.js"),z=t?.provider?.toLowerCase();if(z&&!["github","gitlab","bitbucket"].includes(z))throw Error(`Unsupported CI provider '${t?.provider}'. Use github, gitlab, or bitbucket.`);let U=z;if(!U)try{let X=Tc("git remote get-url origin",{stdio:["ignore","pipe","ignore"]}).toString().trim();U=_(X)}catch{}let Y=A(m,t?.env||"production",{provider:U,site:t?.site,skipDnsVerification:t?.skipDnsVerification,setup:bn("pantry.lock")?"pantry":"bun",sshPrivateKeySecret:t?.sshKeySecret});if(!Y){a("Could not resolve a GitHub, GitLab, or Bitbucket provider from --provider, the origin remote, or a configured site repository."),process.exitCode=1;return}if(bn(Y.path)&&!t?.force){a(`${Y.path} already exists — re-run with --force to overwrite.`);return}vd(Tm(Y.path),{recursive:!0}),Em(Y.path,Y.content),n(`Wrote ${Y.path} (${Y.provider}, deploys on push to '${Y.branch}').`),e("Next: commit it and add your provider credentials as CI secrets/variables.")}catch(m){r(`Quick deploy setup failed: ${m.message}`),process.exitCode=1}}),D.command("down","Put the serverless app into maintenance mode (503)").option("--env <environment>","Environment (production, staging, development)").option("--secret <secret>","Bypass secret (send as x-maintenance-bypass header)").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{setMaintenance:_}=await import("./chunk-8pnm151y.js");await _(m,A,!0,t?.secret)}catch(m){r(`Failed to enable maintenance mode: ${m.message}`),process.exitCode=1}}),D.command("up","Bring the serverless app out of maintenance mode").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{setMaintenance:_}=await import("./chunk-8pnm151y.js");await _(m,A,!1)}catch(m){r(`Failed to disable maintenance mode: ${m.message}`),process.exitCode=1}}),D.command("command <cmd>","Run a command on the serverless CLI function (e.g. migrations)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let A=await Ee(),_=m?.env||"production",{runAndRecordCommand:z}=await import("./chunk-8pnm151y.js"),{id:U,output:Y}=await z(A,_,t);if(e(Y),U>0)e(`
-(recorded as #${U} — re-run with \`cloud command:again ${U}\`)`)}catch(A){r(`Command failed: ${A.message}`),process.exitCode=1}}),D.command("command:history","List recorded CLI-function command invocations").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Show at most this many (most recent)",{default:"20"}).action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{listCommandHistory:_}=await import("./chunk-8pnm151y.js"),z=await _(m,A);if(!z.length){e("No command history yet.");return}let U=Number(t?.limit??20);i(`Command history — ${m.project.slug} (${A})`),c(["#","When","Status","Command"],z.slice(-U).reverse().map((Y)=>[String(Y.id),Y.timestamp,Y.status,Y.command]))}catch(m){r(`Failed to read history: ${m.message}`),process.exitCode=1}}),D.command("command:again [id]","Re-run a recorded command (defaults to the most recent)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let A=await Ee(),_=m?.env||"production",{getCommandRecord:z,runAndRecordCommand:U}=await import("./chunk-8pnm151y.js"),Y=await z(A,_,t?Number(t):void 0);if(!Y){r(t?`No command #${t} in history.`:"No command history to re-run."),process.exitCode=1;return}e(`Re-running #${Y.id}: ${Y.command}`);let X=await U(A,_,Y.command);if(e(X.output),X.id>0)e(`
-(recorded as #${X.id})`)}catch(A){r(`Command failed: ${A.message}`),process.exitCode=1}}),D.command("serverless:db-shell <sql>","Run a SQL statement against a private serverless database (via the CLI function)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let A=await Ee(),_=m?.env||"production",{runDbQuery:z}=await import("./chunk-8pnm151y.js"),U=await z(A,_,t);e(U)}catch(A){r(`Query failed: ${A.message}`),process.exitCode=1}}),D.command("serverless:db-scale <min> <max>","Rescale the serverless Aurora cluster (min/max ACUs)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m,A)=>{i("Scaling serverless database");try{let _=await Ee(),z=A?.env||"production",U=Number(t),Y=Number(m);if(!(U>0)||!(Y>=U)){r("Provide valid capacities: min > 0 and max >= min (e.g. `serverless:db-scale 0.5 8`)."),process.exitCode=1;return}let{scaleServerlessDatabase:X}=await import("./chunk-8pnm151y.js");await X(_,z,U,Y)}catch(_){r(`Scale failed: ${_.message}`),process.exitCode=1}}),D.command("serverless:db-restore","Restore the serverless Aurora cluster to a point in time (as a new cluster)").option("--env <environment>","Environment (production, staging, development)").option("--to <timestamp>","Restore to this ISO-8601 time (UTC)").option("--latest","Restore to the latest restorable time").option("--target <id>","New cluster identifier (defaults to <cluster>-restore-<stamp>)").action(async(t)=>{i("Restoring serverless database");try{let m=await Ee(),A=t?.env||"production",_;if(t?.to){if(_=new Date(t.to),Number.isNaN(_.getTime())){r(`Invalid --to timestamp: ${t.to} (use ISO-8601, e.g. 2026-06-18T10:00:00Z).`),process.exitCode=1;return}}let{restoreServerlessDatabase:z}=await import("./chunk-8pnm151y.js");await z(m,A,{toTime:_,latest:t?.latest,target:t?.target})}catch(m){r(`Restore failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:info","Show an operational summary of a deployed serverless app").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{serverlessInfo:_}=await import("./chunk-8pnm151y.js"),z=await _(m,A);if(i(`${z.slug} (${z.environment})`),e(`Stack:    ${z.stackStatus}`),e(`Region:   ${z.region}`),z.endpoint)e(`URL:      ${z.endpoint}`);if(z.assetUrl)e(`Assets:   ${z.assetUrl}`);if(e(`Scheduler:${z.scheduler==="off"?" off":` ${z.scheduler}`}`),e(`Queues:   ${z.queues.length?z.queues.join(", "):"none"}`),e(`Warming:  ${z.provisionedConcurrency>0?`provisioned concurrency ×${z.provisionedConcurrency}`:"none / ping-warm"}`),z.lastRelease)e(`Release:  ${z.lastRelease.sha.slice(0,12)} @ ${z.lastRelease.timestamp}`);c(["Function","Version","Provisioned"],z.functions.map((U)=>[U.name,U.version,U.provisioned?`${U.provisioned.status} ${U.provisioned.allocated}/${U.provisioned.requested}`:"—"]))}catch(m){r(`Failed to read info: ${m.message}`),process.exitCode=1}}),D.command("dashboard:build","Build the management dashboard with live data baked in").option("--env <environment>","Environment (production, staging, development)").option("--ui <dir>","UI directory (default ./ui)",{default:"ui"}).action(async(t)=>{i("Building management dashboard (live data)");try{let{existsSync:m}=await import("node:fs"),A=t?.ui||"ui";if(!m(`${A}/package.json`)){r(`No UI project at ${A}/ (expected ${A}/package.json). Pass --ui <dir>.`),process.exitCode=1;return}let _=await Ee(),z=t?.env||"production";p("Gathering live data from AWS");let U=null;if(_.environments?.[z]?.app){let{resolveDashboardData:re}=await import("./chunk-dgxzk04r.js"),oe=await re(_,z).catch((fe)=>(a(`Serverless data unavailable (${fe.message}) — that view uses sample data.`),null));if(oe)U={...U??{},...oe}}if(_.infrastructure?.compute){let{resolveServerDashboardData:re}=await import("./chunk-qfkfhg84.js"),oe=await re(_,z).catch(()=>null);if(oe){if(oe._serverReachable===!1)a("Server box not reachable over SSM — server view uses config + sample data.");U={...U??{},...oe}}}p("Building dashboard");let{encodeDashboardPayload:Y}=await import("./chunk-1k9sw5y7.js"),{execSync:X}=await import("node:child_process"),{rmSync:ne}=await import("node:fs");for(let re of[".stx/ssg-cache",".stx/cache"])ne(`${A}/${re}`,{recursive:!0,force:!0});X("bun run build",{cwd:A,stdio:"inherit",env:{...process.env,...U?{TSCLOUD_DASHBOARD_DATA:Y(U)}:{}}}),n(`Dashboard built → ${A}/dist${U?" (live data)":" (sample data)"}`)}catch(m){r(`Dashboard build failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:build-php-layer","Build + publish the ts-cloud PHP runtime layer (requires Docker)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--php <version>","PHP version",{default:"8.3"}).option("--name <name>","Layer name",{default:"tscloud-php"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building PHP runtime layer");try{let m=await Ee().catch(()=>null),A=t?.region||m?.project.region||"us-east-1",_=t?.arch||"x86_64",z=t?.php||"8.3",U=`${t?.name||"tscloud-php"}-${z.replace(".","")}-${_}`,Y=t?.bucket||`${m?.project.slug||"tscloud"}-layers`,{buildPhpRuntimeLayerZip:X}=await import("./chunk-x8wvsf1k.js"),{S3Client:ne}=await import("./chunk-s4x1pb7n.js"),{LambdaClient:re}=await import("./chunk-2rcwhdx9.js"),oe=X({architecture:_,phpVersion:z,onStep:(Re)=>p(Re)});e(`Layer: ${oe.fileCount} files, ${(oe.zip.length/1024/1024).toFixed(1)} MB`);let fe=new ne(A);if(!await fe.bucketExists(Y))p(`Creating layer bucket ${Y}`),await fe.createBucket(Y);let $e=`layers/${U}.zip`;p("Uploading layer zip"),await fe.putObject({bucket:Y,key:$e,body:oe.zip,contentType:"application/zip"}),p("Publishing layer version");let he=await new re(A).publishLayerVersion({LayerName:U,Description:`ts-cloud PHP ${z} runtime (${_})`,Content:{S3Bucket:Y,S3Key:$e},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[_]});ve(["PHP runtime layer published","",`ARN: ${he.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'php', layers: ['${he.LayerVersionArn}'] }`,"or set TSCLOUD_PHP_LAYER_ARN before deploying."].join(`
-`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:build-node-layer","Build + publish a ts-cloud Node custom runtime layer (any version, incl. 24)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--node <version>","Node version (e.g. 24)",{default:"24"}).option("--name <name>","Layer name",{default:"tscloud-node"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building Node runtime layer");try{let m=await Ee().catch(()=>null),A=t?.region||m?.project.region||"us-east-1",_=t?.arch||"x86_64",z=t?.node||"24",{buildNodeRuntimeLayerZip:U}=await import("./chunk-x8wvsf1k.js"),{S3Client:Y}=await import("./chunk-s4x1pb7n.js"),{LambdaClient:X}=await import("./chunk-2rcwhdx9.js"),ne=U({architecture:_,version:z,onStep:(Re)=>p(Re)}),re=`${t?.name||"tscloud-node"}-${ne.version.split(".")[0]}-${_}`,oe=t?.bucket||`${m?.project.slug||"tscloud"}-layers`;e(`Layer: Node ${ne.version}, ${(ne.zip.length/1024/1024).toFixed(1)} MB`);let fe=new Y(A);if(!await fe.bucketExists(oe))p(`Creating layer bucket ${oe}`),await fe.createBucket(oe);let $e=`layers/${re}.zip`;p("Uploading layer zip"),await fe.putObject({bucket:oe,key:$e,body:ne.zip,contentType:"application/zip"}),p("Publishing layer version");let he=await new X(A).publishLayerVersion({LayerName:re,Description:`ts-cloud Node ${ne.version} runtime (${_})`,Content:{S3Bucket:oe,S3Key:$e},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[_]});ve(["Node runtime layer published","",`ARN: ${he.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'node', runtimeVersion: '${ne.version.split(".")[0]}', layers: ['${he.LayerVersionArn}'] }`,"or set TSCLOUD_NODE_LAYER_ARN before deploying."].join(`
-`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:build-bun-layer","Build + publish a ts-cloud Bun custom runtime layer").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--bun <version>",'Bun version (e.g. 1.3.13, or "latest")',{default:"latest"}).option("--name <name>","Layer name",{default:"tscloud-bun"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building Bun runtime layer");try{let m=await Ee().catch(()=>null),A=t?.region||m?.project.region||"us-east-1",_=t?.arch||"x86_64",z=t?.bun||"latest",{buildBunRuntimeLayerZip:U}=await import("./chunk-x8wvsf1k.js"),{S3Client:Y}=await import("./chunk-s4x1pb7n.js"),{LambdaClient:X}=await import("./chunk-2rcwhdx9.js"),ne=U({architecture:_,version:z,onStep:(Re)=>p(Re)}),re=`${t?.name||"tscloud-bun"}-${ne.version.replace(/\./g,"")}-${_}`,oe=t?.bucket||`${m?.project.slug||"tscloud"}-layers`;e(`Layer: Bun ${ne.version}, ${(ne.zip.length/1024/1024).toFixed(1)} MB`);let fe=new Y(A);if(!await fe.bucketExists(oe))p(`Creating layer bucket ${oe}`),await fe.createBucket(oe);let $e=`layers/${re}.zip`;p("Uploading layer zip"),await fe.putObject({bucket:oe,key:$e,body:ne.zip,contentType:"application/zip"}),p("Publishing layer version");let he=await new X(A).publishLayerVersion({LayerName:re,Description:`ts-cloud Bun ${ne.version} runtime (${_})`,Content:{S3Bucket:oe,S3Key:$e},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[_]});ve(["Bun runtime layer published","",`ARN: ${he.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'bun', layers: ['${he.LayerVersionArn}'] }`,"or set TSCLOUD_BUN_LAYER_ARN before deploying."].join(`
+${ne.instanceId}:`),e(ne.output?.trimEnd()||"(no output)");if(!X.success)process.exitCode=1}catch(_){r(`Recipe failed: ${_.message}`),process.exitCode=1}}),D.command("db:restore-backup [from]","Restore the app database from an on-box ts-backups dump (latest, or a given file)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{i("Database Restore");try{let A=await Ee(),_=m?.env||"production",{restoreDatabaseBackup:z}=await import("./chunk-3gg55dkc.js"),U=await z({driver:O({config:A}),slug:A.project.slug,environment:_,logger:f},{database:w(A),from:t});for(let Y of U.perInstance||[])e(`  ${Y.instanceId}: ${Y.output?.trim()||Y.status}`);if(!U.success)r(`Restore failed: ${U.error||"unknown error"}`),process.exitCode=1}catch(A){r(`Restore failed: ${A.message}`),process.exitCode=1}}),D.command("quick-deploy","Generate a push-to-deploy CI pipeline for your git provider (Forge Quick Deploy)").option("--env <environment>","Environment to deploy on push",{default:"production"}).option("--provider <provider>","CI provider (github, gitlab, bitbucket); defaults to the origin remote").option("--site <site>","Deploy only this configured site").option("--skip-dns-verification","Generate a deploy that skips DNS verification and record creation").option("--ssh-key-secret <name>","CI secret/variable containing the Hetzner deployment SSH private key",{default:"SSH_PRIVATE_KEY"}).option("--force","Overwrite an existing pipeline file").action(async(t)=>{i("Quick Deploy (push-to-deploy)");try{let m=await Ee(),{buildQuickDeployCi:A,inferQuickDeployProvider:_}=await import("./chunk-5yv95sqs.js"),z=t?.provider?.toLowerCase();if(z&&!["github","gitlab","bitbucket"].includes(z))throw Error(`Unsupported CI provider '${t?.provider}'. Use github, gitlab, or bitbucket.`);let U=z;if(!U)try{let X=Tc("git remote get-url origin",{stdio:["ignore","pipe","ignore"]}).toString().trim();U=_(X)}catch{}let Y=A(m,t?.env||"production",{provider:U,site:t?.site,skipDnsVerification:t?.skipDnsVerification,setup:bn("pantry.lock")?"pantry":"bun",sshPrivateKeySecret:t?.sshKeySecret});if(!Y){a("Could not resolve a GitHub, GitLab, or Bitbucket provider from --provider, the origin remote, or a configured site repository."),process.exitCode=1;return}if(bn(Y.path)&&!t?.force){a(`${Y.path} already exists — re-run with --force to overwrite.`);return}vd(Tm(Y.path),{recursive:!0}),Em(Y.path,Y.content),n(`Wrote ${Y.path} (${Y.provider}, deploys on push to '${Y.branch}').`),e("Next: commit it and add your provider credentials as CI secrets/variables.")}catch(m){r(`Quick deploy setup failed: ${m.message}`),process.exitCode=1}}),D.command("down","Put the serverless app into maintenance mode (503)").option("--env <environment>","Environment (production, staging, development)").option("--secret <secret>","Bypass secret (send as x-maintenance-bypass header)").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{setMaintenance:_}=await import("./chunk-w68hker6.js");await _(m,A,!0,t?.secret)}catch(m){r(`Failed to enable maintenance mode: ${m.message}`),process.exitCode=1}}),D.command("up","Bring the serverless app out of maintenance mode").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{setMaintenance:_}=await import("./chunk-w68hker6.js");await _(m,A,!1)}catch(m){r(`Failed to disable maintenance mode: ${m.message}`),process.exitCode=1}}),D.command("command <cmd>","Run a command on the serverless CLI function (e.g. migrations)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let A=await Ee(),_=m?.env||"production",{runAndRecordCommand:z}=await import("./chunk-w68hker6.js"),{id:U,output:Y}=await z(A,_,t);if(e(Y),U>0)e(`
+(recorded as #${U} — re-run with \`cloud command:again ${U}\`)`)}catch(A){r(`Command failed: ${A.message}`),process.exitCode=1}}),D.command("command:history","List recorded CLI-function command invocations").option("--env <environment>","Environment (production, staging, development)").option("--limit <n>","Show at most this many (most recent)",{default:"20"}).action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{listCommandHistory:_}=await import("./chunk-w68hker6.js"),z=await _(m,A);if(!z.length){e("No command history yet.");return}let U=Number(t?.limit??20);i(`Command history — ${m.project.slug} (${A})`),c(["#","When","Status","Command"],z.slice(-U).reverse().map((Y)=>[String(Y.id),Y.timestamp,Y.status,Y.command]))}catch(m){r(`Failed to read history: ${m.message}`),process.exitCode=1}}),D.command("command:again [id]","Re-run a recorded command (defaults to the most recent)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let A=await Ee(),_=m?.env||"production",{getCommandRecord:z,runAndRecordCommand:U}=await import("./chunk-w68hker6.js"),Y=await z(A,_,t?Number(t):void 0);if(!Y){r(t?`No command #${t} in history.`:"No command history to re-run."),process.exitCode=1;return}e(`Re-running #${Y.id}: ${Y.command}`);let X=await U(A,_,Y.command);if(e(X.output),X.id>0)e(`
+(recorded as #${X.id})`)}catch(A){r(`Command failed: ${A.message}`),process.exitCode=1}}),D.command("serverless:db-shell <sql>","Run a SQL statement against a private serverless database (via the CLI function)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m)=>{try{let A=await Ee(),_=m?.env||"production",{runDbQuery:z}=await import("./chunk-w68hker6.js"),U=await z(A,_,t);e(U)}catch(A){r(`Query failed: ${A.message}`),process.exitCode=1}}),D.command("serverless:db-scale <min> <max>","Rescale the serverless Aurora cluster (min/max ACUs)").option("--env <environment>","Environment (production, staging, development)").action(async(t,m,A)=>{i("Scaling serverless database");try{let _=await Ee(),z=A?.env||"production",U=Number(t),Y=Number(m);if(!(U>0)||!(Y>=U)){r("Provide valid capacities: min > 0 and max >= min (e.g. `serverless:db-scale 0.5 8`)."),process.exitCode=1;return}let{scaleServerlessDatabase:X}=await import("./chunk-w68hker6.js");await X(_,z,U,Y)}catch(_){r(`Scale failed: ${_.message}`),process.exitCode=1}}),D.command("serverless:db-restore","Restore the serverless Aurora cluster to a point in time (as a new cluster)").option("--env <environment>","Environment (production, staging, development)").option("--to <timestamp>","Restore to this ISO-8601 time (UTC)").option("--latest","Restore to the latest restorable time").option("--target <id>","New cluster identifier (defaults to <cluster>-restore-<stamp>)").action(async(t)=>{i("Restoring serverless database");try{let m=await Ee(),A=t?.env||"production",_;if(t?.to){if(_=new Date(t.to),Number.isNaN(_.getTime())){r(`Invalid --to timestamp: ${t.to} (use ISO-8601, e.g. 2026-06-18T10:00:00Z).`),process.exitCode=1;return}}let{restoreServerlessDatabase:z}=await import("./chunk-w68hker6.js");await z(m,A,{toTime:_,latest:t?.latest,target:t?.target})}catch(m){r(`Restore failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:info","Show an operational summary of a deployed serverless app").option("--env <environment>","Environment (production, staging, development)").action(async(t)=>{try{let m=await Ee(),A=t?.env||"production",{serverlessInfo:_}=await import("./chunk-w68hker6.js"),z=await _(m,A);if(i(`${z.slug} (${z.environment})`),e(`Stack:    ${z.stackStatus}`),e(`Region:   ${z.region}`),z.endpoint)e(`URL:      ${z.endpoint}`);if(z.assetUrl)e(`Assets:   ${z.assetUrl}`);if(e(`Scheduler:${z.scheduler==="off"?" off":` ${z.scheduler}`}`),e(`Queues:   ${z.queues.length?z.queues.join(", "):"none"}`),e(`Warming:  ${z.provisionedConcurrency>0?`provisioned concurrency ×${z.provisionedConcurrency}`:"none / ping-warm"}`),z.lastRelease)e(`Release:  ${z.lastRelease.sha.slice(0,12)} @ ${z.lastRelease.timestamp}`);c(["Function","Version","Provisioned"],z.functions.map((U)=>[U.name,U.version,U.provisioned?`${U.provisioned.status} ${U.provisioned.allocated}/${U.provisioned.requested}`:"—"]))}catch(m){r(`Failed to read info: ${m.message}`),process.exitCode=1}}),D.command("dashboard:build","Build the management dashboard with live data baked in").option("--env <environment>","Environment (production, staging, development)").option("--ui <dir>","UI directory (default ./ui)",{default:"ui"}).action(async(t)=>{i("Building management dashboard (live data)");try{let{existsSync:m}=await import("node:fs"),A=t?.ui||"ui";if(!m(`${A}/package.json`)){r(`No UI project at ${A}/ (expected ${A}/package.json). Pass --ui <dir>.`),process.exitCode=1;return}let _=await Ee(),z=t?.env||"production";p("Gathering live data from AWS");let U=null;if(_.environments?.[z]?.app){let{resolveDashboardData:re}=await import("./chunk-y4pfvx0x.js"),oe=await re(_,z).catch((fe)=>(a(`Serverless data unavailable (${fe.message}) — that view uses sample data.`),null));if(oe)U={...U??{},...oe}}if(_.infrastructure?.compute){let{resolveServerDashboardData:re}=await import("./chunk-7s3wtq40.js"),oe=await re(_,z).catch(()=>null);if(oe){if(oe._serverReachable===!1)a("Server box not reachable over SSM — server view uses config + sample data.");U={...U??{},...oe}}}p("Building dashboard");let{encodeDashboardPayload:Y}=await import("./chunk-1k9sw5y7.js"),{execSync:X}=await import("node:child_process"),{rmSync:ne}=await import("node:fs");for(let re of[".stx/ssg-cache",".stx/cache"])ne(`${A}/${re}`,{recursive:!0,force:!0});X("bun run build",{cwd:A,stdio:"inherit",env:{...process.env,...U?{TSCLOUD_DASHBOARD_DATA:Y(U)}:{}}}),n(`Dashboard built → ${A}/dist${U?" (live data)":" (sample data)"}`)}catch(m){r(`Dashboard build failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:build-php-layer","Build + publish the ts-cloud PHP runtime layer (requires Docker)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--php <version>","PHP version",{default:"8.3"}).option("--name <name>","Layer name",{default:"tscloud-php"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building PHP runtime layer");try{let m=await Ee().catch(()=>null),A=t?.region||m?.project.region||"us-east-1",_=t?.arch||"x86_64",z=t?.php||"8.3",U=`${t?.name||"tscloud-php"}-${z.replace(".","")}-${_}`,Y=t?.bucket||`${m?.project.slug||"tscloud"}-layers`,{buildPhpRuntimeLayerZip:X}=await import("./chunk-x8wvsf1k.js"),{S3Client:ne}=await import("./chunk-dzx0w4zb.js"),{LambdaClient:re}=await import("./chunk-2rcwhdx9.js"),oe=X({architecture:_,phpVersion:z,onStep:(Re)=>p(Re)});e(`Layer: ${oe.fileCount} files, ${(oe.zip.length/1024/1024).toFixed(1)} MB`);let fe=new ne(A);if(!await fe.bucketExists(Y))p(`Creating layer bucket ${Y}`),await fe.createBucket(Y);let $e=`layers/${U}.zip`;p("Uploading layer zip"),await fe.putObject({bucket:Y,key:$e,body:oe.zip,contentType:"application/zip"}),p("Publishing layer version");let he=await new re(A).publishLayerVersion({LayerName:U,Description:`ts-cloud PHP ${z} runtime (${_})`,Content:{S3Bucket:Y,S3Key:$e},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[_]});ve(["PHP runtime layer published","",`ARN: ${he.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'php', layers: ['${he.LayerVersionArn}'] }`,"or set TSCLOUD_PHP_LAYER_ARN before deploying."].join(`
+`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:build-node-layer","Build + publish a ts-cloud Node custom runtime layer (any version, incl. 24)").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--node <version>","Node version (e.g. 24)",{default:"24"}).option("--name <name>","Layer name",{default:"tscloud-node"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building Node runtime layer");try{let m=await Ee().catch(()=>null),A=t?.region||m?.project.region||"us-east-1",_=t?.arch||"x86_64",z=t?.node||"24",{buildNodeRuntimeLayerZip:U}=await import("./chunk-x8wvsf1k.js"),{S3Client:Y}=await import("./chunk-dzx0w4zb.js"),{LambdaClient:X}=await import("./chunk-2rcwhdx9.js"),ne=U({architecture:_,version:z,onStep:(Re)=>p(Re)}),re=`${t?.name||"tscloud-node"}-${ne.version.split(".")[0]}-${_}`,oe=t?.bucket||`${m?.project.slug||"tscloud"}-layers`;e(`Layer: Node ${ne.version}, ${(ne.zip.length/1024/1024).toFixed(1)} MB`);let fe=new Y(A);if(!await fe.bucketExists(oe))p(`Creating layer bucket ${oe}`),await fe.createBucket(oe);let $e=`layers/${re}.zip`;p("Uploading layer zip"),await fe.putObject({bucket:oe,key:$e,body:ne.zip,contentType:"application/zip"}),p("Publishing layer version");let he=await new X(A).publishLayerVersion({LayerName:re,Description:`ts-cloud Node ${ne.version} runtime (${_})`,Content:{S3Bucket:oe,S3Key:$e},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[_]});ve(["Node runtime layer published","",`ARN: ${he.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'node', runtimeVersion: '${ne.version.split(".")[0]}', layers: ['${he.LayerVersionArn}'] }`,"or set TSCLOUD_NODE_LAYER_ARN before deploying."].join(`
+`),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),D.command("serverless:build-bun-layer","Build + publish a ts-cloud Bun custom runtime layer").option("--arch <architecture>","x86_64 or arm64",{default:"x86_64"}).option("--bun <version>",'Bun version (e.g. 1.3.13, or "latest")',{default:"latest"}).option("--name <name>","Layer name",{default:"tscloud-bun"}).option("--bucket <bucket>","S3 bucket to stage the layer zip (defaults to {slug}-layers)").option("--region <region>","AWS region").action(async(t)=>{i("Building Bun runtime layer");try{let m=await Ee().catch(()=>null),A=t?.region||m?.project.region||"us-east-1",_=t?.arch||"x86_64",z=t?.bun||"latest",{buildBunRuntimeLayerZip:U}=await import("./chunk-x8wvsf1k.js"),{S3Client:Y}=await import("./chunk-dzx0w4zb.js"),{LambdaClient:X}=await import("./chunk-2rcwhdx9.js"),ne=U({architecture:_,version:z,onStep:(Re)=>p(Re)}),re=`${t?.name||"tscloud-bun"}-${ne.version.replace(/\./g,"")}-${_}`,oe=t?.bucket||`${m?.project.slug||"tscloud"}-layers`;e(`Layer: Bun ${ne.version}, ${(ne.zip.length/1024/1024).toFixed(1)} MB`);let fe=new Y(A);if(!await fe.bucketExists(oe))p(`Creating layer bucket ${oe}`),await fe.createBucket(oe);let $e=`layers/${re}.zip`;p("Uploading layer zip"),await fe.putObject({bucket:oe,key:$e,body:ne.zip,contentType:"application/zip"}),p("Publishing layer version");let he=await new X(A).publishLayerVersion({LayerName:re,Description:`ts-cloud Bun ${ne.version} runtime (${_})`,Content:{S3Bucket:oe,S3Key:$e},CompatibleRuntimes:["provided.al2023"],CompatibleArchitectures:[_]});ve(["Bun runtime layer published","",`ARN: ${he.LayerVersionArn}`,"","Reference it in your config:",`  app: { kind: 'bun', layers: ['${he.LayerVersionArn}'] }`,"or set TSCLOUD_BUN_LAYER_ARN before deploying."].join(`
 `),"green")}catch(m){r(`Layer build failed: ${m.message}`),process.exitCode=1}}),D.command("deploy:status","Check deployment status").option("--stack <name>","Stack name").option("--env <environment>","Environment").action(async(t)=>{i("Deployment Status");try{let m=await Ee(),A=t?.env||"production",_=t?.stack||T(m,A),z=m.project.region||"us-east-1";e(`Stack: ${_}`),e(`Region: ${z}`);let U=new o("Checking deployment status...");U.start();let X=await new v(z).describeStacks({stackName:_});if(X.Stacks.length===0){U.fail("Stack not found"),Er("No deployment found for this environment");return}let ne=X.Stacks[0];if(U.succeed("Status retrieved"),e(`
 Status: ${ne.StackStatus}`),e(`Created: ${ne.CreationTime}`),ne.LastUpdatedTime)e(`Last Updated: ${ne.LastUpdatedTime}`);if(ne.Outputs&&ne.Outputs.length>0){e(`
 Outputs:`);for(let re of ne.Outputs)e(`  ${re.OutputKey}: ${re.OutputValue}`)}}catch(m){r(`Failed to get status: ${m.message}`)}}),D.command("deploy:rollback","Rollback to previous version").option("--stack <name>","Stack name").option("--env <environment>","Environment").action(async(t)=>{i("Rolling Back Deployment");try{let m=await Ee(),A=t?.env||"production",_=t?.stack||T(m,A),z=m.project.region||"us-east-1";if(e(`Stack: ${_}`),e(`Region: ${z}`),!await d(`
@@ -457,7 +457,7 @@ Resources (${X.StackResourceSummaries.length}):`);let ne=["Logical ID","Type","S
 ... and ${X.StackResourceSummaries.length-10} more resources`)}}catch(m){r(`Failed to describe stack: ${m.message}`)}}),D.command("stack:delete STACK_NAME","Delete a CloudFormation stack").option("--yes","Skip the confirmation prompt").action(async(t,m)=>{i(`Delete Stack: ${t}`);try{let _=(await Ee()).project.region||"us-east-1";if(a("This will permanently delete the stack and all its resources!"),!(m?.yes||await d(`
 Are you sure you want to delete this stack?`,!1))){e("Deletion cancelled");return}let U=new v(_),Y=new o("Deleting stack...");Y.start(),await U.deleteStack(t),Y.succeed("Stack deletion initiated"),p("Waiting for stack deletion..."),await U.waitForStack(t,"stack-delete-complete"),n("Stack deleted successfully!")}catch(A){r(`Failed to delete stack: ${A.message}`)}}),D.command("stack:events STACK_NAME","Show stack events").option("--limit <number>","Limit number of events",{default:"20"}).action(async(t,m)=>{i(`Stack Events: ${t}`);try{let _=(await Ee()).project.region||"us-east-1",z=new v(_),U=new o("Loading events...");U.start();let Y=await z.describeStackEvents(t);U.succeed(`Found ${Y.StackEvents.length} events`);let X=m?.limit?Number.parseInt(m.limit):20,ne=Y.StackEvents.slice(0,X);if(ne.length===0){e("No events found");return}let re=["Time","Resource","Status","Reason"],oe=ne.map((fe)=>[new Date(fe.Timestamp).toLocaleString(),fe.LogicalResourceId,fe.ResourceStatus,fe.ResourceStatusReason||""]);c(re,oe)}catch(A){r(`Failed to load events: ${A.message}`)}}),D.command("stack:outputs STACK_NAME","Show stack outputs").action(async(t)=>{i(`Stack Outputs: ${t}`);try{let A=(await Ee()).project.region||"us-east-1",_=new v(A),z=new o("Loading stack outputs...");z.start();let U=await _.describeStacks({stackName:t});if(!U.Stacks||U.Stacks.length===0){z.fail("Stack not found");return}let Y=U.Stacks[0];if(z.succeed("Stack outputs loaded"),!Y.Outputs||Y.Outputs.length===0){e("No outputs found for this stack");return}let X=["Key","Value","Description","Export Name"],ne=Y.Outputs.map((re)=>[re.OutputKey||"",re.OutputValue||"",re.Description||"",re.ExportName||""]);c(X,ne),e(`
 Copy-friendly format:`);for(let re of Y.Outputs)e(`${re.OutputKey}=${re.OutputValue}`)}catch(m){r(`Failed to load outputs: ${m.message}`)}}),D.command("stack:export STACK_NAME","Export stack template").option("--output <file>","Output file path").option("--format <format>","Output format (json or yaml)",{default:"json"}).action(async(t,m)=>{i(`Export Stack: ${t}`);try{let _=(await Ee()).project.region||"us-east-1",z=new v(_),U=new o("Fetching stack template...");U.start();let Y=await z.getTemplate(t);if(!Y.TemplateBody){U.fail("Template not found");return}U.succeed("Template fetched");let X=m?.format||"json",ne=Y.TemplateBody;if(X==="json"){let re=JSON.parse(ne);ne=JSON.stringify(re,null,2)}if(m?.output){let re=m.output;hf(re,ne,"utf-8"),n(`Template exported to: ${re}`);let fe=(gf(re).size/1024).toFixed(2);e(`File size: ${fe} KB`)}else e(`
-Template:`),console.log(ne)}catch(A){r(`Failed to export template: ${A.message}`)}})}import{existsSync as yf}from"node:fs";function _c(D,t){D.command("upgrade","Upgrade CLI to latest version").action(async()=>{Fn("upgrade",{message:`Self-update is disabled for this ${t} build because no signed update-manifest source is configured.`,nextAction:"Install a verified release with your package manager or configure platform maintenance updates."})}),D.command("doctor","Check system requirements and AWS credentials").action(async()=>{if(i("System Diagnostics"),p("Checking Bun..."),n(`Bun ${process.versions.bun}`),p("Checking AWS CLI..."),await _o())n("AWS CLI is installed");else r("AWS CLI is not installed"),e("Install: https://aws.amazon.com/cli/");if(p("Checking AWS credentials..."),await Oo()){n("AWS credentials are configured");let z=await $o();if(z)e(`Account ID: ${z}`)}else r("AWS credentials are not configured"),e("Run: aws configure");p("Checking CloudFront list access...");let _=!1;try{let{CloudFrontClient:z}=await import("./chunk-h5darb19.js");await new z().listDistributions(),n("CloudFront list access is enabled"),_=!0}catch(z){a(`CloudFront list check failed: ${z.message}`)}if(_){p("Checking CloudFront create access...");try{let z=new v("us-east-1"),U=JSON.stringify({AWSTemplateFormatVersion:"2010-09-09",Description:"Test CloudFront access",Resources:{TestOAC:{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:"test-oac-validation",OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}}}});await z.validateTemplate(U),n("CloudFront create access appears enabled")}catch(z){if(z.message?.includes("403")||z.message?.includes("AccessDenied")||z.message?.includes("must be verified"))r("CloudFront create access denied - account verification required"),e(""),e("Your AWS account needs to be verified for CloudFront."),e("This is required before you can create CloudFront distributions."),e(""),e("To verify your account:"),e("  1. Go to: https://console.aws.amazon.com/support/home#/"),e("  2. Create a support case"),e("  3. Select: Service limit increase > CloudFront"),e('  4. Request: "Please verify my account for CloudFront access"'),e(""),e("Verification usually takes 1-2 business days.");else n("CloudFront create access appears enabled (validation passed)")}}p("Checking S3 access...");try{let{S3Client:z}=await import("./chunk-s4x1pb7n.js");await new z("us-east-1").listBuckets(),n("S3 access is enabled")}catch(z){a(`S3 check failed: ${z.message}`)}p("Checking ACM (SSL certificates) access...");try{await new W("us-east-1").listCertificates(),n("ACM access is enabled")}catch(z){a(`ACM check failed: ${z.message}`)}if(p("Checking configuration..."),yf("cloud.config.ts"))n("cloud.config.ts found");else a("cloud.config.ts not found"),e("Run: cloud init")}),D.command("regions","List available AWS regions").action(async()=>{i("AWS Regions");let m=new o("Fetching regions...");m.start();let A=await Lo();m.stop(),A.forEach((_)=>{console.log(`  ${_}`)})}),D.command("version","Show the version of the CLI").alias("v").action(()=>{console.log(`ts-cloud v${t}`)})}function zc(D){D.command("analytics:sites:list","List all analytics sites").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t)=>{i("Analytics Sites");try{let m=new G(t.region),A=new o("Fetching sites...");A.start();let _=await m.scan({TableName:t.table,FilterExpression:"begins_with(pk, :pk)",ExpressionAttributeValues:{":pk":{S:"SITE#"}}});if(A.succeed(`Found ${_.Items?.length||0} site(s)`),!_.Items||_.Items.length===0){e("No analytics sites found"),e("Use `cloud analytics:sites:create` to create a new site");return}let z=_.Items.map((U)=>G.unmarshal(U));c(["ID","Name","Domains","Active","Created"],z.map((U)=>[U.siteId||"N/A",U.name||"Unnamed",(U.domains||[]).join(", ")||"-",U.isActive?"Yes":"No",U.createdAt?new Date(U.createdAt).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list sites: ${m.message}`),process.exit(1)}}),D.command("analytics:sites:create","Create a new analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","Site name").option("--domain <domain>","Site domain(s) (can be specified multiple times)").action(async(t)=>{i("Create Analytics Site");try{let m=new G(t.region),A=t.name||await R("Site name","My Site"),_=[];if(t.domain)_=Array.isArray(t.domain)?t.domain:[t.domain];else _=(await R("Site domains (comma-separated)","example.com")).split(",").map((re)=>re.trim()).filter(Boolean);if(e(`
+Template:`),console.log(ne)}catch(A){r(`Failed to export template: ${A.message}`)}})}import{existsSync as yf}from"node:fs";function _c(D,t){D.command("upgrade","Upgrade CLI to latest version").action(async()=>{Fn("upgrade",{message:`Self-update is disabled for this ${t} build because no signed update-manifest source is configured.`,nextAction:"Install a verified release with your package manager or configure platform maintenance updates."})}),D.command("doctor","Check system requirements and AWS credentials").action(async()=>{if(i("System Diagnostics"),p("Checking Bun..."),n(`Bun ${process.versions.bun}`),p("Checking AWS CLI..."),await _o())n("AWS CLI is installed");else r("AWS CLI is not installed"),e("Install: https://aws.amazon.com/cli/");if(p("Checking AWS credentials..."),await Oo()){n("AWS credentials are configured");let z=await $o();if(z)e(`Account ID: ${z}`)}else r("AWS credentials are not configured"),e("Run: aws configure");p("Checking CloudFront list access...");let _=!1;try{let{CloudFrontClient:z}=await import("./chunk-h5darb19.js");await new z().listDistributions(),n("CloudFront list access is enabled"),_=!0}catch(z){a(`CloudFront list check failed: ${z.message}`)}if(_){p("Checking CloudFront create access...");try{let z=new v("us-east-1"),U=JSON.stringify({AWSTemplateFormatVersion:"2010-09-09",Description:"Test CloudFront access",Resources:{TestOAC:{Type:"AWS::CloudFront::OriginAccessControl",Properties:{OriginAccessControlConfig:{Name:"test-oac-validation",OriginAccessControlOriginType:"s3",SigningBehavior:"always",SigningProtocol:"sigv4"}}}}});await z.validateTemplate(U),n("CloudFront create access appears enabled")}catch(z){if(z.message?.includes("403")||z.message?.includes("AccessDenied")||z.message?.includes("must be verified"))r("CloudFront create access denied - account verification required"),e(""),e("Your AWS account needs to be verified for CloudFront."),e("This is required before you can create CloudFront distributions."),e(""),e("To verify your account:"),e("  1. Go to: https://console.aws.amazon.com/support/home#/"),e("  2. Create a support case"),e("  3. Select: Service limit increase > CloudFront"),e('  4. Request: "Please verify my account for CloudFront access"'),e(""),e("Verification usually takes 1-2 business days.");else n("CloudFront create access appears enabled (validation passed)")}}p("Checking S3 access...");try{let{S3Client:z}=await import("./chunk-dzx0w4zb.js");await new z("us-east-1").listBuckets(),n("S3 access is enabled")}catch(z){a(`S3 check failed: ${z.message}`)}p("Checking ACM (SSL certificates) access...");try{await new W("us-east-1").listCertificates(),n("ACM access is enabled")}catch(z){a(`ACM check failed: ${z.message}`)}if(p("Checking configuration..."),yf("cloud.config.ts"))n("cloud.config.ts found");else a("cloud.config.ts not found"),e("Run: cloud init")}),D.command("regions","List available AWS regions").action(async()=>{i("AWS Regions");let m=new o("Fetching regions...");m.start();let A=await Lo();m.stop(),A.forEach((_)=>{console.log(`  ${_}`)})}),D.command("version","Show the version of the CLI").alias("v").action(()=>{console.log(`ts-cloud v${t}`)})}function zc(D){D.command("analytics:sites:list","List all analytics sites").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t)=>{i("Analytics Sites");try{let m=new G(t.region),A=new o("Fetching sites...");A.start();let _=await m.scan({TableName:t.table,FilterExpression:"begins_with(pk, :pk)",ExpressionAttributeValues:{":pk":{S:"SITE#"}}});if(A.succeed(`Found ${_.Items?.length||0} site(s)`),!_.Items||_.Items.length===0){e("No analytics sites found"),e("Use `cloud analytics:sites:create` to create a new site");return}let z=_.Items.map((U)=>G.unmarshal(U));c(["ID","Name","Domains","Active","Created"],z.map((U)=>[U.siteId||"N/A",U.name||"Unnamed",(U.domains||[]).join(", ")||"-",U.isActive?"Yes":"No",U.createdAt?new Date(U.createdAt).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list sites: ${m.message}`),process.exit(1)}}),D.command("analytics:sites:create","Create a new analytics site").option("--table <name>","DynamoDB table name",{default:"ts-analytics"}).option("--region <region>","AWS region",{default:"us-east-1"}).option("--name <name>","Site name").option("--domain <domain>","Site domain(s) (can be specified multiple times)").action(async(t)=>{i("Create Analytics Site");try{let m=new G(t.region),A=t.name||await R("Site name","My Site"),_=[];if(t.domain)_=Array.isArray(t.domain)?t.domain:[t.domain];else _=(await R("Site domains (comma-separated)","example.com")).split(",").map((re)=>re.trim()).filter(Boolean);if(e(`
 Creating site: ${A}`),e(`Domains: ${_.join(", ")}`),!await d(`
 Create this site?`,!0)){e("Operation cancelled");return}let U=new o("Creating site...");U.start();let Y=`site_${Date.now()}_${Math.random().toString(36).substring(2,9)}`,X=new Date().toISOString();await m.putItem({TableName:t.table,Item:{pk:{S:`SITE#${Y}`},sk:{S:`SITE#${Y}`},siteId:{S:Y},name:{S:A},domains:{L:_.map((ne)=>({S:ne}))},isActive:{BOOL:!0},createdAt:{S:X},updatedAt:{S:X}}}),U.succeed("Site created successfully"),n(`
 Site ID: ${Y}`),e(`
@@ -629,7 +629,7 @@ Full Event Record:`);let ne=JSON.parse(X.CloudTrailEvent);console.log(JSON.strin
 Create this trail?`,!0)){e("Operation cancelled");return}let z=new o("Creating trail...");z.start();let U=await A.createTrail({Name:t,S3BucketName:m.bucket,S3KeyPrefix:m.prefix,IsMultiRegionTrail:m.multiRegion,EnableLogFileValidation:m.validation,IncludeGlobalServiceEvents:m.globalEvents??!0});z.text="Starting logging...",await A.startLogging(t),z.succeed("Trail created and logging started"),n(`
 Trail ARN: ${U.TrailARN}`),e(`S3 Bucket: ${U.S3BucketName}`)}catch(A){r(`Failed to create trail: ${A.message}`),process.exit(1)}}),D.command("audit:start <trailName>","Start CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Start CloudTrail Logging");try{let A=await Ki(m.region),_=new o("Starting logging...");_.start(),await A.startLogging(t),_.succeed("Logging started")}catch(A){r(`Failed to start logging: ${A.message}`),process.exit(1)}}),D.command("audit:stop <trailName>","Stop CloudTrail logging").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Stop CloudTrail Logging");try{let A=await Ki(m.region);if(a(`This will stop logging for trail: ${t}`),!await d(`
 Stop logging?`,!1)){e("Operation cancelled");return}let z=new o("Stopping logging...");z.start(),await A.stopLogging(t),z.succeed("Logging stopped")}catch(A){r(`Failed to stop logging: ${A.message}`),process.exit(1)}}),D.command("audit:delete <trailName>","Delete a CloudTrail trail").option("--region <region>","AWS region",{default:"us-east-1"}).action(async(t,m)=>{i("Delete CloudTrail Trail");try{let A=await Ki(m.region);if(a(`This will permanently delete trail: ${t}`),!await d(`
-Delete this trail?`,!1)){e("Operation cancelled");return}let z=new o("Deleting trail...");z.start(),await A.deleteTrail(t),z.succeed("Trail deleted")}catch(A){r(`Failed to delete trail: ${A.message}`),process.exit(1)}})}function rl(D){D.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let m=await Ee(),A=t.region||m.project.region||"us-east-1";e(`Region: ${A}`),e(`Project: ${m.project.name||"Unknown"}`),e("");let _=[],z=new o("Checking EC2 instances...");z.start();try{let{EC2Client:he}=await import("./chunk-p5k5z7gm.js"),Te=await new he(A).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),Ae=0,Pe=0,xe=0;for(let We of Te.Reservations||[])for(let Be of We.Instances||[])if(xe++,Be.State?.Name==="running")Ae++;else if(Be.State?.Name==="stopped")Pe++;z.succeed("EC2 instances checked"),_.push({name:"EC2 Instances",status:Ae>0?"OK":xe>0?"WARN":"INFO",details:`${Ae} running, ${Pe} stopped, ${xe} total`})}catch(he){z.fail("EC2 check failed"),_.push({name:"EC2 Instances",status:"ERROR",details:he.message})}let U=new o("Checking RDS instances...");U.start();try{let{RDSClient:he}=await import("./chunk-tj589nbw.js"),Ae=(await new he(A).describeDBInstances()).DBInstances||[],Pe=Ae.filter((xe)=>xe.DBInstanceStatus==="available").length;U.succeed("RDS instances checked"),_.push({name:"RDS Databases",status:Ae.length>0&&Pe===Ae.length?"OK":Ae.length>0?"WARN":"INFO",details:`${Pe} available, ${Ae.length} total`})}catch(he){U.fail("RDS check failed"),_.push({name:"RDS Databases",status:"ERROR",details:he.message})}let Y=new o("Checking Lambda functions...");Y.start();try{let{LambdaClient:he}=await import("./chunk-2rcwhdx9.js"),Ae=(await new he(A).listFunctions()).Functions||[];Y.succeed("Lambda functions checked"),_.push({name:"Lambda Functions",status:"OK",details:`${Ae.length} function(s)`})}catch(he){Y.fail("Lambda check failed"),_.push({name:"Lambda Functions",status:"ERROR",details:he.message})}let X=new o("Checking S3 buckets...");X.start();try{let{S3Client:he}=await import("./chunk-s4x1pb7n.js"),Ae=(await new he(A).listBuckets()).Buckets||[];X.succeed("S3 buckets checked"),_.push({name:"S3 Buckets",status:"OK",details:`${Ae.length} bucket(s)`})}catch(he){X.fail("S3 check failed"),_.push({name:"S3 Buckets",status:"ERROR",details:he.message})}let ne=new o("Checking CloudFront distributions...");ne.start();try{let{CloudFrontClient:he}=await import("./chunk-h5darb19.js"),Te=await new he().listDistributions(),Ae=Te.filter((Pe)=>Pe.Status==="Deployed").length;ne.succeed("CloudFront checked"),_.push({name:"CloudFront",status:Te.length>0&&Ae===Te.length?"OK":Te.length>0?"WARN":"INFO",details:`${Ae} deployed, ${Te.length} total`})}catch(he){ne.fail("CloudFront check failed"),_.push({name:"CloudFront",status:"ERROR",details:he.message})}let re=new o("Checking SQS queues...");re.start();try{let{SQSClient:he}=await import("./chunk-dd567z84.js"),Ae=(await new he(A).listQueues()).QueueUrls||[];re.succeed("SQS queues checked"),_.push({name:"SQS Queues",status:"OK",details:`${Ae.length} queue(s)`})}catch(he){re.fail("SQS check failed"),_.push({name:"SQS Queues",status:"ERROR",details:he.message})}let oe=new o("Checking CloudFormation stacks...");oe.start();try{let{CloudFormationClient:he}=await import("./chunk-683zr91n.js"),Ae=(await new he(A).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Pe=Ae.filter((Be)=>Be.StackStatus==="CREATE_COMPLETE"||Be.StackStatus==="UPDATE_COMPLETE").length,xe=Ae.filter((Be)=>Be.StackStatus?.includes("IN_PROGRESS")).length,We=Ae.filter((Be)=>Be.StackStatus?.includes("ROLLBACK")).length;oe.succeed("CloudFormation checked"),_.push({name:"CloudFormation",status:We>0?"WARN":xe>0?"INFO":"OK",details:`${Pe} healthy, ${xe} in progress, ${We} rolled back`})}catch(he){oe.fail("CloudFormation check failed"),_.push({name:"CloudFormation",status:"ERROR",details:he.message})}let fe=new o("Checking SSL certificates...");fe.start();try{let{ACMClient:he}=await import("./chunk-hc4s84v1.js"),Re=new he("us-east-1"),Ae=(await Re.listCertificates()).CertificateSummaryList||[],Pe=await Promise.all(Ae.map((Ue)=>Re.describeCertificate({CertificateArn:Ue.CertificateArn}))),xe=Pe.filter((Ue)=>Ue.Status==="ISSUED").length,We=Pe.filter((Ue)=>Ue.Status==="PENDING_VALIDATION").length,Be=Pe.filter((Ue)=>{if(Ue.NotAfter)return(new Date(Ue.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;fe.succeed("SSL certificates checked"),_.push({name:"SSL Certificates",status:Be>0?"WARN":We>0?"INFO":"OK",details:`${xe} issued, ${We} pending${Be>0?`, ${Be} expiring soon`:""}`})}catch(he){fe.fail("ACM check failed"),_.push({name:"SSL Certificates",status:"ERROR",details:he.message})}e(`
+Delete this trail?`,!1)){e("Operation cancelled");return}let z=new o("Deleting trail...");z.start(),await A.deleteTrail(t),z.succeed("Trail deleted")}catch(A){r(`Failed to delete trail: ${A.message}`),process.exit(1)}})}function rl(D){D.command("status","Show overall infrastructure health dashboard").option("--region <region>","AWS region").action(async(t)=>{i("Infrastructure Status Dashboard");try{let m=await Ee(),A=t.region||m.project.region||"us-east-1";e(`Region: ${A}`),e(`Project: ${m.project.name||"Unknown"}`),e("");let _=[],z=new o("Checking EC2 instances...");z.start();try{let{EC2Client:he}=await import("./chunk-p5k5z7gm.js"),Te=await new he(A).describeInstances({Filters:[{Name:"instance-state-name",Values:["running","pending","stopping","stopped"]}]}),Ae=0,Pe=0,xe=0;for(let We of Te.Reservations||[])for(let Be of We.Instances||[])if(xe++,Be.State?.Name==="running")Ae++;else if(Be.State?.Name==="stopped")Pe++;z.succeed("EC2 instances checked"),_.push({name:"EC2 Instances",status:Ae>0?"OK":xe>0?"WARN":"INFO",details:`${Ae} running, ${Pe} stopped, ${xe} total`})}catch(he){z.fail("EC2 check failed"),_.push({name:"EC2 Instances",status:"ERROR",details:he.message})}let U=new o("Checking RDS instances...");U.start();try{let{RDSClient:he}=await import("./chunk-tj589nbw.js"),Ae=(await new he(A).describeDBInstances()).DBInstances||[],Pe=Ae.filter((xe)=>xe.DBInstanceStatus==="available").length;U.succeed("RDS instances checked"),_.push({name:"RDS Databases",status:Ae.length>0&&Pe===Ae.length?"OK":Ae.length>0?"WARN":"INFO",details:`${Pe} available, ${Ae.length} total`})}catch(he){U.fail("RDS check failed"),_.push({name:"RDS Databases",status:"ERROR",details:he.message})}let Y=new o("Checking Lambda functions...");Y.start();try{let{LambdaClient:he}=await import("./chunk-2rcwhdx9.js"),Ae=(await new he(A).listFunctions()).Functions||[];Y.succeed("Lambda functions checked"),_.push({name:"Lambda Functions",status:"OK",details:`${Ae.length} function(s)`})}catch(he){Y.fail("Lambda check failed"),_.push({name:"Lambda Functions",status:"ERROR",details:he.message})}let X=new o("Checking S3 buckets...");X.start();try{let{S3Client:he}=await import("./chunk-dzx0w4zb.js"),Ae=(await new he(A).listBuckets()).Buckets||[];X.succeed("S3 buckets checked"),_.push({name:"S3 Buckets",status:"OK",details:`${Ae.length} bucket(s)`})}catch(he){X.fail("S3 check failed"),_.push({name:"S3 Buckets",status:"ERROR",details:he.message})}let ne=new o("Checking CloudFront distributions...");ne.start();try{let{CloudFrontClient:he}=await import("./chunk-h5darb19.js"),Te=await new he().listDistributions(),Ae=Te.filter((Pe)=>Pe.Status==="Deployed").length;ne.succeed("CloudFront checked"),_.push({name:"CloudFront",status:Te.length>0&&Ae===Te.length?"OK":Te.length>0?"WARN":"INFO",details:`${Ae} deployed, ${Te.length} total`})}catch(he){ne.fail("CloudFront check failed"),_.push({name:"CloudFront",status:"ERROR",details:he.message})}let re=new o("Checking SQS queues...");re.start();try{let{SQSClient:he}=await import("./chunk-dd567z84.js"),Ae=(await new he(A).listQueues()).QueueUrls||[];re.succeed("SQS queues checked"),_.push({name:"SQS Queues",status:"OK",details:`${Ae.length} queue(s)`})}catch(he){re.fail("SQS check failed"),_.push({name:"SQS Queues",status:"ERROR",details:he.message})}let oe=new o("Checking CloudFormation stacks...");oe.start();try{let{CloudFormationClient:he}=await import("./chunk-683zr91n.js"),Ae=(await new he(A).listStacks(["CREATE_COMPLETE","UPDATE_COMPLETE","CREATE_IN_PROGRESS","UPDATE_IN_PROGRESS","ROLLBACK_COMPLETE","UPDATE_ROLLBACK_COMPLETE"])).StackSummaries||[],Pe=Ae.filter((Be)=>Be.StackStatus==="CREATE_COMPLETE"||Be.StackStatus==="UPDATE_COMPLETE").length,xe=Ae.filter((Be)=>Be.StackStatus?.includes("IN_PROGRESS")).length,We=Ae.filter((Be)=>Be.StackStatus?.includes("ROLLBACK")).length;oe.succeed("CloudFormation checked"),_.push({name:"CloudFormation",status:We>0?"WARN":xe>0?"INFO":"OK",details:`${Pe} healthy, ${xe} in progress, ${We} rolled back`})}catch(he){oe.fail("CloudFormation check failed"),_.push({name:"CloudFormation",status:"ERROR",details:he.message})}let fe=new o("Checking SSL certificates...");fe.start();try{let{ACMClient:he}=await import("./chunk-hc4s84v1.js"),Re=new he("us-east-1"),Ae=(await Re.listCertificates()).CertificateSummaryList||[],Pe=await Promise.all(Ae.map((Ue)=>Re.describeCertificate({CertificateArn:Ue.CertificateArn}))),xe=Pe.filter((Ue)=>Ue.Status==="ISSUED").length,We=Pe.filter((Ue)=>Ue.Status==="PENDING_VALIDATION").length,Be=Pe.filter((Ue)=>{if(Ue.NotAfter)return(new Date(Ue.NotAfter).getTime()-Date.now())/86400000<30;return!1}).length;fe.succeed("SSL certificates checked"),_.push({name:"SSL Certificates",status:Be>0?"WARN":We>0?"INFO":"OK",details:`${xe} issued, ${We} pending${Be>0?`, ${Be} expiring soon`:""}`})}catch(he){fe.fail("ACM check failed"),_.push({name:"SSL Certificates",status:"ERROR",details:he.message})}e(`
 `+"=".repeat(60)),e("HEALTH SUMMARY"),e("=".repeat(60)+`
 `);for(let he of _){let Re="";if(he.status==="OK")Re=`${C.green}[OK]${C.reset}`;else if(he.status==="WARN")Re=`${C.yellow}[WARN]${C.reset}`;else if(he.status==="ERROR")Re=`${C.red}[ERROR]${C.reset}`;else Re=`${C.blue}[INFO]${C.reset}`;console.log(`${Re} ${he.name.padEnd(20)} ${he.details}`)}let $e=_.some((he)=>he.status==="ERROR"),Ie=_.some((he)=>he.status==="WARN");if(e(""),$e)r("Some services have errors. Check the details above.");else if(Ie)a("Some services need attention. Check the warnings above.");else n("All services are healthy!")}catch(m){r(`Failed to get status: ${m.message}`),process.exit(1)}}),D.command("status:costs","Show current month cost summary").option("--region <region>","AWS region").action(async(t)=>{i("Cost Summary");try{e("Fetching cost data from AWS Cost Explorer..."),e("");let m=new Date,A=new Date(m.getFullYear(),m.getMonth(),1),_=new Date(m.getFullYear(),m.getMonth()+1,0);e(`Period: ${A.toISOString().split("T")[0]} to ${_.toISOString().split("T")[0]}`),e(""),e("Note: Cost data requires AWS Cost Explorer API access."),e("Run `cloud cost` for detailed cost analysis.")}catch(m){r(`Failed to get cost summary: ${m.message}`),process.exit(1)}}),D.command("status:alarms","Show CloudWatch alarm status").option("--region <region>","AWS region").action(async(t)=>{i("CloudWatch Alarms");try{let m=await Ee(),A=t.region||m.project.region||"us-east-1",{AWSClient:_}=await import("./chunk-2cx4k97r.js");class z{client;region;constructor($e){this.region=$e,this.client=new _}async describeAlarms(){return this.client.request({service:"monitoring",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"Action=DescribeAlarms&Version=2010-08-01"})}}let U=new z(A),Y=new o("Fetching alarms...");Y.start();let ne=(await U.describeAlarms()).MetricAlarms||[];if(Y.succeed(`Found ${ne.length} alarm(s)`),ne.length===0){e("No CloudWatch alarms configured");return}let re=ne.filter(($e)=>$e.StateValue==="ALARM"),oe=ne.filter(($e)=>$e.StateValue==="OK"),fe=ne.filter(($e)=>$e.StateValue==="INSUFFICIENT_DATA");if(e(""),e(`Alarming: ${re.length}`),e(`OK: ${oe.length}`),e(`Insufficient Data: ${fe.length}`),re.length>0){e(`
 Alarms in ALARM state:`);for(let $e of re)r(`  - ${$e.AlarmName}: ${$e.AlarmDescription||"No description"}`)}}catch(m){r(`Failed to get alarms: ${m.message}`),process.exit(1)}})}async function Zr(D){let{AWSClient:t}=await import("./chunk-2cx4k97r.js");class m{client;region;constructor(A){this.region=A,this.client=new t}async jsonRpcRequest(A,_){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${A}`},body:JSON.stringify(_)})}async listBackupVaults(){return this.jsonRpcRequest("ListBackupVaults",{})}async listBackupPlans(){return this.jsonRpcRequest("ListBackupPlans",{})}async listRecoveryPointsByBackupVault(A,_){return this.jsonRpcRequest("ListRecoveryPointsByBackupVault",{BackupVaultName:A,..._})}async describeBackupVault(A){return this.jsonRpcRequest("DescribeBackupVault",{BackupVaultName:A})}async getBackupPlan(A){return this.jsonRpcRequest("GetBackupPlan",{BackupPlanId:A})}async createBackupVault(A,_){return this.jsonRpcRequest("CreateBackupVault",{BackupVaultName:A,..._})}async deleteBackupVault(A){return this.jsonRpcRequest("DeleteBackupVault",{BackupVaultName:A})}async createBackupPlan(A){return this.jsonRpcRequest("CreateBackupPlan",{BackupPlan:A})}async deleteBackupPlan(A){return this.jsonRpcRequest("DeleteBackupPlan",{BackupPlanId:A})}async startBackupJob(A){return this.jsonRpcRequest("StartBackupJob",A)}async startRestoreJob(A){return this.jsonRpcRequest("StartRestoreJob",A)}async describeBackupJob(A){return this.jsonRpcRequest("DescribeBackupJob",{BackupJobId:A})}async describeRestoreJob(A){return this.jsonRpcRequest("DescribeRestoreJob",{RestoreJobId:A})}async listBackupJobs(A){return this.jsonRpcRequest("ListBackupJobs",A||{})}async listRestoreJobs(A){return this.jsonRpcRequest("ListRestoreJobs",A||{})}async createBackupSelection(A,_){return this.jsonRpcRequest("CreateBackupSelection",{BackupPlanId:A,BackupSelection:_})}async listBackupSelections(A){return this.jsonRpcRequest("ListBackupSelections",{BackupPlanId:A})}}return new m(D)}function il(D){D.command("backup:vaults","List backup vaults").option("--region <region>","AWS region").action(async(t)=>{i("Backup Vaults");try{let m=await Ee(),A=t.region||m.project.region||"us-east-1",_=await Zr(A),z=new o("Fetching vaults...");z.start();let Y=(await _.listBackupVaults()).BackupVaultList||[];if(z.succeed(`Found ${Y.length} vault(s)`),Y.length===0){e("No backup vaults found"),e("Use `cloud backup:create-vault` to create a new vault");return}c(["Vault Name","Recovery Points","Created","Encrypted"],Y.map((X)=>[X.BackupVaultName||"N/A",(X.NumberOfRecoveryPoints||0).toString(),X.CreationDate?new Date(X.CreationDate).toLocaleDateString():"N/A",X.EncryptionKeyArn?"Yes":"Default"]))}catch(m){r(`Failed to list vaults: ${m.message}`),process.exit(1)}}),D.command("backup:list","List backup plans").option("--region <region>","AWS region").action(async(t)=>{i("Backup Plans");try{let m=await Ee(),A=t.region||m.project.region||"us-east-1",_=await Zr(A),z=new o("Fetching backup plans...");z.start();let Y=(await _.listBackupPlans()).BackupPlansList||[];if(z.succeed(`Found ${Y.length} backup plan(s)`),Y.length===0){e("No backup plans found"),e("Use `cloud backup:create` to create a backup plan");return}c(["Plan Name","Plan ID","Version","Created"],Y.map((X)=>[X.BackupPlanName||"N/A",X.BackupPlanId||"N/A",X.VersionId?.substring(0,8)||"N/A",X.CreationDate?new Date(X.CreationDate).toLocaleDateString():"N/A"]))}catch(m){r(`Failed to list backup plans: ${m.message}`),process.exit(1)}}),D.command("backup:recovery-points <vaultName>","List recovery points in a vault").option("--region <region>","AWS region").option("--limit <number>","Maximum results",{default:"50"}).action(async(t,m)=>{i(`Recovery Points: ${t}`);try{let A=await Ee(),_=m.region||A.project.region||"us-east-1",z=await Zr(_),U=new o("Fetching recovery points...");U.start();let X=(await z.listRecoveryPointsByBackupVault(t,{MaxResults:Number.parseInt(m.limit)})).RecoveryPoints||[];if(U.succeed(`Found ${X.length} recovery point(s)`),X.length===0){e("No recovery points found");return}c(["Resource","Status","Created","Size","Lifecycle"],X.map((ne)=>[ne.ResourceArn?.split(":").pop()||"N/A",ne.Status||"N/A",ne.CreationDate?new Date(ne.CreationDate).toLocaleString():"N/A",ne.BackupSizeInBytes?Vd(ne.BackupSizeInBytes):"N/A",ne.Lifecycle?.DeleteAfterDays?`${ne.Lifecycle.DeleteAfterDays} days`:"Indefinite"]))}catch(A){r(`Failed to list recovery points: ${A.message}`),process.exit(1)}}),D.command("backup:create-vault <vaultName>","Create a backup vault").option("--region <region>","AWS region",{default:"us-east-1"}).option("--kms-key <arn>","KMS key ARN for encryption").action(async(t,m)=>{i("Create Backup Vault");try{let A=await Zr(m.region);if(e(`Vault Name: ${t}`),e(`Region: ${m.region}`),e(`Encryption: ${m.kmsKey?"Custom KMS":"AWS Managed"}`),!await d(`
@@ -652,7 +652,7 @@ Send request?`,!0)){e("Operation cancelled");return}let ne=new o("Sending reques
 Status: ${oe.status} ${oe.statusText}`),e(`
 Response Headers:`),oe.headers.forEach((Ie,he)=>{e(`  ${he}: ${Ie}`)}),e(`
 Response Body:`);try{let Ie=JSON.parse($e);console.log(JSON.stringify(Ie,null,2))}catch{console.log($e)}}catch(_){r(`Failed to test API: ${_.message}`),process.exit(1)}})}async function fo(D){let t=await Ee(),m=y(process.cwd(),t),A=new S(m.store,{workerId:`cli:${process.pid}`});try{return await D(A,m.project.id,m.organization.id)}finally{m.store.close()}}function sg(D){if(!D)return;if(!["queued","running","succeeded","failed","cancelled","timed_out"].includes(D))throw Error("State must be queued, running, succeeded, failed, cancelled, or timed_out");return D}function ag(D,t){if(!D)return"—";let m=Math.max(0,new Date(t??Date.now()).getTime()-new Date(D).getTime());return m<1000?`${m}ms`:m<60000?`${Math.round(m/1000)}s`:`${Math.round(m/60000)}m`}function al(D){D.command("ops:list","List durable deployment and mutation jobs").option("--state <state>","Filter queue state").option("--all-projects","Show all locally authorized projects").action(async(t)=>{try{await fo(async(m,A)=>{let _=m.list({projectId:t.allProjects?void 0:A,state:sg(t.state),limit:500});c(["ID","State","Operation","Target","Attempt","Step / blocked","Queued","Duration"],_.map(({operation:z,job:U,approximatePosition:Y})=>[z.id,z.state,z.kind,z.resourceId??z.environmentId??z.projectId??"global",`${z.attempt}/${U.maxAttempts}`,U.blockedReason??U.currentStep??(Y?`${Y.ahead} ahead`:"—"),z.createdAt,ag(z.startedAt,z.finishedAt)]))})}catch(m){r(m instanceof Error?m.message:String(m))}}),D.command("ops:show <id>","Show a durable operation and its latest sanitized logs").option("--after <cursor>","Show logs after this sequence",{default:"0"}).action(async(t,m)=>{try{await fo(async(A)=>{let _=A.view(t);if(!_)throw Error(`Operation ${t} was not found`);e(JSON.stringify(_,null,2));for(let z of A.logs(t,{after:Number(m.after)||0,limit:500}))e(`${z.sequence} ${z.stream.toUpperCase()}${z.step?` [${z.step}]`:""} ${z.message}`)})}catch(A){r(A instanceof Error?A.message:String(A))}}),D.command("ops:cancel <id>","Cancel queued work or request running cancellation").option("--yes","Skip confirmation").action(async(t,m)=>{try{await fo(async(A)=>{let _=A.view(t);if(!_)throw Error(`Operation ${t} was not found`);if(!m.yes&&!await d(`Cancel ${_.operation.kind} (${t})?`,!1))return;let z=A.requestCancellation(t);n(`${z.state==="cancelled"?"Cancelled":"Cancellation requested for"} ${t}`)})}catch(A){r(A instanceof Error?A.message:String(A))}}),D.command("ops:retry <id>","Retry a terminal job using an allow-listed error class").option("--class <name>","Retryable error class").option("--delay <milliseconds>","Delay before the next attempt",{default:"0"}).action(async(t,m)=>{try{if(!m.class)throw Error("Pass --class with one of the retry classes shown by ops:show");await fo(async(A)=>{let _=A.retry(t,m.class,{delayMs:Number(m.delay)||0});n(`Retry queued: ${_.id} · attempt ${_.attempt+1}`)})}catch(A){r(A instanceof Error?A.message:String(A))}}),D.command("ops:concurrency","Show effective durable queue concurrency limits").action(async()=>{try{await fo(async(t)=>e(JSON.stringify(t.limits,null,2)))}catch(t){r(t instanceof Error?t.message:String(t))}}),D.command("ops:concurrency:set","Confirm and audit durable queue concurrency limits").option("--project <count>","Concurrent jobs per project").option("--environment <count>","Concurrent jobs per environment").option("--provider <count>","Concurrent jobs per provider").option("--builds <count>","Concurrent build slots").option("--confirm <text>",'Must equal "update queue limits"').action(async(t)=>{try{if(t.confirm!=="update queue limits")throw Error('Pass --confirm "update queue limits" to change production concurrency');let m={};for(let A of["project","environment","provider","builds"])if(t[A]!==void 0)m[A]=Number(t[A]);await fo(async(A,_,z)=>n(`Queue concurrency updated: ${JSON.stringify(A.configureConcurrency(m,{organizationId:z}))}`))}catch(m){r(m instanceof Error?m.message:String(m))}}),D.command("ops:history:clear","Clear terminal jobs after their retention policy expires").option("--before <date>","Also require completion before this timestamp").option("--yes","Skip confirmation").action(async(t)=>{try{await fo(async(m,A)=>{if(!t.yes&&!await d("Clear completed queue history whose retention has elapsed?",!1))return;let _=m.clearCompleted({projectId:A,before:t.before});n(`Cleared ${_} retained operation${_===1?"":"s"}.`)})}catch(m){r(m instanceof Error?m.message:String(m))}})}import{readFile as cg,writeFile as lg}from"node:fs/promises";function dg(D){if(D==null)return"—";if(D<60)return`${D}s`;if(D<3600)return`${Math.floor(D/60)}m`;if(D<86400)return`${Math.floor(D/3600)}h`;return`${Math.floor(D/86400)}d`}function ug(D){return D==null?"—":an(D)}function pg(D){return D.map((t)=>[t.id,t.name,t.provider,t.kind,t.status,t.desiredReplicas==null?"—":`${t.runningReplicas??0}/${t.desiredReplicas}`,t.image??t.runtime??"—",ug(t.resources?.memoryBytes??t.resources?.memoryLimitBytes),dg(t.ageSeconds)])}function mg(D,t){let m=t.search?.toLowerCase();return{...D,workloads:D.workloads.filter((A)=>(!t.provider||A.provider===t.provider)&&(!t.status||A.status===t.status)&&(!m||`${A.name} ${A.id} ${A.links.service??""} ${Object.values(A.tags).join(" ")}`.toLowerCase().includes(m)))}}async function go(D){let t=await Ee(),m=D??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let A=new be(t,m);return{config:t,env:m,service:A}}async function Gs(D,t){if(t!==void 0)return t;return R(`Type ${D.name} to confirm`,"")}async function fg(D,t,m,A,_,z){return Hs(D,`runtime.${t}`,{workloadId:D.id,provider:D.provider,action:t,replicas:m??null},_,()=>z.run({workloadId:D.id,action:t,replicas:m,confirm:A,recentAuth:!0}))}async function Hs(D,t,m,A,_){let z=await Ee(),U=y(process.cwd(),z),Y=new S(U.store,{workerId:`cli:${process.pid}`});try{let X=U.environments.get(A),ne=U.store.listResources(U.project.id,X?.id).find((fe)=>fe.slug===D.links.service),re=U.store.getActorByExternalId("system","cli")??U.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI",metadata:{source:"cli"}}),oe=Y.enqueue({projectId:U.project.id,environmentId:X?.id,resourceId:ne?.id,actorId:re.id,kind:t,input:h(m),lockKey:ne?`resource:${ne.id}`:`runtime:${D.id}`,providerKey:D.provider,maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!Y.claim(oe.id))throw Error(`Workload is locked by another operation. Inspect ${oe.id} with cloud ops:show.`);try{let fe=await _();if(fe.stdout)Y.appendLog(oe.id,fe.stdout,{stream:"stdout"});if(fe.stderr)Y.appendLog(oe.id,fe.stderr,{stream:"stderr"});if(fe.ok)Y.complete(oe.id,{ok:!0,command:fe.command??null});else Y.fail(oe.id,fe.error??fe.stderr??"Runtime operation failed",{ok:!1});return{result:fe,operationId:oe.id}}catch(fe){throw Y.fail(oe.id,fe instanceof Error?fe.message:String(fe),{ok:!1,threw:!0}),fe}}finally{U.store.close()}}function cl(D){D.command("runtime:list","List services, containers, ECS tasks, and Lambda functions").option("--env <environment>","Target environment").option("--provider <provider>","Filter systemd, docker, ecs, or lambda").option("--status <status>","Filter normalized runtime status").option("--search <query>","Search names, IDs, services, and tags").option("--json","Print normalized JSON").action(async(t)=>{try{let{service:m}=await go(t.env),A=mg(await m.inventory(),t);if(t.json)e(JSON.stringify(A,null,2));else{c(["ID","Name","Provider","Kind","Status","Replicas","Image / runtime","Memory","Age"],pg(A.workloads));for(let _ of A.sources.filter((z)=>z.status!=="fresh"))a(`${_.id}: ${_.status}${_.message?` — ${_.message}`:""}`)}}catch(m){r(m instanceof Error?m.message:String(m)),process.exitCode=1}}),D.command("runtime:inspect <workload>","Inspect normalized config, replicas, networks, mounts, links, and capabilities").option("--env <environment>","Target environment").action(async(t,m)=>{try{let{service:A}=await go(m.env),_=await A.workload(t);if(!_)throw Error("Workload was not found in this project and environment");e(JSON.stringify(_,null,2))}catch(A){r(A instanceof Error?A.message:String(A)),process.exitCode=1}}),D.command("runtime:logs <workload>","Read bounded logs for one authorized runtime target").option("--env <environment>","Target environment").option("--lines <count>","Maximum log lines",{default:"200"}).option("--json","Print structured JSON").action(async(t,m)=>{try{let{service:A}=await go(m.env),_=await A.logs(t,{limit:Number(m.lines)||200});if(m.json)e(JSON.stringify(_,null,2));else for(let z of _.lines)console.log(`${z.timestamp??"—"} ${z.message}`)}catch(A){r(A instanceof Error?A.message:String(A)),process.exitCode=1}}),D.command("runtime:action <workload> <action>","Start, stop, restart, redeploy, or scale one workload").option("--env <environment>","Target environment").option("--replicas <count>","Desired replicas for scale").option("--confirm <name>","Exact workload name confirmation").action(async(t,m,A)=>{try{let _=m;if(!["start","stop","restart","redeploy","scale"].includes(_))throw Error("Action must be start, stop, restart, redeploy, or scale");let z=A.replicas==null?void 0:Number(A.replicas);if(_==="scale"&&(!Number.isInteger(z)||z<0))throw Error("Scale requires a non-negative integer --replicas value");let{env:U,service:Y}=await go(A.env),X=await Y.inventory(),ne=X.workloads.find((fe)=>fe.id===t);if(!ne)throw Error("Workload was not found in this project and environment");let re=new be(await Ee(),U,{inventory:async()=>X}),oe=await fg(ne,_,z,await Gs(ne,A.confirm),U,re);if(!oe.result.ok)throw Error(oe.result.error??oe.result.stderr??"Runtime operation failed");if(n(`${_} completed for ${ne.name} · operation ${oe.operationId}`),oe.result.stdout)e(oe.result.stdout)}catch(_){r(_ instanceof Error?_.message:String(_)),process.exitCode=1}}),D.command("runtime:exec <workload>","Run a scoped diagnostic preset or container command").option("--env <environment>","Target environment").option("--preset <preset>","Read-only preset: process, sockets, or filesystem").option("--command <command>","Free-form command (Docker containers only)").option("--confirm <name>","Exact workload name confirmation").action(async(t,m)=>{try{let{env:A,service:_}=await go(m.env),U=(await _.inventory()).workloads.find((re)=>re.id===t);if(!U)throw Error("Workload was not found in this project and environment");let Y=["process","sockets","filesystem"].includes(String(m.preset))?m.preset:void 0;if(m.preset&&!Y)throw Error("Preset must be process, sockets, or filesystem");if(!Y&&!m.command)throw Error("Pass --preset or --command");let X=await Gs(U,m.confirm),ne=await Hs(U,"runtime.exec",{workloadId:t,provider:U.provider,preset:Y??null,freeForm:!!m.command},A,()=>_.exec({workloadId:t,preset:Y,command:m.command,confirm:X,recentAuth:!0}));if(!ne.result.ok)throw Error(ne.result.error??ne.result.stderr??"Exec failed");if(ne.result.stdout)e(ne.result.stdout);if(ne.result.stderr)a(ne.result.stderr);n(`Exec completed for ${U.name} · operation ${ne.operationId}`)}catch(A){r(A instanceof Error?A.message:String(A)),process.exitCode=1}}),D.command("runtime:download <workload> <remote> <local>","Download a bounded file from a service-owned path").option("--env <environment>","Target environment").option("--confirm <name>","Exact workload name confirmation").action(async(t,m,A,_)=>{try{let{env:z,service:U}=await go(_.env),X=(await U.inventory()).workloads.find((oe)=>oe.id===t);if(!X)throw Error("Workload was not found in this project and environment");let ne=await Gs(X,_.confirm),re=await Hs(X,"runtime.file.read",{workloadId:t,provider:X.provider,path:m},z,()=>U.readFile({workloadId:t,path:m,confirm:ne,recentAuth:!0}));if(!re.result.ok||!re.result.contentBase64)throw Error(re.result.error??"File download failed");await lg(A,Buffer.from(re.result.contentBase64,"base64")),n(`Downloaded ${re.result.size??0} bytes to ${A} · operation ${re.operationId}${re.result.truncated?" (truncated)":""}`)}catch(z){r(z instanceof Error?z.message:String(z)),process.exitCode=1}}),D.command("runtime:upload <workload> <local> <remote>","Upload and atomically replace a file in a service-owned path").option("--env <environment>","Target environment").option("--confirm <name>","Exact workload name confirmation").action(async(t,m,A,_)=>{try{let{env:z,service:U}=await go(_.env),X=(await U.inventory()).workloads.find((fe)=>fe.id===t);if(!X)throw Error("Workload was not found in this project and environment");let ne=await Gs(X,_.confirm),re=(await cg(m)).toString("base64"),oe=await Hs(X,"runtime.file.write",{workloadId:t,provider:X.provider,path:A,bytes:Buffer.from(re,"base64").byteLength},z,()=>U.writeFile({workloadId:t,path:A,contentBase64:re,confirm:ne,recentAuth:!0}));if(!oe.result.ok)throw Error(oe.result.error??"File upload failed");n(`Uploaded ${oe.result.size??0} bytes to ${A} · operation ${oe.operationId}`)}catch(z){r(z instanceof Error?z.message:String(z)),process.exitCode=1}})}function gg(D,t=new Date){let m=D.to?new Date(D.to):t;if(!Number.isFinite(m.getTime()))throw Error("--to must be a valid ISO-8601 instant");if(D.from){let z=new Date(D.from);if(!Number.isFinite(z.getTime()))throw Error("--from must be a valid ISO-8601 instant");return{from:z.toISOString(),to:m.toISOString()}}let A=String(D.range??"1h").match(/^(\d+)(m|h|d)$/);if(!A)throw Error("--range must use minutes, hours, or days (for example 30m, 6h, or 7d)");let _=A[2]==="m"?60000:A[2]==="h"?3600000:86400000;return{from:new Date(m.getTime()-Number(A[1])*_).toISOString(),to:m.toISOString()}}async function os(D){let t=await Ee(),m=D??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let A=y(process.cwd(),t),_=A.environments.get(m),z=new Qe(A.store);return{config:t,env:m,controlPlane:A,environmentRecord:_,telemetry:z}}function qd(D,t,m){let A=(z)=>z?.split(",").map((U)=>U.trim()).filter(Boolean)||void 0,_=A(D.kind)?.filter((z)=>["metric","log","trace","request","event"].includes(z));return{projectId:t,environmentId:m,...gg(D),kinds:_,names:A(D.name),sources:A(D.source),text:D.text,limit:Math.min(5000,Math.max(1,Number(D.limit)||200))}}function hg(D){let t=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"];return[t.join(","),...D.map((m)=>t.map((A)=>`"${String(m[A]??"").replaceAll('"','""')}"`).join(","))].join(`
-`)}function ll(D){D.command("telemetry:collect","Collect normalized host/runtime or AWS telemetry into the local control plane").option("--env <environment>","Target environment").option("--force","Bypass the provider-query cache").option("--json","Print structured JSON").action(async(t)=>{let m=await os(t.env);try{let A=await ri({controlPlane:m.controlPlane.store,projectId:m.controlPlane.project.id,environmentId:m.environmentRecord?.id,config:m.config,environment:m.env,force:t.force});if(t.json)e(JSON.stringify(A,null,2));else n(`Collected ${A.collected} normalized records${A.cached?" (cached provider result)":""}.`),c(["Source","Freshness","Lag","Sampling","Retention"],A.statuses.map((_)=>[_.source,_.freshness,_.lagSeconds==null?"—":`${_.lagSeconds}s`,`${Math.round(_.samplingRate*100)}%`,`${_.retentionDays}d`]))}finally{m.controlPlane.store.close()}}),D.command("telemetry:query","Query bounded normalized metrics, logs, traces, requests, and events").option("--env <environment>","Target environment").option("--from <instant>","ISO-8601 start").option("--to <instant>","ISO-8601 end").option("--range <duration>","Relative window such as 1h or 7d",{default:"1h"}).option("--kind <kinds>","Comma-separated kinds").option("--name <names>","Comma-separated signal names").option("--source <sources>","Comma-separated sources").option("--text <query>","Search name/message").option("--limit <count>","Maximum records",{default:"200"}).option("--json","Print structured JSON").action(async(t)=>{let m=await os(t.env);try{let A=m.telemetry.query(qd(t,m.controlPlane.project.id,m.environmentRecord?.id));if(t.json)e(JSON.stringify(A,null,2));else c(["Time","Kind","Source","Signal","Value / message","Correlation"],A.records.map((_)=>[_.timestamp,_.kind,_.source,_.name,_.message??(_.value==null?"—":`${_.value} ${_.unit??""}`),_.requestId??_.traceId??_.releaseId??_.deploymentId??"—"]));if(A.truncated)a("More records are available; narrow the window or use the dashboard cursor explorer.")}finally{m.controlPlane.store.close()}}),D.command("telemetry:export <file>","Export a bounded telemetry query as JSON or CSV").option("--env <environment>","Target environment").option("--from <instant>","ISO-8601 start").option("--to <instant>","ISO-8601 end").option("--range <duration>","Relative window",{default:"1h"}).option("--kind <kinds>","Comma-separated kinds").option("--name <names>","Comma-separated signal names").option("--source <sources>","Comma-separated sources").option("--text <query>","Search name/message").option("--limit <count>","Maximum records",{default:"5000"}).action(async(t,m)=>{let A=await os(m.env);try{let _=qd(m,A.controlPlane.project.id,A.environmentRecord?.id),z=A.telemetry.query(_);await Bun.write(t,t.toLowerCase().endsWith(".csv")?hg(z.records):JSON.stringify({exportedAt:new Date().toISOString(),query:_,...z},null,2)),n(`Exported ${z.records.length} records to ${t}${z.truncated?" (bounded result)":""}.`)}finally{A.controlPlane.store.close()}}),D.command("telemetry:compact","Downsample old metrics and enforce configured retention").option("--env <environment>","Target environment").action(async(t)=>{let m=await os(t.env);try{let A=Xe(m.controlPlane.store,m.controlPlane.project.id);e(JSON.stringify(m.telemetry.enforceRetention(A,m.controlPlane.project.id),null,2))}finally{m.controlPlane.store.close()}}),D.command("telemetry:policy","Show or update sampling, retention, and local storage cost assumptions").option("--env <environment>","Target environment").option("--raw-days <days>","Raw retention days").option("--downsample-days <days>","Downsample after days").option("--sampling <rate>","Sampling rate from 0.01 to 1").option("--storage-usd-gb-month <amount>","Local storage cost assumption").option("--json","Print structured JSON").action(async(t)=>{let m=await os(t.env);try{let A={};if(t.rawDays!=null)A.rawDays=Number(t.rawDays);if(t.downsampleDays!=null)A.downsampleAfterDays=Number(t.downsampleDays);if(t.sampling!=null)A.samplingRate=Number(t.sampling);if(t.storageUsdGbMonth!=null)A.estimatedStorageUsdPerGbMonth=Number(t.storageUsdGbMonth);let _=Object.keys(A).length?pi(m.controlPlane.store,m.controlPlane.project.id,A):Xe(m.controlPlane.store,m.controlPlane.project.id),U=m.telemetry.status(m.controlPlane.project.id,m.environmentRecord?.id,_.rawDays,_.samplingRate).reduce((X,ne)=>X+ne.estimatedDailyBytes*30,0),Y={policy:_,estimatedMonthlyBytes:U,estimatedMonthlyCostUsd:mi(U,_),costEstimateConfigured:_.estimatedStorageUsdPerGbMonth>0};if(t.json)e(JSON.stringify(Y,null,2));else e(JSON.stringify(_,null,2)),e(Y.costEstimateConfigured?`Estimated local storage: $${Y.estimatedMonthlyCostUsd}/month`:"Storage cost remains unavailable until --storage-usd-gb-month is set.")}finally{m.controlPlane.store.close()}})}async function oo(D){let t=await Ee(),m=D??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let A=y(process.cwd(),t),_=A.environments.get(m),z=new ft(A.store,{encryptionKey:x(process.cwd())});return{config:t,env:m,controlPlane:A,environmentRecord:_,alerts:z}}function Gd(D){return new yr(D,{emailImpl:async(t)=>{let{email:m}=await import("./chunk-tcstvf11.js");return m.send(t)}})}function dl(D){D.command("health:list","List configured health checks and latest results").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{let m=await oo(t.env);try{let A=m.alerts.listHealthChecks(m.controlPlane.project.id,m.environmentRecord?.id).map((_)=>({..._,latest:m.alerts.listHealthResults(_.id,1)[0]}));if(t.json)e(JSON.stringify(A,null,2));else c(["ID","Name","Kind","Target","Status","Interval","Enabled"],A.map((_)=>[_.id,_.name,_.kind,_.target,_.latest?.status??"no data",`${_.intervalSeconds}s`,_.enabled?"yes":"no"]))}finally{m.controlPlane.store.close()}}),D.command("health:run <check>","Run one health check and evaluate linked alert rules").option("--env <environment>","Target environment").option("--test","Preview without persisting results or incidents").action(async(t,m)=>{let A=await oo(m.env);try{let _=A.alerts.getHealthCheck(t)??A.alerts.listHealthChecks(A.controlPlane.project.id,A.environmentRecord?.id).find((Y)=>Y.name===t);if(!_)throw Error("Health check was not found");let z=new Me(A.alerts);if(m.test){let Y=await z.probe(_);e(JSON.stringify({...Y,productionIncidentCreated:!1},null,2));return}let U=await z.runAndEvaluate(_);if(e(JSON.stringify(U,null,2)),U.result.status==="healthy")n(`${_.name} is healthy.`);else a(`${_.name} is ${U.result.status}.`)}finally{A.controlPlane.store.close()}}),D.command("alerts:list","List pending, firing, silenced, and resolved alerts").option("--env <environment>","Target environment").option("--state <states>","Comma-separated states").option("--json","Print structured JSON").action(async(t)=>{let m=await oo(t.env);try{let A=m.alerts.listAlerts(m.controlPlane.project.id,{environmentId:m.environmentRecord?.id,states:t.state?.split(",").filter(Boolean)});if(t.json)e(JSON.stringify(A,null,2));else c(["ID","State","Severity","Title","Owner","First seen","Last seen"],A.map((_)=>[_.id,_.state,_.severity,_.title,_.ownerActorId??"unassigned",_.firstSeenAt,_.lastSeenAt]))}finally{m.controlPlane.store.close()}}),D.command("alerts:evaluate","Evaluate persisted telemetry rules now").option("--env <environment>","Target environment").action(async(t)=>{let m=await oo(t.env);try{let A=rn(m.alerts,m.controlPlane.project.id,m.environmentRecord?.id);e(JSON.stringify(A,null,2))}finally{m.controlPlane.store.close()}}),D.command("alerts:ack <alert>","Acknowledge an alert as the CLI actor").option("--env <environment>","Target environment").action(async(t,m)=>{let A=await oo(m.env);try{let _=A.controlPlane.store.getActorByExternalId("system","cli")??A.controlPlane.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});n(`Acknowledged ${A.alerts.acknowledge(t,_.id).title}.`)}finally{A.controlPlane.store.close()}}),D.command("notifications:list","List notification channels, routes, and recent delivery diagnostics").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{let m=await oo(t.env);try{let A={channels:m.alerts.listChannels(m.controlPlane.organization.id),routes:m.alerts.listRoutes(m.controlPlane.organization.id),deliveries:m.alerts.listDeliveries({limit:100})};if(t.json)e(JSON.stringify(A,null,2));else c(["Channel","Type","Status","Tested","Error"],A.channels.map((_)=>[_.name,_.kind,_.status,_.lastTestedAt??"never",_.lastError??"—"])),c(["Event","State","Attempts","Status","Error"],A.deliveries.map((_)=>[_.eventType,_.state,`${_.attempt}/${_.maxAttempts}`,String(_.responseStatus??"—"),_.error??"—"]))}finally{m.controlPlane.store.close()}}),D.command("notifications:test <channel>","Send a channel test without creating a production incident").option("--env <environment>","Target environment").action(async(t,m)=>{let A=await oo(m.env);try{let _=A.alerts.getChannel(t)??A.alerts.listChannels(A.controlPlane.organization.id).find((U)=>U.name===t);if(!_)throw Error("Notification channel was not found");let z=await Gd(A.alerts).testChannel(_.id);if(z.ok)n("Test delivered; no production incident was created.");else throw Error(z.error)}finally{A.controlPlane.store.close()}}),D.command("notifications:retry <delivery>","Retry one failed notification delivery").option("--env <environment>","Target environment").action(async(t,m)=>{let A=await oo(m.env);try{let _=A.alerts.getDelivery(t);if(!_)throw Error("Notification delivery was not found");A.alerts.updateDelivery(t,{state:"retrying",attempt:Math.max(0,_.attempt-1),nextAttemptAt:new Date().toISOString()}),e(JSON.stringify(await Gd(A.alerts).deliver(t),null,2))}finally{A.controlPlane.store.close()}})}async function yg(D,t){let m=await Ee(),A=y(process.cwd(),m),_=!D&&t?new Hr(A.store).get(t):void 0,z=_?.environmentId?A.store.listEnvironments(A.project.id).find(($e)=>$e.id===_.environmentId)?.slug:void 0,U=D??z??Object.keys(m.environments??{})[0]??"production";if(!Object.hasOwn(m.environments??{},U))throw A.store.close(),Error(`Environment ${U} was not found`);let Y=A.environments.get(U);if(!Y)throw A.store.close(),Error(`Environment ${U} was not found in the control plane`);let X=new Hr(A.store),ne=new S(A.store,{workerId:`cli:${process.pid}`}),re=new Zn(X,{queue:ne}),oe=A.store.listResources(A.project.id,Y.id);Gr(X,m,{organization:A.organization,project:A.project,environment:Y,resources:oe});let fe=A.store.getActorByExternalId("system","cli")??A.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return{config:m,env:U,controlPlane:A,environmentRecord:Y,resources:oe,store:X,queue:ne,service:re,actor:fe}}async function ni(D,t,m){let A=await yg(D,m);try{return await t(A)}finally{A.controlPlane.store.close()}}async function Sr(D){try{await D()}catch(t){r(t instanceof Error?t.message:String(t))}}function xo(D,t){let m=D.store.list(D.controlPlane.project.id,{environmentId:D.environmentRecord.id}),A=D.store.get(t)??m.find((_)=>_.name===t);if(!A||A.environmentId!==D.environmentRecord.id)throw Error(`Scheduled job ${t} was not found in ${D.env}`);return A}function ho(D,t,m,A){D.controlPlane.store.appendEvent({organizationId:D.controlPlane.organization.id,projectId:D.controlPlane.project.id,resourceId:A,actorId:D.actor.id,type:`job.${t}`,payload:m})}function Hd(D,t,m){if(D.environmentRecord.kind==="production"&&m!==t)throw Error(`Production ${t} requires --confirm ${t}`)}function vg(D){if(!D)return{};if(!/^(?:secret|ssm|arn|env):\/\//.test(D))throw Error("Payloads must use a secret://, ssm://, arn://, or env:// reference");return{input:D}}function bg(D){return D.map((t)=>[t.id,t.enabled?"enabled":"disabled",t.provider,t.name,t.expression,t.timezone,t.nextRunAt??"—",t.reconciliationStatus])}function ul(D){D.command("jobs:list","List server cron, EventBridge, and recurring control-plane jobs").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>Sr(async()=>ni(t.env,async(m)=>{let A=m.store.list(m.controlPlane.project.id,{environmentId:m.environmentRecord.id});if(t.json)e(JSON.stringify(A,null,2));else c(["ID","State","Provider","Name","Expression","Timezone","Next run","Reconciliation"],bg(A))}))),D.command("jobs:preview <expression>","Preview the next runs without creating production work").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--from <date>","Preview from an ISO timestamp").option("--count <count>","Number of runs",{default:"5"}).action(async(t,m)=>Sr(async()=>{let A=ct(t,m.timezone??"UTC",m.from?new Date(m.from):new Date,Number(m.count)||5);e(JSON.stringify({...A,productionExecutionCreated:!1},null,2))})),D.command("jobs:add <name> <expression>","Create a managed recurring job").option("--env <environment>","Target environment").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--operation <id>","Safe server operation target (scheduler, backup, or worker)").option("--resource <id>","Resource ID or slug").option("--starts-at <date>","Schedule window start").option("--ends-at <date>","Schedule window end").option("--flexible-minutes <count>","Provider flexible window",{default:"0"}).option("--missed <policy>","skip or catch_up",{default:"skip"}).option("--overlap <policy>","allow, forbid, or replace",{default:"forbid"}).option("--attempts <count>","Maximum attempts",{default:"3"}).option("--backoff <seconds>","Retry backoff seconds",{default:"30"}).option("--timeout <seconds>","Execution timeout",{default:"900"}).option("--dead-letter <reference>","Dead-letter ARN or secret reference").option("--payload-ref <reference>","Referenced payload; inline values are forbidden").option("--disabled","Create disabled").action(async(t,m,A)=>Sr(async()=>ni(A.env,async(_)=>{if(!["skip","catch_up"].includes(A.missed??"skip"))throw Error("--missed must be skip or catch_up");if(!["allow","forbid","replace"].includes(A.overlap??"forbid"))throw Error("--overlap must be allow, forbid, or replace");let z=H(_.config),Y={workers:_.store.listWorkers(_.controlPlane.project.id,_.environmentRecord.id).map(($e)=>({name:$e.name}))},X;if(z==="server"){let $e=jr(_.config,Y).filter((he)=>!he.danger&&["scheduler","backup","worker"].includes(he.group)),Ie=A.operation?$e.find((he)=>he.id===A.operation):$e.length===1?$e[0]:void 0;if(!Ie)throw Error(`Choose a safe target with --operation. Available: ${$e.map((he)=>he.id).join(", ")||"none"}`);X={kind:"dashboard_operation",operationId:Ie.id}}else X={kind:"serverless_scheduler",action:"run"};let ne=z==="server"?"server":"eventbridge",re=Yn({provider:ne,expression:m,flexibleMinutes:Number(A.flexibleMinutes)||0,missedRunPolicy:A.missed??"skip",overlapPolicy:A.overlap??"forbid"});if(!re.supported)throw Error(re.notes.join(" "));let oe=A.resource?_.resources.find(($e)=>$e.id===A.resource||$e.slug===A.resource):void 0;if(A.resource&&!oe)throw Error(`Resource ${A.resource} was not found in ${_.env}`);let fe=_.store.create({organizationId:_.controlPlane.organization.id,projectId:_.controlPlane.project.id,environmentId:_.environmentRecord.id,resourceId:oe?.id,name:t,provider:ne,expression:m,timezone:A.timezone??"UTC",startsAt:A.startsAt,endsAt:A.endsAt,flexibleMinutes:Number(A.flexibleMinutes)||0,target:X,payloadRefs:vg(A.payloadRef),missedRunPolicy:A.missed??"skip",overlapPolicy:A.overlap??"forbid",retryPolicy:{maxAttempts:Number(A.attempts)||3,backoffSeconds:Number(A.backoff)||30,deadLetterRef:A.deadLetter},timeoutSeconds:Number(A.timeout)||900,enabled:!A.disabled,origin:"managed",ownerActorId:_.actor.id,observedState:{},reconciliationStatus:"pending"});ho(_,"created",{jobId:fe.id,provider:fe.provider,expression:fe.normalizedExpression},fe.resourceId),n(`Created ${fe.name} (${fe.id}); next run ${fe.nextRunAt??"outside the active window"}`)}))),D.command("jobs:update <job>","Update a managed job schedule and policies").option("--env <environment>","Target environment").option("--expression <expression>","Cron, preset, or rate expression").option("--timezone <timezone>","IANA timezone").option("--missed <policy>","skip or catch_up").option("--overlap <policy>","allow, forbid, or replace").option("--timeout <seconds>","Execution timeout").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t);if(_.origin==="config")throw Error("Config-defined schedules must be edited in cloud.config.ts and reconciled");if(m.missed&&!["skip","catch_up"].includes(m.missed))throw Error("--missed must be skip or catch_up");if(m.overlap&&!["allow","forbid","replace"].includes(m.overlap))throw Error("--overlap must be allow, forbid, or replace");let z=A.store.updateSchedule(_.id,{expression:m.expression,timezone:m.timezone,missedRunPolicy:m.missed,overlapPolicy:m.overlap,timeoutSeconds:m.timeout==null?void 0:Number(m.timeout)});ho(A,"updated",{jobId:z.id,expression:z.normalizedExpression,version:z.version},z.resourceId),n(`Updated ${z.name}; next run ${z.nextRunAt??"outside the active window"}`)}))),D.command("jobs:run <job>","Queue a manual run through the durable operation worker").option("--env <environment>","Target environment").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t),z=A.service.enqueue(_,{trigger:"manual",actorId:A.actor.id});ho(A,"run_queued",{jobId:_.id,executionId:z.id},_.resourceId),n(`Queued execution ${z.id}; inspect it with cloud jobs:history "${_.name}"`)}))),D.command("jobs:dispatch <job>","Dispatch an externally triggered schedule into the durable queue").option("--env <environment>","Target environment").option("--scheduled-for <date>","Provider scheduled timestamp").option("--scheduled","Mark this as a provider schedule trigger").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t);if(!_.enabled)throw Error(`${_.name} is disabled`);let z=m.scheduledFor?new Date(m.scheduledFor):new Date;if(!m.scheduledFor)z.setUTCSeconds(0,0);let U=z.toISOString(),Y=A.service.enqueue(_,{trigger:m.scheduled?"scheduled":"external",scheduledFor:U,actorId:A.actor.id}),X=at(_.normalizedExpression,_.timezone,z,1)[0];A.store.markScheduled(_.id,U,X),n(`Accepted ${_.name} for ${U} as ${Y.id}`)},t)));for(let t of["enable","disable"])D.command(`jobs:${t} <job>`,`${t==="enable"?"Enable":"Disable"} a scheduled job`).option("--env <environment>","Target environment").option("--confirm <text>",`Production ${t} confirmation`).action(async(m,A)=>Sr(async()=>ni(A.env,async(_)=>{let z=xo(_,m);if(t==="disable")Hd(_,t,A.confirm);let U=_.store.setEnabled(z.id,t==="enable");ho(_,t==="enable"?"enabled":"disabled",{jobId:U.id},U.resourceId),n(`${U.name} is ${U.enabled?"enabled":"disabled"}`)})));D.command("jobs:delete <job>","Delete a managed schedule").option("--env <environment>","Target environment").option("--confirm <text>","Must be delete in production").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t);Hd(A,"delete",m.confirm),A.store.remove(_.id),ho(A,"deleted",{jobId:_.id,name:_.name},_.resourceId),n(`Deleted ${_.name}`)}))),D.command("jobs:history <job>","Show execution attempts, output, errors, and redacted logs").option("--env <environment>","Target environment").option("--limit <count>","Maximum executions",{default:"100"}).option("--logs","Print execution logs").option("--json","Print structured JSON").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t),z=A.store.listExecutions(_.id,Number(m.limit)||100).map((U)=>({...U,logs:m.logs&&U.operationId?A.queue.logs(U.operationId,{limit:500}):[]}));if(m.json)e(JSON.stringify(z,null,2));else if(c(["ID","Status","Trigger","Scheduled for","Attempt","Started","Finished","Error"],z.map((U)=>[U.id,U.status,U.trigger,U.scheduledFor,String(U.attempt),U.startedAt??"—",U.finishedAt??"—",U.error??"—"])),m.logs)for(let U of z)for(let Y of U.logs)e(`${U.id} ${Y.sequence} ${Y.stream.toUpperCase()} ${Y.message}`)}))),D.command("jobs:reconcile","Import declarative schedules and workers without destructive deletion").option("--env <environment>","Target environment").action(async(t)=>Sr(async()=>ni(t.env,async(m)=>{let A=Gr(m.store,m.config,{organization:m.controlPlane.organization,project:m.controlPlane.project,environment:m.environmentRecord,resources:m.resources});ho(m,"reconciled",A),n(`Reconciled ${A.jobs} schedules and ${A.workers} workers; retained ${A.drifted} missing definitions as drifted`)}))),D.command("workers:list","List configured systemd, ECS, and Lambda workers").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>Sr(async()=>ni(t.env,async(m)=>{let A=m.store.listWorkers(m.controlPlane.project.id,m.environmentRecord.id);if(t.json)e(JSON.stringify(A,null,2));else c(["ID","Provider","Name","Queue","Processes","Timeout","Restart","Reconciliation"],A.map((_)=>[_.id,_.provider,_.name,_.queue,String(_.processes),`${_.timeoutSeconds}s`,_.restartPolicy,_.reconciliationStatus]))}))),D.command("workers:restart <worker>","Gracefully restart an allowlisted systemd worker").option("--env <environment>","Target environment").option("--confirm <name>","Exact worker name confirmation").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=A.store.listWorkers(A.controlPlane.project.id,A.environmentRecord.id),z=A.store.getWorker(t)??_.find((X)=>X.name===t);if(!z||z.environmentId!==A.environmentRecord.id)throw Error(`Worker ${t} was not found in ${A.env}`);if(m.confirm!==z.name)throw Error(`Restart requires --confirm "${z.name}"`);if(z.provider!=="systemd")throw Error(`${z.provider} workers are provider/config managed and do not expose a safe restart adapter`);let U=Xn(String(z.target.operationId??""),A.config,{workers:_.map((X)=>({name:X.name}))});if(!U||U.danger||U.group!=="worker")throw Error("The allowlisted worker restart operation is unavailable");let Y=await Vr(A.config,A.env,U);if(A.store.reconcileWorker(z.id,Y.ok?"in_sync":"unavailable",{...z.observedState,lastRestartAt:new Date().toISOString(),command:Y.command??null,error:Y.error??Y.stderr??null}),ho(A,"worker_restarted",{workerId:z.id,ok:Y.ok},z.resourceId),!Y.ok)throw Error(Y.error??Y.stderr??"Worker restart failed");n(`Restarted ${z.name}`)})))}function pl(D){D.command("tunnel","Start a local tunnel to expose your local server").option("--port <number>","Local port to expose",{default:"3000"}).option("--subdomain <name>","Custom subdomain (if available)").option("--host <hostname>","Local hostname",{default:"localhost"}).option("--server <url>","Tunnel server URL",{default:"localtunnel.dev"}).option("--verbose","Enable verbose logging").action(async(t)=>{i("Local Tunnel");let m=Number.parseInt(t.port);if(e(`Local server: ${t.host}:${m}`),e(`Tunnel server: ${t.server}`),t.subdomain)e(`Requested subdomain: ${t.subdomain}`);let A=new o("Connecting to tunnel server...");A.start();try{let _;try{let ne=await import("localtunnels");_=ne.TunnelClient}catch{A.fail("localtunnels package not found"),e(`
+`)}function ll(D){D.command("telemetry:collect","Collect normalized host/runtime or AWS telemetry into the local control plane").option("--env <environment>","Target environment").option("--force","Bypass the provider-query cache").option("--json","Print structured JSON").action(async(t)=>{let m=await os(t.env);try{let A=await ri({controlPlane:m.controlPlane.store,projectId:m.controlPlane.project.id,environmentId:m.environmentRecord?.id,config:m.config,environment:m.env,force:t.force});if(t.json)e(JSON.stringify(A,null,2));else n(`Collected ${A.collected} normalized records${A.cached?" (cached provider result)":""}.`),c(["Source","Freshness","Lag","Sampling","Retention"],A.statuses.map((_)=>[_.source,_.freshness,_.lagSeconds==null?"—":`${_.lagSeconds}s`,`${Math.round(_.samplingRate*100)}%`,`${_.retentionDays}d`]))}finally{m.controlPlane.store.close()}}),D.command("telemetry:query","Query bounded normalized metrics, logs, traces, requests, and events").option("--env <environment>","Target environment").option("--from <instant>","ISO-8601 start").option("--to <instant>","ISO-8601 end").option("--range <duration>","Relative window such as 1h or 7d",{default:"1h"}).option("--kind <kinds>","Comma-separated kinds").option("--name <names>","Comma-separated signal names").option("--source <sources>","Comma-separated sources").option("--text <query>","Search name/message").option("--limit <count>","Maximum records",{default:"200"}).option("--json","Print structured JSON").action(async(t)=>{let m=await os(t.env);try{let A=m.telemetry.query(qd(t,m.controlPlane.project.id,m.environmentRecord?.id));if(t.json)e(JSON.stringify(A,null,2));else c(["Time","Kind","Source","Signal","Value / message","Correlation"],A.records.map((_)=>[_.timestamp,_.kind,_.source,_.name,_.message??(_.value==null?"—":`${_.value} ${_.unit??""}`),_.requestId??_.traceId??_.releaseId??_.deploymentId??"—"]));if(A.truncated)a("More records are available; narrow the window or use the dashboard cursor explorer.")}finally{m.controlPlane.store.close()}}),D.command("telemetry:export <file>","Export a bounded telemetry query as JSON or CSV").option("--env <environment>","Target environment").option("--from <instant>","ISO-8601 start").option("--to <instant>","ISO-8601 end").option("--range <duration>","Relative window",{default:"1h"}).option("--kind <kinds>","Comma-separated kinds").option("--name <names>","Comma-separated signal names").option("--source <sources>","Comma-separated sources").option("--text <query>","Search name/message").option("--limit <count>","Maximum records",{default:"5000"}).action(async(t,m)=>{let A=await os(m.env);try{let _=qd(m,A.controlPlane.project.id,A.environmentRecord?.id),z=A.telemetry.query(_);await Bun.write(t,t.toLowerCase().endsWith(".csv")?hg(z.records):JSON.stringify({exportedAt:new Date().toISOString(),query:_,...z},null,2)),n(`Exported ${z.records.length} records to ${t}${z.truncated?" (bounded result)":""}.`)}finally{A.controlPlane.store.close()}}),D.command("telemetry:compact","Downsample old metrics and enforce configured retention").option("--env <environment>","Target environment").action(async(t)=>{let m=await os(t.env);try{let A=Xe(m.controlPlane.store,m.controlPlane.project.id);e(JSON.stringify(m.telemetry.enforceRetention(A,m.controlPlane.project.id),null,2))}finally{m.controlPlane.store.close()}}),D.command("telemetry:policy","Show or update sampling, retention, and local storage cost assumptions").option("--env <environment>","Target environment").option("--raw-days <days>","Raw retention days").option("--downsample-days <days>","Downsample after days").option("--sampling <rate>","Sampling rate from 0.01 to 1").option("--storage-usd-gb-month <amount>","Local storage cost assumption").option("--json","Print structured JSON").action(async(t)=>{let m=await os(t.env);try{let A={};if(t.rawDays!=null)A.rawDays=Number(t.rawDays);if(t.downsampleDays!=null)A.downsampleAfterDays=Number(t.downsampleDays);if(t.sampling!=null)A.samplingRate=Number(t.sampling);if(t.storageUsdGbMonth!=null)A.estimatedStorageUsdPerGbMonth=Number(t.storageUsdGbMonth);let _=Object.keys(A).length?pi(m.controlPlane.store,m.controlPlane.project.id,A):Xe(m.controlPlane.store,m.controlPlane.project.id),U=m.telemetry.status(m.controlPlane.project.id,m.environmentRecord?.id,_.rawDays,_.samplingRate).reduce((X,ne)=>X+ne.estimatedDailyBytes*30,0),Y={policy:_,estimatedMonthlyBytes:U,estimatedMonthlyCostUsd:mi(U,_),costEstimateConfigured:_.estimatedStorageUsdPerGbMonth>0};if(t.json)e(JSON.stringify(Y,null,2));else e(JSON.stringify(_,null,2)),e(Y.costEstimateConfigured?`Estimated local storage: $${Y.estimatedMonthlyCostUsd}/month`:"Storage cost remains unavailable until --storage-usd-gb-month is set.")}finally{m.controlPlane.store.close()}})}async function oo(D){let t=await Ee(),m=D??Object.keys(t.environments??{})[0]??"production";if(!Object.hasOwn(t.environments??{},m))throw Error(`Environment ${m} was not found`);let A=y(process.cwd(),t),_=A.environments.get(m),z=new ft(A.store,{encryptionKey:x(process.cwd())});return{config:t,env:m,controlPlane:A,environmentRecord:_,alerts:z}}function Gd(D){return new yr(D,{emailImpl:async(t)=>{let{email:m}=await import("./chunk-9pvkb6br.js");return m.send(t)}})}function dl(D){D.command("health:list","List configured health checks and latest results").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{let m=await oo(t.env);try{let A=m.alerts.listHealthChecks(m.controlPlane.project.id,m.environmentRecord?.id).map((_)=>({..._,latest:m.alerts.listHealthResults(_.id,1)[0]}));if(t.json)e(JSON.stringify(A,null,2));else c(["ID","Name","Kind","Target","Status","Interval","Enabled"],A.map((_)=>[_.id,_.name,_.kind,_.target,_.latest?.status??"no data",`${_.intervalSeconds}s`,_.enabled?"yes":"no"]))}finally{m.controlPlane.store.close()}}),D.command("health:run <check>","Run one health check and evaluate linked alert rules").option("--env <environment>","Target environment").option("--test","Preview without persisting results or incidents").action(async(t,m)=>{let A=await oo(m.env);try{let _=A.alerts.getHealthCheck(t)??A.alerts.listHealthChecks(A.controlPlane.project.id,A.environmentRecord?.id).find((Y)=>Y.name===t);if(!_)throw Error("Health check was not found");let z=new Me(A.alerts);if(m.test){let Y=await z.probe(_);e(JSON.stringify({...Y,productionIncidentCreated:!1},null,2));return}let U=await z.runAndEvaluate(_);if(e(JSON.stringify(U,null,2)),U.result.status==="healthy")n(`${_.name} is healthy.`);else a(`${_.name} is ${U.result.status}.`)}finally{A.controlPlane.store.close()}}),D.command("alerts:list","List pending, firing, silenced, and resolved alerts").option("--env <environment>","Target environment").option("--state <states>","Comma-separated states").option("--json","Print structured JSON").action(async(t)=>{let m=await oo(t.env);try{let A=m.alerts.listAlerts(m.controlPlane.project.id,{environmentId:m.environmentRecord?.id,states:t.state?.split(",").filter(Boolean)});if(t.json)e(JSON.stringify(A,null,2));else c(["ID","State","Severity","Title","Owner","First seen","Last seen"],A.map((_)=>[_.id,_.state,_.severity,_.title,_.ownerActorId??"unassigned",_.firstSeenAt,_.lastSeenAt]))}finally{m.controlPlane.store.close()}}),D.command("alerts:evaluate","Evaluate persisted telemetry rules now").option("--env <environment>","Target environment").action(async(t)=>{let m=await oo(t.env);try{let A=rn(m.alerts,m.controlPlane.project.id,m.environmentRecord?.id);e(JSON.stringify(A,null,2))}finally{m.controlPlane.store.close()}}),D.command("alerts:ack <alert>","Acknowledge an alert as the CLI actor").option("--env <environment>","Target environment").action(async(t,m)=>{let A=await oo(m.env);try{let _=A.controlPlane.store.getActorByExternalId("system","cli")??A.controlPlane.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});n(`Acknowledged ${A.alerts.acknowledge(t,_.id).title}.`)}finally{A.controlPlane.store.close()}}),D.command("notifications:list","List notification channels, routes, and recent delivery diagnostics").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>{let m=await oo(t.env);try{let A={channels:m.alerts.listChannels(m.controlPlane.organization.id),routes:m.alerts.listRoutes(m.controlPlane.organization.id),deliveries:m.alerts.listDeliveries({limit:100})};if(t.json)e(JSON.stringify(A,null,2));else c(["Channel","Type","Status","Tested","Error"],A.channels.map((_)=>[_.name,_.kind,_.status,_.lastTestedAt??"never",_.lastError??"—"])),c(["Event","State","Attempts","Status","Error"],A.deliveries.map((_)=>[_.eventType,_.state,`${_.attempt}/${_.maxAttempts}`,String(_.responseStatus??"—"),_.error??"—"]))}finally{m.controlPlane.store.close()}}),D.command("notifications:test <channel>","Send a channel test without creating a production incident").option("--env <environment>","Target environment").action(async(t,m)=>{let A=await oo(m.env);try{let _=A.alerts.getChannel(t)??A.alerts.listChannels(A.controlPlane.organization.id).find((U)=>U.name===t);if(!_)throw Error("Notification channel was not found");let z=await Gd(A.alerts).testChannel(_.id);if(z.ok)n("Test delivered; no production incident was created.");else throw Error(z.error)}finally{A.controlPlane.store.close()}}),D.command("notifications:retry <delivery>","Retry one failed notification delivery").option("--env <environment>","Target environment").action(async(t,m)=>{let A=await oo(m.env);try{let _=A.alerts.getDelivery(t);if(!_)throw Error("Notification delivery was not found");A.alerts.updateDelivery(t,{state:"retrying",attempt:Math.max(0,_.attempt-1),nextAttemptAt:new Date().toISOString()}),e(JSON.stringify(await Gd(A.alerts).deliver(t),null,2))}finally{A.controlPlane.store.close()}})}async function yg(D,t){let m=await Ee(),A=y(process.cwd(),m),_=!D&&t?new Hr(A.store).get(t):void 0,z=_?.environmentId?A.store.listEnvironments(A.project.id).find(($e)=>$e.id===_.environmentId)?.slug:void 0,U=D??z??Object.keys(m.environments??{})[0]??"production";if(!Object.hasOwn(m.environments??{},U))throw A.store.close(),Error(`Environment ${U} was not found`);let Y=A.environments.get(U);if(!Y)throw A.store.close(),Error(`Environment ${U} was not found in the control plane`);let X=new Hr(A.store),ne=new S(A.store,{workerId:`cli:${process.pid}`}),re=new Zn(X,{queue:ne}),oe=A.store.listResources(A.project.id,Y.id);Gr(X,m,{organization:A.organization,project:A.project,environment:Y,resources:oe});let fe=A.store.getActorByExternalId("system","cli")??A.store.createActor({kind:"system",externalId:"cli",displayName:"ts-cloud CLI"});return{config:m,env:U,controlPlane:A,environmentRecord:Y,resources:oe,store:X,queue:ne,service:re,actor:fe}}async function ni(D,t,m){let A=await yg(D,m);try{return await t(A)}finally{A.controlPlane.store.close()}}async function Sr(D){try{await D()}catch(t){r(t instanceof Error?t.message:String(t))}}function xo(D,t){let m=D.store.list(D.controlPlane.project.id,{environmentId:D.environmentRecord.id}),A=D.store.get(t)??m.find((_)=>_.name===t);if(!A||A.environmentId!==D.environmentRecord.id)throw Error(`Scheduled job ${t} was not found in ${D.env}`);return A}function ho(D,t,m,A){D.controlPlane.store.appendEvent({organizationId:D.controlPlane.organization.id,projectId:D.controlPlane.project.id,resourceId:A,actorId:D.actor.id,type:`job.${t}`,payload:m})}function Hd(D,t,m){if(D.environmentRecord.kind==="production"&&m!==t)throw Error(`Production ${t} requires --confirm ${t}`)}function vg(D){if(!D)return{};if(!/^(?:secret|ssm|arn|env):\/\//.test(D))throw Error("Payloads must use a secret://, ssm://, arn://, or env:// reference");return{input:D}}function bg(D){return D.map((t)=>[t.id,t.enabled?"enabled":"disabled",t.provider,t.name,t.expression,t.timezone,t.nextRunAt??"—",t.reconciliationStatus])}function ul(D){D.command("jobs:list","List server cron, EventBridge, and recurring control-plane jobs").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>Sr(async()=>ni(t.env,async(m)=>{let A=m.store.list(m.controlPlane.project.id,{environmentId:m.environmentRecord.id});if(t.json)e(JSON.stringify(A,null,2));else c(["ID","State","Provider","Name","Expression","Timezone","Next run","Reconciliation"],bg(A))}))),D.command("jobs:preview <expression>","Preview the next runs without creating production work").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--from <date>","Preview from an ISO timestamp").option("--count <count>","Number of runs",{default:"5"}).action(async(t,m)=>Sr(async()=>{let A=ct(t,m.timezone??"UTC",m.from?new Date(m.from):new Date,Number(m.count)||5);e(JSON.stringify({...A,productionExecutionCreated:!1},null,2))})),D.command("jobs:add <name> <expression>","Create a managed recurring job").option("--env <environment>","Target environment").option("--timezone <timezone>","IANA timezone",{default:"UTC"}).option("--operation <id>","Safe server operation target (scheduler, backup, or worker)").option("--resource <id>","Resource ID or slug").option("--starts-at <date>","Schedule window start").option("--ends-at <date>","Schedule window end").option("--flexible-minutes <count>","Provider flexible window",{default:"0"}).option("--missed <policy>","skip or catch_up",{default:"skip"}).option("--overlap <policy>","allow, forbid, or replace",{default:"forbid"}).option("--attempts <count>","Maximum attempts",{default:"3"}).option("--backoff <seconds>","Retry backoff seconds",{default:"30"}).option("--timeout <seconds>","Execution timeout",{default:"900"}).option("--dead-letter <reference>","Dead-letter ARN or secret reference").option("--payload-ref <reference>","Referenced payload; inline values are forbidden").option("--disabled","Create disabled").action(async(t,m,A)=>Sr(async()=>ni(A.env,async(_)=>{if(!["skip","catch_up"].includes(A.missed??"skip"))throw Error("--missed must be skip or catch_up");if(!["allow","forbid","replace"].includes(A.overlap??"forbid"))throw Error("--overlap must be allow, forbid, or replace");let z=H(_.config),Y={workers:_.store.listWorkers(_.controlPlane.project.id,_.environmentRecord.id).map(($e)=>({name:$e.name}))},X;if(z==="server"){let $e=jr(_.config,Y).filter((he)=>!he.danger&&["scheduler","backup","worker"].includes(he.group)),Ie=A.operation?$e.find((he)=>he.id===A.operation):$e.length===1?$e[0]:void 0;if(!Ie)throw Error(`Choose a safe target with --operation. Available: ${$e.map((he)=>he.id).join(", ")||"none"}`);X={kind:"dashboard_operation",operationId:Ie.id}}else X={kind:"serverless_scheduler",action:"run"};let ne=z==="server"?"server":"eventbridge",re=Yn({provider:ne,expression:m,flexibleMinutes:Number(A.flexibleMinutes)||0,missedRunPolicy:A.missed??"skip",overlapPolicy:A.overlap??"forbid"});if(!re.supported)throw Error(re.notes.join(" "));let oe=A.resource?_.resources.find(($e)=>$e.id===A.resource||$e.slug===A.resource):void 0;if(A.resource&&!oe)throw Error(`Resource ${A.resource} was not found in ${_.env}`);let fe=_.store.create({organizationId:_.controlPlane.organization.id,projectId:_.controlPlane.project.id,environmentId:_.environmentRecord.id,resourceId:oe?.id,name:t,provider:ne,expression:m,timezone:A.timezone??"UTC",startsAt:A.startsAt,endsAt:A.endsAt,flexibleMinutes:Number(A.flexibleMinutes)||0,target:X,payloadRefs:vg(A.payloadRef),missedRunPolicy:A.missed??"skip",overlapPolicy:A.overlap??"forbid",retryPolicy:{maxAttempts:Number(A.attempts)||3,backoffSeconds:Number(A.backoff)||30,deadLetterRef:A.deadLetter},timeoutSeconds:Number(A.timeout)||900,enabled:!A.disabled,origin:"managed",ownerActorId:_.actor.id,observedState:{},reconciliationStatus:"pending"});ho(_,"created",{jobId:fe.id,provider:fe.provider,expression:fe.normalizedExpression},fe.resourceId),n(`Created ${fe.name} (${fe.id}); next run ${fe.nextRunAt??"outside the active window"}`)}))),D.command("jobs:update <job>","Update a managed job schedule and policies").option("--env <environment>","Target environment").option("--expression <expression>","Cron, preset, or rate expression").option("--timezone <timezone>","IANA timezone").option("--missed <policy>","skip or catch_up").option("--overlap <policy>","allow, forbid, or replace").option("--timeout <seconds>","Execution timeout").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t);if(_.origin==="config")throw Error("Config-defined schedules must be edited in cloud.config.ts and reconciled");if(m.missed&&!["skip","catch_up"].includes(m.missed))throw Error("--missed must be skip or catch_up");if(m.overlap&&!["allow","forbid","replace"].includes(m.overlap))throw Error("--overlap must be allow, forbid, or replace");let z=A.store.updateSchedule(_.id,{expression:m.expression,timezone:m.timezone,missedRunPolicy:m.missed,overlapPolicy:m.overlap,timeoutSeconds:m.timeout==null?void 0:Number(m.timeout)});ho(A,"updated",{jobId:z.id,expression:z.normalizedExpression,version:z.version},z.resourceId),n(`Updated ${z.name}; next run ${z.nextRunAt??"outside the active window"}`)}))),D.command("jobs:run <job>","Queue a manual run through the durable operation worker").option("--env <environment>","Target environment").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t),z=A.service.enqueue(_,{trigger:"manual",actorId:A.actor.id});ho(A,"run_queued",{jobId:_.id,executionId:z.id},_.resourceId),n(`Queued execution ${z.id}; inspect it with cloud jobs:history "${_.name}"`)}))),D.command("jobs:dispatch <job>","Dispatch an externally triggered schedule into the durable queue").option("--env <environment>","Target environment").option("--scheduled-for <date>","Provider scheduled timestamp").option("--scheduled","Mark this as a provider schedule trigger").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t);if(!_.enabled)throw Error(`${_.name} is disabled`);let z=m.scheduledFor?new Date(m.scheduledFor):new Date;if(!m.scheduledFor)z.setUTCSeconds(0,0);let U=z.toISOString(),Y=A.service.enqueue(_,{trigger:m.scheduled?"scheduled":"external",scheduledFor:U,actorId:A.actor.id}),X=at(_.normalizedExpression,_.timezone,z,1)[0];A.store.markScheduled(_.id,U,X),n(`Accepted ${_.name} for ${U} as ${Y.id}`)},t)));for(let t of["enable","disable"])D.command(`jobs:${t} <job>`,`${t==="enable"?"Enable":"Disable"} a scheduled job`).option("--env <environment>","Target environment").option("--confirm <text>",`Production ${t} confirmation`).action(async(m,A)=>Sr(async()=>ni(A.env,async(_)=>{let z=xo(_,m);if(t==="disable")Hd(_,t,A.confirm);let U=_.store.setEnabled(z.id,t==="enable");ho(_,t==="enable"?"enabled":"disabled",{jobId:U.id},U.resourceId),n(`${U.name} is ${U.enabled?"enabled":"disabled"}`)})));D.command("jobs:delete <job>","Delete a managed schedule").option("--env <environment>","Target environment").option("--confirm <text>","Must be delete in production").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t);Hd(A,"delete",m.confirm),A.store.remove(_.id),ho(A,"deleted",{jobId:_.id,name:_.name},_.resourceId),n(`Deleted ${_.name}`)}))),D.command("jobs:history <job>","Show execution attempts, output, errors, and redacted logs").option("--env <environment>","Target environment").option("--limit <count>","Maximum executions",{default:"100"}).option("--logs","Print execution logs").option("--json","Print structured JSON").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=xo(A,t),z=A.store.listExecutions(_.id,Number(m.limit)||100).map((U)=>({...U,logs:m.logs&&U.operationId?A.queue.logs(U.operationId,{limit:500}):[]}));if(m.json)e(JSON.stringify(z,null,2));else if(c(["ID","Status","Trigger","Scheduled for","Attempt","Started","Finished","Error"],z.map((U)=>[U.id,U.status,U.trigger,U.scheduledFor,String(U.attempt),U.startedAt??"—",U.finishedAt??"—",U.error??"—"])),m.logs)for(let U of z)for(let Y of U.logs)e(`${U.id} ${Y.sequence} ${Y.stream.toUpperCase()} ${Y.message}`)}))),D.command("jobs:reconcile","Import declarative schedules and workers without destructive deletion").option("--env <environment>","Target environment").action(async(t)=>Sr(async()=>ni(t.env,async(m)=>{let A=Gr(m.store,m.config,{organization:m.controlPlane.organization,project:m.controlPlane.project,environment:m.environmentRecord,resources:m.resources});ho(m,"reconciled",A),n(`Reconciled ${A.jobs} schedules and ${A.workers} workers; retained ${A.drifted} missing definitions as drifted`)}))),D.command("workers:list","List configured systemd, ECS, and Lambda workers").option("--env <environment>","Target environment").option("--json","Print structured JSON").action(async(t)=>Sr(async()=>ni(t.env,async(m)=>{let A=m.store.listWorkers(m.controlPlane.project.id,m.environmentRecord.id);if(t.json)e(JSON.stringify(A,null,2));else c(["ID","Provider","Name","Queue","Processes","Timeout","Restart","Reconciliation"],A.map((_)=>[_.id,_.provider,_.name,_.queue,String(_.processes),`${_.timeoutSeconds}s`,_.restartPolicy,_.reconciliationStatus]))}))),D.command("workers:restart <worker>","Gracefully restart an allowlisted systemd worker").option("--env <environment>","Target environment").option("--confirm <name>","Exact worker name confirmation").action(async(t,m)=>Sr(async()=>ni(m.env,async(A)=>{let _=A.store.listWorkers(A.controlPlane.project.id,A.environmentRecord.id),z=A.store.getWorker(t)??_.find((X)=>X.name===t);if(!z||z.environmentId!==A.environmentRecord.id)throw Error(`Worker ${t} was not found in ${A.env}`);if(m.confirm!==z.name)throw Error(`Restart requires --confirm "${z.name}"`);if(z.provider!=="systemd")throw Error(`${z.provider} workers are provider/config managed and do not expose a safe restart adapter`);let U=Xn(String(z.target.operationId??""),A.config,{workers:_.map((X)=>({name:X.name}))});if(!U||U.danger||U.group!=="worker")throw Error("The allowlisted worker restart operation is unavailable");let Y=await Vr(A.config,A.env,U);if(A.store.reconcileWorker(z.id,Y.ok?"in_sync":"unavailable",{...z.observedState,lastRestartAt:new Date().toISOString(),command:Y.command??null,error:Y.error??Y.stderr??null}),ho(A,"worker_restarted",{workerId:z.id,ok:Y.ok},z.resourceId),!Y.ok)throw Error(Y.error??Y.stderr??"Worker restart failed");n(`Restarted ${z.name}`)})))}function pl(D){D.command("tunnel","Start a local tunnel to expose your local server").option("--port <number>","Local port to expose",{default:"3000"}).option("--subdomain <name>","Custom subdomain (if available)").option("--host <hostname>","Local hostname",{default:"localhost"}).option("--server <url>","Tunnel server URL",{default:"localtunnel.dev"}).option("--verbose","Enable verbose logging").action(async(t)=>{i("Local Tunnel");let m=Number.parseInt(t.port);if(e(`Local server: ${t.host}:${m}`),e(`Tunnel server: ${t.server}`),t.subdomain)e(`Requested subdomain: ${t.subdomain}`);let A=new o("Connecting to tunnel server...");A.start();try{let _;try{let ne=await import("localtunnels");_=ne.TunnelClient}catch{A.fail("localtunnels package not found"),e(`
 To use tunnels, install the localtunnels package:`),e("  bun add localtunnels"),e(`
 Or use the standalone CLI:`),e("  bunx localtunnels --port 3000");return}let z=t.server.replace(/^(wss?|https?):\/\//,""),U=t.server.startsWith("wss://")||t.server.startsWith("https://")||z==="localtunnel.dev",Y=new _({localPort:m,localHost:t.host,subdomain:t.subdomain,host:z,port:U?443:80,secure:U,verbose:t.verbose});Y.on("connected",(ne)=>{A.succeed("Connected!"),n(`
 Your tunnel URL: ${ne.url}`),e(`Subdomain: ${ne.subdomain}`),e(`