@stacksjs/ts-cloud 0.16.36 → 0.16.37

package/dist/bin/{chunk-0870bs4x.js → chunk-dvyd4bxh.js}

@@ -1,4 +1,4 @@
-import{ea,Ue,A,H,w,B,ke,Jt}from"./chunk-qbagghsb.js";import{ae,pn,re,mn,h,kr,Yo}from"./chunk-twmeg17s.js";import{$e,S,lo,hr,di,ui,mt,en,hc,$t,tn,Ke,Le,Je,yc,ft,yr,Me,Xe,pi,mi,es,ts,Qe,rn,vr,ht,m,ls,wo,Ao}from"./chunk-exc2mqcc.js";import{zt,u}from"./chunk-7rwc5bvv.js";import{g}from"./chunk-f76wtb7d.js";import{me}from"./chunk-yt95wsqg.js";import{Rr,Tt,Ir,Pr,Dr,Nr,un}from"./chunk-r8e263ne.js";import{He,ur,Ki,O,Yr,lc,dc,_t,oi,ai}from"./chunk-8p2v1gat.js";import{v}from"./chunk-v4gpkkzh.js";import{se,q,ni}from"./chunk-h42xsxhm.js";import{E}from"./chunk-71jh460j.js";import{V}from"./chunk-s7f24j6k.js";import{I}from"./chunk-j01jx36v.js";import{J,P,U,wr,Is,Ar,cn}from"./chunk-v3prk467.js";import{Ss}from"./chunk-cnwncp50.js";import{K,No,ko,Es,Bt,z,xo}from"./chunk-kcsjaam6.js";import{Mo,Uo}from"./chunk-ar6bxdv4.js";import{co}from"./chunk-4mt7rspg.js";import{Zr}from"./chunk-zmp0mksb.js";import{_,k,Xo}from"./chunk-tv0rtc0s.js";import{createHash as FT}from"node:crypto";import{existsSync as ao,mkdtempSync as cp,readdirSync as cb,rmSync as vs,statSync as Sb}from"node:fs";import{readFile as Li,writeFile as ys}from"node:fs/promises";import{tmpdir as kd}from"node:os";import{dirname as UT,extname as ja,join as Ct,normalize as zT,relative as VT,resolve as qT,sep as JT}from"node:path";import{fileURLToPath as GT}from"node:url";class Md extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class Vi{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new Md(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as TS}from"node:crypto";import{lstatSync as Nb,readdirSync as $b,readFileSync as Mb}from"node:fs";import{relative as Lb,resolve as xp,sep as Bb}from"node:path";function jb(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function Jo(e,t,r){return{path:e,reason:t,weight:r}}function Dp(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function Rs(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function Nt(e){let t=jb(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(Rs("dockerfile","dockerfile",0.99,[Jo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=Dp(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(Rs("laravel","server",0.98,[Jo("artisan","Laravel Artisan entrypoint is present.",0.45),Jo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(Rs("php","server",0.82,[Jo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=Dp(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",l=[Jo("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)l.push(Jo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,f=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(Rs(c,f.kind,Math.min(0.94,l.reduce((T,D)=>T+D.weight,0)),l,f,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(Rs("static","static",0.78,[Jo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(Rs("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function qn(e,t={}){let r=xp(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),l=(a)=>{for(let f of $b(a).sort()){if(c.has(f))continue;let T=xp(a,f),D=Lb(r,T).split(Bb).join("/");if(!D||D.startsWith("../"))throw Error("Detection path escaped the application root");let N=Nb(T);if(N.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${D}`);if(N.isDirectory())l(T);else if(N.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let W={path:D,size:N.size};if(s.has(D)&&N.size<=i)W.content=Mb(T,"utf8");o.push(W)}}};return l(r),o}function Bd(e){if(Array.isArray(e))return`[${e.map(Bd).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${Bd(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function pa(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function fn(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function Ld(e){return JSON.parse(JSON.stringify(e))}function Fb(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return Ld({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return Ld({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return Ld({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function ce(e,t=[]){let r=[],n=(W)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(W),i=Object.fromEntries(Object.entries(e.environment??{}).map(([W,Y])=>{if(typeof Y==="string"&&n(W))return r.push(fn(`environment.${W}`,"write_only_secret_required",`${W} must be supplied through the write-only secrets boundary.`)),[W,{secretRef:W}];return[W,Y]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let W=Object.fromEntries(Object.entries(e.build.buildArgs).map(([Y,ee])=>{if(n(Y))return r.push(fn(`build.buildArgs.${Y}`,"write_only_build_secret_required",`${Y} must be declared in secretNames instead of buildArgs.`)),[Y,"[REDACTED]"];return[Y,ee]}));o={...e.build,buildArgs:W}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(fn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!pa((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(fn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((W)=>!pa(W)))r.push(fn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!pa(e.build.context)||!pa(e.build.dockerfile)))r.push(fn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!pa(e.build.publishDirectory))r.push(fn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(fn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(fn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(fn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(fn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(fn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(fn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(fn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((W)=>typeof W==="object"?[W.secretRef]:[]),l=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),f=l.filter((W)=>!a.has(W)),T={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},D=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),N=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&f.length===0,issues:r,missingSecrets:f,manifest:T,configPatch:Fb({...e,build:o,environment:i}),capabilityRequirements:D,costDrivers:N,serializedManifest:`${Bd(T)}
+import{ea,Ue,A,H,w,B,ke,Jt}from"./chunk-hsek7hvh.js";import{ae,pn,re,mn,h,kr,Yo}from"./chunk-4zxwtvvf.js";import{$e,S,lo,hr,di,ui,mt,en,hc,$t,tn,Ke,Le,Je,yc,ft,yr,Me,Xe,pi,mi,es,ts,Qe,rn,vr,ht,m,ls,wo,Ao}from"./chunk-71z22p71.js";import{zt,u}from"./chunk-7rwc5bvv.js";import{g}from"./chunk-f76wtb7d.js";import{me}from"./chunk-yt95wsqg.js";import{Rr,Tt,Ir,Pr,Dr,Nr,un}from"./chunk-gd94501z.js";import{He,ur,Ki,O,Yr,lc,dc,_t,oi,ai}from"./chunk-6dm7x6g2.js";import{v}from"./chunk-v4gpkkzh.js";import{se,G,ni}from"./chunk-nhz2az7v.js";import{E}from"./chunk-6r35j09y.js";import{V}from"./chunk-s7f24j6k.js";import{I}from"./chunk-j01jx36v.js";import{J,P,U,wr,Is,Ar,cn}from"./chunk-fxyr2wkt.js";import{Ss}from"./chunk-5keq8y15.js";import{K,No,ko,Es,Bt,z,xo}from"./chunk-0ffqbgbs.js";import{Mo,Uo}from"./chunk-w663zt0w.js";import{co}from"./chunk-4mt7rspg.js";import{Zr}from"./chunk-zmp0mksb.js";import{_,k,Xo}from"./chunk-tv0rtc0s.js";import{createHash as FT}from"node:crypto";import{existsSync as ao,mkdtempSync as cp,readdirSync as cb,rmSync as vs,statSync as Sb}from"node:fs";import{readFile as Li,writeFile as ys}from"node:fs/promises";import{tmpdir as kd}from"node:os";import{dirname as UT,extname as ja,join as Ct,normalize as zT,relative as VT,resolve as qT,sep as JT}from"node:path";import{fileURLToPath as GT}from"node:url";class Md extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class Vi{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new Md(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as TS}from"node:crypto";import{lstatSync as Nb,readdirSync as $b,readFileSync as Mb}from"node:fs";import{relative as Lb,resolve as xp,sep as Bb}from"node:path";function jb(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function Jo(e,t,r){return{path:e,reason:t,weight:r}}function Dp(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function Rs(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function Nt(e){let t=jb(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(Rs("dockerfile","dockerfile",0.99,[Jo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=Dp(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(Rs("laravel","server",0.98,[Jo("artisan","Laravel Artisan entrypoint is present.",0.45),Jo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(Rs("php","server",0.82,[Jo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=Dp(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",l=[Jo("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)l.push(Jo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,f=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(Rs(c,f.kind,Math.min(0.94,l.reduce((T,D)=>T+D.weight,0)),l,f,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(Rs("static","static",0.78,[Jo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(Rs("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function Gn(e,t={}){let r=xp(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),l=(a)=>{for(let f of $b(a).sort()){if(c.has(f))continue;let T=xp(a,f),D=Lb(r,T).split(Bb).join("/");if(!D||D.startsWith("../"))throw Error("Detection path escaped the application root");let N=Nb(T);if(N.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${D}`);if(N.isDirectory())l(T);else if(N.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let W={path:D,size:N.size};if(s.has(D)&&N.size<=i)W.content=Mb(T,"utf8");o.push(W)}}};return l(r),o}function Bd(e){if(Array.isArray(e))return`[${e.map(Bd).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${Bd(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function pa(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function fn(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function Ld(e){return JSON.parse(JSON.stringify(e))}function Fb(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return Ld({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return Ld({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return Ld({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function ce(e,t=[]){let r=[],n=(W)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(W),i=Object.fromEntries(Object.entries(e.environment??{}).map(([W,Y])=>{if(typeof Y==="string"&&n(W))return r.push(fn(`environment.${W}`,"write_only_secret_required",`${W} must be supplied through the write-only secrets boundary.`)),[W,{secretRef:W}];return[W,Y]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let W=Object.fromEntries(Object.entries(e.build.buildArgs).map(([Y,ee])=>{if(n(Y))return r.push(fn(`build.buildArgs.${Y}`,"write_only_build_secret_required",`${Y} must be declared in secretNames instead of buildArgs.`)),[Y,"[REDACTED]"];return[Y,ee]}));o={...e.build,buildArgs:W}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(fn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!pa((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(fn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((W)=>!pa(W)))r.push(fn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!pa(e.build.context)||!pa(e.build.dockerfile)))r.push(fn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!pa(e.build.publishDirectory))r.push(fn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(fn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(fn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(fn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(fn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(fn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(fn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(fn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((W)=>typeof W==="object"?[W.secretRef]:[]),l=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),f=l.filter((W)=>!a.has(W)),T={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},D=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),N=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&f.length===0,issues:r,missingSecrets:f,manifest:T,configPatch:Fb({...e,build:o,environment:i}),capabilityRequirements:D,costDrivers:N,serializedManifest:`${Bd(T)}
 `}}function Op(e){let t=e.replace(/\\/g,"/");return!!t&&!t.startsWith("/")&&!/^[A-Za-z]:\//.test(t)&&!t.split("/").includes("..")&&!/[\0\r\n]/.test(t)}function _p(e,t,r={}){let n=r.maxBytes??104857600,i=r.maxEntries??1e4,o=r.maxExpandedBytes??524288000;if(e.byteLength>n)throw Error("Archive exceeds the compressed size limit");let s=new DataView(e.buffer,e.byteOffset,e.byteLength),c=[],l=0;if(t.toLowerCase().endsWith(".zip")||e[0]===80&&e[1]===75){let f=0;while(f+30<=e.length){let T=s.getUint32(f,!0);if(T===33639248||T===101010256)break;if(T!==67324752)throw Error("Malformed ZIP local header");let D=s.getUint16(f+6,!0),N=s.getUint32(f+18,!0),W=s.getUint32(f+22,!0),Y=s.getUint16(f+26,!0),ee=s.getUint16(f+28,!0);if(D&8)throw Error("ZIP data descriptors are not accepted for uploaded artifacts");let ne=new TextDecoder().decode(e.subarray(f+30,f+30+Y));if(!Op(ne))throw Error(`Unsafe archive path: ${ne}`);if(c.push(ne),l+=W,c.length>i||l>o)throw Error("Archive expansion limit exceeded");f+=30+Y+ee+N}return{format:"zip",entries:c.length,expandedBytes:l,paths:c}}if(!t.toLowerCase().match(/\.(?:tar|tar\.gz|tgz)$/))throw Error("Only ZIP and uncompressed TAR artifacts are supported");let a=0;while(a+512<=e.length){let f=e.subarray(a,a+512);if(f.every((Y)=>Y===0))break;let T=(Y,ee)=>new TextDecoder().decode(f.subarray(Y,Y+ee)).replace(/\0.*$/,""),D=`${T(345,155)}${T(345,155)?"/":""}${T(0,100)}`,N=Number.parseInt(T(124,12).trim()||"0",8),W=String.fromCharCode(f[156]??0);if(!Op(D))throw Error(`Unsafe archive path: ${D}`);if(W==="1"||W==="2")throw Error(`Archive links are not accepted: ${D}`);if(!Number.isFinite(N)||N<0)throw Error("Malformed TAR entry size");if(c.push(D),l+=N,c.length>i||l>o)throw Error("Archive expansion limit exceeded");a+=512+Math.ceil(N/512)*512}return{format:"tar",entries:c.length,expandedBytes:l,paths:c}}var Np=new Set(["source","build","runtime","environment","domain","review"]);function $p(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function Mp(e){return/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(e)}function Lp(e){for(let[r,n]of Object.entries(e.environment??{}))if(typeof n==="string"&&Mp(r)&&n)throw Error(`${r} must be stored through the write-only secrets boundary`);if(e.build.kind==="dockerfile"){for(let[r,n]of Object.entries(e.build.buildArgs??{}))if(Mp(r)&&n)throw Error(`${r} must be declared as a build secret name`)}let t=JSON.stringify(e);if(/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Drafts cannot contain credential-bearing URLs")}function Bp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),schemaVersion:Number(e.schema_version),name:String(e.name),step:String(e.step),input:$p(e.input,{}),suppliedSecretNames:$p(e.supplied_secret_names,[]),status:String(e.status),version:Number(e.version),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Wn{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}create(e){if(Lp(e.draft),e.draft.projectId!==e.projectId)throw Error("Draft project does not match its storage scope");let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Draft project was not found");let r=this.idFn(),n=this.now(),i=e.step??"source";if(!Np.has(i))throw Error("Invalid draft step");let o=[...new Set(e.suppliedSecretNames??[])].sort(),s=ce(e.draft,o).valid?"ready":"draft";return this.controlPlane.database.run("INSERT INTO application_drafts (id, organization_id, project_id, schema_version, name, step, input, supplied_secret_names, status, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.projectId,e.name.trim().slice(0,100),i,JSON.stringify(e.draft),JSON.stringify(o),s,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.draft.created",payload:{draftId:r,step:i,status:s,requiredSecretNames:e.draft.requiredSecretNames??[]}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_drafts WHERE id=?").get(e);return t?Bp(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_drafts WHERE project_id=? ORDER BY updated_at DESC").all(e).map(Bp)}update(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);if(!Np.has(r.step))throw Error("Invalid draft step");if(r.draft.projectId!==n.projectId)throw Error("Draft project cannot be changed");Lp(r.draft);let i=[...new Set(r.suppliedSecretNames??n.suppliedSecretNames)].sort(),o=ce(r.draft,i).valid?"ready":"draft",s=this.now();if(this.controlPlane.database.run("UPDATE application_drafts SET name=?, step=?, input=?, supplied_secret_names=?, status=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.draft.name.slice(0,100),r.step,JSON.stringify(r.draft),JSON.stringify(i),o,s,e,t]).changes!==1)throw Error(`Application draft ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r.actorId,type:"application.draft.updated",payload:{draftId:e,fromVersion:t,toVersion:t+1,step:r.step,status:o}}),this.get(e)}markApplied(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);let i=ce(n.input,n.suppliedSecretNames);if(!i.valid)throw Error(`Draft is not deployable: ${[...i.issues.map((s)=>s.message),...i.missingSecrets.map((s)=>`Missing secret ${s}`)].join("; ")}`);let o=this.now();return this.controlPlane.database.run("UPDATE application_drafts SET status='applied', step='review', version=version+1, updated_at=? WHERE id=? AND version=?",[o,e,t]),this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r,type:"application.draft.applied",payload:h({draftId:e,manifest:i.manifest})}),this.get(e)}}import{createCipheriv as Ub,createDecipheriv as zb,createHash as Up,randomBytes as Vb}from"node:crypto";function ga(e){return typeof e==="string"&&e?e:void 0}function jd(e){return Up("sha256").update(e).digest("hex").slice(0,16)}function jp(e){let t=new URL(e.includes("://")?e:`https://${e}`);if(t.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(t.hostname))throw Error("Registry host must use HTTPS");if(t.username||t.password||t.search||t.hash)throw Error("Registry host cannot contain credentials");return`${t.protocol}//${t.host}`}function qb(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:ga(e.credential_fingerprint),credentialExpiresAt:ga(e.credential_expires_at),status:String(e.status),healthMessage:ga(e.health_message),lastTestedAt:ga(e.last_tested_at),version:Number(e.version),createdByActorId:ga(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Kn{controlPlane;key;nowFn;idFn;constructor(e,t){this.controlPlane=e;if(!t.encryptionKey)throw Error("Registry encryption key is required");this.key=Up("sha256").update(`ts-cloud:registry:${t.encryptionKey}`).digest(),this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}encrypt(e){let t=Vb(12),r=Ub("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Registry credential envelope is invalid");let o=zb("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}current(e){let t=qb(e);return t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime()?{...t,status:"expired",healthMessage:"Registry credential expired; rotate it before pulling images."}:t}create(e){if(!["docker_hub","ghcr","ecr","gcr","generic"].includes(e.provider))throw Error("A supported registry provider is required");let t=e.credential?JSON.stringify(e.credential):void 0,r=this.idFn(),n=this.now();return this.controlPlane.database.run("INSERT INTO registry_connections (id, organization_id, provider, name, host, credential_ciphertext, credential_fingerprint, credential_expires_at, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.provider,e.name.trim().slice(0,80),jp(e.host),t?this.encrypt(t):null,t?jd(t):null,e.credentialExpiresAt??null,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"registry.connection.created",payload:{connectionId:r,provider:e.provider,host:jp(e.host),credentialConfigured:!!t}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM registry_connections WHERE id=?").get(e);return t?this.current(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM registry_connections WHERE organization_id=? ORDER BY name").all(e).map((t)=>this.current(t))}credential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM registry_connections WHERE id=?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotate(e,t,r={}){let n=this.get(e);if(!n||n.status==="disconnected")throw Error("Registry connection was not found");let i=JSON.stringify(t);return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=?, credential_fingerprint=?, credential_expires_at=?, status='pending', health_message=NULL, version=version+1, updated_at=? WHERE id=?",[this.encrypt(i),jd(i),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"registry.credential.rotated",payload:{connectionId:e,fingerprint:jd(i),expiresAt:r.expiresAt??null}}),this.get(e)}disconnect(e,t){let r=this.get(e);if(!r)throw Error("Registry connection was not found");return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=NULL, credential_fingerprint=NULL, status='disconnected', health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"registry.connection.disconnected",level:"warning",payload:{connectionId:e}}),this.get(e)}async test(e,t={}){let r=this.get(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active registry connection was not found");let n=this.credential(e),i=t.fetch??fetch,o=new AbortController,s=setTimeout(()=>o.abort(),t.timeoutMs??15000),c=n?.token?`Bearer ${n.token}`:n?.username||n?.password?`Basic ${Buffer.from(`${n.username??""}:${n.password??""}`).toString("base64")}`:void 0;try{let l=await i(`${r.host}/v2/`,{method:"GET",redirect:"error",signal:o.signal,headers:c?{Authorization:c}:void 0}),a=l.headers.get("www-authenticate")??"";if(l.status===401&&a.startsWith("Bearer ")&&n){let D=Object.fromEntries([...a.slice(7).matchAll(/(\w+)="([^"]+)"/g)].map((ne)=>[ne[1],ne[2]])),N=new URL(D.realm??"");if(N.protocol!=="https:")throw Error("Registry authentication realm must use HTTPS");if(D.service)N.searchParams.set("service",D.service);if(t.image)N.searchParams.set("scope",`repository:${zp(t.image).repository}:pull`);let W=await i(N,{signal:o.signal,redirect:"error",headers:c?{Authorization:c}:void 0});if(!W.ok)throw Error(`Registry authentication failed (${W.status})`);let Y=await W.json(),ee=Y.token??Y.access_token;if(!ee)throw Error("Registry did not return an access token");l=t.image?await Fp(i,r.host,t.image,ee,o.signal):await i(`${r.host}/v2/`,{signal:o.signal,redirect:"error",headers:{Authorization:`Bearer ${ee}`}})}else if(l.ok&&t.image)l=await Fp(i,r.host,t.image,n?.token,o.signal,c);let f=l.ok?"healthy":"degraded",T=l.ok?t.image?"Registry image is readable.":"Registry connection is healthy.":`Registry request failed (${l.status})`;return this.controlPlane.database.run("UPDATE registry_connections SET status=?, health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[f,T,this.now(),this.now(),e]),this.get(e)}catch(l){let a=o.signal.aborted?"Registry request timed out.":l instanceof Error?l.message:"Registry test failed";return this.controlPlane.database.run("UPDATE registry_connections SET status='degraded', health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[a.slice(0,1000),this.now(),this.now(),e]),this.get(e)}finally{clearTimeout(s)}}}function zp(e){let t=e.replace(/^https?:\/\//,""),r=t.indexOf("/");if(r<1)throw Error("Image must include registry/repository");let n=t.slice(r+1),i=n.lastIndexOf("@"),o=n.lastIndexOf(":"),s=i>=0?i:o>n.lastIndexOf("/")?o:-1,c=s>=0?n.slice(0,s):n,l=s>=0?n.slice(s+1):"latest";if(!/^[A-Za-z0-9_.\/-]+$/.test(c)||!/^[A-Za-z0-9_.:+-]+$/.test(l))throw Error("Image reference is invalid");return{repository:c,reference:l}}async function Fp(e,t,r,n,i,o){let s=zp(r);return e(`${t}/v2/${s.repository}/manifests/${encodeURIComponent(s.reference)}`,{method:"HEAD",redirect:"error",signal:i,headers:{Accept:"application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",...n?{Authorization:`Bearer ${n}`}:o?{Authorization:o}:{}}})}import{createHash as Jb}from"node:crypto";import{chmodSync as Vp,existsSync as qp,mkdirSync as Gb,renameSync as Wb,unlinkSync as Jp,writeFileSync as Hb}from"node:fs";import{basename as Kb,join as Qb}from"node:path";function Fd(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),filename:String(e.filename),sha256:String(e.sha256),size:Number(e.size),format:String(e.format),entryCount:Number(e.entry_count),expandedBytes:Number(e.expanded_bytes),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at)}}class Jn{controlPlane;root;idFn;nowFn;constructor(e,t){this.controlPlane=e;this.root=A(t.cwd,"artifacts"),this.idFn=t.id??(()=>crypto.randomUUID()),this.nowFn=t.now??(()=>new Date)}create(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Artifact project was not found");let r=Kb(e.filename).slice(0,200);if(!r||r!==e.filename)throw Error("Artifact filename must not contain a path");let n=_p(e.bytes,r),i=Jb("sha256").update(e.bytes).digest("hex"),o=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? AND sha256=?").get(e.projectId,i);if(o)return Fd(o);let s=this.idFn();Gb(this.root,{recursive:!0,mode:448}),Vp(this.root,448);let c=Qb(this.root,`${s}.archive`),l=`${c}.partial`;try{Hb(l,e.bytes,{mode:384,flag:"wx"}),Wb(l,c),Vp(c,384),this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[s,e.organizationId,e.projectId,r,c,i,e.bytes.byteLength,n.format,n.entries,n.expandedBytes,e.actorId??null,this.nowFn().toISOString()])}catch(a){if(qp(l))Jp(l);if(qp(c))Jp(c);throw a}return this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.artifact.created",payload:{artifactId:s,filename:r,sha256:i,size:e.bytes.byteLength,entries:n.entries}}),this.get(s)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE id=?").get(e);return t?Fd(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? ORDER BY created_at DESC").all(e).map(Fd)}}function Br(e){let t=e.drafts.get(e.draftId);if(!t||t.version!==e.expectedVersion)throw Error(`Application draft ${e.draftId} changed since version ${e.expectedVersion}`);if(t.status==="applied")throw Error("Application draft was already applied");let r=e.controlPlane.getProject(t.projectId),n=r?e.controlPlane.listEnvironments(r.id).find((a)=>a.id===t.input.environmentId):void 0;if(!r||!n||n.projectId!==r.id||r.organizationId!==t.organizationId)throw Error("Draft deployment scope was not found");if(e.confirmEnvironment!==n.slug)throw Error(`Type ${n.slug} to confirm this deployment target`);let i=ce(t.input,t.suppliedSecretNames);if(!i.valid)throw Error(`Application plan is invalid: ${[...i.issues.map((a)=>a.message),...i.missingSecrets.map((a)=>`Missing secret ${a}`)].join("; ")}`);let o=e.controlPlane.listResources(r.id,n.id).find((a)=>a.kind==="application"&&a.slug===t.input.slug),s=JSON.parse(JSON.stringify({manifest:i.manifest,configPatch:i.configPatch})),c=o?e.controlPlane.updateResource(o.id,o.version,{name:t.input.name,desiredState:s}):e.controlPlane.createResource({projectId:r.id,environmentId:n.id,kind:"application",slug:t.input.slug,name:t.input.name,desiredState:s,metadata:{source:"application-onboarding",draftId:t.id}}),l=new S(e.controlPlane).enqueue({projectId:r.id,environmentId:n.id,resourceId:c.id,actorId:e.actorId,kind:"application.create",idempotencyKey:`application-draft:${t.id}:v${t.version}`,correlationId:`application-draft:${t.id}`,input:s,lockKey:`resource:${c.id}`,providerKey:c.provider??"default",buildSlot:t.input.build.kind!=="prebuilt_image",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return e.drafts.markApplied(t.id,t.version,e.actorId),e.controlPlane.appendEvent({organizationId:t.organizationId,projectId:r.id,resourceId:c.id,operationId:l.id,actorId:e.actorId,type:"application.create.queued",payload:{draftId:t.id,environment:n.slug,strategy:t.input.build.kind,costDrivers:i.costDrivers}}),{plan:i,resource:c,operation:l}}function or(e){let t=["static","compute","serverless_zip","serverless_image"].includes(e.kind),r=["container","compose"].includes(e.kind)&&(e.replicas??1)>1,n=e.kind==="container"||e.kind==="serverless_zip"||e.kind==="serverless_image",i=(o,s)=>s&&(o==="atomic"?e.kind==="static"||e.hasHealthGate:e.hasHealthGate);return[{strategy:"atomic",supported:i("atomic",t),explanation:t?e.hasHealthGate||e.kind==="static"?"Activate an immutable version with an atomic pointer/alias switch.":"Atomic activation needs a readiness gate for this runtime.":"This driver has no atomic pointer or alias primitive.",capacityMultiplier:1,costImpact:"none",rollback:"Switch the pointer/alias back to the previous immutable release."},{strategy:"rolling",supported:i("rolling",r),explanation:r?e.hasHealthGate?"Replace healthy replicas within the configured capacity envelope.":"Rolling activation requires a health/readiness gate.":"Rolling activation requires a capable container/Compose driver and at least two replicas.",capacityMultiplier:1.5,costImpact:"temporary",rollback:"Stop replacement and restore the prior task/service definition."},{strategy:"blue_green",supported:i("blue_green",n),explanation:n?e.hasHealthGate?"Provision a complete green target and switch traffic after health passes.":"Blue-green requires a health gate before traffic can switch.":"The provider does not expose two traffic-addressable revisions.",capacityMultiplier:2,costImpact:"temporary",rollback:"Return all traffic to the preserved blue target."},{strategy:"canary",supported:i("canary",n),explanation:n?e.hasHealthGate?"Shift bounded traffic steps while evaluating health.":"Canary requires a health gate and measurable traffic target.":"The provider does not expose weighted traffic primitives.",capacityMultiplier:1.25,costImpact:"temporary",rollback:"Set canary weight to zero and preserve its diagnostics."}]}function Wa(e,t){let r=or(e).find((n)=>n.strategy===t);if(!r.supported)throw Error(`${t} is unavailable: ${r.explanation}`);return r}import{createHash as Yb}from"node:crypto";var Xb=/^sha256:[a-f0-9]{64}$/,Zb=/^[a-f0-9]{40,64}$/i;function Di(e){return typeof e==="string"&&e?e:void 0}function Go(e,t){try{return JSON.parse(String(e))}catch{return t}}function Gp(e){return{id:String(e.id),organizationId:String(e.organization_id),digest:String(e.digest),kind:String(e.kind),uri:String(e.uri),size:Number(e.size),mediaType:String(e.media_type),provenance:Go(e.provenance,{}),attestation:Go(e.attestation,{}),verifiedAt:String(e.verified_at),createdAt:String(e.created_at)}}function Wp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),artifactId:String(e.artifact_id),kind:String(e.kind),sourceSha:Di(e.source_sha),configHash:String(e.config_hash),manifest:Go(e.manifest,{}),provenance:Go(e.provenance,{}),strategy:String(e.strategy),status:String(e.status),healthGate:e.health_gate==null?void 0:Go(e.health_gate,void 0),hooks:Go(e.hooks,{migrations:"none",preActivate:[],postActivate:[]}),drainSeconds:Number(e.drain_seconds),graceSeconds:Number(e.grace_seconds),automaticRollback:Number(e.automatic_rollback)===1,rollbackAttempts:Number(e.rollback_attempts),previousReleaseId:Di(e.previous_release_id),promotedFromReleaseId:Di(e.promoted_from_release_id),actorId:Di(e.actor_id),trigger:String(e.trigger),pinned:Number(e.pinned)===1,pinReason:Di(e.pin_reason),activatedAt:Di(e.activated_at),failedAt:Di(e.failed_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function eS(e){return{sequence:Number(e.sequence),id:String(e.id),releaseId:String(e.release_id),fromStatus:Di(e.from_status),toStatus:String(e.to_status),trafficPercent:e.traffic_percent==null?void 0:Number(e.traffic_percent),health:Go(e.health,{}),message:String(e.message),operationId:Di(e.operation_id),createdAt:String(e.created_at)}}function tS(e,t){let r=[],n=(i,o,s)=>{if(JSON.stringify(o)===JSON.stringify(s))return;if(o&&s&&typeof o==="object"&&typeof s==="object"&&!Array.isArray(o)&&!Array.isArray(s)){for(let c of[...new Set([...Object.keys(o),...Object.keys(s)])].sort())n(i?`${i}.${c}`:c,o[c],s[c]);return}r.push({path:i,...o!==void 0?{before:o}:{},...s!==void 0?{after:s}:{}})};return n("",e,t),r}class Ud{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}registerArtifact(e){if(!Xb.test(e.digest)||!/^(?:s3|https|oci|file):/.test(e.uri)||!Number.isInteger(e.size)||e.size<0)throw Error("Artifact requires a SHA-256 digest, supported immutable URI, and non-negative byte size");let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE organization_id=? AND digest=?").get(e.organizationId,e.digest);if(t)return Gp(t);let r=this.id(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_artifacts (id, organization_id, digest, kind, uri, size, media_type, provenance, attestation, verified_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.digest,e.kind,e.uri,e.size,e.mediaType??"application/octet-stream",JSON.stringify(h(e.provenance??{})),JSON.stringify(h(e.attestation??{})),n,n]),this.getArtifact(r)}getArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE id=?").get(e);return t?Gp(t):void 0}create(e){let t=this.getArtifact(e.artifactId),r=this.controlPlane.getResource(e.resourceId),n=this.controlPlane.listEnvironments(e.projectId).find((T)=>T.id===e.environmentId);if(!t||t.organizationId!==e.organizationId||t.kind!==e.kind)throw Error("Release artifact does not match the organization and deployable kind");if(!r||r.projectId!==e.projectId||r.environmentId!==e.environmentId||!n)throw Error("Release target scope does not match the resource");if(e.sourceSha&&!Zb.test(e.sourceSha))throw Error("Release source must be an immutable commit SHA");Wa({kind:e.kind,provider:r.provider,hasHealthGate:!!e.healthGate,replicas:e.replicas},e.strategy);let i=h(e.config),o=Yb("sha256").update(JSON.stringify(i)).digest("hex"),s=this.active(e.resourceId),c=this.id(),l=this.now().toISOString(),a=e.approvalRequired?"awaiting_approval":"built",f=e.hooks??{migrations:"none",preActivate:[],postActivate:[]};return this.controlPlane.database.run("INSERT INTO releases (id, organization_id, project_id, environment_id, resource_id, artifact_id, kind, source_sha, config_hash, manifest, provenance, strategy, status, health_gate, hooks, drain_seconds, grace_seconds, automatic_rollback, previous_release_id, promoted_from_release_id, actor_id, trigger, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[c,e.organizationId,e.projectId,e.environmentId,e.resourceId,e.artifactId,e.kind,e.sourceSha??null,o,JSON.stringify(h(e.manifest)),JSON.stringify(h(e.provenance??{})),e.strategy,a,e.healthGate?JSON.stringify(e.healthGate):null,JSON.stringify(f),Math.max(0,Math.min(3600,Math.floor(e.drainSeconds??30))),Math.max(0,Math.min(3600,Math.floor(e.graceSeconds??30))),e.automaticRollback===!1?0:1,s?.id??null,e.promotedFromReleaseId??null,e.actorId??null,e.trigger??"manual",l,l]),this.recordTransition(c,void 0,a,{message:e.promotedFromReleaseId?"Immutable artifact promoted without rebuild.":"Immutable release record created."}),this.get(c)}get(e){let t=this.controlPlane.database.query("SELECT * FROM releases WHERE id=?").get(e);return t?Wp(t):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM releases ORDER BY created_at DESC, rowid DESC").all().map(Wp).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(!e.resourceId||t.resourceId===e.resourceId)&&(!e.status||t.status===e.status))}active(e){return this.list({resourceId:e,status:"active"})[0]}transitions(e){return this.controlPlane.database.query("SELECT * FROM release_transitions WHERE release_id=? ORDER BY sequence").all(e).map(eS)}recordTransition(e,t,r,n){this.controlPlane.database.run("INSERT INTO release_transitions (id, release_id, from_status, to_status, traffic_percent, health, message, operation_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",[this.id(),e,t??null,r,n.trafficPercent??null,JSON.stringify(h(n.health??{})),n.message.slice(0,1000),n.operationId??null,this.now().toISOString()])}progress(e,t){let r=this.get(e);if(!r)throw Error(`Release ${e} was not found`);return this.recordTransition(e,r.status,r.status,t),this.transitions(e).at(-1)}transition(e,t,r){let n=this.get(e);if(!n)throw Error(`Release ${e} was not found`);if(!{built:["awaiting_approval","activating","failed"],awaiting_approval:["built","failed"],activating:["active","failed","rolled_back"],active:["superseded","failed","rolled_back"],failed:["activating","rolled_back"],rolled_back:["activating"],superseded:["activating"]}[n.status].includes(t))throw Error(`Invalid release transition ${n.status} → ${t}`);let o=this.now().toISOString();if(t==="active"){let s=this.active(n.resourceId);if(s&&s.id!==e)this.controlPlane.database.run("UPDATE releases SET status='superseded', updated_at=? WHERE id=?",[o,s.id]),this.recordTransition(s.id,"active","superseded",{message:`Superseded by ${e}.`,operationId:r.operationId})}return this.controlPlane.database.run("UPDATE releases SET status=?, rollback_attempts=rollback_attempts+?, activated_at=CASE WHEN ?='active' THEN ? ELSE activated_at END, failed_at=CASE WHEN ?='failed' THEN ? ELSE failed_at END, updated_at=? WHERE id=?",[t,t==="rolled_back"?1:0,t,o,t,o,o,e]),this.recordTransition(e,n.status,t,r),this.get(e)}approve(e,t){let r=this.get(e);if(!r||r.status!=="awaiting_approval")throw Error("Release is not awaiting approval");let n=this.id(),i=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_approvals (id, release_id, environment_id, decision, actor_id, comment, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[n,e,r.environmentId,t.decision,t.actorId,t.comment?.slice(0,1000)??null,i]),this.transition(e,t.decision==="approved"?"built":"failed",{message:t.decision==="approved"?"Environment gate approved.":"Environment gate rejected."})}approvals(e){return this.controlPlane.database.query("SELECT * FROM release_approvals WHERE release_id=? ORDER BY created_at").all(e).map((t)=>({id:String(t.id),releaseId:String(t.release_id),environmentId:String(t.environment_id),decision:String(t.decision),actorId:String(t.actor_id),comment:Di(t.comment),createdAt:String(t.created_at)}))}promote(e,t){let r=this.get(e);if(!r||!["active","superseded"].includes(r.status))throw Error("Only a tested active/superseded release can be promoted");return this.create({organizationId:r.organizationId,projectId:r.projectId,environmentId:t.targetEnvironmentId,resourceId:t.targetResourceId,artifactId:r.artifactId,kind:r.kind,sourceSha:r.sourceSha,config:t.config,manifest:r.manifest,provenance:r.provenance,strategy:t.strategy??r.strategy,healthGate:t.healthGate??r.healthGate,hooks:r.hooks,drainSeconds:r.drainSeconds,graceSeconds:r.graceSeconds,automaticRollback:r.automaticRollback,promotedFromReleaseId:r.id,actorId:t.actorId,trigger:"promotion",approvalRequired:t.approvalRequired})}compare(e,t){let r=this.get(e),n=this.get(t);if(!r||!n)throw Error("Both releases are required for comparison");return{artifactChanged:r.artifactId!==n.artifactId,sourceChanged:r.sourceSha!==n.sourceSha,configChanged:r.configHash!==n.configHash,manifestChanges:tS(r.manifest,n.manifest),dataCaveat:n.hooks.migrations==="none"?"No database migration is recorded.":`Database hooks are ${n.hooks.migrations}; release rollback does not roll back data.`}}pin(e,t,r){if(!this.get(e))throw Error("Release was not found");return this.controlPlane.database.run("UPDATE releases SET pinned=?, pin_reason=?, updated_at=? WHERE id=?",[t?1:0,t?r?.slice(0,500)??"operator":null,this.now().toISOString(),e]),this.get(e)}retentionCandidates(e){let t=Math.max(1,Math.min(100,Math.floor(e.keepPerResource??10))),r=new Map;for(let n of this.list()){let i=r.get(n.resourceId)??[];i.push(n),r.set(n.resourceId,i)}return[...r.values()].flatMap((n)=>n.slice(t)).filter((n)=>new Date(n.createdAt)<e.before&&!n.pinned&&!["active","activating","awaiting_approval"].includes(n.status)&&!this.list().some((i)=>i.previousReleaseId===n.id&&["active","activating"].includes(i.status)))}}class ot{controlPlane;releases;queue;constructor(e){this.controlPlane=e;this.releases=new Ud(e),this.queue=new S(e)}enqueueActivation(e,t={}){let r=this.releases.get(e.id);if(!r)throw Error("Release was not found");if(!["built","failed","rolled_back","superseded"].includes(r.status))throw Error(`Release ${r.status} cannot be activated`);let n=t.action??"activate",i=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:`release.${n}`,idempotencyKey:`release:${r.id}:${n}:${r.rollbackAttempts}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:t.targetReleaseId??null},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:r.automaticRollback?2:1,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return this.releases.transition(r.id,"activating",{message:`${n} queued.`,operationId:i.id,trafficPercent:0}),i}completeHealthGate(e,t){let r=this.releases.get(e);if(!r||r.status!=="activating")throw Error("Release is not activating");if(t.healthy)return{release:this.releases.transition(r.id,"active",{message:t.message??"Health gate passed; activation completed.",operationId:t.operationId,trafficPercent:100,health:t.health})};let n=this.releases.transition(r.id,"failed",{message:t.message??"Health gate failed.",operationId:t.operationId,trafficPercent:0,health:t.health}),i=r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!r.automaticRollback||r.rollbackAttempts>=1||!i)return{release:n};let o=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"release.rollback",idempotencyKey:`release:${r.id}:automatic-rollback`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:i.id,automatic:!0},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return{release:n,rollbackOperation:o}}enqueueRollback(e,t={}){let r=this.releases.get(e.id);if(!r||r.status!=="active")throw Error("Only the active release can be rolled back");let n=t.targetReleaseId?this.releases.get(t.targetReleaseId):r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!n||n.resourceId!==r.resourceId||!["superseded","active"].includes(n.status))throw Error("Rollback requires a preserved prior release for the same resource");return this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:"release.rollback",idempotencyKey:`release:${r.id}:manual-rollback:${n.id}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:n.id,automatic:!1},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}}function rS(e){if(e.strategy==="canary")return[5,25,50,100].map((t,r)=>({step:`canary-${t}`,trafficPercent:t,waitSeconds:r===3?e.drainSeconds:e.graceSeconds,requiresHealth:!0}));if(e.strategy==="blue_green")return[{step:"green-health",trafficPercent:0,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"traffic-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];if(e.strategy==="rolling")return[{step:"rolling-replacement",trafficPercent:50,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"rolling-complete",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];return[{step:"immutable-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!!e.healthGate}]}async function Hp(e,t){if(t.release.artifactId!==t.artifact.id)throw Error("Release activation artifact identity changed");Wa({kind:t.release.kind,hasHealthGate:!!t.release.healthGate,replicas:Number(t.release.manifest?.replicas)||void 0},t.release.strategy);let r=e.capability(t);if(!r.supported)throw Error(`${t.release.strategy} is unavailable in ${e.name}: ${r.explanation}`);return e.activate({...t,transitions:rS(t.release)})}async function Kp(e,t){if(!t.previous)throw Error("Rollback requires the preserved previous release");return e.rollback({...t,transitions:[{step:"rollback",trafficPercent:0,waitSeconds:t.release.drainSeconds,requiresHealth:!0}]})}var nS=["release.activate","release.rollback"];function iS(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function Qp(e){let t=new ot(e.store),r=async(n)=>{let i=iS(n.operation.input),o=typeof i.releaseId==="string"?i.releaseId:"",s=t.releases.get(o);if(!s)throw Error(`Queued release ${o||"(missing)"} was not found`);if(s.projectId!==n.operation.projectId||s.environmentId!==n.operation.environmentId||s.resourceId!==n.operation.resourceId)throw Error("Queued release does not match the operation scope");let c=t.releases.getArtifact(s.artifactId);if(!c||c.digest!==t.releases.getArtifact(s.artifactId)?.digest)throw Error("Immutable release artifact is unavailable");let l=typeof i.targetReleaseId==="string"&&i.targetReleaseId?i.targetReleaseId:s.previousReleaseId,a=l?t.releases.get(l):void 0;if(a&&(a.resourceId!==s.resourceId||a.artifactId===s.artifactId&&a.id===s.id))throw Error("Rollback target does not match the release resource");let f=await e.resolveDriver(s);n.checkpoint("verify",`Verifying ${c.digest} and ${s.configHash} for ${f.name}.`),n.log(`Artifact ${c.digest}; source ${s.sourceSha??"not recorded"}; config ${s.configHash}.`,{stream:"system"}),n.throwIfCancellationRequested();let T;try{T=n.operation.kind==="release.rollback"?await Kp(f,{release:s,artifact:c,previous:a}):await Hp(f,{release:s,artifact:c,previous:a})}catch(D){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:D instanceof Error?D.message:String(D)});throw D}for(let D of T.transitions)t.releases.progress(s.id,{message:`${n.operation.kind==="release.rollback"?"Rollback":"Activation"} traffic at ${D.trafficPercent}%.`,trafficPercent:D.trafficPercent,health:D.observed,operationId:n.operation.id}),n.log(`Traffic ${D.trafficPercent}%: ${D.healthy?"healthy":"unhealthy"}.`,{stream:D.healthy?"step":"stderr",step:"health"});if(n.checkpoint("health","Evaluating the provider health result."),!T.activated||!T.healthy){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:{resourceVersions:T.resourceVersions},message:T.error??"Provider health gate failed."});throw Error(T.error??`${f.name} reported an unhealthy release`)}if(n.operation.kind==="release.activate"&&s.healthGate?.name){if(!e.resolveHealthGate)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:`Named health gate ${s.healthGate.name} is not available to this worker.`}),Error(`Named health gate ${s.healthGate.name} is unavailable`);n.checkpoint("named-health-gate",`Waiting on ${s.healthGate.name}.`);let D=await e.resolveHealthGate(s.healthGate.name,s);if(n.log(`${s.healthGate.name}: ${D.healthy?"healthy":"unhealthy"}${D.message?` — ${D.message}`:""}.`,{stream:D.healthy?"step":"stderr",step:"health"}),!D.healthy)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:D.evidence,message:D.message??`Named health gate ${s.healthGate.name} failed.`}),Error(D.message??`Named health gate ${s.healthGate.name} failed`)}if(n.operation.kind==="release.rollback"){let D=t.releases.get(s.id);if(D.status!=="rolled_back")t.releases.transition(D.id,"rolled_back",{message:`Traffic restored through ${f.name}.`,operationId:n.operation.id,trafficPercent:0,health:{resourceVersions:T.resourceVersions}});if(a&&a.status!=="active"){let N=a.status==="activating"?a:t.releases.transition(a.id,"activating",{message:"Rollback target restoring traffic.",operationId:n.operation.id,trafficPercent:0});t.releases.transition(N.id,"active",{message:"Previous immutable release restored.",operationId:n.operation.id,trafficPercent:100,health:{resourceVersions:T.resourceVersions}})}}else t.completeHealthGate(s.id,{healthy:!0,operationId:n.operation.id,health:{providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions},message:"Provider activation and health gates completed."});return n.checkpoint("finalize","Persisted the terminal release state."),{releaseId:s.id,artifactDigest:c.digest,provider:f.name,providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions,status:t.releases.get(s.id).status}};return Object.fromEntries(nS.map((n)=>[n,r]))}import{createCipheriv as oS,createDecipheriv as sS,createHash as tg,randomBytes as zd}from"node:crypto";var rg={github:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitlab:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},bitbucket:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitea:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!1,deployKeys:!0},generic_https:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!1},generic_ssh:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!0}};function Rt(e){return typeof e==="string"&&e?e:void 0}function Ho(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function Oi(e){return JSON.stringify(h(e))}function Wo(e){return tg("sha256").update(e).digest("hex")}function Yp(e){let t=e.trim().replace(/\/$/,""),r=new URL(t.includes("://")?t:`https://${t}`);if(r.username||r.password||r.search||r.hash)throw Error("Source host cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(r.hostname)))throw Error("Source host must use HTTPS");return`${r.protocol}//${r.host}${r.pathname.replace(/\/$/,"")}`}function Xp(e){let t=e.trim();if(t.length<2||t.length>80)throw Error("Connection name must contain 2-80 characters");return t}function Vd(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function Zp(e){let t=e.trim()||".";if(t.startsWith("/")||t.split("/").includes("..")||/[\0\r\n]/.test(t))throw Error("Monorepo root must stay inside the repository");return t.replace(/^\.\//,"")||"."}function Ha(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Boolean))].slice(0,100)}function aS(e){let t=e.trim();if(/\r|\n/.test(t)||/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Clone URL cannot contain credentials or control characters");if(!/^(?:https?:\/\/|ssh:\/\/|git@[A-Za-z0-9.-]+:)/.test(t))throw Error("Clone URL must use HTTPS or SSH");return t}function cS(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),owner:Rt(e.owner),authKind:String(e.auth_kind),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:Rt(e.credential_fingerprint),grantedScopes:Ho(e.granted_scopes,[]),capabilities:Ho(e.capabilities,rg[String(e.provider)]),status:String(e.status),healthMessage:Rt(e.health_message),lastTestedAt:Rt(e.last_tested_at),lastSyncedAt:Rt(e.last_synced_at),credentialExpiresAt:Rt(e.credential_expires_at),version:Number(e.version),createdByActorId:Rt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qd(e){return{id:String(e.id),connectionId:String(e.connection_id),providerRepositoryId:String(e.provider_repository_id),fullName:String(e.full_name),cloneUrl:String(e.clone_url),defaultBranch:String(e.default_branch),visibility:String(e.visibility),archived:Number(e.archived)===1,metadata:Ho(e.metadata,{}),syncedAt:String(e.synced_at)}}function eg(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Rt(e.environment_id),resourceId:Rt(e.resource_id),connectionId:String(e.connection_id),repositoryId:Rt(e.repository_id),repositoryFullName:String(e.repository_full_name),defaultBranch:String(e.default_branch),branchRule:Rt(e.branch_rule),tagRule:Rt(e.tag_rule),monorepoRoot:String(e.monorepo_root),includePaths:Ho(e.include_paths,[]),excludePaths:Ho(e.exclude_paths,[]),submodules:Number(e.submodules)===1,cloneDepth:e.clone_depth==null?void 0:Number(e.clone_depth),deployKeyId:Rt(e.deploy_key_id),autoDeploy:Number(e.auto_deploy)===1,pullRequestPreviews:Number(e.pull_request_previews)===1,status:String(e.status),disabledReason:Rt(e.disabled_reason),version:Number(e.version),createdByActorId:Rt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Jd(e){return{id:String(e.id),connectionId:String(e.connection_id),name:String(e.name),publicKey:String(e.public_key),publicKeyFingerprint:String(e.public_key_fingerprint),host:String(e.host),hostKey:String(e.host_key),hostKeyFingerprint:String(e.host_key_fingerprint),createdByActorId:Rt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Gd(e){return{id:String(e.id),connectionId:String(e.connection_id),repositoryId:Rt(e.repository_id),repositoryFullName:String(e.repository_full_name),providerWebhookId:Rt(e.provider_webhook_id),events:Ho(e.events,[]),status:String(e.status),healthMessage:Rt(e.health_message),lastDeliveryAt:Rt(e.last_delivery_at),lastReconciledAt:Rt(e.last_reconciled_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Wd(e){return{id:String(e.id),connectionId:String(e.connection_id),webhookId:String(e.webhook_id),providerDeliveryId:String(e.provider_delivery_id),event:String(e.event),action:Rt(e.action),commitSha:Rt(e.commit_sha),signatureStatus:String(e.signature_status),status:String(e.status),payloadSummary:Ho(e.payload_summary,{}),operationId:Rt(e.operation_id),error:Rt(e.error),receivedAt:String(e.received_at),processedAt:Rt(e.processed_at)}}class rr{controlPlane;key;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.key=t.encryptionKey?tg("sha256").update(t.encryptionKey).digest():void 0,this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let t=zd(12),r=oS("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted source credential is unavailable");let o=sS("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createConnection(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Source connection organization was not found");let t=this.now(),r=this.idFn(),n=e.credential?JSON.stringify(e.credential):void 0;return this.run(`INSERT INTO source_connections (id, organization_id, provider, name, host, owner, auth_kind, credential_ciphertext, credential_fingerprint, granted_scopes, capabilities, status, credential_expires_at, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)`,[r,e.organizationId,e.provider,Xp(e.name),Yp(e.host),e.owner?.trim()||null,e.authKind??(n?"access_token":"none"),n?this.encrypt(n):null,n?Wo(n).slice(0,16):null,Oi([...new Set(e.grantedScopes??[])].sort()),Oi(rg[e.provider]),e.credentialExpiresAt??null,e.createdByActorId??null,t,t]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"source.connection.created",payload:{connectionId:r,provider:e.provider,host:Yp(e.host),owner:e.owner??null,scopes:e.grantedScopes??[]}}),this.getConnection(r)}getConnection(e){let t=this.controlPlane.database.query("SELECT * FROM source_connections WHERE id = ?").get(e);return t?this.currentConnection(t):void 0}listConnections(e){return this.controlPlane.database.query("SELECT * FROM source_connections WHERE organization_id = ? ORDER BY name").all(e).map((t)=>this.currentConnection(t))}currentConnection(e){let t=cS(e);if(t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime())return{...t,status:"expired",healthMessage:"Source credential expired; rotate it before deploying."};return t}getCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM source_connections WHERE id = ?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotateCredential(e,t,r={}){let n=this.getConnection(e);if(!n||n.status==="disconnected")throw Error("Active source connection was not found");let i=JSON.stringify(t);return this.run("UPDATE source_connections SET credential_ciphertext = ?, credential_fingerprint = ?, credential_expires_at = ?, status = 'pending', health_message = NULL, version = version + 1, updated_at = ? WHERE id = ?",[this.encrypt(i),Wo(i).slice(0,16),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"source.credential.rotated",payload:{connectionId:e,fingerprint:Wo(i).slice(0,16),expiresAt:r.expiresAt??null}}),this.getConnection(e)}updateHealth(e,t){let r=this.getConnection(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");let n=this.now(),i=t.grantedScopes?[...new Set(t.grantedScopes.map((o)=>o.trim()).filter(Boolean))].sort():void 0;if(this.run("UPDATE source_connections SET status = ?, health_message = ?, granted_scopes = COALESCE(?, granted_scopes), last_tested_at = COALESCE(?, last_tested_at), last_synced_at = COALESCE(?, last_synced_at), version = version + 1, updated_at = ? WHERE id = ?",[t.status,t.message?.slice(0,1000)??null,i?Oi(i):null,t.tested?n:null,t.synced?n:null,n,e]),i&&JSON.stringify(i)!==JSON.stringify([...r.grantedScopes].sort()))this.controlPlane.appendEvent({organizationId:r.organizationId,type:"source.connection.scopes_updated",payload:{connectionId:e,grantedScopes:i}});return this.getConnection(e)}upsertRepository(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");let r=this.now(),n=this.controlPlane.database.query("SELECT id FROM source_repositories WHERE connection_id = ? AND provider_repository_id = ?").get(e.connectionId,e.providerRepositoryId),i=n?String(n.id):this.idFn();return this.run(`INSERT INTO source_repositories (id, connection_id, provider_repository_id, full_name, clone_url, default_branch, visibility, archived, metadata, synced_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(connection_id, provider_repository_id) DO UPDATE SET full_name=excluded.full_name, clone_url=excluded.clone_url, default_branch=excluded.default_branch, visibility=excluded.visibility, archived=excluded.archived, metadata=excluded.metadata, synced_at=excluded.synced_at`,[i,e.connectionId,e.providerRepositoryId,Vd(e.fullName),aS(e.cloneUrl),e.defaultBranch.trim()||"main",e.visibility,e.archived?1:0,Oi(e.metadata),r]),qd(this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(i))}listRepositories(e,t,r=100){let n=t?.trim().toLowerCase();return(n?this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? AND lower(full_name) LIKE ? ORDER BY full_name LIMIT ?").all(e,`%${n}%`,Math.min(500,r)):this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? ORDER BY full_name LIMIT ?").all(e,Math.min(500,r))).map(qd)}getRepository(e){let t=this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(e);return t?qd(t):void 0}createDeployKey(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status)||!t.capabilities.deployKeys)throw Error("An active deploy-key capable source connection is required");if(!/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/=]+/.test(e.publicKey.trim()))throw Error("A valid SSH public key is required");if(!/BEGIN (?:OPENSSH|RSA) PRIVATE KEY/.test(e.privateKey))throw Error("A valid SSH private key is required");if(!/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+)\s+[A-Za-z0-9+/=]+/.test(e.hostKey.trim()))throw Error("A pinned SSH host key is required");let r=this.idFn(),n=this.now(),i=`sha256:${Wo(e.publicKey.trim())}`,o=`sha256:${Wo(e.hostKey.trim())}`;return this.run("INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,Xp(e.name),e.publicKey.trim(),i,this.encrypt(e.privateKey),e.host.trim().toLowerCase(),e.hostKey.trim(),o,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"source.deploy_key.created",payload:{connectionId:e.connectionId,deployKeyId:r,publicFingerprint:i,hostFingerprint:o}}),Jd(this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(r))}getDeployKey(e){let t=this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(e);return t?Jd(t):void 0}listDeployKeys(e){return this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE connection_id = ? ORDER BY name, created_at").all(e).map(Jd)}revokeDeployKey(e,t){let r=this.getDeployKey(e),n=r?this.getConnection(r.connectionId):void 0;if(!r||!n)throw Error("Deploy key was not found");let i=this.listBindings({connectionId:n.id}).filter((s)=>s.deployKeyId===e),o=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_bindings SET deploy_key_id=NULL, status='disabled', auto_deploy=0, disabled_reason='Source deploy key was revoked', version=version+1, updated_at=? WHERE deploy_key_id=?",[o,e]),this.run("DELETE FROM source_deploy_keys WHERE id=?",[e])})(),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:t,type:"source.deploy_key.revoked",level:"warning",payload:{connectionId:n.id,deployKeyId:e,affectedBindingIds:i.map((s)=>s.id)}}),{affectedBindings:i}}getDeployPrivateKey(e){let t=this.controlPlane.database.query("SELECT private_key_ciphertext FROM source_deploy_keys WHERE id = ?").get(e);if(!t)throw Error("Deploy key was not found");return this.decrypt(String(t.private_key_ciphertext))}createBinding(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");if(e.deployKeyId&&this.getDeployKey(e.deployKeyId)?.connectionId!==t.id)throw Error("Deploy key does not belong to this connection");let r=this.idFn(),n=this.now();return this.run(`INSERT INTO source_bindings (id, project_id, environment_id, resource_id, connection_id, repository_id, repository_full_name, default_branch, branch_rule, tag_rule, monorepo_root, include_paths, exclude_paths, submodules, clone_depth, deploy_key_id, auto_deploy, pull_request_previews, status, created_by_actor_id, created_at, updated_at)
@@ -30,11 +30,11 @@ data: ${JSON.stringify(rt)}
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,n,i,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(o),JSON.stringify(s),e.defaultRole??c.defaultRole,e.enabled??c.enabled?1:0,e.enforceSso??c.enforceSso?1:0,l,c.id]),this.getOidcProvider(c.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let a=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[a,e.organizationId,t,r,n,i,this.encrypt(e.clientSecret),JSON.stringify(o),JSON.stringify(s),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,l,l]),this.getOidcProvider(a)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?Za(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?Za(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(Za).filter((n)=>t.includeDisabled||n.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:Za(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let i=this.idFn(),o=qi(32).toString("base64url"),s=qi(32).toString("base64url"),c=qi(64).toString("base64url"),l=this.now(),a=new Date(this.nowFn().getTime()+Ag).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i,e,yi(o),this.encrypt(s),this.encrypt(c),t,r,a,l]),{transaction:this.getOidcTransaction(i),state:o,nonce:s,verifier:c}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?wg(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,yi(t));if(!r)throw Error("OIDC transaction is invalid");let n=wg(r,this.now());if(n.state!=="pending")throw Error(`OIDC transaction is ${n.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),n.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(n.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?LS(r):void 0}linkOidcSubject(e,t,r,n){let i=this.getOidcProvider(e),o=this.getIdentity(t);if(!i||!o)throw Error("OIDC provider or identity was not found");let s=ru(n);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let c=this.getOidcSubject(e,r);if(c&&c.identityId!==t)throw Error("OIDC subject is already linked to another identity");let l=this.now();if(c)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[s,l,c.id]),this.getOidcSubject(e,r);let a=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,t,r,s,l,l]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function ba(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:n}=await import("./chunk-9pvkb6br.js");return await new n({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as BS}from"node:crypto";import{chmodSync as jS,existsSync as FS,mkdirSync as US,readFileSync as zS,writeFileSync as VS}from"node:fs";import{dirname as qS}from"node:path";function x(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=A(e,"auth-encryption-key");try{if(FS(r)){let i=zS(r,"utf8").trim();if(i)return i}}catch{}let n=BS(32).toString("base64url");try{US(qS(r),{recursive:!0,mode:448}),VS(r,`${n}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i,e,yi(o),this.encrypt(s),this.encrypt(c),t,r,a,l]),{transaction:this.getOidcTransaction(i),state:o,nonce:s,verifier:c}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?wg(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,yi(t));if(!r)throw Error("OIDC transaction is invalid");let n=wg(r,this.now());if(n.state!=="pending")throw Error(`OIDC transaction is ${n.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),n.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(n.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?LS(r):void 0}linkOidcSubject(e,t,r,n){let i=this.getOidcProvider(e),o=this.getIdentity(t);if(!i||!o)throw Error("OIDC provider or identity was not found");let s=ru(n);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let c=this.getOidcSubject(e,r);if(c&&c.identityId!==t)throw Error("OIDC subject is already linked to another identity");let l=this.now();if(c)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[s,l,c.id]),this.getOidcSubject(e,r);let a=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,t,r,s,l,l]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function ba(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:n}=await import("./chunk-fawjv4dc.js");return await new n({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as BS}from"node:crypto";import{chmodSync as jS,existsSync as FS,mkdirSync as US,readFileSync as zS,writeFileSync as VS}from"node:fs";import{dirname as qS}from"node:path";function x(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=A(e,"auth-encryption-key");try{if(FS(r)){let i=zS(r,"utf8").trim();if(i)return i}}catch{}let n=BS(32).toString("base64url");try{US(qS(r),{recursive:!0,mode:448}),VS(r,`${n}
 `,{mode:384}),jS(r,384)}catch{}return n}import{constants as JS,createHash as ou,createPublicKey as GS,createVerify as WS,timingSafeEqual as HS}from"node:crypto";var Pg=new Set(["RS256","PS256","ES256"]),Rg=60;function ec(e,t){let r=new URL(e),n=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&n))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function su(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function au(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let i=await e.text();if(i.length>1048576)throw Error(`${t} response is too large`);try{return su(JSON.parse(i),t)}catch(o){if(o instanceof Error&&o.message===`${t} is invalid`)throw o;throw Error(`${t} returned invalid JSON`)}}function KS(e,t){let r=ou("sha256").update(e).digest(),n=ou("sha256").update(t).digest();return HS(r,n)}function xg(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function An(e,t=fetch){let r=ec(e.issuer,"OIDC issuer"),n=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),i=await au(await t(n,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(i.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let s of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof i[s]!=="string")throw Error(`OIDC discovery is missing ${s}`);ec(i[s],`OIDC ${s}`)}if(Array.isArray(i.response_types_supported)&&!i.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(i.code_challenge_methods_supported)&&!i.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let o=Array.isArray(i.id_token_signing_alg_values_supported)?i.id_token_signing_alg_values_supported.filter((s)=>typeof s==="string"):[];if(o.length>0&&!o.some((s)=>Pg.has(s)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return i}async function cu(e,t,r,n,i=fetch){let o=e.getOidcProviderBySlug(t);if(!o?.enabled)throw Error("OIDC provider is unavailable");let s=ec(r,"Application origin").origin,c=await An(o,i),l=`${s}/auth/oidc/${encodeURIComponent(o.slug)}/callback`,a=e.beginOidcTransaction(o.id,l,xg(n)),f=new URL(c.authorization_endpoint);return f.searchParams.set("response_type","code"),f.searchParams.set("client_id",o.clientId),f.searchParams.set("redirect_uri",l),f.searchParams.set("scope",o.scopes.join(" ")),f.searchParams.set("state",a.state),f.searchParams.set("nonce",a.nonce),f.searchParams.set("code_challenge",ou("sha256").update(a.verifier).digest("base64url")),f.searchParams.set("code_challenge_method","S256"),{authorizationUrl:f.href,expiresAt:a.transaction.expiresAt}}function QS(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:su(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:su(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function YS(e,t,r){let n=QS(e),i=typeof n.header.alg==="string"?n.header.alg:"",o=typeof n.header.kid==="string"?n.header.kid:"";if(!Pg.has(i)||!o)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(i))throw Error("OIDC ID-token algorithm was not advertised by the provider");let s=await au(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(s.keys))throw Error("OIDC signing-key response is invalid");let c=s.keys.find((T)=>{if(!T||typeof T!=="object"||Array.isArray(T))return!1;let D=T;return D.kid===o&&(!D.alg||D.alg===i)&&(!D.use||D.use==="sig")});if(!c)throw Error("OIDC ID-token signing key was not found");let l=GS({key:c,format:"jwk"}),a=WS("SHA256").update(n.signingInput).end();if(!(i==="PS256"?a.verify({key:l,padding:JS.RSA_PKCS1_PSS_PADDING,saltLength:32},n.signature):i==="ES256"?a.verify({key:l,dsaEncoding:"ieee-p1363"},n.signature):a.verify(l,n.signature)))throw Error("OIDC ID-token signature is invalid");return n.claims}function XS(e,t,r,n){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let i=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((l)=>typeof l==="string"):[];if(!i.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((i.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let o=Math.floor(n.getTime()/1000);if(typeof e.exp!=="number"||e.exp<o-Rg)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>o+Rg)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!KS(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let s=e.email.trim().toLowerCase();if(s.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(s))throw Error("OIDC provider returned an invalid email address");let c=s.split("@")[1];if(!c||!t.allowedDomains.includes(c))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:s,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function du(e,t,r=fetch){let n=e.getOidcProviderBySlug(t.providerSlug);if(!n?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let i=ec(t.origin,"Application origin").origin,o=e.consumeOidcTransaction(n.id,t.state),s=`${i}/auth/oidc/${encodeURIComponent(n.slug)}/callback`;if(o.transaction.redirectUri!==s)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:c}=e.getOidcProviderCredentials(n.id),l=await An(n,r),a=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:o.transaction.redirectUri,code_verifier:o.verifier}),f={accept:"application/json","content-type":"application/x-www-form-urlencoded"},T=l.token_endpoint_auth_methods_supported??["client_secret_basic"];if(T.includes("client_secret_basic")){let W=(ee)=>new URLSearchParams({value:ee}).toString().slice(6),Y=`${W(n.clientId)}:${W(c)}`;f.authorization=`Basic ${Buffer.from(Y).toString("base64")}`}else if(T.includes("client_secret_post"))a.set("client_id",n.clientId),a.set("client_secret",c);else throw Error("OIDC provider does not support a configured client authentication method");let D=await au(await r(l.token_endpoint,{method:"POST",headers:f,body:a,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof D.id_token!=="string")throw Error("OIDC token response did not include an ID token");let N=await YS(D.id_token,l,r);return{identity:XS(N,n,o.nonce,t.now??new Date),returnPath:o.transaction.returnPath}}import{createHash as ZS,randomBytes as ev}from"node:crypto";var Og=new Set(ae),_g=7776000000,Ng=31536000000,$g=86400000;function Ji(e){return typeof e==="string"?e:void 0}function Dg(e){return ZS("sha256").update(e).digest("hex")}function tv(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&Og.has(r)):[]}catch{return[]}}function rv(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function uu(e){let t=Ji(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:Ji(e.description),createdByActorId:Ji(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function lu(e,t){let r=Ji(e.revoked_at),n=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:tv(e.capabilities),scope:rv(e),expiresAt:n,lastUsedAt:Ji(e.last_used_at),lastNetworkHint:Ji(e.last_network_hint),revokedAt:r,rotatedFromTokenId:Ji(e.rotated_from_token_id),createdByActorId:Ji(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":n<=t?"expired":"active"}}function nv(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:Ji(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class Ve{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let n=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),i=this.idFn(),o=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[i,e.organizationId,n.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,o,o]);let s=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:n.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),c=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:i,roleTemplate:e.roleTemplate,scope:{type:c.type,id:c.id??null}}}),{serviceAccount:this.getServiceAccount(i),membership:s}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?uu(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?uu(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(uu).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let n=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[n,n,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[n,n,e]);let i=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(i?.status==="active")this.controlPlane.revokeMembership(i.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let n=[...new Set(e.capabilities)];if(n.length===0||n.some((D)=>!Og.has(D)))throw Error("API token requires valid explicit capabilities");let i=e.scope??r.scope,o=this.controlPlane.resolveAuthorizationTarget(t.organizationId,i);if(!o)throw Error("API token scope was not found in this organization");for(let D of n)if(!re({membership:r,grants:this.controlPlane.listGrants(r.id),capability:D,target:o}).allowed)throw Error(`Service-account membership does not grant ${D} at the token scope`);let s=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+_g);if(!Number.isFinite(s.getTime())||s.getTime()<=this.nowFn().getTime()+60000||s.getTime()>this.nowFn().getTime()+Ng)throw Error("API token expiry must be between one minute and one year from now");let c=this.idFn(),l=ev(32).toString("base64url"),a=`tsc_v1.${c}.${l}`,f=`tsc_v1.${c.slice(0,8)}`,T=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[c,t.id,e.name.trim().slice(0,100)||"API token",Dg(a),f,JSON.stringify(n.sort()),i.type,i.type==="organization"?null:i.id??null,s.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,T,T]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:c,prefix:f,capabilities:n,scope:{type:i.type,id:i.id??null},expiresAt:s.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(c),secret:a}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?lu(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>lu(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let n=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],Dg(e));if(!n)return;let i=lu(n,this.now()),o=this.getServiceAccount(i.serviceAccountId);if(!o||o.state!=="active"||i.state!=="active")return;let s=this.controlPlane.getActor(o.actorId),c=this.controlPlane.getMembershipForActor(o.organizationId,o.actorId);if(!s||s.disabledAt||!c||c.status!=="active")return;let l=this.now(),a=!i.lastUsedAt||this.nowFn().getTime()-new Date(i.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[l,t?.slice(0,128)??null,l,i.id]),a)this.controlPlane.appendEvent({organizationId:o.organizationId,actorId:s.id,type:"api.token.used",payload:{serviceAccountId:o.id,tokenId:i.id,prefix:i.prefix}});return{serviceAccount:o,token:this.getToken(i.id),actor:s,membership:c}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let n=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),i=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:i?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:n.token.id}}),n}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let n=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[n,n,e]);let i=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:i?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?nv(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),n=this.now(),i=new Date(this.nowFn().getTime()+$g).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.tokenId,e.key,e.requestHash,e.operationId??null,e.responseStatus,JSON.stringify(e.responseBody),i,n]),this.getIdempotency(e.tokenId,e.key)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM api_tokens WHERE (expires_at < ? OR revoked_at IS NOT NULL) AND created_at < ?",[e,new Date(this.nowFn().getTime()-2592000000).toISOString()]).changes,r=this.controlPlane.database.run("DELETE FROM api_idempotency_records WHERE expires_at < ?",[e]).changes;return{tokens:t,idempotency:r}}}class Sa{region;client;constructor(e="us-east-1",t=new u){this.region=e;this.client=t}request(e,t){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${e}`},body:JSON.stringify(t)})}startBackupJob(e){return this.request("StartBackupJob",e)}describeBackupJob(e){return this.request("DescribeBackupJob",{BackupJobId:e})}startRestoreJob(e){return this.request("StartRestoreJob",e)}describeRestoreJob(e){return this.request("DescribeRestoreJob",{RestoreJobId:e})}deleteRecoveryPoint(e,t){return this.request("DeleteRecoveryPoint",{BackupVaultName:e,RecoveryPointArn:t})}}var iv=new zt({ignoreAttributes:!0,parseTagValue:!1,trimValues:!0});function Lg(e){if(e===void 0||e===null||e==="")return;let t=Number(e);return Number.isFinite(t)?t:void 0}function Bg(e){if(!e?.Address)return;return{Address:String(e.Address),Port:Lg(e.Port)??0}}function Mg(e){return{CacheClusterId:String(e?.CacheClusterId??""),CacheClusterStatus:String(e?.CacheClusterStatus??""),Engine:String(e?.Engine??""),EngineVersion:String(e?.EngineVersion??""),CacheNodeType:String(e?.CacheNodeType??""),NumCacheNodes:Lg(e?.NumCacheNodes)??0,PreferredAvailabilityZone:e?.PreferredAvailabilityZone||void 0,CacheClusterCreateTime:String(e?.CacheClusterCreateTime??""),CacheNodes:k(e?.CacheNodes?.CacheNode).map((t)=>({CacheNodeId:String(t.CacheNodeId??""),CacheNodeStatus:String(t.CacheNodeStatus??""),Endpoint:Bg(t.Endpoint)}))}}function ov(e){return{ReplicationGroupId:String(e?.ReplicationGroupId??""),Status:String(e?.Status??""),Description:e?.Description||void 0,MemberClusters:k(e?.MemberClusters?.ClusterId).map(String),NodeGroups:k(e?.NodeGroups?.NodeGroup).map((t)=>({NodeGroupId:String(t.NodeGroupId??""),Status:String(t.Status??""),PrimaryEndpoint:Bg(t.PrimaryEndpoint)}))}}class ie{client;region;profile;constructor(e="us-east-1",t){this.region=e,this.profile=t,this.client=new u(void 0,{profile:t})}async query(e){let t=await this.client.request({service:"elasticache",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString(),rawResponse:!0});if(typeof t!=="string"||!t.trim())return;return _(iv.parse(t),e.Action)}async describeCacheClusters(e){let t={Action:"DescribeCacheClusters",Version:"2015-02-02",ShowCacheNodeInfo:"true"};if(e)t.CacheClusterId=e;let r=await this.query(t);return{CacheClusters:k(r?.CacheClusters?.CacheCluster).map(Mg)}}async describeReplicationGroups(e){let t={Action:"DescribeReplicationGroups",Version:"2015-02-02"};if(e)t.ReplicationGroupId=e;let r=await this.query(t);return{ReplicationGroups:k(r?.ReplicationGroups?.ReplicationGroup).map(ov)}}async createCacheCluster(e){let t={Action:"CreateCacheCluster",Version:"2015-02-02",CacheClusterId:e.cacheClusterId,Engine:e.engine,CacheNodeType:e.cacheNodeType};if(e.numCacheNodes)t.NumCacheNodes=e.numCacheNodes;if(e.engineVersion)t.EngineVersion=e.engineVersion;if(e.port)t.Port=e.port;if(e.securityGroupIds&&e.securityGroupIds.length>0)e.securityGroupIds.forEach((n,i)=>{t[`SecurityGroupIds.member.${i+1}`]=n});if(e.subnetGroupName)t.CacheSubnetGroupName=e.subnetGroupName;if(e.tags&&e.tags.length>0)e.tags.forEach((n,i)=>{t[`Tags.member.${i+1}.Key`]=n.Key,t[`Tags.member.${i+1}.Value`]=n.Value});let r=await this.query(t);return{CacheCluster:Mg(r?.CacheCluster)}}async deleteCacheCluster(e,t){let r={Action:"DeleteCacheCluster",Version:"2015-02-02",CacheClusterId:e};if(t)r.FinalSnapshotIdentifier=t;await this.query(r)}async rebootCacheCluster(e,t){let r={Action:"RebootCacheCluster",Version:"2015-02-02",CacheClusterId:e};t.forEach((n,i)=>{r[`CacheNodeIdsToReboot.member.${i+1}`]=n}),await this.query(r)}async describeCacheEngineVersions(e){let t={Action:"DescribeCacheEngineVersions",Version:"2015-02-02"};if(e)t.Engine=e;let r=[],n;do{let i=await this.query(n?{...t,Marker:n}:t);for(let o of k(i?.CacheEngineVersions?.CacheEngineVersion))r.push({Engine:String(o.Engine??""),EngineVersion:String(o.EngineVersion??""),CacheParameterGroupFamily:String(o.CacheParameterGroupFamily??"")});n=i?.Marker||void 0}while(n);return{CacheEngineVersions:r}}async getCacheStatistics(e){let r=(await this.describeCacheClusters(e)).CacheClusters[0];if(!r)throw Error(`Cache cluster ${e} not found`);let n=r.Engine==="memcached",i=new q(this.region,this.profile),o=new Date,s=new Date(o.getTime()-600000),c=async(N,W)=>[...await i.getMetricStatistics({Namespace:"AWS/ElastiCache",MetricName:N,Dimensions:[{Name:"CacheClusterId",Value:e}],StartTime:s,EndTime:o,Period:300,Statistics:[W]})].sort((ne,he)=>new Date(he.Timestamp??0).getTime()-new Date(ne.Timestamp??0).getTime())[0]?.[W],[l,a,f,T,D]=await Promise.all([c("CPUUtilization","Average"),c("Evictions","Sum"),c(n?"GetHits":"CacheHits","Sum"),c(n?"GetMisses":"CacheMisses","Sum"),c("CurrConnections","Average")]);return{cpuUtilization:l,evictions:a,hits:f,misses:T,connections:D}}}import{isIP as Jg}from"node:net";var sv={every_minute:"* * * * *",every_five_minutes:"*/5 * * * *",hourly:"0 * * * *",daily:"0 0 * * *",weekly:"0 0 * * 0"},av={JAN:1,FEB:2,MAR:3,APR:4,MAY:5,JUN:6,JUL:7,AUG:8,SEP:9,OCT:10,NOV:11,DEC:12},jg={SUN:0,MON:1,TUE:2,WED:3,THU:4,FRI:5,SAT:6};function Fg(e){try{return new Intl.DateTimeFormat("en",{timeZone:e}).format(new Date),e}catch{throw Error(`Unknown schedule timezone: ${e}`)}}function tc(e,t,r,n){let i=t[e.toUpperCase()]??Number(e);if(!Number.isInteger(i)||i<r||i>n)throw Error(`Schedule field value ${e} is outside ${r}-${n}.`);return i}function Ds(e,t,r,n={},i){if(e==="*"||e==="?")return;let o=new Set;for(let s of e.split(",")){let[c,l]=s.split("/"),a=l?tc(l,{},1,r-t+1):1,f,T;if(c==="*")f=t,T=r;else if(c.includes("-")){let D=c.split("-");f=tc(D[0],n,t,r),T=tc(D[1],n,t,r)}else f=tc(c,n,t,r),T=f;if(T<f)throw Error("Schedule ranges must be ascending.");for(let D=f;D<=T;D+=a)o.add(i?i(D):D===7&&r===7?0:D)}return o}function cv(e,t){let r=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:t,year:"numeric",month:"numeric",day:"numeric",weekday:"short",hour:"numeric",minute:"numeric",hourCycle:"h23"}).formatToParts(e).map((n)=>[n.type,n.value]));return{minute:Number(r.minute),hour:Number(r.hour),day:Number(r.day),month:Number(r.month),weekday:jg[r.weekday.toUpperCase()],year:Number(r.year),key:`${r.year}-${r.month}-${r.day} ${r.hour}:${r.minute}`}}function Ug(e){let r=(e.startsWith("cron(")?e.slice(5,-1).trim():e.trim()).split(/\s+/);if(r.length!==5&&r.length!==6)throw Error("Cron schedules require five standard fields or six EventBridge fields.");let[n,i,o,s,c,l]=r,a=r.length===6;return{minute:Ds(n,0,59),hour:Ds(i,0,23),day:Ds(o,1,31),month:Ds(s,1,12,av),weekday:Ds(c,a?1:0,7,jg,a?(f)=>f===7?6:f-1:void 0),year:l?Ds(l,1970,2199):void 0,dayWildcard:o==="*"||o==="?",weekdayWildcard:c==="*"||c==="?"}}function dv(e,t){if(!((!t.minute||t.minute.has(e.minute))&&(!t.hour||t.hour.has(e.hour))&&(!t.month||t.month.has(e.month))&&(!t.year||t.year.has(e.year))))return!1;let n=!t.day||t.day.has(e.day),i=!t.weekday||t.weekday.has(e.weekday);return t.dayWildcard?i:t.weekdayWildcard?n:n||i}function zg(e){let t=/^rate\(\s*(\d+)\s+(minute|minutes|hour|hours|day|days)\s*\)$/i.exec(e);if(!t)return;let r=Number(t[1]);if(r<1)throw Error("Rate amount must be positive.");return r*(t[2].toLowerCase().startsWith("minute")?60000:t[2].toLowerCase().startsWith("hour")?3600000:86400000)}function Os(e){let t=e.trim(),r=sv[t.toLowerCase()]??t;if(!r)throw Error("Schedule expression is required.");let n=zg(r);if(n){let i=n/60000;return{original:t,normalized:`rate(${i} minutes)`,kind:"rate",description:i%1440===0?`Every ${i/1440} day(s)`:i%60===0?`Every ${i/60} hour(s)`:`Every ${i} minute(s)`}}return Ug(r),{original:t,normalized:r.startsWith("cron(")?r:`cron(${r})`,kind:"cron",description:`Cron ${r.replace(/^cron\(|\)$/g,"")}`}}function at(e,t,r=new Date,n=5){let i=Os(e),o=Fg(t),s=Math.min(20,Math.max(1,n)),c=zg(i.normalized);if(c)return Array.from({length:s},(N,W)=>new Date(r.getTime()+c*(W+1)).toISOString());let l=Ug(i.normalized),a=[],f=new Set,T=new Date(Math.floor(r.getTime()/60000)*60000+60000),D=0;while(a.length<s&&D<1100000){let N=cv(T,o);if(dv(N,l)&&!f.has(N.key))a.push(T.toISOString()),f.add(N.key);T=new Date(T.getTime()+60000),D++}if(a.length<s)throw Error("Schedule produced no runs within the bounded preview horizon.");return a}function ct(e,t="UTC",r=new Date,n=5){let i=Os(e),o=at(i.normalized,t,r,n),s=i.kind==="cron"?["Server cron and EventBridge use the same wall-clock preview; provider-specific extensions are retained only when supported."]:["Rate schedules use elapsed-time intervals and are not shifted by DST."];return{...i,timezone:Fg(t),nextRuns:o,capabilities:{server:i.kind==="cron",eventbridge:!0,notes:s}}}function Yn(e){let t=Os(e.expression),r=t.normalized.slice(5,-1).trim().split(/\s+/),n=t.kind==="cron"&&r.length===5;if(e.provider==="server")return{provider:"server",supported:n,features:{timezone:!0,flexibleWindow:!1,catchUp:!1,replaceOverlap:!1},notes:[t.kind==="rate"?"Server cron requires a cron expression; use an equivalent cron schedule.":r.length!==5?"EventBridge six-field cron extensions cannot be installed as server cron.":"Cron is reconciled through a root-owned ts-cloud entry.",e.missedRunPolicy==="catch_up"?"Catch-up is handled by the control plane, not cron.":"Missed runs are skipped by cron."]};if(e.provider==="eventbridge")return{provider:"eventbridge",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["Five-field cron is translated explicitly to EventBridge six-field syntax. Flexible windows are provider-native; overlap and catch-up remain control-plane policies."]};if(e.provider==="lambda")return{provider:"lambda",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["The schedule invokes one immutable Lambda target."]};return{provider:"platform",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!0,replaceOverlap:!0},notes:["The durable control-plane worker enforces all configured policies."]}}function uv(e){if(e.queues===!0)return[{queue:"default",processes:e.queueConcurrency??1}];if(!Array.isArray(e.queues))return[];return e.queues.map((t)=>{if(typeof t==="string")return{queue:t,processes:e.queueConcurrency??1};let[r,n]=Object.entries(t)[0]??["default",e.queueConcurrency??1];return{queue:r,processes:n}})}function Gr(e,t,r){let n=new Set,i=new Set,o=new Map(r.resources.map((T)=>[T.slug,T])),s=0,c=0;for(let[T,D]of Object.entries(t.sites??{})){let N=o.get(T);if(D.scheduler){let ee=`config:site:${T}:scheduler`;n.add(ee),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:N?.id,name:`${T} scheduler`,provider:"server",expression:"* * * * *",timezone:"UTC",flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:`scheduler:run:${T}`},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:300,enabled:!0,origin:"config",sourceKey:ee,observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),s++}let W=D,Y=Array.isArray(W.queues??W.workers)?W.queues??W.workers:[];for(let[ee,ne]of Y.entries()){let he=typeof ne==="string"?{queue:ne}:ne,te=String(he.queue??he.name??"default"),xe=`config:site:${T}:worker:${ee}:${te}`;i.add(xe),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:N?.id,name:`${T}:${te}`,provider:"systemd",queue:te,processes:Number(he.processes)||1,timeoutSeconds:Number(he.timeout)||60,restartPolicy:"always",target:{operationId:`worker:restart:${T}`,site:T},enabled:!0,origin:"config",sourceKey:xe,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),c++}}let l=t.infrastructure?.compute?.backups;if(l?.enabled)n.add("config:platform:backup"),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:"Scheduled backup",provider:"server",expression:String(l.schedule??"0 2 * * *"),timezone:String(l.timezone??"UTC"),flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:"backup:run"},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:60},timeoutSeconds:3600,enabled:!0,origin:"config",sourceKey:"config:platform:backup",observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),s++;let a=t.environments?.[r.environment.slug]?.app;if(a){if(a.scheduler!=="off"){let T=`config:serverless:${r.environment.slug}:scheduler`;n.add(T),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name} serverless scheduler`,provider:"eventbridge",expression:"rate(1 minute)",timezone:"UTC",flexibleMinutes:0,target:{kind:"serverless_scheduler",action:"schedule:run"},payloadRefs:{},missedRunPolicy:a.scheduler==="sub-minute"?"catch_up":"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:a.cliTimeout??900,enabled:!0,origin:"config",sourceKey:T,observedState:{source:"cloud.config.ts",mode:a.scheduler??"on"},reconciliationStatus:"pending"}),s++}for(let{queue:T,processes:D}of uv(a)){let N=`config:serverless:${r.environment.slug}:worker:${T}`;i.add(N),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name}:${T}`,provider:"lambda",queue:T,processes:D,timeoutSeconds:a.queueTimeout??120,restartPolicy:"on_failure",target:{function:"queue",queue:T},enabled:!0,origin:"config",sourceKey:N,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),c++}}let f=0;for(let T of e.list(r.project.id,{environmentId:r.environment.id}).filter((D)=>D.origin==="config"&&D.sourceKey&&!n.has(D.sourceKey)))e.reconcile(T.id,"drifted",{...T.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),f++;for(let T of e.listWorkers(r.project.id,r.environment.id).filter((D)=>D.origin==="config"&&D.sourceKey&&!i.has(D.sourceKey)))e.reconcileWorker(T.id,"drifted",{...T.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),f++;return{jobs:s,workers:c,drifted:f}}class Zn{store;queue;constructor(e,t={}){this.store=e;this.queue=t.queue??new S(e.controlPlane)}enqueue(e,t){let r=new Date(t.scheduledFor??this.store.now()).toISOString(),n=`${e.id}:${t.trigger==="manual"?crypto.randomUUID():r}`,i=this.store.activeExecution(e.id);if(i&&e.overlapPolicy==="forbid")return this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:n,status:"skipped",output:{reason:"overlap_forbidden",activeExecutionId:i.id}});if(i&&e.overlapPolicy==="replace"&&i.operationId)try{this.queue.requestCancellation(i.operationId,t.actorId)}catch{}let o=this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:n,status:"queued",output:{semantics:"at_least_once"}});if(o.operationId)return o;let s=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:t.actorId,kind:"job.execute",input:{jobId:e.id,executionId:o.id},idempotencyKey:`job-execution:${o.id}`,lockKey:e.overlapPolicy==="allow"?`job-execution:${o.id}`:`job:${e.id}`,maxAttempts:e.retryPolicy.maxAttempts,timeoutSeconds:e.timeoutSeconds,retryClasses:["job_transient"],resumePolicy:"requeue"}).operation;return this.store.attachOperation(o.id,s.id)}tick(e=this.store.now()){let t=[];for(let r of this.store.due(e.toISOString())){let n=r.nextRunAt,i=at(r.normalizedExpression,r.timezone,e,1)[0];if(r.missedRunPolicy==="catch_up"){let o=n,s=0;while(o<=e.toISOString()&&s<10)t.push(this.enqueue(r,{trigger:o===n?"scheduled":"catch_up",scheduledFor:o})),o=at(r.normalizedExpression,r.timezone,new Date(o),1)[0],s++}else t.push(this.enqueue(r,{trigger:"scheduled",scheduledFor:n}));this.store.markScheduled(r.id,n,i)}return t}}function Vg(e){return{"job.execute":async(r)=>{let n=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},i=e.store.get(String(n.jobId??"")),o=e.store.getExecution(String(n.executionId??""));if(!i||!o)throw Error("Scheduled job execution is no longer available.");e.store.transitionExecution(o.id,"running",{attempt:r.operation.attempt}),r.checkpoint("execute",`Running ${i.name} on ${i.provider}.`),r.log(`Trigger ${o.trigger}; scheduled for ${o.scheduledFor}; semantics at-least-once.`,{stream:"system"});let s=await e.executor(i,i.target,r);if(s.stdout)r.log(s.stdout,{stream:"stdout"});if(s.stderr)r.log(s.stderr,{stream:"stderr"});if(!s.ok){if(e.store.transitionExecution(o.id,r.operation.attempt>=i.retryPolicy.maxAttempts?"dead":"failed",{attempt:r.operation.attempt,error:s.stderr??"Job execution failed."}),s.retryable)throw new $e(s.stderr??"Scheduled job failed transiently.","job_transient");throw Error(s.stderr??"Scheduled job failed.")}return e.store.transitionExecution(o.id,"succeeded",{attempt:r.operation.attempt,output:s.output??{}}),{jobId:i.id,executionId:o.id,provider:i.provider}}}}var Jr=(e)=>typeof e==="string"&&e?e:void 0,qg=(e)=>Number(e)===1,Zo=(e)=>{try{return JSON.parse(String(e))}catch{return{}}},Eo=(e,t,r,n)=>{let i=Number(e);return Number.isFinite(i)?Math.min(n,Math.max(r,Math.floor(i))):t};function rc(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Jr(e.environment_id),resourceId:Jr(e.resource_id),name:String(e.name),provider:String(e.provider),expression:String(e.expression),normalizedExpression:String(e.normalized_expression),timezone:String(e.timezone),startsAt:Jr(e.starts_at),endsAt:Jr(e.ends_at),flexibleMinutes:Number(e.flexible_minutes),target:Zo(e.target),payloadRefs:Zo(e.payload_refs),missedRunPolicy:String(e.missed_run_policy),overlapPolicy:String(e.overlap_policy),retryPolicy:Zo(e.retry_policy),timeoutSeconds:Number(e.timeout_seconds),enabled:qg(e.enabled),origin:String(e.origin),sourceKey:Jr(e.source_key),ownerActorId:Jr(e.owner_actor_id),observedState:Zo(e.observed_state),reconciliationStatus:String(e.reconciliation_status),nextRunAt:Jr(e.next_run_at),lastScheduledFor:Jr(e.last_scheduled_for),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function oc(e){return{id:String(e.id),jobId:String(e.job_id),operationId:Jr(e.operation_id),trigger:String(e.trigger),scheduledFor:String(e.scheduled_for),idempotencyKey:String(e.idempotency_key),status:String(e.status),attempt:Number(e.attempt),startedAt:Jr(e.started_at),finishedAt:Jr(e.finished_at),output:Zo(e.output),error:Jr(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function pu(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Jr(e.environment_id),resourceId:Jr(e.resource_id),name:String(e.name),provider:String(e.provider),queue:String(e.queue),processes:Number(e.processes),timeoutSeconds:Number(e.timeout_seconds),restartPolicy:String(e.restart_policy),target:Zo(e.target),enabled:qg(e.enabled),origin:String(e.origin),sourceKey:Jr(e.source_key),ownerActorId:Jr(e.owner_actor_id),observedState:Zo(e.observed_state),reconciliationStatus:String(e.reconciliation_status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Hr{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return this.options.now?.()??new Date}create(e){if(!e.name.trim())throw Error("Scheduled jobs require a name.");let t=ct(e.expression,e.timezone,this.now(),1),r=crypto.randomUUID(),n=this.now().toISOString(),i=e.startsAt?new Date(e.startsAt).toISOString():void 0,o=e.endsAt?new Date(e.endsAt).toISOString():void 0;if(i&&o&&i>=o)throw Error("Schedule start must be before end.");let s=t.nextRuns.find((c)=>(!i||c>=i)&&(!o||c<=o));return this.controlPlane.database.run("INSERT INTO scheduled_jobs (id,organization_id,project_id,environment_id,resource_id,name,provider,expression,normalized_expression,timezone,starts_at,ends_at,flexible_minutes,target,payload_refs,missed_run_policy,overlap_policy,retry_policy,timeout_seconds,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,next_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.trim().slice(0,120),e.provider,e.expression,t.normalized,e.timezone,i??null,o??null,Eo(e.flexibleMinutes,0,0,1440),JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify({maxAttempts:Eo(e.retryPolicy.maxAttempts,3,1,20),backoffSeconds:Eo(e.retryPolicy.backoffSeconds,30,0,86400),deadLetterRef:e.retryPolicy.deadLetterRef}),Eo(e.timeoutSeconds,900,1,86400),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,s??null,1,n,n]),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE id=?").get(e);return t?rc(t):void 0}getBySource(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE project_id=? AND environment_id IS ? AND source_key=?").get(e,t??null,r);return n?rc(n):void 0}list(e,t={}){let r=["project_id=?"],n=[e];if(t.environmentId)r.push("environment_id=?"),n.push(t.environmentId);if(t.resourceIds?.length)r.push(`resource_id IN (${t.resourceIds.map(()=>"?").join(",")})`),n.push(...t.resourceIds);if(t.enabled!=null)r.push("enabled=?"),n.push(t.enabled?1:0);return this.controlPlane.database.query(`SELECT * FROM scheduled_jobs WHERE ${r.join(" AND ")} ORDER BY next_run_at IS NULL,next_run_at,name`).all(...n).map(rc)}setEnabled(e,t){this.controlPlane.database.run("UPDATE scheduled_jobs SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now().toISOString(),e]);let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");return r}updateSchedule(e,t){let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");let n=t.expression??r.expression,i=t.timezone??r.timezone,o=ct(n,i,this.now(),1),s=this.now().toISOString();return this.controlPlane.database.run("UPDATE scheduled_jobs SET expression=?,normalized_expression=?,timezone=?,missed_run_policy=?,overlap_policy=?,timeout_seconds=?,next_run_at=?,reconciliation_status=?,version=version+1,updated_at=? WHERE id=?",[n,o.normalized,i,t.missedRunPolicy??r.missedRunPolicy,t.overlapPolicy??r.overlapPolicy,Eo(t.timeoutSeconds,r.timeoutSeconds,1,86400),o.nextRuns[0],"pending",s,e]),this.get(e)}remove(e){let t=this.get(e);if(!t)throw Error("Scheduled job was not found.");if(t.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");this.controlPlane.database.run("DELETE FROM scheduled_jobs WHERE id=?",[e])}markScheduled(e,t,r){this.controlPlane.database.run("UPDATE scheduled_jobs SET last_scheduled_for=?,next_run_at=?,updated_at=? WHERE id=?",[t,r??null,this.now().toISOString(),e])}reconcile(e,t,r){return this.controlPlane.database.run("UPDATE scheduled_jobs SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]),this.get(e)}upsertConfigJob(e){let t=this.getBySource(e.projectId,e.environmentId,e.sourceKey);if(!t)return this.create(e);let r=ct(e.expression,e.timezone,this.now(),1),n=this.now().toISOString();if(t.resourceId===e.resourceId&&t.name===e.name&&t.provider===e.provider&&t.expression===e.expression&&t.normalizedExpression===r.normalized&&t.timezone===e.timezone&&JSON.stringify(t.target)===JSON.stringify(e.target)&&JSON.stringify(t.payloadRefs)===JSON.stringify(e.payloadRefs)&&t.missedRunPolicy===e.missedRunPolicy&&t.overlapPolicy===e.overlapPolicy&&JSON.stringify(t.retryPolicy)===JSON.stringify(e.retryPolicy)&&t.timeoutSeconds===e.timeoutSeconds&&t.enabled===e.enabled)return t;return this.controlPlane.database.run("UPDATE scheduled_jobs SET resource_id=?,name=?,provider=?,expression=?,normalized_expression=?,timezone=?,target=?,payload_refs=?,missed_run_policy=?,overlap_policy=?,retry_policy=?,timeout_seconds=?,enabled=?,observed_state=?,reconciliation_status=?,next_run_at=COALESCE(next_run_at,?),version=version+1,updated_at=? WHERE id=?",[e.resourceId??null,e.name,e.provider,e.expression,r.normalized,e.timezone,JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify(e.retryPolicy),e.timeoutSeconds,e.enabled?1:0,JSON.stringify(e.observedState),e.reconciliationStatus,r.nextRuns[0],n,t.id]),this.get(t.id)}due(e=this.now().toISOString()){return this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=? AND (starts_at IS NULL OR starts_at<=?) AND (ends_at IS NULL OR ends_at>=?) ORDER BY next_run_at LIMIT 200").all(e,e,e).map(rc)}createExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return oc(t);let r=crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO job_executions (id,job_id,operation_id,trigger,scheduled_for,idempotency_key,status,attempt,output,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[r,e.jobId,e.operationId??null,e.trigger,e.scheduledFor,e.idempotencyKey,e.status,0,JSON.stringify(e.output),n,n]),this.getExecution(r)}getExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE id=?").get(e);return t?oc(t):void 0}listExecutions(e,t=100){return this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? ORDER BY scheduled_for DESC,created_at DESC LIMIT ?").all(e,Math.min(1000,Math.max(1,t))).map(oc)}activeExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? AND status IN ('queued','running') ORDER BY created_at DESC LIMIT 1").get(e);return t?oc(t):void 0}attachOperation(e,t){return this.controlPlane.database.run("UPDATE job_executions SET operation_id=?,updated_at=? WHERE id=?",[t,this.now().toISOString(),e]),this.getExecution(e)}transitionExecution(e,t,r={}){let n=this.now().toISOString(),i=t==="running"?n:null,o=["succeeded","failed","skipped","dead"].includes(t)?n:null;return this.controlPlane.database.run("UPDATE job_executions SET status=?,attempt=COALESCE(?,attempt),started_at=COALESCE(started_at,?),finished_at=?,output=COALESCE(?,output),error=?,updated_at=? WHERE id=?",[t,r.attempt??null,i,o,r.output?JSON.stringify(r.output):null,r.error?.slice(0,2000)??null,n,e]),this.getExecution(e)}upsertWorker(e){let t=e.sourceKey?this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE project_id=? AND source_key=? AND environment_id IS ?").get(e.projectId,e.sourceKey,e.environmentId??null):void 0,r=t?pu(t):void 0,n=r?.id??crypto.randomUUID(),i=this.now().toISOString(),o=Eo(e.processes,1,0,1000),s=Eo(e.timeoutSeconds,60,1,86400);if(r&&r.resourceId===e.resourceId&&r.name===e.name.slice(0,120)&&r.provider===e.provider&&r.queue===e.queue.slice(0,200)&&r.processes===o&&r.timeoutSeconds===s&&r.restartPolicy===e.restartPolicy&&JSON.stringify(r.target)===JSON.stringify(e.target)&&r.enabled===e.enabled)return r;return this.controlPlane.database.run("INSERT INTO worker_definitions (id,organization_id,project_id,environment_id,resource_id,name,provider,queue,processes,timeout_seconds,restart_policy,target,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,resource_id=excluded.resource_id,provider=excluded.provider,queue=excluded.queue,processes=excluded.processes,timeout_seconds=excluded.timeout_seconds,restart_policy=excluded.restart_policy,target=excluded.target,enabled=excluded.enabled,observed_state=excluded.observed_state,reconciliation_status=excluded.reconciliation_status,version=worker_definitions.version+1,updated_at=excluded.updated_at",[n,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.slice(0,120),e.provider,e.queue.slice(0,200),o,s,e.restartPolicy,JSON.stringify(e.target),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,1,r?.createdAt??i,i]),this.getWorker(n)}getWorker(e){let t=this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE id=?").get(e);return t?pu(t):void 0}listWorkers(e,t){return this.controlPlane.database.query(`SELECT * FROM worker_definitions WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(pu)}setWorkerProcesses(e,t){this.controlPlane.database.run("UPDATE worker_definitions SET processes=?,reconciliation_status='pending',version=version+1,updated_at=? WHERE id=?",[Eo(t,1,0,1000),this.now().toISOString(),e]);let r=this.getWorker(e);if(!r)throw Error("Worker was not found.");return r}reconcileWorker(e,t,r){this.controlPlane.database.run("UPDATE worker_definitions SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]);let n=this.getWorker(e);if(!n)throw Error("Worker was not found.");return n}}var pt=(e)=>e==null?void 0:String(e),ac=(e)=>Number(e)===1,To=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}};function Gg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),provider:String(e.provider),endpoint:pt(e.endpoint),endpointPolicy:String(e.endpoint_policy),bucket:pt(e.bucket),prefix:String(e.prefix),region:pt(e.region),forcePathStyle:ac(e.force_path_style),credentialRef:pt(e.credential_ref),encryption:String(e.encryption),encryptionKeyRef:pt(e.encryption_key_ref),immutability:To(e.immutability,{}),status:String(e.status),lastTestedAt:pt(e.last_tested_at),lastSuccessAt:pt(e.last_success_at),lastFailureAt:pt(e.last_failure_at),lastError:pt(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function gu(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:pt(e.environment_id),resourceId:pt(e.resource_id),dataServiceId:pt(e.data_service_id),destinationId:String(e.destination_id),name:String(e.name),resourceKind:String(e.resource_kind),schedule:String(e.schedule),timezone:String(e.timezone),retention:To(e.retention,{}),compression:String(e.compression),encryption:String(e.encryption),includePatterns:To(e.include_patterns,[]),excludePatterns:To(e.exclude_patterns,[]),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),healthCheckId:pt(e.health_check_id),enabled:ac(e.enabled),nextRunAt:pt(e.next_run_at),lastRunAt:pt(e.last_run_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function mu(e){return{id:String(e.id),projectId:String(e.project_id),policyId:pt(e.policy_id),destinationId:String(e.destination_id),resourceId:pt(e.resource_id),dataServiceId:pt(e.data_service_id),backupJobId:pt(e.backup_job_id),kind:String(e.kind),pointInTime:String(e.point_in_time),uri:String(e.uri),sizeBytes:Number(e.size_bytes),checksum:String(e.checksum),manifest:To(e.manifest,{}),toolVersion:pt(e.tool_version),engineVersion:pt(e.engine_version),expiresAt:pt(e.expires_at),lockedUntil:pt(e.locked_until),held:ac(e.held),pinned:ac(e.pinned),status:String(e.status),verificationState:String(e.verification_state),verifiedAt:pt(e.verified_at),durationMs:e.duration_ms==null?void 0:Number(e.duration_ms),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function fu(e){return{id:String(e.id),projectId:String(e.project_id),policyId:pt(e.policy_id),recoveryPointId:pt(e.recovery_point_id),operationId:pt(e.operation_id),kind:String(e.kind),status:String(e.status),idempotencyKey:String(e.idempotency_key),target:To(e.target,{}),restoreMode:pt(e.restore_mode),cancellability:String(e.cancellability),safetyBackupId:pt(e.safety_backup_id),healthResult:e.health_result?To(e.health_result,{}):void 0,progress:To(e.progress,{}),error:pt(e.error),startedAt:pt(e.started_at),finishedAt:pt(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function lv(e){let t=e.toLowerCase();if(t==="localhost"||t.endsWith(".localhost")||t.endsWith(".local")||t.endsWith(".internal"))return!0;if(Jg(t)===6)return t==="::1"||t.startsWith("fe80:");if(Jg(t)!==4)return!1;let[r,n]=t.split(".").map(Number);return r===10||r===127||r===0||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===168}function pv(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup destination names must be 2-63 lowercase letters, numbers, or dashes.");if(e.provider!=="aws_backup"&&!e.bucket)throw Error("S3 backup destinations require a bucket.");if(e.provider==="s3_compatible"&&!e.endpoint)throw Error("S3-compatible destinations require an explicit endpoint.");if(e.provider==="s3_compatible"&&!e.credentialRef)throw Error("S3-compatible destinations require a credential reference.");if(e.encryption!=="provider"&&!e.encryptionKeyRef)throw Error("Client-side encryption requires an encryption key reference.");if(e.endpoint){let t=new URL(e.endpoint);if(t.protocol!=="https:"||t.username||t.password||t.search||t.hash||t.pathname!=="/")throw Error("Backup endpoints must be origin-only HTTPS URLs without credentials, paths, queries, or fragments.");if(lv(t.hostname)&&e.endpointPolicy!=="allow_private")throw Error("Private backup endpoints require endpointPolicy allow_private.")}}class ei{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}createDestination(e){pv(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_destinations (id,organization_id,project_id,name,provider,endpoint,endpoint_policy,bucket,prefix,region,force_path_style,credential_ref,encryption,encryption_key_ref,immutability,status,last_tested_at,last_success_at,last_failure_at,last_error,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.provider,e.endpoint??null,e.endpointPolicy,e.bucket??null,e.prefix,e.region??null,e.forcePathStyle?1:0,e.credentialRef??null,e.encryption,e.encryptionKeyRef??null,JSON.stringify(e.immutability),e.status,e.lastTestedAt??null,e.lastSuccessAt??null,e.lastFailureAt??null,e.lastError??null,1,r,r]),this.getDestination(t)}getDestination(e){let t=this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE id=?").get(e);return t?Gg(t):void 0}listDestinations(e){return this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE project_id=? ORDER BY name").all(e).map(Gg)}recordDestinationTest(e,t){let r=this.now().toISOString();return this.controlPlane.database.run("UPDATE backup_destinations SET status=?,last_tested_at=?,last_success_at=CASE WHEN ? THEN ? ELSE last_success_at END,last_failure_at=CASE WHEN ? THEN last_failure_at ELSE ? END,last_error=?,version=version+1,updated_at=? WHERE id=?",[t.ok?"healthy":"failing",r,t.ok?1:0,r,t.ok?1:0,r,t.ok?null:String(t.error??"Destination test failed.").slice(0,1000),r,e]),this.getDestination(e)}createPolicy(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup policy names must be lowercase slugs.");if(!e.resourceId&&!e.dataServiceId&&!["control_plane","infrastructure"].includes(e.resourceKind))throw Error("A backup policy requires a resource or data service target.");let t=this.getDestination(e.destinationId);if(!t||t.projectId!==e.projectId)throw Error("Backup destination was not found.");if(e.resourceKind==="control_plane"&&t.encryption==="provider")throw Error("Control-plane backups require client-side destination encryption.");if(["logical_database","volume","files","control_plane"].includes(e.resourceKind)&&t.provider==="aws_backup")throw Error(`${e.resourceKind} backups require an object-storage destination.`);if(e.resourceKind==="infrastructure"&&t.provider!=="aws_backup")throw Error("Infrastructure backups require an AWS Backup destination.");let r=Os(e.schedule),n=at(r.normalized,e.timezone,this.now(),1)[0],i=crypto.randomUUID(),o=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_policies (id,organization_id,project_id,environment_id,resource_id,data_service_id,destination_id,name,resource_kind,schedule,timezone,retention,compression,encryption,include_patterns,exclude_patterns,expected_rpo_minutes,expected_rto_minutes,health_check_id,enabled,next_run_at,last_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[i,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.dataServiceId??null,e.destinationId,e.name,e.resourceKind,r.normalized,e.timezone,JSON.stringify(e.retention),e.compression,e.encryption,JSON.stringify(e.includePatterns),JSON.stringify(e.excludePatterns),e.expectedRpoMinutes,e.expectedRtoMinutes,e.healthCheckId??null,e.enabled?1:0,n,e.lastRunAt??null,1,o,o]),this.getPolicy(i)}getPolicy(e){let t=this.controlPlane.database.query("SELECT * FROM backup_policies WHERE id=?").get(e);return t?gu(t):void 0}listPolicies(e,t){return this.controlPlane.database.query(`SELECT * FROM backup_policies WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(gu)}duePolicies(e=this.now()){return this.controlPlane.database.query("SELECT * FROM backup_policies WHERE enabled=1 AND next_run_at<=? ORDER BY next_run_at,id").all(e.toISOString()).map(gu)}advancePolicy(e,t){let r=this.getPolicy(e);if(!r)throw Error("Backup policy was not found.");let n=at(r.schedule,r.timezone,new Date(t),1)[0];return this.controlPlane.database.run("UPDATE backup_policies SET last_run_at=?,next_run_at=?,version=version+1,updated_at=? WHERE id=?",[t,n,this.now().toISOString(),e]),this.getPolicy(e)}createJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return fu(t);let r=crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_jobs (id,project_id,policy_id,recovery_point_id,operation_id,kind,status,idempotency_key,target,restore_mode,cancellability,safety_backup_id,health_result,progress,error,started_at,finished_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.projectId,e.policyId??null,e.recoveryPointId??null,e.operationId??null,e.kind,e.status,e.idempotencyKey,JSON.stringify(e.target),e.restoreMode??null,e.cancellability,e.safetyBackupId??null,e.healthResult?JSON.stringify(e.healthResult):null,JSON.stringify(e.progress),e.error??null,e.startedAt??null,e.finishedAt??null,n,n]),this.getJob(r)}getJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE id=?").get(e);return t?fu(t):void 0}listJobs(e){return this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE project_id=? ORDER BY created_at DESC").all(e).map(fu)}updateJob(e,t){let r=this.getJob(e);if(!r)throw Error("Backup job was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE backup_jobs SET status=?,operation_id=?,recovery_point_id=?,progress=?,health_result=?,error=?,started_at=?,finished_at=?,safety_backup_id=?,updated_at=? WHERE id=?",[n.status,n.operationId??null,n.recoveryPointId??null,JSON.stringify(n.progress),n.healthResult?JSON.stringify(n.healthResult):null,n.error??null,n.startedAt??null,n.finishedAt??null,n.safetyBackupId??null,this.now().toISOString(),e]),this.getJob(e)}createRecoveryPoint(e){if(!/^sha256:[a-f0-9]{64}$/i.test(e.checksum))throw Error("Recovery points require a SHA-256 checksum.");if(typeof e.uri!=="string"||!["s3:","aws-backup:","file:"].some((n)=>e.uri.startsWith(n)))throw Error("Recovery point URI uses an unsupported destination scheme.");let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO recovery_points (id,project_id,policy_id,destination_id,resource_id,data_service_id,backup_job_id,kind,point_in_time,uri,size_bytes,checksum,manifest,tool_version,engine_version,expires_at,locked_until,held,pinned,status,verification_state,verified_at,duration_ms,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.policyId??null,e.destinationId,e.resourceId??null,e.dataServiceId??null,e.backupJobId??null,e.kind,e.pointInTime,e.uri,e.sizeBytes,e.checksum,JSON.stringify(e.manifest),e.toolVersion??null,e.engineVersion??null,e.expiresAt??null,e.lockedUntil??null,e.held?1:0,e.pinned?1:0,e.status,e.verificationState,e.verifiedAt??null,e.durationMs??null,r,r]),this.getRecoveryPoint(t)}getRecoveryPoint(e){let t=this.controlPlane.database.query("SELECT * FROM recovery_points WHERE id=?").get(e);return t?mu(t):void 0}listRecoveryPoints(e,t){return this.controlPlane.database.query(`SELECT * FROM recovery_points WHERE project_id=?${t?" AND policy_id=?":""} ORDER BY point_in_time DESC`).all(e,...t?[t]:[]).map(mu)}updateRecoveryPoint(e,t){let r=this.getRecoveryPoint(e);if(!r)throw Error("Recovery point was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE recovery_points SET status=?,verification_state=?,verified_at=?,held=?,pinned=?,manifest=?,duration_ms=?,updated_at=? WHERE id=?",[n.status,n.verificationState,n.verifiedAt??null,n.held?1:0,n.pinned?1:0,JSON.stringify(n.manifest),n.durationMs??null,this.now().toISOString(),e]),this.getRecoveryPoint(e)}retentionCandidates(e=this.now()){let t=this.controlPlane.database.query(`SELECT rp.* FROM recovery_points rp
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.tokenId,e.key,e.requestHash,e.operationId??null,e.responseStatus,JSON.stringify(e.responseBody),i,n]),this.getIdempotency(e.tokenId,e.key)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM api_tokens WHERE (expires_at < ? OR revoked_at IS NOT NULL) AND created_at < ?",[e,new Date(this.nowFn().getTime()-2592000000).toISOString()]).changes,r=this.controlPlane.database.run("DELETE FROM api_idempotency_records WHERE expires_at < ?",[e]).changes;return{tokens:t,idempotency:r}}}class Sa{region;client;constructor(e="us-east-1",t=new u){this.region=e;this.client=t}request(e,t){return this.client.request({service:"backup",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`CryoControllerFrontendService.${e}`},body:JSON.stringify(t)})}startBackupJob(e){return this.request("StartBackupJob",e)}describeBackupJob(e){return this.request("DescribeBackupJob",{BackupJobId:e})}startRestoreJob(e){return this.request("StartRestoreJob",e)}describeRestoreJob(e){return this.request("DescribeRestoreJob",{RestoreJobId:e})}deleteRecoveryPoint(e,t){return this.request("DeleteRecoveryPoint",{BackupVaultName:e,RecoveryPointArn:t})}}var iv=new zt({ignoreAttributes:!0,parseTagValue:!1,trimValues:!0});function Lg(e){if(e===void 0||e===null||e==="")return;let t=Number(e);return Number.isFinite(t)?t:void 0}function Bg(e){if(!e?.Address)return;return{Address:String(e.Address),Port:Lg(e.Port)??0}}function Mg(e){return{CacheClusterId:String(e?.CacheClusterId??""),CacheClusterStatus:String(e?.CacheClusterStatus??""),Engine:String(e?.Engine??""),EngineVersion:String(e?.EngineVersion??""),CacheNodeType:String(e?.CacheNodeType??""),NumCacheNodes:Lg(e?.NumCacheNodes)??0,PreferredAvailabilityZone:e?.PreferredAvailabilityZone||void 0,CacheClusterCreateTime:String(e?.CacheClusterCreateTime??""),CacheNodes:k(e?.CacheNodes?.CacheNode).map((t)=>({CacheNodeId:String(t.CacheNodeId??""),CacheNodeStatus:String(t.CacheNodeStatus??""),Endpoint:Bg(t.Endpoint)}))}}function ov(e){return{ReplicationGroupId:String(e?.ReplicationGroupId??""),Status:String(e?.Status??""),Description:e?.Description||void 0,MemberClusters:k(e?.MemberClusters?.ClusterId).map(String),NodeGroups:k(e?.NodeGroups?.NodeGroup).map((t)=>({NodeGroupId:String(t.NodeGroupId??""),Status:String(t.Status??""),PrimaryEndpoint:Bg(t.PrimaryEndpoint)}))}}class ie{client;region;profile;constructor(e="us-east-1",t){this.region=e,this.profile=t,this.client=new u(void 0,{profile:t})}async query(e){let t=await this.client.request({service:"elasticache",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(e).toString(),rawResponse:!0});if(typeof t!=="string"||!t.trim())return;return _(iv.parse(t),e.Action)}async describeCacheClusters(e){let t={Action:"DescribeCacheClusters",Version:"2015-02-02",ShowCacheNodeInfo:"true"};if(e)t.CacheClusterId=e;let r=await this.query(t);return{CacheClusters:k(r?.CacheClusters?.CacheCluster).map(Mg)}}async describeReplicationGroups(e){let t={Action:"DescribeReplicationGroups",Version:"2015-02-02"};if(e)t.ReplicationGroupId=e;let r=await this.query(t);return{ReplicationGroups:k(r?.ReplicationGroups?.ReplicationGroup).map(ov)}}async createCacheCluster(e){let t={Action:"CreateCacheCluster",Version:"2015-02-02",CacheClusterId:e.cacheClusterId,Engine:e.engine,CacheNodeType:e.cacheNodeType};if(e.numCacheNodes)t.NumCacheNodes=e.numCacheNodes;if(e.engineVersion)t.EngineVersion=e.engineVersion;if(e.port)t.Port=e.port;if(e.securityGroupIds&&e.securityGroupIds.length>0)e.securityGroupIds.forEach((n,i)=>{t[`SecurityGroupIds.member.${i+1}`]=n});if(e.subnetGroupName)t.CacheSubnetGroupName=e.subnetGroupName;if(e.tags&&e.tags.length>0)e.tags.forEach((n,i)=>{t[`Tags.member.${i+1}.Key`]=n.Key,t[`Tags.member.${i+1}.Value`]=n.Value});let r=await this.query(t);return{CacheCluster:Mg(r?.CacheCluster)}}async deleteCacheCluster(e,t){let r={Action:"DeleteCacheCluster",Version:"2015-02-02",CacheClusterId:e};if(t)r.FinalSnapshotIdentifier=t;await this.query(r)}async rebootCacheCluster(e,t){let r={Action:"RebootCacheCluster",Version:"2015-02-02",CacheClusterId:e};t.forEach((n,i)=>{r[`CacheNodeIdsToReboot.member.${i+1}`]=n}),await this.query(r)}async describeCacheEngineVersions(e){let t={Action:"DescribeCacheEngineVersions",Version:"2015-02-02"};if(e)t.Engine=e;let r=[],n;do{let i=await this.query(n?{...t,Marker:n}:t);for(let o of k(i?.CacheEngineVersions?.CacheEngineVersion))r.push({Engine:String(o.Engine??""),EngineVersion:String(o.EngineVersion??""),CacheParameterGroupFamily:String(o.CacheParameterGroupFamily??"")});n=i?.Marker||void 0}while(n);return{CacheEngineVersions:r}}async getCacheStatistics(e){let r=(await this.describeCacheClusters(e)).CacheClusters[0];if(!r)throw Error(`Cache cluster ${e} not found`);let n=r.Engine==="memcached",i=new G(this.region,this.profile),o=new Date,s=new Date(o.getTime()-600000),c=async(N,W)=>[...await i.getMetricStatistics({Namespace:"AWS/ElastiCache",MetricName:N,Dimensions:[{Name:"CacheClusterId",Value:e}],StartTime:s,EndTime:o,Period:300,Statistics:[W]})].sort((ne,he)=>new Date(he.Timestamp??0).getTime()-new Date(ne.Timestamp??0).getTime())[0]?.[W],[l,a,f,T,D]=await Promise.all([c("CPUUtilization","Average"),c("Evictions","Sum"),c(n?"GetHits":"CacheHits","Sum"),c(n?"GetMisses":"CacheMisses","Sum"),c("CurrConnections","Average")]);return{cpuUtilization:l,evictions:a,hits:f,misses:T,connections:D}}}import{isIP as Jg}from"node:net";var sv={every_minute:"* * * * *",every_five_minutes:"*/5 * * * *",hourly:"0 * * * *",daily:"0 0 * * *",weekly:"0 0 * * 0"},av={JAN:1,FEB:2,MAR:3,APR:4,MAY:5,JUN:6,JUL:7,AUG:8,SEP:9,OCT:10,NOV:11,DEC:12},jg={SUN:0,MON:1,TUE:2,WED:3,THU:4,FRI:5,SAT:6};function Fg(e){try{return new Intl.DateTimeFormat("en",{timeZone:e}).format(new Date),e}catch{throw Error(`Unknown schedule timezone: ${e}`)}}function tc(e,t,r,n){let i=t[e.toUpperCase()]??Number(e);if(!Number.isInteger(i)||i<r||i>n)throw Error(`Schedule field value ${e} is outside ${r}-${n}.`);return i}function Ds(e,t,r,n={},i){if(e==="*"||e==="?")return;let o=new Set;for(let s of e.split(",")){let[c,l]=s.split("/"),a=l?tc(l,{},1,r-t+1):1,f,T;if(c==="*")f=t,T=r;else if(c.includes("-")){let D=c.split("-");f=tc(D[0],n,t,r),T=tc(D[1],n,t,r)}else f=tc(c,n,t,r),T=f;if(T<f)throw Error("Schedule ranges must be ascending.");for(let D=f;D<=T;D+=a)o.add(i?i(D):D===7&&r===7?0:D)}return o}function cv(e,t){let r=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:t,year:"numeric",month:"numeric",day:"numeric",weekday:"short",hour:"numeric",minute:"numeric",hourCycle:"h23"}).formatToParts(e).map((n)=>[n.type,n.value]));return{minute:Number(r.minute),hour:Number(r.hour),day:Number(r.day),month:Number(r.month),weekday:jg[r.weekday.toUpperCase()],year:Number(r.year),key:`${r.year}-${r.month}-${r.day} ${r.hour}:${r.minute}`}}function Ug(e){let r=(e.startsWith("cron(")?e.slice(5,-1).trim():e.trim()).split(/\s+/);if(r.length!==5&&r.length!==6)throw Error("Cron schedules require five standard fields or six EventBridge fields.");let[n,i,o,s,c,l]=r,a=r.length===6;return{minute:Ds(n,0,59),hour:Ds(i,0,23),day:Ds(o,1,31),month:Ds(s,1,12,av),weekday:Ds(c,a?1:0,7,jg,a?(f)=>f===7?6:f-1:void 0),year:l?Ds(l,1970,2199):void 0,dayWildcard:o==="*"||o==="?",weekdayWildcard:c==="*"||c==="?"}}function dv(e,t){if(!((!t.minute||t.minute.has(e.minute))&&(!t.hour||t.hour.has(e.hour))&&(!t.month||t.month.has(e.month))&&(!t.year||t.year.has(e.year))))return!1;let n=!t.day||t.day.has(e.day),i=!t.weekday||t.weekday.has(e.weekday);return t.dayWildcard?i:t.weekdayWildcard?n:n||i}function zg(e){let t=/^rate\(\s*(\d+)\s+(minute|minutes|hour|hours|day|days)\s*\)$/i.exec(e);if(!t)return;let r=Number(t[1]);if(r<1)throw Error("Rate amount must be positive.");return r*(t[2].toLowerCase().startsWith("minute")?60000:t[2].toLowerCase().startsWith("hour")?3600000:86400000)}function Os(e){let t=e.trim(),r=sv[t.toLowerCase()]??t;if(!r)throw Error("Schedule expression is required.");let n=zg(r);if(n){let i=n/60000;return{original:t,normalized:`rate(${i} minutes)`,kind:"rate",description:i%1440===0?`Every ${i/1440} day(s)`:i%60===0?`Every ${i/60} hour(s)`:`Every ${i} minute(s)`}}return Ug(r),{original:t,normalized:r.startsWith("cron(")?r:`cron(${r})`,kind:"cron",description:`Cron ${r.replace(/^cron\(|\)$/g,"")}`}}function at(e,t,r=new Date,n=5){let i=Os(e),o=Fg(t),s=Math.min(20,Math.max(1,n)),c=zg(i.normalized);if(c)return Array.from({length:s},(N,W)=>new Date(r.getTime()+c*(W+1)).toISOString());let l=Ug(i.normalized),a=[],f=new Set,T=new Date(Math.floor(r.getTime()/60000)*60000+60000),D=0;while(a.length<s&&D<1100000){let N=cv(T,o);if(dv(N,l)&&!f.has(N.key))a.push(T.toISOString()),f.add(N.key);T=new Date(T.getTime()+60000),D++}if(a.length<s)throw Error("Schedule produced no runs within the bounded preview horizon.");return a}function ct(e,t="UTC",r=new Date,n=5){let i=Os(e),o=at(i.normalized,t,r,n),s=i.kind==="cron"?["Server cron and EventBridge use the same wall-clock preview; provider-specific extensions are retained only when supported."]:["Rate schedules use elapsed-time intervals and are not shifted by DST."];return{...i,timezone:Fg(t),nextRuns:o,capabilities:{server:i.kind==="cron",eventbridge:!0,notes:s}}}function Yn(e){let t=Os(e.expression),r=t.normalized.slice(5,-1).trim().split(/\s+/),n=t.kind==="cron"&&r.length===5;if(e.provider==="server")return{provider:"server",supported:n,features:{timezone:!0,flexibleWindow:!1,catchUp:!1,replaceOverlap:!1},notes:[t.kind==="rate"?"Server cron requires a cron expression; use an equivalent cron schedule.":r.length!==5?"EventBridge six-field cron extensions cannot be installed as server cron.":"Cron is reconciled through a root-owned ts-cloud entry.",e.missedRunPolicy==="catch_up"?"Catch-up is handled by the control plane, not cron.":"Missed runs are skipped by cron."]};if(e.provider==="eventbridge")return{provider:"eventbridge",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["Five-field cron is translated explicitly to EventBridge six-field syntax. Flexible windows are provider-native; overlap and catch-up remain control-plane policies."]};if(e.provider==="lambda")return{provider:"lambda",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["The schedule invokes one immutable Lambda target."]};return{provider:"platform",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!0,replaceOverlap:!0},notes:["The durable control-plane worker enforces all configured policies."]}}function uv(e){if(e.queues===!0)return[{queue:"default",processes:e.queueConcurrency??1}];if(!Array.isArray(e.queues))return[];return e.queues.map((t)=>{if(typeof t==="string")return{queue:t,processes:e.queueConcurrency??1};let[r,n]=Object.entries(t)[0]??["default",e.queueConcurrency??1];return{queue:r,processes:n}})}function qr(e,t,r){let n=new Set,i=new Set,o=new Map(r.resources.map((T)=>[T.slug,T])),s=0,c=0;for(let[T,D]of Object.entries(t.sites??{})){let N=o.get(T);if(D.scheduler){let ee=`config:site:${T}:scheduler`;n.add(ee),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:N?.id,name:`${T} scheduler`,provider:"server",expression:"* * * * *",timezone:"UTC",flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:`scheduler:run:${T}`},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:300,enabled:!0,origin:"config",sourceKey:ee,observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),s++}let W=D,Y=Array.isArray(W.queues??W.workers)?W.queues??W.workers:[];for(let[ee,ne]of Y.entries()){let he=typeof ne==="string"?{queue:ne}:ne,te=String(he.queue??he.name??"default"),xe=`config:site:${T}:worker:${ee}:${te}`;i.add(xe),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:N?.id,name:`${T}:${te}`,provider:"systemd",queue:te,processes:Number(he.processes)||1,timeoutSeconds:Number(he.timeout)||60,restartPolicy:"always",target:{operationId:`worker:restart:${T}`,site:T},enabled:!0,origin:"config",sourceKey:xe,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),c++}}let l=t.infrastructure?.compute?.backups;if(l?.enabled)n.add("config:platform:backup"),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:"Scheduled backup",provider:"server",expression:String(l.schedule??"0 2 * * *"),timezone:String(l.timezone??"UTC"),flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:"backup:run"},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:60},timeoutSeconds:3600,enabled:!0,origin:"config",sourceKey:"config:platform:backup",observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),s++;let a=t.environments?.[r.environment.slug]?.app;if(a){if(a.scheduler!=="off"){let T=`config:serverless:${r.environment.slug}:scheduler`;n.add(T),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name} serverless scheduler`,provider:"eventbridge",expression:"rate(1 minute)",timezone:"UTC",flexibleMinutes:0,target:{kind:"serverless_scheduler",action:"schedule:run"},payloadRefs:{},missedRunPolicy:a.scheduler==="sub-minute"?"catch_up":"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:a.cliTimeout??900,enabled:!0,origin:"config",sourceKey:T,observedState:{source:"cloud.config.ts",mode:a.scheduler??"on"},reconciliationStatus:"pending"}),s++}for(let{queue:T,processes:D}of uv(a)){let N=`config:serverless:${r.environment.slug}:worker:${T}`;i.add(N),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name}:${T}`,provider:"lambda",queue:T,processes:D,timeoutSeconds:a.queueTimeout??120,restartPolicy:"on_failure",target:{function:"queue",queue:T},enabled:!0,origin:"config",sourceKey:N,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),c++}}let f=0;for(let T of e.list(r.project.id,{environmentId:r.environment.id}).filter((D)=>D.origin==="config"&&D.sourceKey&&!n.has(D.sourceKey)))e.reconcile(T.id,"drifted",{...T.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),f++;for(let T of e.listWorkers(r.project.id,r.environment.id).filter((D)=>D.origin==="config"&&D.sourceKey&&!i.has(D.sourceKey)))e.reconcileWorker(T.id,"drifted",{...T.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),f++;return{jobs:s,workers:c,drifted:f}}class Zn{store;queue;constructor(e,t={}){this.store=e;this.queue=t.queue??new S(e.controlPlane)}enqueue(e,t){let r=new Date(t.scheduledFor??this.store.now()).toISOString(),n=`${e.id}:${t.trigger==="manual"?crypto.randomUUID():r}`,i=this.store.activeExecution(e.id);if(i&&e.overlapPolicy==="forbid")return this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:n,status:"skipped",output:{reason:"overlap_forbidden",activeExecutionId:i.id}});if(i&&e.overlapPolicy==="replace"&&i.operationId)try{this.queue.requestCancellation(i.operationId,t.actorId)}catch{}let o=this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:n,status:"queued",output:{semantics:"at_least_once"}});if(o.operationId)return o;let s=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:t.actorId,kind:"job.execute",input:{jobId:e.id,executionId:o.id},idempotencyKey:`job-execution:${o.id}`,lockKey:e.overlapPolicy==="allow"?`job-execution:${o.id}`:`job:${e.id}`,maxAttempts:e.retryPolicy.maxAttempts,timeoutSeconds:e.timeoutSeconds,retryClasses:["job_transient"],resumePolicy:"requeue"}).operation;return this.store.attachOperation(o.id,s.id)}tick(e=this.store.now()){let t=[];for(let r of this.store.due(e.toISOString())){let n=r.nextRunAt,i=at(r.normalizedExpression,r.timezone,e,1)[0];if(r.missedRunPolicy==="catch_up"){let o=n,s=0;while(o<=e.toISOString()&&s<10)t.push(this.enqueue(r,{trigger:o===n?"scheduled":"catch_up",scheduledFor:o})),o=at(r.normalizedExpression,r.timezone,new Date(o),1)[0],s++}else t.push(this.enqueue(r,{trigger:"scheduled",scheduledFor:n}));this.store.markScheduled(r.id,n,i)}return t}}function Vg(e){return{"job.execute":async(r)=>{let n=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},i=e.store.get(String(n.jobId??"")),o=e.store.getExecution(String(n.executionId??""));if(!i||!o)throw Error("Scheduled job execution is no longer available.");e.store.transitionExecution(o.id,"running",{attempt:r.operation.attempt}),r.checkpoint("execute",`Running ${i.name} on ${i.provider}.`),r.log(`Trigger ${o.trigger}; scheduled for ${o.scheduledFor}; semantics at-least-once.`,{stream:"system"});let s=await e.executor(i,i.target,r);if(s.stdout)r.log(s.stdout,{stream:"stdout"});if(s.stderr)r.log(s.stderr,{stream:"stderr"});if(!s.ok){if(e.store.transitionExecution(o.id,r.operation.attempt>=i.retryPolicy.maxAttempts?"dead":"failed",{attempt:r.operation.attempt,error:s.stderr??"Job execution failed."}),s.retryable)throw new $e(s.stderr??"Scheduled job failed transiently.","job_transient");throw Error(s.stderr??"Scheduled job failed.")}return e.store.transitionExecution(o.id,"succeeded",{attempt:r.operation.attempt,output:s.output??{}}),{jobId:i.id,executionId:o.id,provider:i.provider}}}}var Jr=(e)=>typeof e==="string"&&e?e:void 0,qg=(e)=>Number(e)===1,Zo=(e)=>{try{return JSON.parse(String(e))}catch{return{}}},Eo=(e,t,r,n)=>{let i=Number(e);return Number.isFinite(i)?Math.min(n,Math.max(r,Math.floor(i))):t};function rc(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Jr(e.environment_id),resourceId:Jr(e.resource_id),name:String(e.name),provider:String(e.provider),expression:String(e.expression),normalizedExpression:String(e.normalized_expression),timezone:String(e.timezone),startsAt:Jr(e.starts_at),endsAt:Jr(e.ends_at),flexibleMinutes:Number(e.flexible_minutes),target:Zo(e.target),payloadRefs:Zo(e.payload_refs),missedRunPolicy:String(e.missed_run_policy),overlapPolicy:String(e.overlap_policy),retryPolicy:Zo(e.retry_policy),timeoutSeconds:Number(e.timeout_seconds),enabled:qg(e.enabled),origin:String(e.origin),sourceKey:Jr(e.source_key),ownerActorId:Jr(e.owner_actor_id),observedState:Zo(e.observed_state),reconciliationStatus:String(e.reconciliation_status),nextRunAt:Jr(e.next_run_at),lastScheduledFor:Jr(e.last_scheduled_for),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function oc(e){return{id:String(e.id),jobId:String(e.job_id),operationId:Jr(e.operation_id),trigger:String(e.trigger),scheduledFor:String(e.scheduled_for),idempotencyKey:String(e.idempotency_key),status:String(e.status),attempt:Number(e.attempt),startedAt:Jr(e.started_at),finishedAt:Jr(e.finished_at),output:Zo(e.output),error:Jr(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function pu(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Jr(e.environment_id),resourceId:Jr(e.resource_id),name:String(e.name),provider:String(e.provider),queue:String(e.queue),processes:Number(e.processes),timeoutSeconds:Number(e.timeout_seconds),restartPolicy:String(e.restart_policy),target:Zo(e.target),enabled:qg(e.enabled),origin:String(e.origin),sourceKey:Jr(e.source_key),ownerActorId:Jr(e.owner_actor_id),observedState:Zo(e.observed_state),reconciliationStatus:String(e.reconciliation_status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Hr{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return this.options.now?.()??new Date}create(e){if(!e.name.trim())throw Error("Scheduled jobs require a name.");let t=ct(e.expression,e.timezone,this.now(),1),r=crypto.randomUUID(),n=this.now().toISOString(),i=e.startsAt?new Date(e.startsAt).toISOString():void 0,o=e.endsAt?new Date(e.endsAt).toISOString():void 0;if(i&&o&&i>=o)throw Error("Schedule start must be before end.");let s=t.nextRuns.find((c)=>(!i||c>=i)&&(!o||c<=o));return this.controlPlane.database.run("INSERT INTO scheduled_jobs (id,organization_id,project_id,environment_id,resource_id,name,provider,expression,normalized_expression,timezone,starts_at,ends_at,flexible_minutes,target,payload_refs,missed_run_policy,overlap_policy,retry_policy,timeout_seconds,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,next_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.trim().slice(0,120),e.provider,e.expression,t.normalized,e.timezone,i??null,o??null,Eo(e.flexibleMinutes,0,0,1440),JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify({maxAttempts:Eo(e.retryPolicy.maxAttempts,3,1,20),backoffSeconds:Eo(e.retryPolicy.backoffSeconds,30,0,86400),deadLetterRef:e.retryPolicy.deadLetterRef}),Eo(e.timeoutSeconds,900,1,86400),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,s??null,1,n,n]),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE id=?").get(e);return t?rc(t):void 0}getBySource(e,t,r){let n=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE project_id=? AND environment_id IS ? AND source_key=?").get(e,t??null,r);return n?rc(n):void 0}list(e,t={}){let r=["project_id=?"],n=[e];if(t.environmentId)r.push("environment_id=?"),n.push(t.environmentId);if(t.resourceIds?.length)r.push(`resource_id IN (${t.resourceIds.map(()=>"?").join(",")})`),n.push(...t.resourceIds);if(t.enabled!=null)r.push("enabled=?"),n.push(t.enabled?1:0);return this.controlPlane.database.query(`SELECT * FROM scheduled_jobs WHERE ${r.join(" AND ")} ORDER BY next_run_at IS NULL,next_run_at,name`).all(...n).map(rc)}setEnabled(e,t){this.controlPlane.database.run("UPDATE scheduled_jobs SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now().toISOString(),e]);let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");return r}updateSchedule(e,t){let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");let n=t.expression??r.expression,i=t.timezone??r.timezone,o=ct(n,i,this.now(),1),s=this.now().toISOString();return this.controlPlane.database.run("UPDATE scheduled_jobs SET expression=?,normalized_expression=?,timezone=?,missed_run_policy=?,overlap_policy=?,timeout_seconds=?,next_run_at=?,reconciliation_status=?,version=version+1,updated_at=? WHERE id=?",[n,o.normalized,i,t.missedRunPolicy??r.missedRunPolicy,t.overlapPolicy??r.overlapPolicy,Eo(t.timeoutSeconds,r.timeoutSeconds,1,86400),o.nextRuns[0],"pending",s,e]),this.get(e)}remove(e){let t=this.get(e);if(!t)throw Error("Scheduled job was not found.");if(t.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");this.controlPlane.database.run("DELETE FROM scheduled_jobs WHERE id=?",[e])}markScheduled(e,t,r){this.controlPlane.database.run("UPDATE scheduled_jobs SET last_scheduled_for=?,next_run_at=?,updated_at=? WHERE id=?",[t,r??null,this.now().toISOString(),e])}reconcile(e,t,r){return this.controlPlane.database.run("UPDATE scheduled_jobs SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]),this.get(e)}upsertConfigJob(e){let t=this.getBySource(e.projectId,e.environmentId,e.sourceKey);if(!t)return this.create(e);let r=ct(e.expression,e.timezone,this.now(),1),n=this.now().toISOString();if(t.resourceId===e.resourceId&&t.name===e.name&&t.provider===e.provider&&t.expression===e.expression&&t.normalizedExpression===r.normalized&&t.timezone===e.timezone&&JSON.stringify(t.target)===JSON.stringify(e.target)&&JSON.stringify(t.payloadRefs)===JSON.stringify(e.payloadRefs)&&t.missedRunPolicy===e.missedRunPolicy&&t.overlapPolicy===e.overlapPolicy&&JSON.stringify(t.retryPolicy)===JSON.stringify(e.retryPolicy)&&t.timeoutSeconds===e.timeoutSeconds&&t.enabled===e.enabled)return t;return this.controlPlane.database.run("UPDATE scheduled_jobs SET resource_id=?,name=?,provider=?,expression=?,normalized_expression=?,timezone=?,target=?,payload_refs=?,missed_run_policy=?,overlap_policy=?,retry_policy=?,timeout_seconds=?,enabled=?,observed_state=?,reconciliation_status=?,next_run_at=COALESCE(next_run_at,?),version=version+1,updated_at=? WHERE id=?",[e.resourceId??null,e.name,e.provider,e.expression,r.normalized,e.timezone,JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify(e.retryPolicy),e.timeoutSeconds,e.enabled?1:0,JSON.stringify(e.observedState),e.reconciliationStatus,r.nextRuns[0],n,t.id]),this.get(t.id)}due(e=this.now().toISOString()){return this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=? AND (starts_at IS NULL OR starts_at<=?) AND (ends_at IS NULL OR ends_at>=?) ORDER BY next_run_at LIMIT 200").all(e,e,e).map(rc)}createExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return oc(t);let r=crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO job_executions (id,job_id,operation_id,trigger,scheduled_for,idempotency_key,status,attempt,output,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[r,e.jobId,e.operationId??null,e.trigger,e.scheduledFor,e.idempotencyKey,e.status,0,JSON.stringify(e.output),n,n]),this.getExecution(r)}getExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE id=?").get(e);return t?oc(t):void 0}listExecutions(e,t=100){return this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? ORDER BY scheduled_for DESC,created_at DESC LIMIT ?").all(e,Math.min(1000,Math.max(1,t))).map(oc)}activeExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? AND status IN ('queued','running') ORDER BY created_at DESC LIMIT 1").get(e);return t?oc(t):void 0}attachOperation(e,t){return this.controlPlane.database.run("UPDATE job_executions SET operation_id=?,updated_at=? WHERE id=?",[t,this.now().toISOString(),e]),this.getExecution(e)}transitionExecution(e,t,r={}){let n=this.now().toISOString(),i=t==="running"?n:null,o=["succeeded","failed","skipped","dead"].includes(t)?n:null;return this.controlPlane.database.run("UPDATE job_executions SET status=?,attempt=COALESCE(?,attempt),started_at=COALESCE(started_at,?),finished_at=?,output=COALESCE(?,output),error=?,updated_at=? WHERE id=?",[t,r.attempt??null,i,o,r.output?JSON.stringify(r.output):null,r.error?.slice(0,2000)??null,n,e]),this.getExecution(e)}upsertWorker(e){let t=e.sourceKey?this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE project_id=? AND source_key=? AND environment_id IS ?").get(e.projectId,e.sourceKey,e.environmentId??null):void 0,r=t?pu(t):void 0,n=r?.id??crypto.randomUUID(),i=this.now().toISOString(),o=Eo(e.processes,1,0,1000),s=Eo(e.timeoutSeconds,60,1,86400);if(r&&r.resourceId===e.resourceId&&r.name===e.name.slice(0,120)&&r.provider===e.provider&&r.queue===e.queue.slice(0,200)&&r.processes===o&&r.timeoutSeconds===s&&r.restartPolicy===e.restartPolicy&&JSON.stringify(r.target)===JSON.stringify(e.target)&&r.enabled===e.enabled)return r;return this.controlPlane.database.run("INSERT INTO worker_definitions (id,organization_id,project_id,environment_id,resource_id,name,provider,queue,processes,timeout_seconds,restart_policy,target,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,resource_id=excluded.resource_id,provider=excluded.provider,queue=excluded.queue,processes=excluded.processes,timeout_seconds=excluded.timeout_seconds,restart_policy=excluded.restart_policy,target=excluded.target,enabled=excluded.enabled,observed_state=excluded.observed_state,reconciliation_status=excluded.reconciliation_status,version=worker_definitions.version+1,updated_at=excluded.updated_at",[n,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.slice(0,120),e.provider,e.queue.slice(0,200),o,s,e.restartPolicy,JSON.stringify(e.target),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,1,r?.createdAt??i,i]),this.getWorker(n)}getWorker(e){let t=this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE id=?").get(e);return t?pu(t):void 0}listWorkers(e,t){return this.controlPlane.database.query(`SELECT * FROM worker_definitions WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(pu)}setWorkerProcesses(e,t){this.controlPlane.database.run("UPDATE worker_definitions SET processes=?,reconciliation_status='pending',version=version+1,updated_at=? WHERE id=?",[Eo(t,1,0,1000),this.now().toISOString(),e]);let r=this.getWorker(e);if(!r)throw Error("Worker was not found.");return r}reconcileWorker(e,t,r){this.controlPlane.database.run("UPDATE worker_definitions SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]);let n=this.getWorker(e);if(!n)throw Error("Worker was not found.");return n}}var pt=(e)=>e==null?void 0:String(e),ac=(e)=>Number(e)===1,To=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}};function Gg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),provider:String(e.provider),endpoint:pt(e.endpoint),endpointPolicy:String(e.endpoint_policy),bucket:pt(e.bucket),prefix:String(e.prefix),region:pt(e.region),forcePathStyle:ac(e.force_path_style),credentialRef:pt(e.credential_ref),encryption:String(e.encryption),encryptionKeyRef:pt(e.encryption_key_ref),immutability:To(e.immutability,{}),status:String(e.status),lastTestedAt:pt(e.last_tested_at),lastSuccessAt:pt(e.last_success_at),lastFailureAt:pt(e.last_failure_at),lastError:pt(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function gu(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:pt(e.environment_id),resourceId:pt(e.resource_id),dataServiceId:pt(e.data_service_id),destinationId:String(e.destination_id),name:String(e.name),resourceKind:String(e.resource_kind),schedule:String(e.schedule),timezone:String(e.timezone),retention:To(e.retention,{}),compression:String(e.compression),encryption:String(e.encryption),includePatterns:To(e.include_patterns,[]),excludePatterns:To(e.exclude_patterns,[]),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),healthCheckId:pt(e.health_check_id),enabled:ac(e.enabled),nextRunAt:pt(e.next_run_at),lastRunAt:pt(e.last_run_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function mu(e){return{id:String(e.id),projectId:String(e.project_id),policyId:pt(e.policy_id),destinationId:String(e.destination_id),resourceId:pt(e.resource_id),dataServiceId:pt(e.data_service_id),backupJobId:pt(e.backup_job_id),kind:String(e.kind),pointInTime:String(e.point_in_time),uri:String(e.uri),sizeBytes:Number(e.size_bytes),checksum:String(e.checksum),manifest:To(e.manifest,{}),toolVersion:pt(e.tool_version),engineVersion:pt(e.engine_version),expiresAt:pt(e.expires_at),lockedUntil:pt(e.locked_until),held:ac(e.held),pinned:ac(e.pinned),status:String(e.status),verificationState:String(e.verification_state),verifiedAt:pt(e.verified_at),durationMs:e.duration_ms==null?void 0:Number(e.duration_ms),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function fu(e){return{id:String(e.id),projectId:String(e.project_id),policyId:pt(e.policy_id),recoveryPointId:pt(e.recovery_point_id),operationId:pt(e.operation_id),kind:String(e.kind),status:String(e.status),idempotencyKey:String(e.idempotency_key),target:To(e.target,{}),restoreMode:pt(e.restore_mode),cancellability:String(e.cancellability),safetyBackupId:pt(e.safety_backup_id),healthResult:e.health_result?To(e.health_result,{}):void 0,progress:To(e.progress,{}),error:pt(e.error),startedAt:pt(e.started_at),finishedAt:pt(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function lv(e){let t=e.toLowerCase();if(t==="localhost"||t.endsWith(".localhost")||t.endsWith(".local")||t.endsWith(".internal"))return!0;if(Jg(t)===6)return t==="::1"||t.startsWith("fe80:");if(Jg(t)!==4)return!1;let[r,n]=t.split(".").map(Number);return r===10||r===127||r===0||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===168}function pv(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup destination names must be 2-63 lowercase letters, numbers, or dashes.");if(e.provider!=="aws_backup"&&!e.bucket)throw Error("S3 backup destinations require a bucket.");if(e.provider==="s3_compatible"&&!e.endpoint)throw Error("S3-compatible destinations require an explicit endpoint.");if(e.provider==="s3_compatible"&&!e.credentialRef)throw Error("S3-compatible destinations require a credential reference.");if(e.encryption!=="provider"&&!e.encryptionKeyRef)throw Error("Client-side encryption requires an encryption key reference.");if(e.endpoint){let t=new URL(e.endpoint);if(t.protocol!=="https:"||t.username||t.password||t.search||t.hash||t.pathname!=="/")throw Error("Backup endpoints must be origin-only HTTPS URLs without credentials, paths, queries, or fragments.");if(lv(t.hostname)&&e.endpointPolicy!=="allow_private")throw Error("Private backup endpoints require endpointPolicy allow_private.")}}class ei{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}createDestination(e){pv(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_destinations (id,organization_id,project_id,name,provider,endpoint,endpoint_policy,bucket,prefix,region,force_path_style,credential_ref,encryption,encryption_key_ref,immutability,status,last_tested_at,last_success_at,last_failure_at,last_error,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.provider,e.endpoint??null,e.endpointPolicy,e.bucket??null,e.prefix,e.region??null,e.forcePathStyle?1:0,e.credentialRef??null,e.encryption,e.encryptionKeyRef??null,JSON.stringify(e.immutability),e.status,e.lastTestedAt??null,e.lastSuccessAt??null,e.lastFailureAt??null,e.lastError??null,1,r,r]),this.getDestination(t)}getDestination(e){let t=this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE id=?").get(e);return t?Gg(t):void 0}listDestinations(e){return this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE project_id=? ORDER BY name").all(e).map(Gg)}recordDestinationTest(e,t){let r=this.now().toISOString();return this.controlPlane.database.run("UPDATE backup_destinations SET status=?,last_tested_at=?,last_success_at=CASE WHEN ? THEN ? ELSE last_success_at END,last_failure_at=CASE WHEN ? THEN last_failure_at ELSE ? END,last_error=?,version=version+1,updated_at=? WHERE id=?",[t.ok?"healthy":"failing",r,t.ok?1:0,r,t.ok?1:0,r,t.ok?null:String(t.error??"Destination test failed.").slice(0,1000),r,e]),this.getDestination(e)}createPolicy(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup policy names must be lowercase slugs.");if(!e.resourceId&&!e.dataServiceId&&!["control_plane","infrastructure"].includes(e.resourceKind))throw Error("A backup policy requires a resource or data service target.");let t=this.getDestination(e.destinationId);if(!t||t.projectId!==e.projectId)throw Error("Backup destination was not found.");if(e.resourceKind==="control_plane"&&t.encryption==="provider")throw Error("Control-plane backups require client-side destination encryption.");if(["logical_database","volume","files","control_plane"].includes(e.resourceKind)&&t.provider==="aws_backup")throw Error(`${e.resourceKind} backups require an object-storage destination.`);if(e.resourceKind==="infrastructure"&&t.provider!=="aws_backup")throw Error("Infrastructure backups require an AWS Backup destination.");let r=Os(e.schedule),n=at(r.normalized,e.timezone,this.now(),1)[0],i=crypto.randomUUID(),o=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_policies (id,organization_id,project_id,environment_id,resource_id,data_service_id,destination_id,name,resource_kind,schedule,timezone,retention,compression,encryption,include_patterns,exclude_patterns,expected_rpo_minutes,expected_rto_minutes,health_check_id,enabled,next_run_at,last_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[i,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.dataServiceId??null,e.destinationId,e.name,e.resourceKind,r.normalized,e.timezone,JSON.stringify(e.retention),e.compression,e.encryption,JSON.stringify(e.includePatterns),JSON.stringify(e.excludePatterns),e.expectedRpoMinutes,e.expectedRtoMinutes,e.healthCheckId??null,e.enabled?1:0,n,e.lastRunAt??null,1,o,o]),this.getPolicy(i)}getPolicy(e){let t=this.controlPlane.database.query("SELECT * FROM backup_policies WHERE id=?").get(e);return t?gu(t):void 0}listPolicies(e,t){return this.controlPlane.database.query(`SELECT * FROM backup_policies WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(gu)}duePolicies(e=this.now()){return this.controlPlane.database.query("SELECT * FROM backup_policies WHERE enabled=1 AND next_run_at<=? ORDER BY next_run_at,id").all(e.toISOString()).map(gu)}advancePolicy(e,t){let r=this.getPolicy(e);if(!r)throw Error("Backup policy was not found.");let n=at(r.schedule,r.timezone,new Date(t),1)[0];return this.controlPlane.database.run("UPDATE backup_policies SET last_run_at=?,next_run_at=?,version=version+1,updated_at=? WHERE id=?",[t,n,this.now().toISOString(),e]),this.getPolicy(e)}createJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return fu(t);let r=crypto.randomUUID(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_jobs (id,project_id,policy_id,recovery_point_id,operation_id,kind,status,idempotency_key,target,restore_mode,cancellability,safety_backup_id,health_result,progress,error,started_at,finished_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.projectId,e.policyId??null,e.recoveryPointId??null,e.operationId??null,e.kind,e.status,e.idempotencyKey,JSON.stringify(e.target),e.restoreMode??null,e.cancellability,e.safetyBackupId??null,e.healthResult?JSON.stringify(e.healthResult):null,JSON.stringify(e.progress),e.error??null,e.startedAt??null,e.finishedAt??null,n,n]),this.getJob(r)}getJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE id=?").get(e);return t?fu(t):void 0}listJobs(e){return this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE project_id=? ORDER BY created_at DESC").all(e).map(fu)}updateJob(e,t){let r=this.getJob(e);if(!r)throw Error("Backup job was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE backup_jobs SET status=?,operation_id=?,recovery_point_id=?,progress=?,health_result=?,error=?,started_at=?,finished_at=?,safety_backup_id=?,updated_at=? WHERE id=?",[n.status,n.operationId??null,n.recoveryPointId??null,JSON.stringify(n.progress),n.healthResult?JSON.stringify(n.healthResult):null,n.error??null,n.startedAt??null,n.finishedAt??null,n.safetyBackupId??null,this.now().toISOString(),e]),this.getJob(e)}createRecoveryPoint(e){if(!/^sha256:[a-f0-9]{64}$/i.test(e.checksum))throw Error("Recovery points require a SHA-256 checksum.");if(typeof e.uri!=="string"||!["s3:","aws-backup:","file:"].some((n)=>e.uri.startsWith(n)))throw Error("Recovery point URI uses an unsupported destination scheme.");let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO recovery_points (id,project_id,policy_id,destination_id,resource_id,data_service_id,backup_job_id,kind,point_in_time,uri,size_bytes,checksum,manifest,tool_version,engine_version,expires_at,locked_until,held,pinned,status,verification_state,verified_at,duration_ms,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.policyId??null,e.destinationId,e.resourceId??null,e.dataServiceId??null,e.backupJobId??null,e.kind,e.pointInTime,e.uri,e.sizeBytes,e.checksum,JSON.stringify(e.manifest),e.toolVersion??null,e.engineVersion??null,e.expiresAt??null,e.lockedUntil??null,e.held?1:0,e.pinned?1:0,e.status,e.verificationState,e.verifiedAt??null,e.durationMs??null,r,r]),this.getRecoveryPoint(t)}getRecoveryPoint(e){let t=this.controlPlane.database.query("SELECT * FROM recovery_points WHERE id=?").get(e);return t?mu(t):void 0}listRecoveryPoints(e,t){return this.controlPlane.database.query(`SELECT * FROM recovery_points WHERE project_id=?${t?" AND policy_id=?":""} ORDER BY point_in_time DESC`).all(e,...t?[t]:[]).map(mu)}updateRecoveryPoint(e,t){let r=this.getRecoveryPoint(e);if(!r)throw Error("Recovery point was not found.");let n={...r,...t};return this.controlPlane.database.run("UPDATE recovery_points SET status=?,verification_state=?,verified_at=?,held=?,pinned=?,manifest=?,duration_ms=?,updated_at=? WHERE id=?",[n.status,n.verificationState,n.verifiedAt??null,n.held?1:0,n.pinned?1:0,JSON.stringify(n.manifest),n.durationMs??null,this.now().toISOString(),e]),this.getRecoveryPoint(e)}retentionCandidates(e=this.now()){let t=this.controlPlane.database.query(`SELECT rp.* FROM recovery_points rp
         WHERE rp.status='available' AND rp.held=0 AND rp.pinned=0
           AND rp.expires_at IS NOT NULL AND rp.expires_at<=?
           AND (rp.locked_until IS NULL OR rp.locked_until<=?)
@@ -42,7 +42,7 @@ data: ${JSON.stringify(rt)}
             SELECT 1 FROM backup_jobs bj WHERE bj.recovery_point_id=rp.id
             AND bj.kind IN ('restore','drill') AND bj.status IN ('queued','running','cleanup_required')
           )
-        ORDER BY rp.expires_at,rp.id`).all(e.toISOString(),e.toISOString()).map(mu),r=new Set;for(let n of new Set(t.map((i)=>i.projectId)))for(let i of this.listPolicies(n)){let o=this.listRecoveryPoints(i.projectId,i.id).filter((c)=>c.status==="available").sort((c,l)=>l.pointInTime.localeCompare(c.pointInTime));for(let c of o.slice(0,Math.max(0,i.retention.keepLast??0)))r.add(c.id);let s=[[i.retention.hourly,(c)=>c.toISOString().slice(0,13)],[i.retention.daily,(c)=>c.toISOString().slice(0,10)],[i.retention.weekly,(c)=>new Date(Date.UTC(c.getUTCFullYear(),c.getUTCMonth(),c.getUTCDate()-(c.getUTCDay()+6)%7)).toISOString().slice(0,10)],[i.retention.monthly,(c)=>c.toISOString().slice(0,7)]];for(let[c,l]of s){let a=new Set;for(let f of o){let T=l(new Date(f.pointInTime));if(a.has(T))continue;if(a.add(T),a.size<=Math.max(0,c??0))r.add(f.id)}}}return t.filter((n)=>!r.has(n.id))}coverage(e,t=this.now()){let r=new Map(this.listDestinations(e).map((n)=>[n.id,n]));return this.listPolicies(e).map((n)=>{let i=this.listRecoveryPoints(e,n.id).filter((c)=>c.status==="available"),o=i[0],s=o?(t.getTime()-new Date(o.pointInTime).getTime())/60000:Number.POSITIVE_INFINITY;return{policy:n,lastRecoveryPoint:o,missedRpo:n.enabled&&s>n.expectedRpoMinutes,unverified:i.filter((c)=>c.verificationState!=="verified").length,destinationHealthy:r.get(n.destinationId)?.status==="healthy"}})}}import{createCipheriv as gv,createDecipheriv as mv,createHash as Wg,randomBytes as Hg}from"node:crypto";var hu=Buffer.from("TSCB1"),cc=(e)=>`sha256:${Wg("sha256").update(e).digest("hex")}`;function Kg(e){return Wg("sha256").update(e).digest()}function fv(e,t,r){let n=r?Buffer.from(r):Hg(12);if(n.length!==12)throw Error("Backup encryption IV must contain 12 bytes.");let i=gv("aes-256-gcm",Kg(t),n),o=Buffer.concat([i.update(e),i.final()]),s=i.getAuthTag();return Buffer.concat([hu,n,s,o])}function hv(e,t){let r=Buffer.from(e);if(!r.subarray(0,hu.length).equals(hu))throw Error("Backup does not contain a valid encrypted envelope.");let n=r.subarray(5,17),i=r.subarray(17,33),o=r.subarray(33),s=mv("aes-256-gcm",Kg(t),n);return s.setAuthTag(i),Buffer.concat([s.update(o),s.final()])}function yv(e){let t;try{t=JSON.parse(e)}catch{throw Error("Backup destination credential must be a JSON object with accessKeyId and secretAccessKey.")}if(!t.accessKeyId||!t.secretAccessKey)throw Error("Backup destination credential requires accessKeyId and secretAccessKey.");if(t.expiresAt){let r=new Date(String(t.expiresAt));if(!Number.isFinite(r.getTime()))throw Error("Backup destination credential expiresAt must be an ISO timestamp.");if(r.getTime()<=Date.now())throw Error("Backup destination credential has expired.")}return{accessKeyId:String(t.accessKeyId),secretAccessKey:String(t.secretAccessKey),sessionToken:t.sessionToken?String(t.sessionToken):void 0}}async function Qg(e,t,r=new Date){if(!e.credentialRef)return{status:"default"};try{let n=JSON.parse(await t.resolve(e.credentialRef));if(!n.accessKeyId||!n.secretAccessKey)return{status:"invalid"};if(!n.expiresAt)return{status:"static"};let i=new Date(String(n.expiresAt));if(!Number.isFinite(i.getTime()))return{status:"invalid"};let o=i.getTime()-r.getTime();return{status:o<=0?"expired":o<=604800000?"expiring":"valid",expiresAt:i.toISOString()}}catch{return{status:"invalid"}}}class ti{secrets;clientFactory;multipartThreshold;partSize;constructor(e,t=(i,o)=>new g(i.region??"us-east-1",void 0,{endpoint:i.endpoint?new URL(i.endpoint).host:void 0,forcePathStyle:i.forcePathStyle,credentials:o}),r=8388608,n=8388608){this.secrets=e;this.clientFactory=t;this.multipartThreshold=r;this.partSize=n}async client(e){let t=e.credentialRef?yv(await this.secrets.resolve(e.credentialRef)):void 0;return this.clientFactory(e,t)}async test(e){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let t=await this.client(e),r=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}.ts-cloud-health/${crypto.randomUUID()}`;await t.putObject({bucket:e.bucket,key:r,body:"ts-cloud backup destination health check",contentType:"text/plain"});try{let n=await t.getObjectBytes(e.bucket,r);if(Buffer.from(n.body).toString()!=="ts-cloud backup destination health check")throw Error("Backup destination health object was corrupted.")}finally{await t.deleteObject(e.bucket,r)}}async upload(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),n=cc(t.body),i=e.encryption!=="provider"?await this.secrets.resolve(e.encryptionKeyRef):void 0,o=i?t.resume?.encryptionIv?Buffer.from(t.resume.encryptionIv,"base64url"):Hg(12):void 0,s=i?fv(t.body,i,o):Buffer.from(t.body),c=cc(s),l=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}${t.key.replace(/^\/+/,"")}`,a=t.contentType??"application/octet-stream",f={"ts-cloud-format":"v1","ts-cloud-sha256":c.slice(7),"ts-cloud-encrypted":i?"true":"false"};if(t.resume&&t.resume.key!==l)throw Error("Multipart checkpoint does not match the requested backup key.");if(t.resume&&i&&!t.resume.encryptionIv)throw Error("Encrypted multipart checkpoint has no resumable envelope state.");if(t.resume&&i&&t.resume.plaintextChecksum!==n)throw Error("Encrypted multipart checkpoint does not match the backup payload.");if(s.length<this.multipartThreshold)await r.putObject({bucket:e.bucket,key:l,body:s,contentType:a,metadata:f});else{let T=t.resume?void 0:await r.createMultipartUpload(e.bucket,l,{contentType:a,metadata:f}),D=t.resume??{uploadId:T.UploadId,key:l,parts:[],bytesUploaded:0,encryptionIv:o?.toString("base64url"),plaintextChecksum:n},N=new Map(D.parts.map((Y)=>[Y.PartNumber,Y])),W=Math.ceil(s.length/this.partSize);for(let Y=0;Y<W;Y++){let ee=Y+1;if(!N.has(ee)){let ne=Y*this.partSize,he=await r.uploadPart(e.bucket,l,D.uploadId,ee,s.subarray(ne,Math.min(s.length,ne+this.partSize)));N.set(ee,{PartNumber:ee,ETag:he.ETag})}D.parts=[...N.values()].sort((ne,he)=>ne.PartNumber-he.PartNumber),D.bytesUploaded=Math.min(s.length,ee*this.partSize),t.checkpoint?.(D)}await r.completeMultipartUpload(e.bucket,l,D.uploadId,D.parts)}return{uri:`s3://${e.bucket}/${l}`,key:l,sizeBytes:s.length,checksum:c,manifest:{format:"ts-cloud-backup-v1",encrypted:!!i,plaintextChecksum:n,storageChecksum:c,contentType:a}}}async download(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),n=await r.getObjectBytes(e.bucket,t.key),i=Buffer.from(n.body);if(cc(i)!==t.checksum)throw Error("Backup checksum verification failed; object is corrupt.");let o=t.manifest.encrypted?hv(i,await this.secrets.resolve(e.encryptionKeyRef)):i;if(cc(o)!==t.manifest.plaintextChecksum)throw Error("Backup plaintext checksum verification failed.");return o}async abortPartial(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).abortMultipartUpload(e.bucket,t.key,t.uploadId)}async delete(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).deleteObject(e.bucket,t)}}import{createHash as bv}from"node:crypto";var Sv=(e)=>`sha256:${bv("sha256").update(e).digest("hex")}`;class qr{store;queue;now;constructor(e,t,r=()=>new Date){this.store=e;this.queue=t;this.now=r}enqueueBackup(e,t=this.now().toISOString(),r){if(!e.enabled)throw Error("Backup policy is disabled.");let n=this.store.createJob({projectId:e.projectId,policyId:e.id,kind:"backup",status:"queued",idempotencyKey:`backup:${e.id}:${t}`,target:{scheduledFor:t},cancellability:"checkpoint_only",progress:{phase:"queued"}});if(!n.operationId){let i=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:r,kind:"backup.run",input:{backupJobId:n.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`backup-policy:${e.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:14400,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(n.id,{operationId:i.operation.id})}return n}enqueueDue(e=this.now()){return this.store.duePolicies(e).map((t)=>{let r=t.nextRunAt;return this.store.advancePolicy(t.id,r),this.enqueueBackup(t,r)})}enqueueVerification(e){let t=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:"verify",status:"queued",idempotencyKey:`verify:${e.id}:${e.checksum}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!t.operationId){let r=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"backup.verify",input:{backupJobId:t.id},lockKey:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:2,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(t.id,{operationId:r.operation.id})}return t}planRestore(e,t){if(e.status!=="available")throw Error("Only available recovery points can be restored.");if(e.verificationState!=="verified")throw Error("Restore requires a verified recovery point.");if(t.mode==="in_place"){if(!t.recentAuth)throw Error("In-place restore requires recent authentication.");if(t.confirm!==t.targetName)throw Error(`Type ${t.targetName} to confirm in-place restore.`);if(!t.downtimeAcknowledged)throw Error("In-place restore requires downtime acknowledgement.");let r=t.safetyBackupId?this.store.getRecoveryPoint(t.safetyBackupId):void 0;if(!r||r.id===e.id||r.status!=="available"||r.verificationState!=="verified"||r.resourceId!==e.resourceId||r.dataServiceId!==e.dataServiceId)throw Error("In-place restore requires a distinct verified safety backup for the same target.")}return{point:e,mode:t.mode,target:{...t.target,inPlace:t.mode==="in_place",restoreMode:t.mode},warnings:t.mode==="in_place"?["The target is locked against deployments and backup work.","Downtime and data replacement are expected.","Provider cancellation may stop only at a checkpoint."]:["An isolated target is created and health-validated before cleanup."]}}enqueueRestore(e,t){let r=this.planRestore(e,t),n=t.drill?"drill":"restore",i=Sv(JSON.stringify({point:e.id,mode:t.mode,target:t.target,safety:t.safetyBackupId,drill:!!t.drill})),o=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:n,status:"queued",idempotencyKey:`${n}:${i}`,target:r.target,restoreMode:r.mode,cancellability:"checkpoint_only",safetyBackupId:t.safetyBackupId,progress:{phase:"queued",warnings:r.warnings}});if(!o.operationId){let s=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,actorId:t.actorId,kind:t.drill?"backup.drill":"backup.restore",input:{backupJobId:o.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:1,timeoutSeconds:14400,retryClasses:[],resumePolicy:"fail"});return this.store.updateJob(o.id,{operationId:s.operation.id})}return o}enqueueRetention(e=this.now()){return this.store.retentionCandidates(e).map((t)=>{let r=this.store.createJob({projectId:t.projectId,policyId:t.policyId,recoveryPointId:t.id,kind:"cleanup",status:"queued",idempotencyKey:`cleanup:${t.id}:${t.expiresAt}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!r.operationId){let n=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,kind:"backup.cleanup",input:{backupJobId:r.id},lockKey:`recovery-point:${t.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(r.id,{operationId:n.operation.id})}return r})}}function Yg(e){let t=e.now??(()=>new Date),r=new qr(e.store,e.queue,t),n=(c)=>{let l=c.recoveryPointId?e.store.getRecoveryPoint(c.recoveryPointId):void 0,a=c.policyId?e.store.getPolicy(c.policyId):l?.policyId?e.store.getPolicy(l.policyId):void 0;if(!a)throw Error("Backup policy was not found.");let f=e.store.getDestination(l?.destinationId??a.destinationId),T=e.resolveSource(a);if(!f)throw Error("Backup destination was not found.");if(!T)throw Error(`No ${a.resourceKind} backup adapter is configured.`);return{point:l,policy:a,destination:f,source:T}},i=(c)=>{let l=c.operation.input,a=e.store.getJob(String(l.backupJobId??""));if(!a)throw Error("Backup job was not found.");return e.store.updateJob(a.id,{status:"running",startedAt:a.startedAt??t().toISOString(),progress:{...a.progress,phase:"running"}}),a},o=(c,l)=>{let a=e.store.getJob(c.id)??c;e.store.updateJob(c.id,{status:"failed",finishedAt:t().toISOString(),error:l instanceof Error?l.message:String(l),progress:{...a.progress,phase:"failed"}})};return{"backup.run":async(c)=>{let l=i(c);try{let{policy:a,destination:f,source:T}=n(l),D=await T.create(a,c),N=e.resolveDestination(f),W=D.mode==="object"?await(async()=>{if(!N)throw Error("Backup destination adapter is not configured.");let he=e.store.getJob(l.id)?.progress,te=he?.multipart,xe=te&&typeof te==="object"&&!Array.isArray(te)&&typeof te.uploadId==="string"&&typeof te.key==="string"&&Array.isArray(te.parts)?te:void 0;return N.upload(f,{key:D.key,body:D.body,contentType:D.contentType,resume:xe,checkpoint:(tt)=>{c.checkpoint("uploading",`Uploaded ${Number(tt.bytesUploaded??0)} backup bytes.`),e.store.updateJob(l.id,{progress:{phase:"uploading",multipart:{...tt}}})}})})():{uri:D.uri,key:D.uri,sizeBytes:D.sizeBytes,checksum:D.checksum,manifest:{format:"ts-cloud-backup-v1",encrypted:!1,plaintextChecksum:D.checksum,storageChecksum:D.checksum,contentType:"application/provider-snapshot"}},Y=a.retention.expireAfterDays?new Date(t().getTime()+a.retention.expireAfterDays*86400000).toISOString():void 0,ee=e.store.getJob(l.id)?.startedAt,ne=e.store.createRecoveryPoint({projectId:a.projectId,policyId:a.id,destinationId:f.id,resourceId:a.resourceId,dataServiceId:a.dataServiceId,backupJobId:l.id,kind:a.resourceKind,pointInTime:t().toISOString(),uri:W.uri,sizeBytes:W.sizeBytes,checksum:W.checksum,manifest:{...D.manifest,...W.manifest,storageKey:W.key},toolVersion:D.toolVersion,engineVersion:D.engineVersion,expiresAt:Y,lockedUntil:f.immutability.defaultRetentionDays?new Date(t().getTime()+f.immutability.defaultRetentionDays*86400000).toISOString():void 0,held:!1,pinned:!1,status:"available",verificationState:"unverified",durationMs:Math.max(0,t().getTime()-new Date(ee??t().toISOString()).getTime())});if(D.mode==="external"&&f.provider==="aws_backup")e.store.recordDestinationTest(f.id,{ok:!0});return e.store.updateJob(l.id,{status:"succeeded",recoveryPointId:ne.id,finishedAt:t().toISOString(),progress:{phase:"stored",recoveryPointId:ne.id}}),r.enqueueVerification(ne),{backupJobId:l.id,recoveryPointId:ne.id}}catch(a){let f=e.store.getJob(l.id),T=f?.progress.multipart,D=(()=>{try{return n(l)}catch{return}})();if(D?.destination.provider==="aws_backup")e.store.recordDestinationTest(D.destination.id,{ok:!1,error:a instanceof Error?a.message:String(a)});let N=!1;if(T&&typeof T==="object"&&!Array.isArray(T)&&D){let W=e.resolveDestination(D.destination);if(N=!0,W?.abortPartial)try{await W.abortPartial(D.destination,T),N=!1,e.store.updateJob(l.id,{progress:{...f.progress,partialCleanup:"aborted"}})}catch{e.store.updateJob(l.id,{progress:{...f.progress,partialCleanup:"required"}})}}if(N)e.store.updateJob(l.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:a instanceof Error?a.message:String(a),progress:{...e.store.getJob(l.id)?.progress??{},phase:"cleanup_required"}});else o(l,a);throw a}},"backup.verify":async(c)=>{let l=i(c);try{let{point:a,destination:f,source:T}=n(l);if(!a)throw Error("Recovery point was not found.");e.store.updateRecoveryPoint(a.id,{verificationState:"verifying"});let D;if(a.uri.startsWith("s3:")){let N=e.resolveDestination(f);if(!N)throw Error("Backup destination adapter is not configured.");let W=await N.download(f,{key:String(a.manifest.storageKey??""),checksum:a.checksum,manifest:a.manifest}),Y=T.verify?await T.verify(a,W,c):{};D={bytes:W.length,checksum:a.checksum,...Y}}else if(T.verifyExternal)D=await T.verifyExternal(a,c);else throw Error("External recovery point verification is not supported.");return e.store.updateRecoveryPoint(a.id,{verificationState:"verified",verifiedAt:t().toISOString(),manifest:{...a.manifest,verification:D}}),e.store.updateJob(l.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"verified",evidence:D}}),{backupJobId:l.id,recoveryPointId:a.id,evidence:D}}catch(a){if(l.recoveryPointId)e.store.updateRecoveryPoint(l.recoveryPointId,{verificationState:/checksum|corrupt|authentic/i.test(a instanceof Error?a.message:String(a))?"corrupt":"failed"});throw o(l,a),a}},"backup.restore":async(c)=>s(c,!1),"backup.drill":async(c)=>s(c,!0),"backup.cleanup":async(c)=>{let l=i(c);try{let{point:a,destination:f,source:T}=n(l);if(!a)throw Error("Recovery point was not found.");if(!e.store.retentionCandidates(t()).some((D)=>D.id===a.id))throw Error("Recovery point is held, pinned, locked, or in active use.");if(e.store.updateRecoveryPoint(a.id,{status:"deleting"}),a.uri.startsWith("s3:")){let D=e.resolveDestination(f);if(!D)throw Error("Destination cleanup is unavailable.");await D.delete(f,String(a.manifest.storageKey??""))}else if(T.deleteExternal)await T.deleteExternal(a,c);else throw Error("External recovery point cleanup is unavailable.");return e.store.updateRecoveryPoint(a.id,{status:"deleted"}),e.store.updateJob(l.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"deleted"}}),{backupJobId:l.id,recoveryPointId:a.id,deleted:!0}}catch(a){throw o(l,a),a}}};async function s(c,l){let a=i(c);try{let{point:f,policy:T,destination:D,source:N}=n(a);if(!f)throw Error("Recovery point was not found.");if(l&&!N.cleanup)throw Error("This backup source cannot safely clean a recovery drill target.");let W=f.uri.startsWith("s3:")?e.resolveDestination(D):void 0,Y=W?await W.download(D,{key:String(f.manifest.storageKey??""),checksum:f.checksum,manifest:f.manifest}):void 0,ee=await N.restore(f,Y,a.target,c),ne=N.validateHealth?await N.validateHealth({...a.target,...ee},c):{healthy:!0,mode:"adapter"},he=e.validateHealth?await e.validateHealth(T,a.target):{healthy:!0,mode:"not_configured"},te={...ne,healthy:ne.healthy===!0&&he.healthy===!0,configured:he};if(te.healthy!==!0)throw Error("Restored target did not pass its configured health check.");if(l&&N.cleanup)await N.cleanup({...a.target,provider:f.manifest.provider??null},c);return e.store.updateJob(a.id,{status:"succeeded",finishedAt:t().toISOString(),healthResult:te,progress:{phase:l?"drill_cleaned":"restored",restored:ee}}),{backupJobId:a.id,recoveryPointId:f.id,restored:ee,health:te,cleaned:l}}catch(f){let T=(()=>{try{return n(a)}catch{return}})(),D=f instanceof Error?f.message:String(f),N=!1;if(l&&T?.source.cleanup)try{await T.source.cleanup({...a.target,provider:T.point?.manifest.provider??null},c)}catch{N=!0}if(N)e.store.updateJob(a.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:D,progress:{...a.progress,phase:"cleanup_required"}});else o(a,f);throw f}}}import{createHash as vv}from"node:crypto";var wv=(e)=>`sha256:${vv("sha256").update(e).digest("hex")}`;class yu{dataServices;client;constructor(e,t=new me){this.dataServices=e;this.client=t}service(e){let t=e.dataServiceId?this.dataServices.get(e.dataServiceId):void 0;if(!t||!["aws_rds","aws_aurora"].includes(t.provider))throw Error("Managed database backup policy requires an RDS or Aurora data service.");return t}async waitForSnapshot(e,t,r){for(;;){r.throwIfCancellationRequested?.(),r.heartbeat?.();let n=e==="aws_aurora"?(await this.client.describeDBClusterSnapshots({DBClusterSnapshotIdentifier:t})).DBClusterSnapshots[0]:(await this.client.describeDBSnapshots({DBSnapshotIdentifier:t})).DBSnapshots?.[0];if(!n)throw Error("Provider snapshot was not found.");let i=n,o=String(i.Status??i.DBSnapshotStatus??"unknown");if(r.checkpoint?.("provider_snapshot",`Database snapshot ${t} is ${o}.`),o==="available")return i;if(["deleted","deleting","failed"].includes(o))throw Error(`Provider snapshot ${t} failed with state ${o}.`);await Bun.sleep(5000)}}async create(e,t){let r=this.service(e),n=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,20),i=`${r.placement.slice(0,42).replace(/-+$/,"")}-${n}`;if(r.provider==="aws_aurora")await this.client.createDBClusterSnapshot(r.placement,i);else await this.client.createDBSnapshot({DBInstanceIdentifier:r.placement,DBSnapshotIdentifier:i});await this.waitForSnapshot(r.provider,i,t);let o=`${r.provider}:${r.placement}:${i}`;return{mode:"external",uri:`aws-backup:${o}`,checksum:wv(o),sizeBytes:0,manifest:{provider:r.provider,sourceId:r.placement,snapshotId:i,plan:r.plan,engine:r.engine},engineVersion:r.engineVersion,toolVersion:"aws-rds-api-2014-10-31"}}async verifyExternal(e,t){let r=String(e.manifest.snapshotId??""),n=String(e.manifest.provider??"");if(!r)throw Error("Snapshot recovery point has no snapshot ID.");let i=await this.waitForSnapshot(n,r,t),o=String(i.Status??i.DBSnapshotStatus??"unknown");return{snapshotId:r,status:o,encrypted:i.Encrypted??i.StorageEncrypted??!0}}async restore(e,t,r,n){let i=String(r.targetId??""),o=String(e.manifest.snapshotId??""),s=String(e.manifest.provider??"");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(i))throw Error("Managed restore requires a valid distinct targetId.");if(i===e.manifest.sourceId)throw Error("Managed restore target must differ from its source.");if(s==="aws_aurora"){let c=e.manifest.engine==="postgres"?"aurora-postgresql":"aurora-mysql";await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:i,SnapshotIdentifier:o,Engine:c,EngineVersion:e.engineVersion,DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:Number(r.minCapacity)||0.5,MaxCapacity:Number(r.maxCapacity)||4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${i}-writer-1`,DBClusterIdentifier:i,DBInstanceClass:String(r.plan??e.manifest.plan??"db.serverless"),Engine:c,PubliclyAccessible:!1})}else await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:i,DBSnapshotIdentifier:o,DBInstanceClass:String(r.plan??e.manifest.plan??""),PubliclyAccessible:!1,DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud-restore"}]});return{targetId:i,provider:s,status:"creating",isolated:!0}}async validateHealth(e,t){let r=String(e.targetId??""),n=String(e.provider??"");for(;;){t.throwIfCancellationRequested?.(),t.heartbeat?.();let i=n==="aws_aurora"?(await this.client.describeDBClusters({DBClusterIdentifier:r})).DBClusters?.[0]:(await this.client.describeDBInstances({DBInstanceIdentifier:r})).DBInstances?.[0];if(!i)throw Error("Restored managed database was not found.");let o=String(i.Status??i.DBInstanceStatus??"unknown");if(t.checkpoint?.("provider_restore",`Restored database ${r} is ${o}.`),o==="available")return{healthy:!0,targetId:r,provider:n,status:o};if(["deleted","deleting","failed","incompatible-restore"].includes(o))throw Error(`Restored managed database ${r} failed with state ${o}.`);await Bun.sleep(5000)}}async cleanup(e,t){let r=String(e.targetId??""),n=String(e.provider??"");if(!r)throw Error("Restore cleanup target is required.");if(n==="aws_aurora")await this.client.deleteDBInstance({DBInstanceIdentifier:`${r}-writer-1`,SkipFinalSnapshot:!0}),await this.client.modifyDBCluster({DBClusterIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(r);else await this.client.modifyDBInstance({DBInstanceIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:r,SkipFinalSnapshot:!0,DeleteAutomatedBackups:!0})}async deleteExternal(e,t){let r=String(e.manifest.snapshotId??"");if(e.manifest.provider==="aws_aurora")await this.client.deleteDBClusterSnapshot(r);else await this.client.deleteDBSnapshot(r)}}var Wr=(e,t="none",r=!1)=>({supported:!0,downtime:t,destructive:r,explanation:e}),Er=(e)=>({supported:!1,downtime:"none",destructive:!1,explanation:e});function Zt(e,t){let r=["aws_rds","aws_aurora","aws_elasticache"].includes(t),n=["server","container"].includes(t),i=["postgres","mysql","mariadb"].includes(e),o=e==="redis",s={};return s.create=t==="external"?Er("External services can be adopted as read-only inventory."):Wr(r?"Provision through the provider API.":"Provision through the owning runtime driver.","possible"),s.observe=t==="external"?Er("External observation requires a configured provider adapter."):Wr("Provider/runtime health and endpoint metadata are observable."),s.connect=Wr("Connection guidance uses secret references and never returns a password by default."),s.backup=i&&(r||n)?Wr(r?"Create a provider snapshot.":"Create a consistent engine-native dump.","possible"):Er("This cache path is not a durable backup source."),s.restore=r&&i?Wr("Restore creates a reviewed provider target.","required",!0):Er("Restore requires a configured provider restore runner."),s.restart=t==="external"?Er("External restart requires a configured provider adapter."):Wr(r?"Provider restart/failover semantics apply.":"Restart the owning service unit.","required"),s.resize=t==="aws_elasticache"?Er("ElastiCache resizing requires a replication-group migration runner."):r?Wr("Provider plan/storage modification may enter a maintenance window.","possible"):n?Wr("Edit host/container resources and reconcile.","required"):Er("External resize requires a configured provider adapter."),s.version=n?Er("Runtime version upgrades require an explicit image migration runner."):r&&t!=="aws_elasticache"?Wr(i?"Major versions require compatibility preflight and backup.":"Engine upgrades require a maintenance window.","required"):Er("External upgrades require a configured provider adapter."),s.rotate=t==="aws_elasticache"||t==="external"||n&&!i&&!o?Er("Credential rotation is not available for this provider/engine path."):Wr("Rotate through the secret backend, update the engine, then flag dependent releases."),s.expose=n?Er("Direct container publishing is refused; use a reviewed firewall and proxy policy."):t==="aws_rds"?Wr("Exposure is reconciled through security groups; public access defaults off."):Er("Exposure changes require a provider-specific network runner."),s.delete=t==="external"?Er("External deletion requires a configured provider adapter."):Wr(r?"Final snapshot is supported where the provider allows it.":"A final engine backup is required unless explicitly retained.","required",!0),s.logs=n?Wr("Read bounded service logs from the runtime."):Er("Provider log export is not configured for this adapter."),s.slow_queries=n&&i?Wr("Read bounded runtime logs after engine slow-query logging is enabled."):Er("A slow-query log runner is not configured for this provider."),s.users=n&&i?Wr("Logical users can be listed; creation requires a referenced secondary credential."):Er("User management requires an engine connection runner."),s.databases=n&&i?Wr("Logical databases can be listed, created, and confirmation-gated for deletion."):Er("Logical database management requires an engine connection runner."),{actions:s,endpointTypes:r?["internal","external","tunnel"]:["internal","tunnel"],metrics:o?["connections","memory","evictions","hit_rate","latency"]:["connections","cpu","storage","read_latency","write_latency","iops"]}}var _s=(e)=>e==null?void 0:String(e),pc=(e)=>Number(e)===1,uc=(e)=>{try{return JSON.parse(String(e))}catch{return{}}};function Xg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:_s(e.environment_id),resourceId:_s(e.resource_id),name:String(e.name),engine:String(e.engine),provider:String(e.provider),placement:String(e.placement),engineVersion:_s(e.engine_version),plan:String(e.plan),storageGb:e.storage_gb==null?void 0:Number(e.storage_gb),highAvailability:pc(e.high_availability),publicExposure:pc(e.public_exposure),allowedCidrs:uc(e.allowed_cidrs),desiredState:uc(e.desired_state),observedState:uc(e.observed_state),capabilities:uc(e.capabilities),credentialRef:_s(e.credential_ref),status:String(e.status),origin:String(e.origin),managementEnabled:pc(e.management_enabled),ownerActorId:_s(e.owner_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class er{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}create(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Data service names must be 2-63 lowercase letters, numbers, or dashes.");if(e.publicExposure&&(!e.allowedCidrs.length||e.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");let t=crypto.randomUUID(),r=this.now().toISOString(),n=Zt(e.engine,e.provider);return this.controlPlane.database.run("INSERT INTO data_services (id,organization_id,project_id,environment_id,resource_id,name,engine,provider,placement,engine_version,plan,storage_gb,high_availability,public_exposure,allowed_cidrs,desired_state,observed_state,capabilities,credential_ref,status,origin,management_enabled,owner_actor_id,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.engine,e.provider,e.placement,e.engineVersion??null,e.plan,e.storageGb??null,e.highAvailability?1:0,e.publicExposure?1:0,JSON.stringify(e.allowedCidrs),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),JSON.stringify(n),e.credentialRef??null,e.status,e.origin,e.managementEnabled?1:0,e.ownerActorId??null,1,r,r]),this.get(t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM data_services WHERE id=?").get(e);return t?Xg(t):void 0}list(e,t){return this.controlPlane.database.query(`SELECT * FROM data_services WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Xg)}update(e,t,r){let n=this.get(e);if(!n)throw Error("Data service was not found.");if(n.version!==t)throw Error("Data service changed; refresh before retrying.");let i={...n,...r};if(i.publicExposure&&(!i.allowedCidrs.length||i.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");if(this.controlPlane.database.run("UPDATE data_services SET plan=?,storage_gb=?,engine_version=?,high_availability=?,public_exposure=?,allowed_cidrs=?,desired_state=?,observed_state=?,status=?,management_enabled=?,credential_ref=?,version=version+1,updated_at=? WHERE id=? AND version=?",[i.plan,i.storageGb??null,i.engineVersion??null,i.highAvailability?1:0,i.publicExposure?1:0,JSON.stringify(i.allowedCidrs),JSON.stringify(i.desiredState),JSON.stringify(i.observedState),i.status,i.managementEnabled?1:0,i.credentialRef??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Data service changed; refresh before retrying.");return this.get(e)}credential(e){let t=this.controlPlane.database.query("SELECT * FROM data_service_credentials WHERE service_id=? ORDER BY version DESC LIMIT 1").get(e);return t?{id:String(t.id),serviceId:String(t.service_id),username:String(t.username),secretRef:String(t.secret_ref),version:Number(t.version),createdAt:String(t.created_at),rotatedAt:_s(t.rotated_at)}:void 0}saveCredential(e,t,r){let n=this.credential(e),i=n?.id??crypto.randomUUID(),o=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_credentials (id,service_id,username,secret_ref,version,created_at,rotated_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(service_id,username) DO UPDATE SET secret_ref=excluded.secret_ref,version=data_service_credentials.version+1,rotated_at=excluded.rotated_at",[i,e,t,r,n?.version??1,n?.createdAt??o,n?o:null]),this.credential(e)}addDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_dependencies (service_id,resource_id,secret_ref,requires_redeploy,created_at) VALUES (?,?,?,?,?) ON CONFLICT(service_id,resource_id) DO UPDATE SET secret_ref=excluded.secret_ref,requires_redeploy=excluded.requires_redeploy",[e.serviceId,e.resourceId,e.secretRef,e.requiresRedeploy?1:0,t]),{...e,createdAt:t}}dependencies(e){return this.controlPlane.database.query("SELECT * FROM data_service_dependencies WHERE service_id=? ORDER BY resource_id").all(e).map((t)=>({serviceId:String(t.service_id),resourceId:String(t.resource_id),secretRef:String(t.secret_ref),requiresRedeploy:pc(t.requires_redeploy),createdAt:String(t.created_at)}))}removeDependency(e,t){return this.controlPlane.database.run("DELETE FROM data_service_dependencies WHERE service_id=? AND resource_id=?",[e,t]).changes===1}remove(e){this.controlPlane.database.run("DELETE FROM data_services WHERE id=?",[e])}}function Zg(){let t=crypto.getRandomValues(new Uint8Array(40));return Array.from(t,(r)=>"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*_-+="[r%69]).join("")}function Ln(e,t){return t.map((r)=>{let n=r.type==="tunnel"?"127.0.0.1":r.host,i=e.engine==="redis"?`redis-cli -h ${n} -p ${r.port}${r.tls?" --tls":""}`:e.engine==="postgres"?`psql "host=${n} port=${r.port} dbname=${r.database??"postgres"} sslmode=${r.tls?"require":"disable"}"`:e.engine==="mongodb"?`mongosh "mongodb://${n}:${r.port}/${r.database??"admin"}${r.tls?"?tls=true":""}"`:e.engine==="libsql"?`turso db shell ${r.tls?"https":"http"}://${n}:${r.port}`:`mysql --host=${n} --port=${r.port} --database=${r.database??"mysql"} --ssl-mode=${r.tls?"REQUIRED":"DISABLED"}`;return{type:r.type,command:i,secretRef:e.credentialRef}})}class Ur{store;queue;secrets;constructor(e,t,r){this.store=e;this.queue=t;this.secrets=r}async create(e){let t,r;if(e.provider!=="aws_elasticache"){let n=e.username??"app",i=Zg();r=`secret://data-services/${e.projectId}/${e.name}/${n}`,await this.secrets.put(r,i),t={username:n,password:i,secretRef:r}}try{let n=this.store.create({...e,credentialRef:r,status:"planning"});if(t)this.store.saveCredential(n.id,t.username,t.secretRef);let i=this.enqueue(n,"create",{});return{service:n,credential:t,operationId:i}}catch(n){if(r)await this.secrets.remove(r);throw n}}plan(e,t,r={}){let n=e.capabilities.actions[t],i=t==="version"&&String(r.engineVersion??"").split(".")[0]!==String(e.engineVersion??"").split(".")[0];return{service:e,action:t,capability:n,changes:r,preflight:{backupRequired:["delete","restore"].includes(t)||i,compatibilityRequired:i,typedConfirmation:n.destructive?e.name:void 0,retentionChoiceRequired:t==="delete"},warnings:[...n.downtime!=="none"?[`Downtime is ${n.downtime}.`]:[],...e.origin==="adopted"&&!e.managementEnabled?["Adopted resource is read-only until management is explicitly enabled."]:[]]}}enqueue(e,t,r,n){let i=this.plan(e,t,r);if(!i.capability.supported)throw Error(i.capability.explanation);if(e.origin==="adopted"&&!e.managementEnabled&&t!=="observe")throw Error("Adopted resources remain read-only until management is explicitly enabled.");if(i.preflight.typedConfirmation&&r.confirm!==i.preflight.typedConfirmation)throw Error(`Type ${i.preflight.typedConfirmation} to confirm ${t}.`);if(i.preflight.retentionChoiceRequired&&!["final_backup","retain"].includes(String(r.retention??"")))throw Error("Deletion requires retention final_backup or retain.");if(i.preflight.compatibilityRequired&&(r.compatibilityReviewed!==!0||!r.backupId))throw Error("Major version changes require compatibilityReviewed=true and a backupId.");if(t==="restore"){let o=String(r.backupId??""),s=String(r.targetId??"");if(!o||!s)throw Error("Restore requires both backupId and targetId.");if(s===e.placement)throw Error("Restore targetId must differ from the source placement.");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(s))throw Error("Restore targetId must be 2-63 lowercase letters, numbers, or dashes.")}return this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:n,kind:"data_service.action",input:{serviceId:e.id,action:t,...r},lockKey:`data-service:${e.id}`,providerKey:e.provider,maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"}).operation.id}async rotate(e,t,r){let n=this.store.credential(e.id);if(!n)throw Error("Data service credential metadata was not found.");let i=Zg(),o=`${n.secretRef}/v${n.version+1}`;await this.secrets.put(o,i);try{return await t.action(e,"rotate",{username:n.username,secretRef:o},i,r),this.store.saveCredential(e.id,n.username,o),this.store.update(e.id,e.version,{credentialRef:o}),{credential:{username:n.username,password:i,secretRef:o},dependencies:this.store.dependencies(e.id).filter((s)=>s.requiresRedeploy).map((s)=>s.resourceId)}}catch(s){throw await this.secrets.remove(o),s}}}function em(e){return{"data_service.action":async(t)=>{let r=t.operation.input,n=e.store.get(String(r.serviceId??"")),i=String(r.action??"");if(!n)throw Error("Data service was not found.");let o=e.resolveAdapter(n);if(!o||o.provider!==n.provider||!o.engines.includes(n.engine))throw Error(`No ${n.provider}/${n.engine} adapter is configured.`);if(i==="rotate"){let c=await new Ur(e.store,new S(e.store.controlPlane),e.secrets).rotate(n,o,t);return{serviceId:n.id,action:i,username:c.credential.username,secretRef:c.credential.secretRef,dependencies:c.dependencies}}let s=n.credentialRef?await e.secrets.resolve(n.credentialRef):void 0;try{let c=i==="observe"?await o.observe(n):i==="create"?await o.apply(n,s,t):await o.action(n,i,r,s,t),l=e.store.get(n.id);return e.store.update(n.id,l.version,{observedState:c,status:i==="delete"?r.retention==="retain"?"retained":"deleting":"available"}),{serviceId:n.id,action:i,observed:c}}catch(c){let l=e.store.get(n.id);if(e.store.update(n.id,l.version,{status:"failed",observedState:{...l.observedState,error:c instanceof Error?c.message:String(c)}}),/temporar|timeout|unavailable|throttl/i.test(c instanceof Error?c.message:String(c)))throw new $e(c instanceof Error?c.message:String(c),"provider_transient");throw c}}}}class Ns{transport;constructor(e){this.transport=e}observe(e){return this.transport.observe(e.placement)}apply(e,t){return this.transport.apply({id:e.placement,name:e.name,engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,storageGb:e.storageGb??null,highAvailability:e.highAvailability,publicExposure:e.publicExposure,allowedCidrs:e.allowedCidrs,username:e.desiredState.username??"app",desiredState:e.desiredState},t)}action(e,t,r,n,i){return this.transport.execute(e.placement,t,{engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,desiredState:e.desiredState,...r},n,i)}}class Mn extends Ns{provider="aws_rds";engines=["postgres","mysql","mariadb"]}class Un extends Ns{provider="aws_aurora";engines=["postgres","mysql"]}class Bn extends Ns{provider="aws_elasticache";engines=["redis"]}class jn extends Ns{provider="server";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}class Vn extends Ns{provider="container";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}var fc=(e,t)=>{let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)},Ut=(e,t,r)=>{let n=fc(e,t);return n==null?r:String(n)},hn=(e,t)=>{let r=fc(e,t);return r==null?void 0:Number(r)},Ro=(e,t)=>{let r=fc(e,t);return r==null?void 0:r===!0||r==="true"},$s=(e,t)=>{let r=fc(e,t);return Array.isArray(r)?r.map(String):[]},mc=(e,t)=>Ut(t,"snapshotId")??`${e}-final-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`;function gc(e){if(!e)throw Error("RDS instance was not found.");return{providerId:e.DBInstanceIdentifier??null,status:e.DBInstanceStatus??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,plan:e.DBInstanceClass??null,storageGb:e.AllocatedStorage??null,highAvailability:e.MultiAZ??!1,publicExposure:e.PubliclyAccessible??!1,endpoint:e.Endpoint?.Address??null,port:e.Endpoint?.Port??null,username:e.MasterUsername??null,database:e.DBName??null,encrypted:e.StorageEncrypted??!1}}class zn{client;constructor(e=new me){this.client=e}async observe(e){return gc(await this.client.describeDBInstance(e))}async apply(e,t){let r=String(e.id),n=await this.client.createDBInstance({DBInstanceIdentifier:r,DBInstanceClass:String(e.plan),Engine:String(e.engine),MasterUsername:Ut(e,"username","app"),MasterUserPassword:t,DBName:Ut(e,"database"),AllocatedStorage:hn(e,"storageGb"),VpcSecurityGroupIds:$s(e,"securityGroupIds"),DBSubnetGroupName:Ut(e,"subnetGroup"),BackupRetentionPeriod:hn(e,"backupRetentionDays")??7,MultiAZ:Ro(e,"highAvailability"),EngineVersion:Ut(e,"engineVersion"),PubliclyAccessible:Ro(e,"publicExposure")??!1,StorageType:Ut(e,"storageType","gp3"),StorageEncrypted:!0,KmsKeyId:Ut(e,"kmsKeyId"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return gc(n.DBInstance)}async execute(e,t,r,n,i){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBInstance({DBInstanceIdentifier:e}),{status:"rebooting"};if(t==="backup"){let o=mc(e,r);return await this.client.createDBSnapshot({DBInstanceIdentifier:e,DBSnapshotIdentifier:o}),{status:"snapshotting",snapshotId:o}}if(t==="restore"){let o=String(r.targetId),s=await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:o,DBSnapshotIdentifier:String(r.backupId),DBInstanceClass:Ut(r,"plan"),DBSubnetGroupName:Ut(r,"subnetGroup"),MultiAZ:Ro(r,"highAvailability"),PubliclyAccessible:!1,StorageType:Ut(r,"storageType"),VpcSecurityGroupIds:$s(r,"securityGroupIds"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{...gc(s.DBInstance),sourceId:e,restoreTargetId:o}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let o=mc(e,r);return await this.client.modifyDBInstance({DBInstanceIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:e,SkipFinalSnapshot:!1,FinalDBSnapshotIdentifier:o,DeleteAutomatedBackups:!1}),{status:"deleting",finalSnapshotId:o}}if(["resize","version","rotate","expose"].includes(t)){let o=await this.client.modifyDBInstance({DBInstanceIdentifier:e,DBInstanceClass:Ut(r,"plan"),AllocatedStorage:hn(r,"storageGb"),MasterUserPassword:t==="rotate"?n:void 0,EngineVersion:Ut(r,"engineVersion"),MultiAZ:Ro(r,"highAvailability"),PubliclyAccessible:Ro(r,"publicExposure"),VpcSecurityGroupIds:$s(r,"securityGroupIds"),ApplyImmediately:Ro(r,"applyImmediately")??!0});return gc(o.DBInstance)}throw Error(`RDS action ${t} requires an engine connection runner.`)}}function bu(e){if(!e)throw Error("Aurora cluster was not found.");return{providerId:e.DBClusterIdentifier??null,status:e.Status??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,endpoint:e.Endpoint??null,readerEndpoint:e.ReaderEndpoint??null,port:e.Port??null,username:e.MasterUsername??null,database:e.DatabaseName??null,encrypted:e.StorageEncrypted??!1,highAvailability:e.MultiAZ??!0}}class Hn{client;constructor(e=new me){this.client=e}async observe(e){let t=await this.client.describeDBClusters({DBClusterIdentifier:e});return bu(t.DBClusters?.[0])}async apply(e,t){let r=String(e.id),n=String(e.engine)==="postgres"?"aurora-postgresql":"aurora-mysql";return await this.client.createDBCluster({DBClusterIdentifier:r,Engine:n,EngineVersion:Ut(e,"engineVersion"),MasterUsername:Ut(e,"username","app"),MasterUserPassword:t,DatabaseName:Ut(e,"database"),DBSubnetGroupName:Ut(e,"subnetGroup"),VpcSecurityGroupIds:$s(e,"securityGroupIds"),BackupRetentionPeriod:hn(e,"backupRetentionDays")??7,StorageEncrypted:!0,KmsKeyId:Ut(e,"kmsKeyId"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:hn(e,"minCapacity")??0.5,MaxCapacity:hn(e,"maxCapacity")??4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${r}-writer-1`,DBClusterIdentifier:r,DBInstanceClass:String(e.plan||"db.serverless"),Engine:n,PubliclyAccessible:Ro(e,"publicExposure")??!1}),{status:"creating",providerId:r}}async execute(e,t,r,n){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBCluster(e),{status:"rebooting"};if(t==="backup"){let i=mc(e,r);return await this.client.createDBClusterSnapshot(e,i),{status:"snapshotting",snapshotId:i}}if(t==="restore"){let i=String(r.targetId),o=String(r.engine)==="postgres"?"aurora-postgresql":"aurora-mysql",s=await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:i,SnapshotIdentifier:String(r.backupId),Engine:o,EngineVersion:Ut(r,"engineVersion"),DBSubnetGroupName:Ut(r,"subnetGroup"),VpcSecurityGroupIds:$s(r,"securityGroupIds"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:hn(r,"minCapacity")??0.5,MaxCapacity:hn(r,"maxCapacity")??4}});return await this.client.createDBInstance({DBInstanceIdentifier:`${i}-writer-1`,DBClusterIdentifier:i,DBInstanceClass:Ut(r,"plan","db.serverless"),Engine:o,PubliclyAccessible:!1}),{...bu(s.DBCluster),sourceId:e,restoreTargetId:i}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let i=mc(e,r);return await this.client.modifyDBCluster({DBClusterIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(e,i),{status:"deleting",finalSnapshotId:i}}if(["resize","version","rotate"].includes(t)){let i=await this.client.modifyDBCluster({DBClusterIdentifier:e,ServerlessV2ScalingConfiguration:hn(r,"minCapacity")==null&&hn(r,"maxCapacity")==null?void 0:{MinCapacity:hn(r,"minCapacity")??0.5,MaxCapacity:hn(r,"maxCapacity")??4},EngineVersion:Ut(r,"engineVersion"),MasterUserPassword:t==="rotate"?n:void 0,ApplyImmediately:Ro(r,"applyImmediately")??!0});return bu(i.DBCluster)}throw Error(`Aurora action ${t} requires an engine connection runner.`)}}class Gn{client;constructor(e=new ie){this.client=e}async observe(e){let t=(await this.client.describeCacheClusters(e)).CacheClusters[0];if(!t)throw Error("ElastiCache cluster was not found.");let r=t.CacheNodes?.[0]?.Endpoint;return{providerId:t.CacheClusterId,status:t.CacheClusterStatus,engine:t.Engine,engineVersion:t.EngineVersion,plan:t.CacheNodeType,nodes:t.NumCacheNodes,endpoint:r?.Address??null,port:r?.Port??null}}async apply(e){let t=await this.client.createCacheCluster({cacheClusterId:String(e.id),engine:"redis",cacheNodeType:String(e.plan),numCacheNodes:hn(e,"nodes")??1,engineVersion:Ut(e,"engineVersion"),port:hn(e,"port"),securityGroupIds:$s(e,"securityGroupIds"),subnetGroupName:Ut(e,"subnetGroup"),tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{providerId:t.CacheCluster.CacheClusterId,status:t.CacheCluster.CacheClusterStatus}}async execute(e,t,r){if(t==="observe")return this.observe(e);if(t==="restart"){let n=(await this.client.describeCacheClusters(e)).CacheClusters[0];return await this.client.rebootCacheCluster(e,n?.CacheNodes?.map((i)=>i.CacheNodeId)??["0001"]),{status:"rebooting"}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};return await this.client.deleteCacheCluster(e),{status:"deleting"}}throw Error(`ElastiCache action ${t} is not supported by this cluster mode.`)}}import{mkdir as Iv,writeFile as Cv}from"node:fs/promises";import{join as Ev}from"node:path";async function vn(e,t,r=!1){let n=Bun.spawn(["docker",...e],{stdin:t==null?"ignore":"pipe",stdout:"pipe",stderr:"pipe"}),i=new Response(n.stdout).text(),o=new Response(n.stderr).text();if(t!=null)n.stdin.write(t),n.stdin.end();let[s,c,l]=await Promise.all([n.exited,i,o]);if(s!==0&&!r)throw Error(`Docker command failed (${s}): ${l.trim()||c.trim()}`);return{code:s,stdout:c,stderr:l}}class tm{async ensureNetwork(e){if((await vn(["network","inspect",e],void 0,!0)).code!==0)await vn(["network","create","--internal",e])}async seedSecret(e,t){await vn(["volume","create",e]),await vn(["run","--rm","-i","-v",`${e}:/run/target`,"alpine:3.21","sh","-c","umask 077; cat > /run/target/credential"],t)}async removeVolume(e){await vn(["volume","rm",e],void 0,!0)}async inspect(e){let t=await vn(["inspect",e],void 0,!0);if(t.code!==0)return;return JSON.parse(t.stdout)[0]}async run(e){await vn(["run",...e])}async exec(e,t,r){return(await vn(["exec","-i",e,...t],r)).stdout}async update(e,t){await vn(["update",...t,e])}async restart(e){await vn(["restart",e])}async remove(e){await vn(["rm","--force",e],void 0,!0)}async logs(e,t){let r=await vn(["logs","--tail",String(Math.min(2000,Math.max(1,t))),e],void 0,!0);return`${r.stdout}${r.stderr}`.slice(-262144)}async stats(e){let t=await vn(["stats","--no-stream","--format","{{json .}}",e],void 0,!0);if(t.code!==0||!t.stdout.trim())return{};let r=JSON.parse(t.stdout.trim());return{cpuPercent:String(r.CPUPerc??""),memoryUsage:String(r.MemUsage??""),memoryPercent:String(r.MemPerc??""),networkIo:String(r.NetIO??""),blockIo:String(r.BlockIO??""),pids:Number(r.PIDs??0)}}}var Tv={postgres:{image:"postgres:17-alpine",port:5432,dataPath:"/var/lib/postgresql/data"},mysql:{image:"mysql:8.4",port:3306,dataPath:"/var/lib/mysql"},mariadb:{image:"mariadb:11.7",port:3306,dataPath:"/var/lib/mysql"},redis:{image:"redis:7.4-alpine",port:6379,dataPath:"/data"},mongodb:{image:"mongo:8.0",port:27017,dataPath:"/data/db"}};function Gi(e,t="app"){let r=String(e??t);if(!/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(r))throw Error("Database identifiers must be letters, numbers, or underscores.");return r}function rs(e){if(!/^[a-z0-9][a-z0-9_.-]{1,62}$/i.test(e))throw Error("Runtime placement must be a valid container identifier.");return`tscloud-data-${e.toLowerCase()}`}function Av(e,t){let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)}function va(e){return e.Config?.Labels??{}}class st{runtime;backupRoot;constructor(e=new tm,t=A(process.cwd(),"backups","data")){this.runtime=e;this.backupRoot=t}async observe(e){let t=rs(e),r=await this.runtime.inspect(t);if(!r)throw Error(`Data container ${t} was not found.`);let n=va(r),i=await this.runtime.stats(t),o=r.NetworkSettings?.Ports??{},s=Object.values(o).flat().find(Boolean);return{providerId:t,status:r.State?.Status??"unknown",healthy:r.State?.Health?.Status??null,engine:n["ts-cloud.engine"]??null,engineVersion:n["ts-cloud.engine-version"]??null,username:n["ts-cloud.username"]??null,database:n["ts-cloud.database"]??null,endpoint:s?.HostIp||"127.0.0.1",port:s?.HostPort?Number(s.HostPort):null,image:r.Config?.Image??null,startedAt:r.State?.StartedAt??null,metrics:i}}async apply(e,t){let r=String(e.id),n=rs(r),i=String(e.engine);if(i==="libsql")throw Error("libSQL requires an explicitly configured runtime image.");let o=Tv[i];if(!o)throw Error(`Unsupported runtime data engine ${i}.`);if(!t)throw Error(`${i} requires a managed credential.`);if(e.publicExposure===!0)throw Error("Container public exposure requires an external reviewed firewall policy; direct publishing is refused.");let s=Gi(e.username),c=Gi(Av(e,"database")),l=`${n}-secret`,a=`${n}-data`,f=i==="redis"?`appendonly yes
+        ORDER BY rp.expires_at,rp.id`).all(e.toISOString(),e.toISOString()).map(mu),r=new Set;for(let n of new Set(t.map((i)=>i.projectId)))for(let i of this.listPolicies(n)){let o=this.listRecoveryPoints(i.projectId,i.id).filter((c)=>c.status==="available").sort((c,l)=>l.pointInTime.localeCompare(c.pointInTime));for(let c of o.slice(0,Math.max(0,i.retention.keepLast??0)))r.add(c.id);let s=[[i.retention.hourly,(c)=>c.toISOString().slice(0,13)],[i.retention.daily,(c)=>c.toISOString().slice(0,10)],[i.retention.weekly,(c)=>new Date(Date.UTC(c.getUTCFullYear(),c.getUTCMonth(),c.getUTCDate()-(c.getUTCDay()+6)%7)).toISOString().slice(0,10)],[i.retention.monthly,(c)=>c.toISOString().slice(0,7)]];for(let[c,l]of s){let a=new Set;for(let f of o){let T=l(new Date(f.pointInTime));if(a.has(T))continue;if(a.add(T),a.size<=Math.max(0,c??0))r.add(f.id)}}}return t.filter((n)=>!r.has(n.id))}coverage(e,t=this.now()){let r=new Map(this.listDestinations(e).map((n)=>[n.id,n]));return this.listPolicies(e).map((n)=>{let i=this.listRecoveryPoints(e,n.id).filter((c)=>c.status==="available"),o=i[0],s=o?(t.getTime()-new Date(o.pointInTime).getTime())/60000:Number.POSITIVE_INFINITY;return{policy:n,lastRecoveryPoint:o,missedRpo:n.enabled&&s>n.expectedRpoMinutes,unverified:i.filter((c)=>c.verificationState!=="verified").length,destinationHealthy:r.get(n.destinationId)?.status==="healthy"}})}}import{createCipheriv as gv,createDecipheriv as mv,createHash as Wg,randomBytes as Hg}from"node:crypto";var hu=Buffer.from("TSCB1"),cc=(e)=>`sha256:${Wg("sha256").update(e).digest("hex")}`;function Kg(e){return Wg("sha256").update(e).digest()}function fv(e,t,r){let n=r?Buffer.from(r):Hg(12);if(n.length!==12)throw Error("Backup encryption IV must contain 12 bytes.");let i=gv("aes-256-gcm",Kg(t),n),o=Buffer.concat([i.update(e),i.final()]),s=i.getAuthTag();return Buffer.concat([hu,n,s,o])}function hv(e,t){let r=Buffer.from(e);if(!r.subarray(0,hu.length).equals(hu))throw Error("Backup does not contain a valid encrypted envelope.");let n=r.subarray(5,17),i=r.subarray(17,33),o=r.subarray(33),s=mv("aes-256-gcm",Kg(t),n);return s.setAuthTag(i),Buffer.concat([s.update(o),s.final()])}function yv(e){let t;try{t=JSON.parse(e)}catch{throw Error("Backup destination credential must be a JSON object with accessKeyId and secretAccessKey.")}if(!t.accessKeyId||!t.secretAccessKey)throw Error("Backup destination credential requires accessKeyId and secretAccessKey.");if(t.expiresAt){let r=new Date(String(t.expiresAt));if(!Number.isFinite(r.getTime()))throw Error("Backup destination credential expiresAt must be an ISO timestamp.");if(r.getTime()<=Date.now())throw Error("Backup destination credential has expired.")}return{accessKeyId:String(t.accessKeyId),secretAccessKey:String(t.secretAccessKey),sessionToken:t.sessionToken?String(t.sessionToken):void 0}}async function Qg(e,t,r=new Date){if(!e.credentialRef)return{status:"default"};try{let n=JSON.parse(await t.resolve(e.credentialRef));if(!n.accessKeyId||!n.secretAccessKey)return{status:"invalid"};if(!n.expiresAt)return{status:"static"};let i=new Date(String(n.expiresAt));if(!Number.isFinite(i.getTime()))return{status:"invalid"};let o=i.getTime()-r.getTime();return{status:o<=0?"expired":o<=604800000?"expiring":"valid",expiresAt:i.toISOString()}}catch{return{status:"invalid"}}}class ti{secrets;clientFactory;multipartThreshold;partSize;constructor(e,t=(i,o)=>new g(i.region??"us-east-1",void 0,{endpoint:i.endpoint?new URL(i.endpoint).host:void 0,forcePathStyle:i.forcePathStyle,credentials:o}),r=8388608,n=8388608){this.secrets=e;this.clientFactory=t;this.multipartThreshold=r;this.partSize=n}async client(e){let t=e.credentialRef?yv(await this.secrets.resolve(e.credentialRef)):void 0;return this.clientFactory(e,t)}async test(e){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let t=await this.client(e),r=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}.ts-cloud-health/${crypto.randomUUID()}`;await t.putObject({bucket:e.bucket,key:r,body:"ts-cloud backup destination health check",contentType:"text/plain"});try{let n=await t.getObjectBytes(e.bucket,r);if(Buffer.from(n.body).toString()!=="ts-cloud backup destination health check")throw Error("Backup destination health object was corrupted.")}finally{await t.deleteObject(e.bucket,r)}}async upload(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),n=cc(t.body),i=e.encryption!=="provider"?await this.secrets.resolve(e.encryptionKeyRef):void 0,o=i?t.resume?.encryptionIv?Buffer.from(t.resume.encryptionIv,"base64url"):Hg(12):void 0,s=i?fv(t.body,i,o):Buffer.from(t.body),c=cc(s),l=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}${t.key.replace(/^\/+/,"")}`,a=t.contentType??"application/octet-stream",f={"ts-cloud-format":"v1","ts-cloud-sha256":c.slice(7),"ts-cloud-encrypted":i?"true":"false"};if(t.resume&&t.resume.key!==l)throw Error("Multipart checkpoint does not match the requested backup key.");if(t.resume&&i&&!t.resume.encryptionIv)throw Error("Encrypted multipart checkpoint has no resumable envelope state.");if(t.resume&&i&&t.resume.plaintextChecksum!==n)throw Error("Encrypted multipart checkpoint does not match the backup payload.");if(s.length<this.multipartThreshold)await r.putObject({bucket:e.bucket,key:l,body:s,contentType:a,metadata:f});else{let T=t.resume?void 0:await r.createMultipartUpload(e.bucket,l,{contentType:a,metadata:f}),D=t.resume??{uploadId:T.UploadId,key:l,parts:[],bytesUploaded:0,encryptionIv:o?.toString("base64url"),plaintextChecksum:n},N=new Map(D.parts.map((Y)=>[Y.PartNumber,Y])),W=Math.ceil(s.length/this.partSize);for(let Y=0;Y<W;Y++){let ee=Y+1;if(!N.has(ee)){let ne=Y*this.partSize,he=await r.uploadPart(e.bucket,l,D.uploadId,ee,s.subarray(ne,Math.min(s.length,ne+this.partSize)));N.set(ee,{PartNumber:ee,ETag:he.ETag})}D.parts=[...N.values()].sort((ne,he)=>ne.PartNumber-he.PartNumber),D.bytesUploaded=Math.min(s.length,ee*this.partSize),t.checkpoint?.(D)}await r.completeMultipartUpload(e.bucket,l,D.uploadId,D.parts)}return{uri:`s3://${e.bucket}/${l}`,key:l,sizeBytes:s.length,checksum:c,manifest:{format:"ts-cloud-backup-v1",encrypted:!!i,plaintextChecksum:n,storageChecksum:c,contentType:a}}}async download(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),n=await r.getObjectBytes(e.bucket,t.key),i=Buffer.from(n.body);if(cc(i)!==t.checksum)throw Error("Backup checksum verification failed; object is corrupt.");let o=t.manifest.encrypted?hv(i,await this.secrets.resolve(e.encryptionKeyRef)):i;if(cc(o)!==t.manifest.plaintextChecksum)throw Error("Backup plaintext checksum verification failed.");return o}async abortPartial(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).abortMultipartUpload(e.bucket,t.key,t.uploadId)}async delete(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).deleteObject(e.bucket,t)}}import{createHash as bv}from"node:crypto";var Sv=(e)=>`sha256:${bv("sha256").update(e).digest("hex")}`;class Gr{store;queue;now;constructor(e,t,r=()=>new Date){this.store=e;this.queue=t;this.now=r}enqueueBackup(e,t=this.now().toISOString(),r){if(!e.enabled)throw Error("Backup policy is disabled.");let n=this.store.createJob({projectId:e.projectId,policyId:e.id,kind:"backup",status:"queued",idempotencyKey:`backup:${e.id}:${t}`,target:{scheduledFor:t},cancellability:"checkpoint_only",progress:{phase:"queued"}});if(!n.operationId){let i=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:r,kind:"backup.run",input:{backupJobId:n.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`backup-policy:${e.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:14400,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(n.id,{operationId:i.operation.id})}return n}enqueueDue(e=this.now()){return this.store.duePolicies(e).map((t)=>{let r=t.nextRunAt;return this.store.advancePolicy(t.id,r),this.enqueueBackup(t,r)})}enqueueVerification(e){let t=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:"verify",status:"queued",idempotencyKey:`verify:${e.id}:${e.checksum}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!t.operationId){let r=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"backup.verify",input:{backupJobId:t.id},lockKey:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:2,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(t.id,{operationId:r.operation.id})}return t}planRestore(e,t){if(e.status!=="available")throw Error("Only available recovery points can be restored.");if(e.verificationState!=="verified")throw Error("Restore requires a verified recovery point.");if(t.mode==="in_place"){if(!t.recentAuth)throw Error("In-place restore requires recent authentication.");if(t.confirm!==t.targetName)throw Error(`Type ${t.targetName} to confirm in-place restore.`);if(!t.downtimeAcknowledged)throw Error("In-place restore requires downtime acknowledgement.");let r=t.safetyBackupId?this.store.getRecoveryPoint(t.safetyBackupId):void 0;if(!r||r.id===e.id||r.status!=="available"||r.verificationState!=="verified"||r.resourceId!==e.resourceId||r.dataServiceId!==e.dataServiceId)throw Error("In-place restore requires a distinct verified safety backup for the same target.")}return{point:e,mode:t.mode,target:{...t.target,inPlace:t.mode==="in_place",restoreMode:t.mode},warnings:t.mode==="in_place"?["The target is locked against deployments and backup work.","Downtime and data replacement are expected.","Provider cancellation may stop only at a checkpoint."]:["An isolated target is created and health-validated before cleanup."]}}enqueueRestore(e,t){let r=this.planRestore(e,t),n=t.drill?"drill":"restore",i=Sv(JSON.stringify({point:e.id,mode:t.mode,target:t.target,safety:t.safetyBackupId,drill:!!t.drill})),o=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:n,status:"queued",idempotencyKey:`${n}:${i}`,target:r.target,restoreMode:r.mode,cancellability:"checkpoint_only",safetyBackupId:t.safetyBackupId,progress:{phase:"queued",warnings:r.warnings}});if(!o.operationId){let s=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,actorId:t.actorId,kind:t.drill?"backup.drill":"backup.restore",input:{backupJobId:o.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:1,timeoutSeconds:14400,retryClasses:[],resumePolicy:"fail"});return this.store.updateJob(o.id,{operationId:s.operation.id})}return o}enqueueRetention(e=this.now()){return this.store.retentionCandidates(e).map((t)=>{let r=this.store.createJob({projectId:t.projectId,policyId:t.policyId,recoveryPointId:t.id,kind:"cleanup",status:"queued",idempotencyKey:`cleanup:${t.id}:${t.expiresAt}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!r.operationId){let n=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,kind:"backup.cleanup",input:{backupJobId:r.id},lockKey:`recovery-point:${t.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(r.id,{operationId:n.operation.id})}return r})}}function Yg(e){let t=e.now??(()=>new Date),r=new Gr(e.store,e.queue,t),n=(c)=>{let l=c.recoveryPointId?e.store.getRecoveryPoint(c.recoveryPointId):void 0,a=c.policyId?e.store.getPolicy(c.policyId):l?.policyId?e.store.getPolicy(l.policyId):void 0;if(!a)throw Error("Backup policy was not found.");let f=e.store.getDestination(l?.destinationId??a.destinationId),T=e.resolveSource(a);if(!f)throw Error("Backup destination was not found.");if(!T)throw Error(`No ${a.resourceKind} backup adapter is configured.`);return{point:l,policy:a,destination:f,source:T}},i=(c)=>{let l=c.operation.input,a=e.store.getJob(String(l.backupJobId??""));if(!a)throw Error("Backup job was not found.");return e.store.updateJob(a.id,{status:"running",startedAt:a.startedAt??t().toISOString(),progress:{...a.progress,phase:"running"}}),a},o=(c,l)=>{let a=e.store.getJob(c.id)??c;e.store.updateJob(c.id,{status:"failed",finishedAt:t().toISOString(),error:l instanceof Error?l.message:String(l),progress:{...a.progress,phase:"failed"}})};return{"backup.run":async(c)=>{let l=i(c);try{let{policy:a,destination:f,source:T}=n(l),D=await T.create(a,c),N=e.resolveDestination(f),W=D.mode==="object"?await(async()=>{if(!N)throw Error("Backup destination adapter is not configured.");let he=e.store.getJob(l.id)?.progress,te=he?.multipart,xe=te&&typeof te==="object"&&!Array.isArray(te)&&typeof te.uploadId==="string"&&typeof te.key==="string"&&Array.isArray(te.parts)?te:void 0;return N.upload(f,{key:D.key,body:D.body,contentType:D.contentType,resume:xe,checkpoint:(tt)=>{c.checkpoint("uploading",`Uploaded ${Number(tt.bytesUploaded??0)} backup bytes.`),e.store.updateJob(l.id,{progress:{phase:"uploading",multipart:{...tt}}})}})})():{uri:D.uri,key:D.uri,sizeBytes:D.sizeBytes,checksum:D.checksum,manifest:{format:"ts-cloud-backup-v1",encrypted:!1,plaintextChecksum:D.checksum,storageChecksum:D.checksum,contentType:"application/provider-snapshot"}},Y=a.retention.expireAfterDays?new Date(t().getTime()+a.retention.expireAfterDays*86400000).toISOString():void 0,ee=e.store.getJob(l.id)?.startedAt,ne=e.store.createRecoveryPoint({projectId:a.projectId,policyId:a.id,destinationId:f.id,resourceId:a.resourceId,dataServiceId:a.dataServiceId,backupJobId:l.id,kind:a.resourceKind,pointInTime:t().toISOString(),uri:W.uri,sizeBytes:W.sizeBytes,checksum:W.checksum,manifest:{...D.manifest,...W.manifest,storageKey:W.key},toolVersion:D.toolVersion,engineVersion:D.engineVersion,expiresAt:Y,lockedUntil:f.immutability.defaultRetentionDays?new Date(t().getTime()+f.immutability.defaultRetentionDays*86400000).toISOString():void 0,held:!1,pinned:!1,status:"available",verificationState:"unverified",durationMs:Math.max(0,t().getTime()-new Date(ee??t().toISOString()).getTime())});if(D.mode==="external"&&f.provider==="aws_backup")e.store.recordDestinationTest(f.id,{ok:!0});return e.store.updateJob(l.id,{status:"succeeded",recoveryPointId:ne.id,finishedAt:t().toISOString(),progress:{phase:"stored",recoveryPointId:ne.id}}),r.enqueueVerification(ne),{backupJobId:l.id,recoveryPointId:ne.id}}catch(a){let f=e.store.getJob(l.id),T=f?.progress.multipart,D=(()=>{try{return n(l)}catch{return}})();if(D?.destination.provider==="aws_backup")e.store.recordDestinationTest(D.destination.id,{ok:!1,error:a instanceof Error?a.message:String(a)});let N=!1;if(T&&typeof T==="object"&&!Array.isArray(T)&&D){let W=e.resolveDestination(D.destination);if(N=!0,W?.abortPartial)try{await W.abortPartial(D.destination,T),N=!1,e.store.updateJob(l.id,{progress:{...f.progress,partialCleanup:"aborted"}})}catch{e.store.updateJob(l.id,{progress:{...f.progress,partialCleanup:"required"}})}}if(N)e.store.updateJob(l.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:a instanceof Error?a.message:String(a),progress:{...e.store.getJob(l.id)?.progress??{},phase:"cleanup_required"}});else o(l,a);throw a}},"backup.verify":async(c)=>{let l=i(c);try{let{point:a,destination:f,source:T}=n(l);if(!a)throw Error("Recovery point was not found.");e.store.updateRecoveryPoint(a.id,{verificationState:"verifying"});let D;if(a.uri.startsWith("s3:")){let N=e.resolveDestination(f);if(!N)throw Error("Backup destination adapter is not configured.");let W=await N.download(f,{key:String(a.manifest.storageKey??""),checksum:a.checksum,manifest:a.manifest}),Y=T.verify?await T.verify(a,W,c):{};D={bytes:W.length,checksum:a.checksum,...Y}}else if(T.verifyExternal)D=await T.verifyExternal(a,c);else throw Error("External recovery point verification is not supported.");return e.store.updateRecoveryPoint(a.id,{verificationState:"verified",verifiedAt:t().toISOString(),manifest:{...a.manifest,verification:D}}),e.store.updateJob(l.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"verified",evidence:D}}),{backupJobId:l.id,recoveryPointId:a.id,evidence:D}}catch(a){if(l.recoveryPointId)e.store.updateRecoveryPoint(l.recoveryPointId,{verificationState:/checksum|corrupt|authentic/i.test(a instanceof Error?a.message:String(a))?"corrupt":"failed"});throw o(l,a),a}},"backup.restore":async(c)=>s(c,!1),"backup.drill":async(c)=>s(c,!0),"backup.cleanup":async(c)=>{let l=i(c);try{let{point:a,destination:f,source:T}=n(l);if(!a)throw Error("Recovery point was not found.");if(!e.store.retentionCandidates(t()).some((D)=>D.id===a.id))throw Error("Recovery point is held, pinned, locked, or in active use.");if(e.store.updateRecoveryPoint(a.id,{status:"deleting"}),a.uri.startsWith("s3:")){let D=e.resolveDestination(f);if(!D)throw Error("Destination cleanup is unavailable.");await D.delete(f,String(a.manifest.storageKey??""))}else if(T.deleteExternal)await T.deleteExternal(a,c);else throw Error("External recovery point cleanup is unavailable.");return e.store.updateRecoveryPoint(a.id,{status:"deleted"}),e.store.updateJob(l.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"deleted"}}),{backupJobId:l.id,recoveryPointId:a.id,deleted:!0}}catch(a){throw o(l,a),a}}};async function s(c,l){let a=i(c);try{let{point:f,policy:T,destination:D,source:N}=n(a);if(!f)throw Error("Recovery point was not found.");if(l&&!N.cleanup)throw Error("This backup source cannot safely clean a recovery drill target.");let W=f.uri.startsWith("s3:")?e.resolveDestination(D):void 0,Y=W?await W.download(D,{key:String(f.manifest.storageKey??""),checksum:f.checksum,manifest:f.manifest}):void 0,ee=await N.restore(f,Y,a.target,c),ne=N.validateHealth?await N.validateHealth({...a.target,...ee},c):{healthy:!0,mode:"adapter"},he=e.validateHealth?await e.validateHealth(T,a.target):{healthy:!0,mode:"not_configured"},te={...ne,healthy:ne.healthy===!0&&he.healthy===!0,configured:he};if(te.healthy!==!0)throw Error("Restored target did not pass its configured health check.");if(l&&N.cleanup)await N.cleanup({...a.target,provider:f.manifest.provider??null},c);return e.store.updateJob(a.id,{status:"succeeded",finishedAt:t().toISOString(),healthResult:te,progress:{phase:l?"drill_cleaned":"restored",restored:ee}}),{backupJobId:a.id,recoveryPointId:f.id,restored:ee,health:te,cleaned:l}}catch(f){let T=(()=>{try{return n(a)}catch{return}})(),D=f instanceof Error?f.message:String(f),N=!1;if(l&&T?.source.cleanup)try{await T.source.cleanup({...a.target,provider:T.point?.manifest.provider??null},c)}catch{N=!0}if(N)e.store.updateJob(a.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:D,progress:{...a.progress,phase:"cleanup_required"}});else o(a,f);throw f}}}import{createHash as vv}from"node:crypto";var wv=(e)=>`sha256:${vv("sha256").update(e).digest("hex")}`;class yu{dataServices;client;constructor(e,t=new me){this.dataServices=e;this.client=t}service(e){let t=e.dataServiceId?this.dataServices.get(e.dataServiceId):void 0;if(!t||!["aws_rds","aws_aurora"].includes(t.provider))throw Error("Managed database backup policy requires an RDS or Aurora data service.");return t}async waitForSnapshot(e,t,r){for(;;){r.throwIfCancellationRequested?.(),r.heartbeat?.();let n=e==="aws_aurora"?(await this.client.describeDBClusterSnapshots({DBClusterSnapshotIdentifier:t})).DBClusterSnapshots[0]:(await this.client.describeDBSnapshots({DBSnapshotIdentifier:t})).DBSnapshots?.[0];if(!n)throw Error("Provider snapshot was not found.");let i=n,o=String(i.Status??i.DBSnapshotStatus??"unknown");if(r.checkpoint?.("provider_snapshot",`Database snapshot ${t} is ${o}.`),o==="available")return i;if(["deleted","deleting","failed"].includes(o))throw Error(`Provider snapshot ${t} failed with state ${o}.`);await Bun.sleep(5000)}}async create(e,t){let r=this.service(e),n=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,20),i=`${r.placement.slice(0,42).replace(/-+$/,"")}-${n}`;if(r.provider==="aws_aurora")await this.client.createDBClusterSnapshot(r.placement,i);else await this.client.createDBSnapshot({DBInstanceIdentifier:r.placement,DBSnapshotIdentifier:i});await this.waitForSnapshot(r.provider,i,t);let o=`${r.provider}:${r.placement}:${i}`;return{mode:"external",uri:`aws-backup:${o}`,checksum:wv(o),sizeBytes:0,manifest:{provider:r.provider,sourceId:r.placement,snapshotId:i,plan:r.plan,engine:r.engine},engineVersion:r.engineVersion,toolVersion:"aws-rds-api-2014-10-31"}}async verifyExternal(e,t){let r=String(e.manifest.snapshotId??""),n=String(e.manifest.provider??"");if(!r)throw Error("Snapshot recovery point has no snapshot ID.");let i=await this.waitForSnapshot(n,r,t),o=String(i.Status??i.DBSnapshotStatus??"unknown");return{snapshotId:r,status:o,encrypted:i.Encrypted??i.StorageEncrypted??!0}}async restore(e,t,r,n){let i=String(r.targetId??""),o=String(e.manifest.snapshotId??""),s=String(e.manifest.provider??"");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(i))throw Error("Managed restore requires a valid distinct targetId.");if(i===e.manifest.sourceId)throw Error("Managed restore target must differ from its source.");if(s==="aws_aurora"){let c=e.manifest.engine==="postgres"?"aurora-postgresql":"aurora-mysql";await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:i,SnapshotIdentifier:o,Engine:c,EngineVersion:e.engineVersion,DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:Number(r.minCapacity)||0.5,MaxCapacity:Number(r.maxCapacity)||4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${i}-writer-1`,DBClusterIdentifier:i,DBInstanceClass:String(r.plan??e.manifest.plan??"db.serverless"),Engine:c,PubliclyAccessible:!1})}else await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:i,DBSnapshotIdentifier:o,DBInstanceClass:String(r.plan??e.manifest.plan??""),PubliclyAccessible:!1,DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud-restore"}]});return{targetId:i,provider:s,status:"creating",isolated:!0}}async validateHealth(e,t){let r=String(e.targetId??""),n=String(e.provider??"");for(;;){t.throwIfCancellationRequested?.(),t.heartbeat?.();let i=n==="aws_aurora"?(await this.client.describeDBClusters({DBClusterIdentifier:r})).DBClusters?.[0]:(await this.client.describeDBInstances({DBInstanceIdentifier:r})).DBInstances?.[0];if(!i)throw Error("Restored managed database was not found.");let o=String(i.Status??i.DBInstanceStatus??"unknown");if(t.checkpoint?.("provider_restore",`Restored database ${r} is ${o}.`),o==="available")return{healthy:!0,targetId:r,provider:n,status:o};if(["deleted","deleting","failed","incompatible-restore"].includes(o))throw Error(`Restored managed database ${r} failed with state ${o}.`);await Bun.sleep(5000)}}async cleanup(e,t){let r=String(e.targetId??""),n=String(e.provider??"");if(!r)throw Error("Restore cleanup target is required.");if(n==="aws_aurora")await this.client.deleteDBInstance({DBInstanceIdentifier:`${r}-writer-1`,SkipFinalSnapshot:!0}),await this.client.modifyDBCluster({DBClusterIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(r);else await this.client.modifyDBInstance({DBInstanceIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:r,SkipFinalSnapshot:!0,DeleteAutomatedBackups:!0})}async deleteExternal(e,t){let r=String(e.manifest.snapshotId??"");if(e.manifest.provider==="aws_aurora")await this.client.deleteDBClusterSnapshot(r);else await this.client.deleteDBSnapshot(r)}}var Wr=(e,t="none",r=!1)=>({supported:!0,downtime:t,destructive:r,explanation:e}),Er=(e)=>({supported:!1,downtime:"none",destructive:!1,explanation:e});function Zt(e,t){let r=["aws_rds","aws_aurora","aws_elasticache"].includes(t),n=["server","container"].includes(t),i=["postgres","mysql","mariadb"].includes(e),o=e==="redis",s={};return s.create=t==="external"?Er("External services can be adopted as read-only inventory."):Wr(r?"Provision through the provider API.":"Provision through the owning runtime driver.","possible"),s.observe=t==="external"?Er("External observation requires a configured provider adapter."):Wr("Provider/runtime health and endpoint metadata are observable."),s.connect=Wr("Connection guidance uses secret references and never returns a password by default."),s.backup=i&&(r||n)?Wr(r?"Create a provider snapshot.":"Create a consistent engine-native dump.","possible"):Er("This cache path is not a durable backup source."),s.restore=r&&i?Wr("Restore creates a reviewed provider target.","required",!0):Er("Restore requires a configured provider restore runner."),s.restart=t==="external"?Er("External restart requires a configured provider adapter."):Wr(r?"Provider restart/failover semantics apply.":"Restart the owning service unit.","required"),s.resize=t==="aws_elasticache"?Er("ElastiCache resizing requires a replication-group migration runner."):r?Wr("Provider plan/storage modification may enter a maintenance window.","possible"):n?Wr("Edit host/container resources and reconcile.","required"):Er("External resize requires a configured provider adapter."),s.version=n?Er("Runtime version upgrades require an explicit image migration runner."):r&&t!=="aws_elasticache"?Wr(i?"Major versions require compatibility preflight and backup.":"Engine upgrades require a maintenance window.","required"):Er("External upgrades require a configured provider adapter."),s.rotate=t==="aws_elasticache"||t==="external"||n&&!i&&!o?Er("Credential rotation is not available for this provider/engine path."):Wr("Rotate through the secret backend, update the engine, then flag dependent releases."),s.expose=n?Er("Direct container publishing is refused; use a reviewed firewall and proxy policy."):t==="aws_rds"?Wr("Exposure is reconciled through security groups; public access defaults off."):Er("Exposure changes require a provider-specific network runner."),s.delete=t==="external"?Er("External deletion requires a configured provider adapter."):Wr(r?"Final snapshot is supported where the provider allows it.":"A final engine backup is required unless explicitly retained.","required",!0),s.logs=n?Wr("Read bounded service logs from the runtime."):Er("Provider log export is not configured for this adapter."),s.slow_queries=n&&i?Wr("Read bounded runtime logs after engine slow-query logging is enabled."):Er("A slow-query log runner is not configured for this provider."),s.users=n&&i?Wr("Logical users can be listed; creation requires a referenced secondary credential."):Er("User management requires an engine connection runner."),s.databases=n&&i?Wr("Logical databases can be listed, created, and confirmation-gated for deletion."):Er("Logical database management requires an engine connection runner."),{actions:s,endpointTypes:r?["internal","external","tunnel"]:["internal","tunnel"],metrics:o?["connections","memory","evictions","hit_rate","latency"]:["connections","cpu","storage","read_latency","write_latency","iops"]}}var _s=(e)=>e==null?void 0:String(e),pc=(e)=>Number(e)===1,uc=(e)=>{try{return JSON.parse(String(e))}catch{return{}}};function Xg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:_s(e.environment_id),resourceId:_s(e.resource_id),name:String(e.name),engine:String(e.engine),provider:String(e.provider),placement:String(e.placement),engineVersion:_s(e.engine_version),plan:String(e.plan),storageGb:e.storage_gb==null?void 0:Number(e.storage_gb),highAvailability:pc(e.high_availability),publicExposure:pc(e.public_exposure),allowedCidrs:uc(e.allowed_cidrs),desiredState:uc(e.desired_state),observedState:uc(e.observed_state),capabilities:uc(e.capabilities),credentialRef:_s(e.credential_ref),status:String(e.status),origin:String(e.origin),managementEnabled:pc(e.management_enabled),ownerActorId:_s(e.owner_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class er{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}create(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Data service names must be 2-63 lowercase letters, numbers, or dashes.");if(e.publicExposure&&(!e.allowedCidrs.length||e.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");let t=crypto.randomUUID(),r=this.now().toISOString(),n=Zt(e.engine,e.provider);return this.controlPlane.database.run("INSERT INTO data_services (id,organization_id,project_id,environment_id,resource_id,name,engine,provider,placement,engine_version,plan,storage_gb,high_availability,public_exposure,allowed_cidrs,desired_state,observed_state,capabilities,credential_ref,status,origin,management_enabled,owner_actor_id,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.engine,e.provider,e.placement,e.engineVersion??null,e.plan,e.storageGb??null,e.highAvailability?1:0,e.publicExposure?1:0,JSON.stringify(e.allowedCidrs),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),JSON.stringify(n),e.credentialRef??null,e.status,e.origin,e.managementEnabled?1:0,e.ownerActorId??null,1,r,r]),this.get(t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM data_services WHERE id=?").get(e);return t?Xg(t):void 0}list(e,t){return this.controlPlane.database.query(`SELECT * FROM data_services WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Xg)}update(e,t,r){let n=this.get(e);if(!n)throw Error("Data service was not found.");if(n.version!==t)throw Error("Data service changed; refresh before retrying.");let i={...n,...r};if(i.publicExposure&&(!i.allowedCidrs.length||i.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");if(this.controlPlane.database.run("UPDATE data_services SET plan=?,storage_gb=?,engine_version=?,high_availability=?,public_exposure=?,allowed_cidrs=?,desired_state=?,observed_state=?,status=?,management_enabled=?,credential_ref=?,version=version+1,updated_at=? WHERE id=? AND version=?",[i.plan,i.storageGb??null,i.engineVersion??null,i.highAvailability?1:0,i.publicExposure?1:0,JSON.stringify(i.allowedCidrs),JSON.stringify(i.desiredState),JSON.stringify(i.observedState),i.status,i.managementEnabled?1:0,i.credentialRef??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Data service changed; refresh before retrying.");return this.get(e)}credential(e){let t=this.controlPlane.database.query("SELECT * FROM data_service_credentials WHERE service_id=? ORDER BY version DESC LIMIT 1").get(e);return t?{id:String(t.id),serviceId:String(t.service_id),username:String(t.username),secretRef:String(t.secret_ref),version:Number(t.version),createdAt:String(t.created_at),rotatedAt:_s(t.rotated_at)}:void 0}saveCredential(e,t,r){let n=this.credential(e),i=n?.id??crypto.randomUUID(),o=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_credentials (id,service_id,username,secret_ref,version,created_at,rotated_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(service_id,username) DO UPDATE SET secret_ref=excluded.secret_ref,version=data_service_credentials.version+1,rotated_at=excluded.rotated_at",[i,e,t,r,n?.version??1,n?.createdAt??o,n?o:null]),this.credential(e)}addDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_dependencies (service_id,resource_id,secret_ref,requires_redeploy,created_at) VALUES (?,?,?,?,?) ON CONFLICT(service_id,resource_id) DO UPDATE SET secret_ref=excluded.secret_ref,requires_redeploy=excluded.requires_redeploy",[e.serviceId,e.resourceId,e.secretRef,e.requiresRedeploy?1:0,t]),{...e,createdAt:t}}dependencies(e){return this.controlPlane.database.query("SELECT * FROM data_service_dependencies WHERE service_id=? ORDER BY resource_id").all(e).map((t)=>({serviceId:String(t.service_id),resourceId:String(t.resource_id),secretRef:String(t.secret_ref),requiresRedeploy:pc(t.requires_redeploy),createdAt:String(t.created_at)}))}removeDependency(e,t){return this.controlPlane.database.run("DELETE FROM data_service_dependencies WHERE service_id=? AND resource_id=?",[e,t]).changes===1}remove(e){this.controlPlane.database.run("DELETE FROM data_services WHERE id=?",[e])}}function Zg(){let t=crypto.getRandomValues(new Uint8Array(40));return Array.from(t,(r)=>"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*_-+="[r%69]).join("")}function Ln(e,t){return t.map((r)=>{let n=r.type==="tunnel"?"127.0.0.1":r.host,i=e.engine==="redis"?`redis-cli -h ${n} -p ${r.port}${r.tls?" --tls":""}`:e.engine==="postgres"?`psql "host=${n} port=${r.port} dbname=${r.database??"postgres"} sslmode=${r.tls?"require":"disable"}"`:e.engine==="mongodb"?`mongosh "mongodb://${n}:${r.port}/${r.database??"admin"}${r.tls?"?tls=true":""}"`:e.engine==="libsql"?`turso db shell ${r.tls?"https":"http"}://${n}:${r.port}`:`mysql --host=${n} --port=${r.port} --database=${r.database??"mysql"} --ssl-mode=${r.tls?"REQUIRED":"DISABLED"}`;return{type:r.type,command:i,secretRef:e.credentialRef}})}class Ur{store;queue;secrets;constructor(e,t,r){this.store=e;this.queue=t;this.secrets=r}async create(e){let t,r;if(e.provider!=="aws_elasticache"){let n=e.username??"app",i=Zg();r=`secret://data-services/${e.projectId}/${e.name}/${n}`,await this.secrets.put(r,i),t={username:n,password:i,secretRef:r}}try{let n=this.store.create({...e,credentialRef:r,status:"planning"});if(t)this.store.saveCredential(n.id,t.username,t.secretRef);let i=this.enqueue(n,"create",{});return{service:n,credential:t,operationId:i}}catch(n){if(r)await this.secrets.remove(r);throw n}}plan(e,t,r={}){let n=e.capabilities.actions[t],i=t==="version"&&String(r.engineVersion??"").split(".")[0]!==String(e.engineVersion??"").split(".")[0];return{service:e,action:t,capability:n,changes:r,preflight:{backupRequired:["delete","restore"].includes(t)||i,compatibilityRequired:i,typedConfirmation:n.destructive?e.name:void 0,retentionChoiceRequired:t==="delete"},warnings:[...n.downtime!=="none"?[`Downtime is ${n.downtime}.`]:[],...e.origin==="adopted"&&!e.managementEnabled?["Adopted resource is read-only until management is explicitly enabled."]:[]]}}enqueue(e,t,r,n){let i=this.plan(e,t,r);if(!i.capability.supported)throw Error(i.capability.explanation);if(e.origin==="adopted"&&!e.managementEnabled&&t!=="observe")throw Error("Adopted resources remain read-only until management is explicitly enabled.");if(i.preflight.typedConfirmation&&r.confirm!==i.preflight.typedConfirmation)throw Error(`Type ${i.preflight.typedConfirmation} to confirm ${t}.`);if(i.preflight.retentionChoiceRequired&&!["final_backup","retain"].includes(String(r.retention??"")))throw Error("Deletion requires retention final_backup or retain.");if(i.preflight.compatibilityRequired&&(r.compatibilityReviewed!==!0||!r.backupId))throw Error("Major version changes require compatibilityReviewed=true and a backupId.");if(t==="restore"){let o=String(r.backupId??""),s=String(r.targetId??"");if(!o||!s)throw Error("Restore requires both backupId and targetId.");if(s===e.placement)throw Error("Restore targetId must differ from the source placement.");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(s))throw Error("Restore targetId must be 2-63 lowercase letters, numbers, or dashes.")}return this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:n,kind:"data_service.action",input:{serviceId:e.id,action:t,...r},lockKey:`data-service:${e.id}`,providerKey:e.provider,maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"}).operation.id}async rotate(e,t,r){let n=this.store.credential(e.id);if(!n)throw Error("Data service credential metadata was not found.");let i=Zg(),o=`${n.secretRef}/v${n.version+1}`;await this.secrets.put(o,i);try{return await t.action(e,"rotate",{username:n.username,secretRef:o},i,r),this.store.saveCredential(e.id,n.username,o),this.store.update(e.id,e.version,{credentialRef:o}),{credential:{username:n.username,password:i,secretRef:o},dependencies:this.store.dependencies(e.id).filter((s)=>s.requiresRedeploy).map((s)=>s.resourceId)}}catch(s){throw await this.secrets.remove(o),s}}}function em(e){return{"data_service.action":async(t)=>{let r=t.operation.input,n=e.store.get(String(r.serviceId??"")),i=String(r.action??"");if(!n)throw Error("Data service was not found.");let o=e.resolveAdapter(n);if(!o||o.provider!==n.provider||!o.engines.includes(n.engine))throw Error(`No ${n.provider}/${n.engine} adapter is configured.`);if(i==="rotate"){let c=await new Ur(e.store,new S(e.store.controlPlane),e.secrets).rotate(n,o,t);return{serviceId:n.id,action:i,username:c.credential.username,secretRef:c.credential.secretRef,dependencies:c.dependencies}}let s=n.credentialRef?await e.secrets.resolve(n.credentialRef):void 0;try{let c=i==="observe"?await o.observe(n):i==="create"?await o.apply(n,s,t):await o.action(n,i,r,s,t),l=e.store.get(n.id);return e.store.update(n.id,l.version,{observedState:c,status:i==="delete"?r.retention==="retain"?"retained":"deleting":"available"}),{serviceId:n.id,action:i,observed:c}}catch(c){let l=e.store.get(n.id);if(e.store.update(n.id,l.version,{status:"failed",observedState:{...l.observedState,error:c instanceof Error?c.message:String(c)}}),/temporar|timeout|unavailable|throttl/i.test(c instanceof Error?c.message:String(c)))throw new $e(c instanceof Error?c.message:String(c),"provider_transient");throw c}}}}class Ns{transport;constructor(e){this.transport=e}observe(e){return this.transport.observe(e.placement)}apply(e,t){return this.transport.apply({id:e.placement,name:e.name,engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,storageGb:e.storageGb??null,highAvailability:e.highAvailability,publicExposure:e.publicExposure,allowedCidrs:e.allowedCidrs,username:e.desiredState.username??"app",desiredState:e.desiredState},t)}action(e,t,r,n,i){return this.transport.execute(e.placement,t,{engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,desiredState:e.desiredState,...r},n,i)}}class Mn extends Ns{provider="aws_rds";engines=["postgres","mysql","mariadb"]}class Un extends Ns{provider="aws_aurora";engines=["postgres","mysql"]}class Bn extends Ns{provider="aws_elasticache";engines=["redis"]}class jn extends Ns{provider="server";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}class Vn extends Ns{provider="container";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}var fc=(e,t)=>{let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)},Ut=(e,t,r)=>{let n=fc(e,t);return n==null?r:String(n)},hn=(e,t)=>{let r=fc(e,t);return r==null?void 0:Number(r)},Ro=(e,t)=>{let r=fc(e,t);return r==null?void 0:r===!0||r==="true"},$s=(e,t)=>{let r=fc(e,t);return Array.isArray(r)?r.map(String):[]},mc=(e,t)=>Ut(t,"snapshotId")??`${e}-final-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`;function gc(e){if(!e)throw Error("RDS instance was not found.");return{providerId:e.DBInstanceIdentifier??null,status:e.DBInstanceStatus??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,plan:e.DBInstanceClass??null,storageGb:e.AllocatedStorage??null,highAvailability:e.MultiAZ??!1,publicExposure:e.PubliclyAccessible??!1,endpoint:e.Endpoint?.Address??null,port:e.Endpoint?.Port??null,username:e.MasterUsername??null,database:e.DBName??null,encrypted:e.StorageEncrypted??!1}}class zn{client;constructor(e=new me){this.client=e}async observe(e){return gc(await this.client.describeDBInstance(e))}async apply(e,t){let r=String(e.id),n=await this.client.createDBInstance({DBInstanceIdentifier:r,DBInstanceClass:String(e.plan),Engine:String(e.engine),MasterUsername:Ut(e,"username","app"),MasterUserPassword:t,DBName:Ut(e,"database"),AllocatedStorage:hn(e,"storageGb"),VpcSecurityGroupIds:$s(e,"securityGroupIds"),DBSubnetGroupName:Ut(e,"subnetGroup"),BackupRetentionPeriod:hn(e,"backupRetentionDays")??7,MultiAZ:Ro(e,"highAvailability"),EngineVersion:Ut(e,"engineVersion"),PubliclyAccessible:Ro(e,"publicExposure")??!1,StorageType:Ut(e,"storageType","gp3"),StorageEncrypted:!0,KmsKeyId:Ut(e,"kmsKeyId"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return gc(n.DBInstance)}async execute(e,t,r,n,i){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBInstance({DBInstanceIdentifier:e}),{status:"rebooting"};if(t==="backup"){let o=mc(e,r);return await this.client.createDBSnapshot({DBInstanceIdentifier:e,DBSnapshotIdentifier:o}),{status:"snapshotting",snapshotId:o}}if(t==="restore"){let o=String(r.targetId),s=await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:o,DBSnapshotIdentifier:String(r.backupId),DBInstanceClass:Ut(r,"plan"),DBSubnetGroupName:Ut(r,"subnetGroup"),MultiAZ:Ro(r,"highAvailability"),PubliclyAccessible:!1,StorageType:Ut(r,"storageType"),VpcSecurityGroupIds:$s(r,"securityGroupIds"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{...gc(s.DBInstance),sourceId:e,restoreTargetId:o}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let o=mc(e,r);return await this.client.modifyDBInstance({DBInstanceIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:e,SkipFinalSnapshot:!1,FinalDBSnapshotIdentifier:o,DeleteAutomatedBackups:!1}),{status:"deleting",finalSnapshotId:o}}if(["resize","version","rotate","expose"].includes(t)){let o=await this.client.modifyDBInstance({DBInstanceIdentifier:e,DBInstanceClass:Ut(r,"plan"),AllocatedStorage:hn(r,"storageGb"),MasterUserPassword:t==="rotate"?n:void 0,EngineVersion:Ut(r,"engineVersion"),MultiAZ:Ro(r,"highAvailability"),PubliclyAccessible:Ro(r,"publicExposure"),VpcSecurityGroupIds:$s(r,"securityGroupIds"),ApplyImmediately:Ro(r,"applyImmediately")??!0});return gc(o.DBInstance)}throw Error(`RDS action ${t} requires an engine connection runner.`)}}function bu(e){if(!e)throw Error("Aurora cluster was not found.");return{providerId:e.DBClusterIdentifier??null,status:e.Status??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,endpoint:e.Endpoint??null,readerEndpoint:e.ReaderEndpoint??null,port:e.Port??null,username:e.MasterUsername??null,database:e.DatabaseName??null,encrypted:e.StorageEncrypted??!1,highAvailability:e.MultiAZ??!0}}class Hn{client;constructor(e=new me){this.client=e}async observe(e){let t=await this.client.describeDBClusters({DBClusterIdentifier:e});return bu(t.DBClusters?.[0])}async apply(e,t){let r=String(e.id),n=String(e.engine)==="postgres"?"aurora-postgresql":"aurora-mysql";return await this.client.createDBCluster({DBClusterIdentifier:r,Engine:n,EngineVersion:Ut(e,"engineVersion"),MasterUsername:Ut(e,"username","app"),MasterUserPassword:t,DatabaseName:Ut(e,"database"),DBSubnetGroupName:Ut(e,"subnetGroup"),VpcSecurityGroupIds:$s(e,"securityGroupIds"),BackupRetentionPeriod:hn(e,"backupRetentionDays")??7,StorageEncrypted:!0,KmsKeyId:Ut(e,"kmsKeyId"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:hn(e,"minCapacity")??0.5,MaxCapacity:hn(e,"maxCapacity")??4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${r}-writer-1`,DBClusterIdentifier:r,DBInstanceClass:String(e.plan||"db.serverless"),Engine:n,PubliclyAccessible:Ro(e,"publicExposure")??!1}),{status:"creating",providerId:r}}async execute(e,t,r,n){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBCluster(e),{status:"rebooting"};if(t==="backup"){let i=mc(e,r);return await this.client.createDBClusterSnapshot(e,i),{status:"snapshotting",snapshotId:i}}if(t==="restore"){let i=String(r.targetId),o=String(r.engine)==="postgres"?"aurora-postgresql":"aurora-mysql",s=await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:i,SnapshotIdentifier:String(r.backupId),Engine:o,EngineVersion:Ut(r,"engineVersion"),DBSubnetGroupName:Ut(r,"subnetGroup"),VpcSecurityGroupIds:$s(r,"securityGroupIds"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:hn(r,"minCapacity")??0.5,MaxCapacity:hn(r,"maxCapacity")??4}});return await this.client.createDBInstance({DBInstanceIdentifier:`${i}-writer-1`,DBClusterIdentifier:i,DBInstanceClass:Ut(r,"plan","db.serverless"),Engine:o,PubliclyAccessible:!1}),{...bu(s.DBCluster),sourceId:e,restoreTargetId:i}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let i=mc(e,r);return await this.client.modifyDBCluster({DBClusterIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(e,i),{status:"deleting",finalSnapshotId:i}}if(["resize","version","rotate"].includes(t)){let i=await this.client.modifyDBCluster({DBClusterIdentifier:e,ServerlessV2ScalingConfiguration:hn(r,"minCapacity")==null&&hn(r,"maxCapacity")==null?void 0:{MinCapacity:hn(r,"minCapacity")??0.5,MaxCapacity:hn(r,"maxCapacity")??4},EngineVersion:Ut(r,"engineVersion"),MasterUserPassword:t==="rotate"?n:void 0,ApplyImmediately:Ro(r,"applyImmediately")??!0});return bu(i.DBCluster)}throw Error(`Aurora action ${t} requires an engine connection runner.`)}}class qn{client;constructor(e=new ie){this.client=e}async observe(e){let t=(await this.client.describeCacheClusters(e)).CacheClusters[0];if(!t)throw Error("ElastiCache cluster was not found.");let r=t.CacheNodes?.[0]?.Endpoint;return{providerId:t.CacheClusterId,status:t.CacheClusterStatus,engine:t.Engine,engineVersion:t.EngineVersion,plan:t.CacheNodeType,nodes:t.NumCacheNodes,endpoint:r?.Address??null,port:r?.Port??null}}async apply(e){let t=await this.client.createCacheCluster({cacheClusterId:String(e.id),engine:"redis",cacheNodeType:String(e.plan),numCacheNodes:hn(e,"nodes")??1,engineVersion:Ut(e,"engineVersion"),port:hn(e,"port"),securityGroupIds:$s(e,"securityGroupIds"),subnetGroupName:Ut(e,"subnetGroup"),tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{providerId:t.CacheCluster.CacheClusterId,status:t.CacheCluster.CacheClusterStatus}}async execute(e,t,r){if(t==="observe")return this.observe(e);if(t==="restart"){let n=(await this.client.describeCacheClusters(e)).CacheClusters[0];return await this.client.rebootCacheCluster(e,n?.CacheNodes?.map((i)=>i.CacheNodeId)??["0001"]),{status:"rebooting"}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};return await this.client.deleteCacheCluster(e),{status:"deleting"}}throw Error(`ElastiCache action ${t} is not supported by this cluster mode.`)}}import{mkdir as Iv,writeFile as Cv}from"node:fs/promises";import{join as Ev}from"node:path";async function vn(e,t,r=!1){let n=Bun.spawn(["docker",...e],{stdin:t==null?"ignore":"pipe",stdout:"pipe",stderr:"pipe"}),i=new Response(n.stdout).text(),o=new Response(n.stderr).text();if(t!=null)n.stdin.write(t),n.stdin.end();let[s,c,l]=await Promise.all([n.exited,i,o]);if(s!==0&&!r)throw Error(`Docker command failed (${s}): ${l.trim()||c.trim()}`);return{code:s,stdout:c,stderr:l}}class tm{async ensureNetwork(e){if((await vn(["network","inspect",e],void 0,!0)).code!==0)await vn(["network","create","--internal",e])}async seedSecret(e,t){await vn(["volume","create",e]),await vn(["run","--rm","-i","-v",`${e}:/run/target`,"alpine:3.21","sh","-c","umask 077; cat > /run/target/credential"],t)}async removeVolume(e){await vn(["volume","rm",e],void 0,!0)}async inspect(e){let t=await vn(["inspect",e],void 0,!0);if(t.code!==0)return;return JSON.parse(t.stdout)[0]}async run(e){await vn(["run",...e])}async exec(e,t,r){return(await vn(["exec","-i",e,...t],r)).stdout}async update(e,t){await vn(["update",...t,e])}async restart(e){await vn(["restart",e])}async remove(e){await vn(["rm","--force",e],void 0,!0)}async logs(e,t){let r=await vn(["logs","--tail",String(Math.min(2000,Math.max(1,t))),e],void 0,!0);return`${r.stdout}${r.stderr}`.slice(-262144)}async stats(e){let t=await vn(["stats","--no-stream","--format","{{json .}}",e],void 0,!0);if(t.code!==0||!t.stdout.trim())return{};let r=JSON.parse(t.stdout.trim());return{cpuPercent:String(r.CPUPerc??""),memoryUsage:String(r.MemUsage??""),memoryPercent:String(r.MemPerc??""),networkIo:String(r.NetIO??""),blockIo:String(r.BlockIO??""),pids:Number(r.PIDs??0)}}}var Tv={postgres:{image:"postgres:17-alpine",port:5432,dataPath:"/var/lib/postgresql/data"},mysql:{image:"mysql:8.4",port:3306,dataPath:"/var/lib/mysql"},mariadb:{image:"mariadb:11.7",port:3306,dataPath:"/var/lib/mysql"},redis:{image:"redis:7.4-alpine",port:6379,dataPath:"/data"},mongodb:{image:"mongo:8.0",port:27017,dataPath:"/data/db"}};function Gi(e,t="app"){let r=String(e??t);if(!/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(r))throw Error("Database identifiers must be letters, numbers, or underscores.");return r}function rs(e){if(!/^[a-z0-9][a-z0-9_.-]{1,62}$/i.test(e))throw Error("Runtime placement must be a valid container identifier.");return`tscloud-data-${e.toLowerCase()}`}function Av(e,t){let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)}function va(e){return e.Config?.Labels??{}}class st{runtime;backupRoot;constructor(e=new tm,t=A(process.cwd(),"backups","data")){this.runtime=e;this.backupRoot=t}async observe(e){let t=rs(e),r=await this.runtime.inspect(t);if(!r)throw Error(`Data container ${t} was not found.`);let n=va(r),i=await this.runtime.stats(t),o=r.NetworkSettings?.Ports??{},s=Object.values(o).flat().find(Boolean);return{providerId:t,status:r.State?.Status??"unknown",healthy:r.State?.Health?.Status??null,engine:n["ts-cloud.engine"]??null,engineVersion:n["ts-cloud.engine-version"]??null,username:n["ts-cloud.username"]??null,database:n["ts-cloud.database"]??null,endpoint:s?.HostIp||"127.0.0.1",port:s?.HostPort?Number(s.HostPort):null,image:r.Config?.Image??null,startedAt:r.State?.StartedAt??null,metrics:i}}async apply(e,t){let r=String(e.id),n=rs(r),i=String(e.engine);if(i==="libsql")throw Error("libSQL requires an explicitly configured runtime image.");let o=Tv[i];if(!o)throw Error(`Unsupported runtime data engine ${i}.`);if(!t)throw Error(`${i} requires a managed credential.`);if(e.publicExposure===!0)throw Error("Container public exposure requires an external reviewed firewall policy; direct publishing is refused.");let s=Gi(e.username),c=Gi(Av(e,"database")),l=`${n}-secret`,a=`${n}-data`,f=i==="redis"?`appendonly yes
 protected-mode yes
 requirepass ${t.replaceAll("\\","\\\\").replaceAll(`
 `,"")}
@@ -116,7 +116,7 @@ export type ConfigOf = Config
 `;r+=`| Variable | Type | Description | Example |
 `,r+=`|----------|------|-------------|----------|
 `;for(let n of e)r+=`| \`${n.key}\` | ${n.type} | ${n.description} | \`${n.example}\` |
-`;return r}}function VI(e,t,r={}){return _f(e,t,r,new WeakMap)}function _f(e,t,r,n){let{arrayMergeMode:i="replace",skipNullish:o=!1,customMerger:s}=r;if(t===null||t===void 0)return o?e:t;if(s){let c=s(e,t);if(c!==void 0)return c}if(Array.isArray(t)||Array.isArray(e))return Nf(e,t,i,n);if(!ci(t)||!ci(e))return t;return WI(e,t,r,n)}function Nf(e,t,r,n){if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(e)&&!Array.isArray(t))return t;if(Array.isArray(t)&&Array.isArray(e))switch(r){case"replace":return t;case"concat":return qI(e,t);case"smart":return JI(e,t,n);default:return t}return t}function qI(e,t){let r=[...t];for(let n of e)if(!r.some((i)=>ol(i,n)))r.push(n);return r}function JI(e,t,r){if(t.length===0)return e;if(e.length===0)return t;if(ci(t[0])&&ci(e[0]))return GI(e,t,r);if(t.every((n)=>typeof n==="string")&&e.every((n)=>typeof n==="string")){let n=[...t];for(let i of e)if(!n.includes(i))n.push(i);return n}return t}function GI(e,t,r){let n=[...t];for(let i of e){if(!ci(i)){n.push(i);continue}let o=["id","name","key","path","type"],s=!1;for(let c of o)if(c in i){if(n.find((a)=>ci(a)&&(c in a)&&a[c]===i[c])){s=!0;break}}if(!s)n.push(i)}return n}function WI(e,t,r,n){let i=t;if(ci(i)&&n.has(i))return n.get(i);let o={...e};if(ci(i))n.set(i,o);for(let s in i){if(!Object.prototype.hasOwnProperty.call(i,s))continue;let c=i[s],l=o[s];if(r.skipNullish&&(c===null||c===void 0))continue;if(c===null||c===void 0){o[s]=c;continue}if(ci(c)&&ci(l))o[s]=_f(l,c,r,n);else if(Array.isArray(c)||Array.isArray(l))o[s]=Nf(l,c,r.arrayMergeMode||"smart",n);else o[s]=c}return o}function $f(e,t,r="replace"){return VI(e,t,{arrayMergeMode:r==="replace"?"replace":"smart",skipNullish:!0})}function ol(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!ol(e[r],t[r]))return!1;return!0}if(ci(e)&&ci(t)){let r=Object.keys(e),n=Object.keys(t);if(r.length!==n.length)return!1;for(let i of r){if(!Object.prototype.hasOwnProperty.call(t,i))return!1;if(!ol(e[i],t[i]))return!1}return!0}return!1}function ci(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}class Mf{extensions=rf;async loadFromPath(e,t,r={}){let{arrayStrategy:n="replace",useCache:i=!0,cacheTtl:o,trackPerformance:s=!0,verbose:c=!1}=r;if(i){let a=jc.getWithFileCheck("file",e);if(a){if(c)console.log(`Configuration loaded from cache: ${e}`);return a}}let l=async()=>{if(!_c(e))return null;try{let a=`?t=${Date.now()}`,f=await import(e+a),T=f.default||f,D="default"in f,N=Object.keys(f).length>0;if(!D&&!N)throw new Yc(e,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof T!=="object"||T===null||Array.isArray(T))throw new Yc(e,Error("Configuration must export a valid object"),"unknown");let ee={config:$f(t,T,n),source:{type:"file",path:e,priority:100,timestamp:new Date}};if(i)jc.setWithFileCheck("file",ee,e,o);return ee}catch(a){throw a instanceof Error?os.configLoad(e,a):os.configLoad(e,Error(String(a)))}};if(s)return sl.track("loadFromPath",l,{path:e});return l()}async tryLoadFromPaths(e,t,r={}){for(let n of e)try{let i=await this.loadFromPath(n,t,r);if(i)return i}catch(i){if(i instanceof Error&&i.name==="ConfigLoadError")throw i;if(r.verbose)console.warn(`Failed to load config from ${n}:`,i)}return null}generateConfigPaths(e,t,r){return Uv({name:e,directory:t,alias:r})}generateNamePatterns(e,t){return nf({name:e,alias:t})}checkFileAccess(e){return zI(async()=>_c(e),{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(e,t,r){let n=[];if(!_c(e))return n;if(t||r){let i=this.generateNamePatterns(t||"",r);for(let o of i)for(let s of this.extensions){let c=Zm(e,`${o}${s}`);if(await this.checkFileAccess(c))n.push(c)}}else try{let{readdirSync:i}=await import("fs"),o=i(e);for(let s of o)if(this.looksLikeConfigFile(s)){let c=Zm(e,s);if(await this.checkFileAccess(c))n.push(c)}}catch{return[]}return n}looksLikeConfigFile(e){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((r)=>r.test(e))}async validateConfigFile(e){let t=[];try{if(!_c(e))return t.push("Configuration file does not exist"),t;let r=await import(e),n=r.default||r;if(n===void 0)t.push("Configuration file must export a default value or named exports");else if(typeof n!=="object"||n===null)t.push("Configuration must be an object");else if(Array.isArray(n))t.push("Configuration cannot be an array at the root level");if(e.endsWith(".json"))try{let{readFileSync:i}=await import("fs"),o=i(e,"utf8");JSON.parse(o)}catch(i){t.push(`Invalid JSON syntax: ${i}`)}}catch(r){t.push(`Failed to load configuration file: ${r}`)}return t}async getFileModificationTime(e){try{let{statSync:t}=await import("fs");return t(e).mtime}catch{return null}}async preloadConfigurations(e,t={}){let r=new Map;return await Promise.allSettled(e.map(async(n)=>{try{let i=await this.loadFromPath(n,{},t);if(i)r.set(n,i.config)}catch(i){if(t.verbose)console.warn(`Failed to preload ${n}:`,i)}})),r}}var KI=/^https?:\/\//;class Lf{async validateConfiguration(e,t,r={}){let{stopOnFirstError:n=!1,validateRequired:i=!0,validateTypes:o=!0,customRules:s=[],trackPerformance:c=!0,verbose:l=!1}=r,a=async()=>{let f=[],T=[],D={stopOnFirstError:n,validateRequired:i,validateTypes:o,customRules:s,trackPerformance:c,verbose:l};try{if(typeof t==="string")return await this.validateWithSchemaFile(e,t,D);else if(Array.isArray(t))return this.validateWithRules(e,[...t,...s],D);else return this.validateWithJSONSchema(e,t,D)}catch(N){return f.push({path:"",message:`Validation failed: ${N}`,rule:"system"}),{isValid:!1,errors:f,warnings:T}}};if(c)return await sl.track("validateConfiguration",a);return a()}async validateWithSchemaFile(e,t,r){try{if(!HI(t))throw new Xc(t,[{path:"",message:"Schema file does not exist"}]);let n=await import(t),i=n.default||n;if(Array.isArray(i))return this.validateWithRules(e,i,r);else return this.validateWithJSONSchema(e,i,r)}catch(n){throw new Xc(t,[{path:"",message:`Failed to load schema: ${n}`}])}}validateWithJSONSchema(e,t,r){let n=[],i=[];return this.validateObjectAgainstSchema(e,t,"",n,i,r),{isValid:n.length===0,errors:n,warnings:i}}validateObjectAgainstSchema(e,t,r,n,i,o){if(o.validateTypes&&t.type){let s=Array.isArray(e)?"array":typeof e,c=Array.isArray(t.type)?t.type:[t.type];if(!c.includes(s)){if(n.push({path:r,message:`Expected type ${c.join(" or ")}, got ${s}`,expected:c.join(" or "),actual:s,rule:"type"}),o.stopOnFirstError)return}}if(t.enum&&!t.enum.includes(e)){if(n.push({path:r,message:`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"}),o.stopOnFirstError)return}if(typeof e==="string"){if(t.minLength!==void 0&&e.length<t.minLength)n.push({path:r,message:`String length must be at least ${t.minLength}`,expected:`>= ${t.minLength}`,actual:e.length,rule:"minLength"});if(t.maxLength!==void 0&&e.length>t.maxLength)n.push({path:r,message:`String length must not exceed ${t.maxLength}`,expected:`<= ${t.maxLength}`,actual:e.length,rule:"maxLength"});if(t.pattern){if(!new RegExp(t.pattern).test(e))n.push({path:r,message:`String does not match pattern ${t.pattern}`,expected:t.pattern,actual:e,rule:"pattern"})}}if(typeof e==="number"){if(t.minimum!==void 0&&e<t.minimum)n.push({path:r,message:`Value must be at least ${t.minimum}`,expected:`>= ${t.minimum}`,actual:e,rule:"minimum"});if(t.maximum!==void 0&&e>t.maximum)n.push({path:r,message:`Value must not exceed ${t.maximum}`,expected:`<= ${t.maximum}`,actual:e,rule:"maximum"})}if(Array.isArray(e)&&t.items)for(let s=0;s<e.length;s++){let c=r?`${r}[${s}]`:`[${s}]`;if(this.validateObjectAgainstSchema(e[s],t.items,c,n,i,o),o.stopOnFirstError&&n.length>0)return}if(e&&typeof e==="object"&&!Array.isArray(e)){let s=e;if(o.validateRequired&&t.required){for(let c of t.required)if(!(c in s)){if(n.push({path:r?`${r}.${c}`:c,message:`Missing required property '${c}'`,expected:"required",rule:"required"}),o.stopOnFirstError)return}}if(t.properties){for(let[c,l]of Object.entries(t.properties))if(c in s){let a=r?`${r}.${c}`:c;if(this.validateObjectAgainstSchema(s[c],l,a,n,i,o),o.stopOnFirstError&&n.length>0)return}}if(t.additionalProperties===!1){let c=new Set(Object.keys(t.properties||{}));for(let l of Object.keys(s))if(!c.has(l))i.push({path:r?`${r}.${l}`:l,message:`Additional property '${l}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(e,t,r){let n=[],i=[];for(let o of t)try{let s=this.getValueByPath(e,o.path),c=this.validateWithRule(s,o,o.path);if(n.push(...c),r.stopOnFirstError&&n.length>0)break}catch(s){n.push({path:o.path,message:`Rule validation failed: ${s}`,rule:"system"})}return{isValid:n.length===0,errors:n,warnings:i}}validateWithRule(e,t,r){let n=[];if(t.required&&(e===void 0||e===null))return n.push({path:r,message:t.message||`Property '${r}' is required`,expected:"required",rule:"required"}),n;if(e===void 0||e===null)return n;if(t.type){let i=Array.isArray(e)?"array":typeof e;if(i!==t.type)n.push({path:r,message:t.message||`Expected type ${t.type}, got ${i}`,expected:t.type,actual:i,rule:"type"})}if(t.min!==void 0){let i=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(i<t.min)n.push({path:r,message:t.message||`Value must be at least ${t.min}`,expected:`>= ${t.min}`,actual:i,rule:"min"})}if(t.max!==void 0){let i=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(i>t.max)n.push({path:r,message:t.message||`Value must not exceed ${t.max}`,expected:`<= ${t.max}`,actual:i,rule:"max"})}if(t.pattern&&typeof e==="string"){if(!t.pattern.test(e))n.push({path:r,message:t.message||`Value does not match pattern ${t.pattern}`,expected:t.pattern.toString(),actual:e,rule:"pattern"})}if(t.enum&&!t.enum.includes(e))n.push({path:r,message:t.message||`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"});if(t.validator){let i=t.validator(e);if(i)n.push({path:r,message:t.message||i,rule:"custom"})}return n}getValueByPath(e,t){if(!t)return e;let r=t.split("."),n=e;for(let i of r)if(n&&typeof n==="object"&&i in n)n=n[i];else return;return n}generateRulesFromInterface(e){let t=[],r=e.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let n of r){let[,i,o,s]=n;t.push({path:i,required:!o,type:this.mapTypeScriptType(s)})}return t}mapTypeScriptType(e){switch(e.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:KI},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}var bi=new rd("bunfig",{showTags:!0});function QI(e){if(!e)return"";let t=Array.isArray(e)?e.filter(Boolean):[e];if(t.length===0)return"";if(t.length===1)return` or alias "${t[0]}"`;return` or aliases ${t.map((r)=>`"${r}"`).join(", ")}`}class Bf{fileLoader=new Mf;envProcessor=new fl;validator=new Lf;async loadConfig(e){let t=Date.now(),{cache:r,performance:n,schema:i,validate:o,...s}=e;try{if(r?.enabled){let l=this.checkCache(s.name||"",s);if(l)return l}let c;try{c=await this.loadConfigurationStrategies(s,!0,r)}catch(l){if(s.configFile)throw l;let a=s.__strictErrorHandling;if(l instanceof Error&&l.name==="ConfigNotFoundError"){if(a)throw l;c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:[`No configuration file found for "${s.name||"config"}", using defaults with environment variables`]}}else if(l instanceof Error&&l.name==="ConfigLoadError"){let f=l.message.includes("EACCES")||l.message.includes("EPERM")||l.message.includes("permission denied"),T=!f&&(l.message.includes("syntax")||l.message.includes("Expected")||l.message.includes("Unexpected")||l.message.includes("BuildMessage")||l.message.includes("errors building")),D=l.message.includes("Configuration must export a valid object")||l.message.includes("Configuration file is empty and exports nothing");if(a&&(D||f))throw l;if(T&&(!a||!D))c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!a)c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:[`Configuration loading error, using defaults: ${l.message}`]};else throw l}else c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${l instanceof Error?l.message:String(l)}`]}}if(i||o)await this.validateConfiguration(c.config,i,o,s.name);if(r?.enabled&&c)this.cacheResult(s.name||"",c,r,s);if(n?.enabled){let l={operation:"loadConfig",duration:Date.now()-t,configName:s.name,timestamp:new Date};if(n.onMetrics)n.onMetrics(l);if(n.slowThreshold&&l.duration>n.slowThreshold)bi.warn(`Slow configuration loading detected: ${l.duration}ms for ${s.name}`);c.metrics=l}return c}catch(c){if(c instanceof Error&&c.name==="ConfigNotFoundError")throw c;let l=Date.now()-t;throw bi.error(`Configuration loading failed after ${l}ms:`,[c instanceof Error?c:Error(String(c))]),c}}async loadConfigurationStrategies(e,t=!1,r){let{name:n="",alias:i,configFile:o,cwd:s,configDir:c,defaultConfig:l,checkEnv:a=!0,arrayStrategy:f="replace",verbose:T=!1}=e,D=s||Zc.cwd(),N=[];if(o){let he=_i(D,o);N.push(he);let te=a?Ia(n,l,T):l,xe=await this.fileLoader.tryLoadFromPaths([he],te,{arrayStrategy:f,verbose:T,cacheTtl:r?.ttl,useCache:!r?.ttl||r.ttl>100});if(!xe)throw os.configNotFound(n||o,N,i);if(T)bi.success(`Configuration loaded from explicit path: ${he}`);return this.finalizeResult(xe,N,a,n,T)}let W=await this.loadLocalConfiguration(n,i,D,c,l,f,T,a,r);if(W)return N.push(...this.getLocalSearchPaths(n,i,D,c)),this.finalizeResult(W,N,a,n,T);let Y=await this.loadHomeConfiguration(n,i,l,f,T,a);if(Y)return N.push(...this.getHomeSearchPaths(n,i)),this.finalizeResult(Y,N,a,n,T);let ee=await this.loadPackageJsonConfiguration(n,i,D,l,f,T,a);if(ee)return N.push(_i(D,"package.json")),this.finalizeResult(ee,N,a,n,T);if(N.push(...this.getAllSearchPaths(n,i,D,c)),t)throw os.configNotFound(n,N,i);return{...await this.applyEnvironmentVariables(n,l,a,T),warnings:[`No configuration file found for "${n}"${QI(i)}, using defaults with environment variables`]}}async loadLocalConfiguration(e,t,r,n,i,o,s,c,l){let a=c?Ia(e,i,s):i,f=this.getLocalDirectories(r,n);for(let T of f){if(s)bi.info(`Searching for configuration in: ${T}`);let D=this.fileLoader.generateConfigPaths(e,T,t),N=await this.fileLoader.tryLoadFromPaths(D,a,{arrayStrategy:o,verbose:s,cacheTtl:l?.ttl,useCache:!l?.ttl||l.ttl>100});if(N){if(s)bi.success(`Configuration loaded from: ${N.source.path}`);return N}}return null}async loadHomeConfiguration(e,t,r,n,i,o){if(!e)return null;let s=o?Ia(e,r,i):r,c=[_i(Ls(),".config",e),_i(Ls(),".config"),Ls()];for(let l of c){if(i)bi.info(`Checking home directory: ${l}`);let a=this.fileLoader.generateConfigPaths(e,l,t),f=await this.fileLoader.tryLoadFromPaths(a,s,{arrayStrategy:n,verbose:i});if(f){if(i)bi.success(`Configuration loaded from home directory: ${f.source.path}`);return f}}return null}async loadPackageJsonConfiguration(e,t,r,n,i,o,s){let c=s?Ia(e,n,o):n;try{let l=_i(r,"package.json");if(!Vv(l))return null;let a={};try{a=JSON.parse(qv(l,"utf8"))}catch(D){if(o)bi.warn("Failed to parse package.json:",[D instanceof Error?D:Error(String(D))]);return null}let f=a[e],T=e;if(!f&&t){let D=Array.isArray(t)?t:[t];for(let N of D){if(!N)continue;if(a[N]){f=a[N],T=N;break}}}if(f&&typeof f==="object"&&!Array.isArray(f)){if(o)bi.success(`Configuration loaded from package.json: ${T}`);return{config:$f(c,f,i),source:{type:"package.json",path:l,priority:30,timestamp:new Date}}}}catch(l){if(o)bi.warn("Failed to load package.json:",[l instanceof Error?l:Error(String(l))])}return null}async applyEnvironmentVariables(e,t,r,n){if(!r||!e||typeof t!=="object"||t===null||Array.isArray(t))return{config:t,source:{type:"default",priority:10,timestamp:new Date}};return{config:Ia(e,t,n),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(e,t,r,n,i){return{config:e.config,source:e.source,path:e.source.path}}async validateConfiguration(e,t,r,n){let i=[];if(r){let o=r(e);if(o)i.push(...o)}if(t){let o=await this.validator.validateConfiguration(e,t);if(!o.isValid)i.push(...o.errors.map((s)=>s.path?`${s.path}: ${s.message}`:s.message))}if(i.length>0)throw os.configValidation(n||"unknown",i,n)}checkCache(e,t){let r=this.generateCacheKey(e,t);return jc.get(r)||null}cacheResult(e,t,r,n){let i=this.generateCacheKey(e,n);jc.set(i,t,void 0,r.ttl)}generateCacheKey(e,t){let r=[e];if(t.alias){let n=Array.isArray(t.alias)?t.alias.join(","):t.alias;r.push(`alias:${n}`)}if(t.cwd)r.push(`cwd:${t.cwd}`);if(t.configFile)r.push(`configFile:${t.configFile}`);if(t.configDir)r.push(`configDir:${t.configDir}`);if("checkEnv"in t)r.push(`checkEnv:${t.checkEnv}`);return r.join("|")}getLocalDirectories(e,t){return zv({cwd:e,configDir:t})}getAllSearchPaths(e,t,r,n){let i=[];return i.push(...this.getLocalSearchPaths(e,t,r,n)),i.push(...this.getHomeSearchPaths(e,t)),i.push(_i(r,"package.json")),i}getLocalSearchPaths(e,t,r,n){let i=this.getLocalDirectories(r,n),o=[];for(let s of i)o.push(...this.fileLoader.generateConfigPaths(e,s,t));return o}getHomeSearchPaths(e,t){if(!e)return[];let r=[_i(Ls(),".config",e),_i(Ls(),".config"),Ls()],n=[];for(let i of r)n.push(...this.fileLoader.generateConfigPaths(e,i,t));return n}async loadConfigWithResult(e){return this.loadConfig(e)}}var Wu=new Bf;async function jf(e){let t="defaultConfig"in e&&e.defaultConfig!==void 0?e.defaultConfig:{},r="cache"in e||"performance"in e||"schema"in e||"validate"in e;try{let n;if(r)n=await Wu.loadConfig(e);else n=await Wu.loadConfig({...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}});return n?.config??t}catch(n){if(e.configFile)throw n;let i=n instanceof Error?n.name:"UnknownError",o=n instanceof Error?n.message:String(n);if(!(i==="ConfigNotFoundError"||i==="ConfigLoadError"||i==="ConfigValidationError"||o.includes("config"))&&e.verbose)bi.warn("Unexpected error loading config, using defaults:",[n instanceof Error?n:Error(String(n))]);let c=r?{...e,defaultConfig:t}:{...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in e?e.checkEnv!==!1:!0)return(await Wu.applyEnvironmentVariables(c.name||"",t,!0,c.verbose||!1))?.config??t;return t}}function Ia(e,t,r=!1){let n=new fl,i=e.toUpperCase().replace(/[^A-Z0-9]/g,"_");function o(s,c=[]){let l={...s};for(let[a,f]of Object.entries(s)){let T=[...c,a],D=[`${i}_${T.join("_").toUpperCase()}`,`${i}_${T.map((Y)=>Y.toUpperCase()).join("")}`,`${i}_${T.map((Y)=>Y.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],N,W;for(let Y of D)if(N=Zc.env[Y],N!==void 0){W=Y;break}if(N!==void 0&&W)if(typeof f==="boolean")l[a]=["true","1","yes"].includes(N.toLowerCase());else if(typeof f==="number"){let Y=Number(N);if(!Number.isNaN(Y))l[a]=Y}else if(Array.isArray(f))try{l[a]=JSON.parse(N)}catch{l[a]=N.split(",").map((Y)=>Y.trim())}else l[a]=N;else if(f&&typeof f==="object"&&!Array.isArray(f))l[a]=o(f,T)}return l}return o(t)}var aO=_i(Zc.cwd(),"config"),cO=_i(Zc.cwd(),"src/generated");var Rn={project:{name:"my-project",slug:"my-project",region:"us-east-1"},environments:{production:{type:"production"}}},as=null;function ZI(e){return e.project?.slug===Rn.project?.slug&&Object.keys(e.environments??{}).length===1&&!!e.environments?.production}async function eC(){let e=[Ff(process.cwd(),"config","cloud.ts"),Ff(process.cwd(),"config","cloud.js")];for(let t of e){if(!YI(t))continue;let r=await import(`${XI(t).href}?t=${Date.now()}`),n=r.tsCloud??r.default?.tsCloud??r.default??r.cloud??r.config;if(n)return n}return null}async function tC(){if(!as){if(as=await jf({name:"cloud",defaultConfig:Rn}),ZI(as))as=await eC()??as;ea(as.stateDir)}return as}var Bi=tC;var rC=async(e)=>{let t=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),[r,n,i]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:n,stderr:i}};class Mr{async scan(e,t){return Ki(e,t)}async exec(e,t){if(e.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return rC(["ssh","-p",String(e.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${e.sshUser}@${e.endpoint}`,t])}}var nC=ur,iC=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class it{provider;transport;discoverer;constructor(e,t=new Mr,r){this.provider=e;this.transport=t;this.discoverer=r}discover(e){return this.discoverer?.(e)??Promise.resolve([])}async test(e){try{let t=await this.transport.scan(e.endpoint,e.sshPort);return{reachable:!0,hostKeyAlgorithm:t.algorithm,hostKeyFingerprint:nC(t.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(e){let t=await this.transport.exec(e,iC);if(t.code!==0)throw Error(`Fleet validation failed: ${t.stderr.trim()||t.code}`);try{return JSON.parse(t.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(e,t){let r=await this.transport.exec(e,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${t.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function Uf(e,t){return{"fleet.bootstrap":async(r)=>{let n=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},i=e.get(String(n.serverId??""));if(!i)throw Error("Queued fleet server was not found.");let o=t.find((l)=>l.provider===i.provider);if(!o)throw Error(`No ${i.provider} fleet driver is configured.`);let s=Array.isArray(n.steps)?n.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),i.trustState!=="pinned"||!i.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let c=await o.bootstrap(i,s);return e.update(i.id,{bootstrapVersion:c.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:i.id,bootstrapVersion:c.version,steps:s.length}}}}var Ni=(e)=>e==null?void 0:String(e),cs=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},hl=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),resourceId:String(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:Ni(e.provider_id),region:Ni(e.region),zone:Ni(e.zone),endpoint:String(e.endpoint),sshUser:String(e.ssh_user),sshPort:Number(e.ssh_port),credentialRef:String(e.credential_ref),hostKeyAlgorithm:Ni(e.host_key_algorithm),hostKeyFingerprint:Ni(e.host_key_fingerprint),pendingHostKey:Ni(e.pending_host_key),roles:cs(e.roles,[]),labels:cs(e.labels,{}),taints:cs(e.taints,[]),capacity:cs(e.capacity,{}),usage:cs(e.usage,{}),capabilities:cs(e.capabilities,{}),status:String(e.status),trustState:String(e.trust_state),validation:cs(e.validation,void 0),bootstrapVersion:Ni(e.bootstrap_version),heartbeatAt:Ni(e.heartbeat_at),lastSeenAt:Ni(e.last_seen_at),archivedAt:Ni(e.archived_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class De{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}get(e){let t=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(e);return t?hl(t):void 0}list(e,t=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(e).map(hl).filter((r)=>t||r.status!=="archived")}findProvider(e,t,r){let n=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(e,t,r);return n?hl(n):void 0}create(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.resourceId,e.name,e.provider,e.providerId??null,e.region??null,e.zone??null,e.endpoint,e.sshUser,e.sshPort,e.credentialRef,e.hostKeyAlgorithm??null,e.hostKeyFingerprint??null,e.pendingHostKey??null,JSON.stringify(e.roles),JSON.stringify(e.labels),JSON.stringify(e.taints),JSON.stringify(e.capacity),JSON.stringify(e.usage),JSON.stringify(e.capabilities),e.status,e.trustState,JSON.stringify(e.validation??{}),e.bootstrapVersion??null,e.heartbeatAt??null,e.lastSeenAt??null,e.archivedAt??null,r,r]),this.get(t)}update(e,t){let r=this.get(e);if(!r)throw Error("Server was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[n.name,n.providerId??null,n.region??null,n.zone??null,n.endpoint,n.sshUser,n.sshPort,n.credentialRef,n.hostKeyAlgorithm??null,n.hostKeyFingerprint??null,n.pendingHostKey??null,JSON.stringify(n.roles),JSON.stringify(n.labels),JSON.stringify(n.taints),JSON.stringify(n.capacity),JSON.stringify(n.usage),JSON.stringify(n.capabilities),n.status,n.trustState,JSON.stringify(n.validation??{}),n.bootstrapVersion??null,n.heartbeatAt??null,n.lastSeenAt??null,n.archivedAt??null,i,e]),this.get(e)}}var oC=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class Pn{store;drivers;now;queue;constructor(e,t,r,n=()=>new Date){this.store=e;this.drivers=t;this.now=n;this.queue=r??new S(e.control)}driver(e){let t=this.drivers.find((r)=>r.provider===e);if(!t)throw Error(`No ${e} fleet driver is configured.`);return t}enroll(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Server name is invalid.");if(!oC.test(e.endpoint)||e.sshUser==="root"||!e.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let t=e.providerId?this.store.findProvider(e.organizationId,e.provider,e.providerId):void 0;if(t)return this.store.update(t.id,{endpoint:e.endpoint,region:e.region,zone:e.zone});let r=this.store.control.createResource({projectId:e.projectId,kind:"server",slug:e.name,name:e.name,provider:e.provider,providerId:e.providerId}),n=this.driver(e.provider);return this.store.create({...e,resourceId:r.id,sshPort:e.sshPort??22,labels:e.labels??{},taints:[],capacity:{},usage:{},capabilities:n.capabilities(),status:"pending",trustState:"unverified"})}async test(e){let t=this.store.get(e);if(!t)throw Error("Server was not found.");let r=await this.driver(t.provider).test(t);if(!r.reachable)return this.store.update(e,{status:"unreachable"});if(t.hostKeyFingerprint&&t.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(e,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(e,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(e,t){let r=this.store.get(e);if(!r||r.pendingHostKey!==t)throw Error("Pending host key does not match.");return this.store.update(e,{hostKeyFingerprint:t,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(e){let t=this.store.get(e);if(!t||t.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(t.provider).validate(t),n=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))n.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let s of["curl","tar"])if(!r.tools?.[s])n.push({code:`tool.${s}`,severity:"error",message:`${s} is missing.`,remediation:`Install ${s} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)n.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)n.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let i={valid:!n.some((s)=>s.severity==="error"),facts:r,findings:n,validatedAt:this.now().toISOString(),validatorVersion:"1"},o={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(e,{validation:i,capacity:o,status:i.valid?"ready":"degraded"})}bootstrap(e,t=!1){let r=this.store.get(e);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let n=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!t)return{preview:!0,steps:n};let i=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:e,steps:n},lockKey:`server:${e}`,providerKey:r.provider}).operation;return{preview:!1,steps:n,operation:i}}heartbeat(e,t){let r=this.store.get(e);if(!r)throw Error("Server was not found.");let n=this.now().toISOString();return this.store.update(e,{usage:t.usage,capabilities:t.capabilities??r.capabilities,heartbeatAt:n,lastSeenAt:n,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(e,t=!1){return this.store.update(e,{status:t?"drained":"draining"})}uncordon(e){return this.store.update(e,{status:"ready"})}archive(e,t){let r=this.store.get(e);if(!r||t!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(e,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as yl,createPublicKey as qf,verify as sC}from"node:crypto";function Pa(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(Pa).join(",")}]`;return`{${Object.keys(e).sort().map((t)=>`${JSON.stringify(t)}:${Pa(e[t])}`).join(",")}}`}var Jf=(e)=>yl("sha256").update(Pa(e)).digest("hex"),nd=(e)=>yl("sha256").update(Pa(e)).digest("hex"),Gf=(e)=>yl("sha256").update(qf(e).export({type:"spki",format:"der"})).digest("hex");function Wf(e,t,r){try{return sC(null,Buffer.from(Pa(e)),qf(r),Buffer.from(t,"base64"))}catch{return!1}}var zf=(e)=>e.replace(/^v/,"").split(/[.-]/).slice(0,3).map((t)=>Number(t)||0),Vf=(e,t)=>{let r=zf(e),n=zf(t);for(let i=0;i<3;i++){let o=(r[i]??0)-(n[i]??0);if(o)return o}return 0};function Hf(e,t){let r=[];if(t.schemaVersion<e.minimumSchema)r.push(`schema ${t.schemaVersion} is below ${e.minimumSchema}`);if(t.schemaVersion>e.maximumSchema)r.push(`schema ${t.schemaVersion} is above ${e.maximumSchema}`);if(e.minimumVersion&&Vf(t.currentVersion,e.minimumVersion)<0)r.push(`platform ${t.currentVersion} is below ${e.minimumVersion}`);if(Vf(e.version,t.currentVersion)<=0)r.push(`version ${e.version} is not newer than ${t.currentVersion}`);if(!e.artifacts.some((n)=>n.platform===t.platform&&n.architecture===t.architecture))r.push(`no artifact for ${t.platform}/${t.architecture}`);return{compatible:r.length===0,reasons:r}}var to=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},_r=(e)=>e==null?void 0:String(e),aC=(e)=>({id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),algorithm:"ed25519",publicKeyPem:String(e.public_key_pem),fingerprint:String(e.fingerprint),revokedAt:_r(e.revoked_at),createdAt:String(e.created_at)}),Kf=(e)=>({id:String(e.id),organizationId:String(e.organization_id),version:String(e.version),channel:String(e.channel),publishedAt:String(e.published_at),keyId:String(e.key_id),digest:String(e.digest),document:to(e.document,{}),signature:String(e.signature),verificationStatus:String(e.verification_status),compatibility:to(e.compatibility,{compatible:!1,reasons:[]}),createdAt:String(e.created_at)}),Qf=(e)=>({id:String(e.id),projectId:String(e.project_id),name:String(e.name),schedule:String(e.schedule),timezone:String(e.timezone),durationMinutes:Number(e.duration_minutes),allowedOperations:to(e.allowed_operations,[]),requireApproval:Number(e.require_approval)===1,enabled:Number(e.enabled)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Yf=(e)=>({id:String(e.id),projectId:String(e.project_id),manifestId:String(e.manifest_id),windowId:_r(e.window_id),fromVersion:String(e.from_version),strategy:String(e.strategy),batchSize:Number(e.batch_size),healthGate:to(e.health_gate,{}),status:String(e.status),currentStage:_r(e.current_stage),backupId:_r(e.backup_id),approvedBy:_r(e.approved_by),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),bl=(e)=>({id:String(e.id),campaignId:String(e.campaign_id),serverId:_r(e.server_id),target:String(e.target),cohort:Number(e.cohort),previousVersion:String(e.previous_version),status:String(e.status),evidence:to(e.evidence,{}),error:_r(e.error),startedAt:_r(e.started_at),finishedAt:_r(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Xf=(e)=>({id:String(e.id),projectId:String(e.project_id),kind:String(e.kind),criteria:to(e.criteria,{}),candidates:to(e.candidates,[]),candidateDigest:String(e.candidate_digest),estimatedBytes:Number(e.estimated_bytes),status:String(e.status),confirmation:_r(e.confirmation),expiresAt:String(e.expires_at),result:to(e.result,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Zf=(e)=>({id:String(e.id),projectId:String(e.project_id),backupPolicyId:_r(e.backup_policy_id),recoveryPointId:_r(e.recovery_point_id),topologyId:_r(e.topology_id),scenario:String(e.scenario),isolatedTarget:String(e.isolated_target),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),status:String(e.status),operationId:_r(e.operation_id),evidence:to(e.evidence,{}),measuredRpoMinutes:e.measured_rpo_minutes==null?void 0:Number(e.measured_rpo_minutes),measuredRtoMinutes:e.measured_rto_minutes==null?void 0:Number(e.measured_rto_minutes),cleanupVerified:Number(e.cleanup_verified)===1,error:_r(e.error),startedAt:_r(e.started_at),finishedAt:_r(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class _n{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}addTrustedKey(e){let t=this.id(),r=this.now().toISOString(),n=Gf(e.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[t,e.organizationId,e.name,e.publicKeyPem,n,r]),this.key(t)}key(e){let t=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(e);return t?aC(t):void 0}revokeKey(e){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),e]),this.key(e)}importManifest(e){let t=this.key(e.keyId);if(!t||t.organizationId!==e.organizationId)throw Error("Trusted update key was not found.");if(t.revokedAt)throw Error("Update signing key is revoked.");if(!Wf(e.document,e.signature,t.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=Hf(e.document,e.current),n=Jf(e.document),i=this.id(),o=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[i,e.organizationId,e.document.version,e.document.channel,new Date(e.document.publishedAt).toISOString(),e.keyId,n,JSON.stringify(e.document),e.signature,JSON.stringify(r),o]),this.manifest(i)}manifest(e){let t=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(e);return t?Kf(t):void 0}manifests(e){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(e).map(Kf)}createWindow(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[t,e.projectId,e.name,e.schedule,e.timezone,e.durationMinutes,JSON.stringify(e.allowedOperations),e.requireApproval===!1?0:1,r,r]),this.window(t)}window(e){let t=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(e);return t?Qf(t):void 0}windows(e){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(e).map(Qf)}createCampaign(e){return this.control.transaction(()=>{let t=this.manifest(e.manifestId);if(!t?.compatibility.compatible||t.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!e.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),n=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,e.projectId,e.manifestId,e.windowId??null,e.fromVersion,e.strategy,e.batchSize,JSON.stringify(e.healthGate),e.backupId,e.approvedBy??null,n,n]),e.targets.forEach((i,o)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,i.serverId??null,i.target,e.strategy==="canary"?o===0?0:1+Math.floor((o-1)/e.batchSize):Math.floor(o/e.batchSize),i.previousVersion,n,n])),this.campaign(r)})}campaign(e){let t=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(e);return t?Yf(t):void 0}campaigns(e){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(e).map(Yf)}targets(e){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(e).map(bl)}updateCampaign(e,t){let r=this.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let n={...r,...t};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[n.status,n.currentStage??null,this.now().toISOString(),e]),this.campaign(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e);if(!r)throw Error("Upgrade target was not found.");let n={...bl(r),...t};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[n.status,JSON.stringify(n.evidence),n.error??null,n.startedAt??null,n.finishedAt??null,this.now().toISOString(),e]),bl(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e))}createCleanup(e){let t=[...e.candidates].sort((s,c)=>s.id.localeCompare(c.id)),r=nd(t),n=this.id(),i=this.now().toISOString(),o=new Date(this.now().getTime()+(e.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[n,e.projectId,e.kind,JSON.stringify(e.criteria),JSON.stringify(t),r,t.reduce((s,c)=>s+c.bytes,0),o,i,i]),this.cleanup(n)}cleanup(e){let t=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(e);return t?Xf(t):void 0}cleanups(e){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(e).map(Xf)}updateCleanup(e,t){let r=this.cleanup(e);if(!r)throw Error("Cleanup plan was not found.");let n={...r,...t};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[n.status,n.confirmation??null,JSON.stringify(n.result),this.now().toISOString(),e]),this.cleanup(e)}createDrill(e){if(!/^isolated:\/\//.test(e.isolatedTarget))throw Error("DR drills require an isolated target.");let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[t,e.projectId,e.backupPolicyId??null,e.recoveryPointId??null,e.topologyId??null,e.scenario,e.isolatedTarget,e.expectedRpoMinutes,e.expectedRtoMinutes,r,r]),this.drill(t)}drill(e){let t=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(e);return t?Zf(t):void 0}drills(e){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(e).map(Zf)}updateDrill(e,t){let r=this.drill(e);if(!r)throw Error("DR drill was not found.");let n={...r,...t};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[n.status,n.operationId??null,JSON.stringify(n.evidence),n.measuredRpoMinutes??null,n.measuredRtoMinutes??null,n.cleanupVerified?1:0,n.error??null,n.startedAt??null,n.finishedAt??null,this.now().toISOString(),e]),this.drill(e)}}function cC(e,t=new Date){if(!e.enabled)return!1;let r=new Date(e.schedule);if(!Number.isNaN(r.getTime()))return t>=r&&t.getTime()<=r.getTime()+e.durationMinutes*60000;let n=/^(\d{2}):(\d{2})$/.exec(e.schedule);if(!n)return!1;let i=new Intl.DateTimeFormat("en-US",{timeZone:e.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(t),o=Number(i.find((c)=>c.type==="hour")?.value)*60+Number(i.find((c)=>c.type==="minute")?.value),s=Number(n[1])*60+Number(n[2]);return o>=s&&o<s+e.durationMinutes}class On{store;now;queue;constructor(e,t,r=()=>new Date){this.store=e;this.now=r;this.queue=t??new S(e.control)}enqueueCampaign(e,t={}){let r=this.store.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let n=r.windowId?this.store.window(r.windowId):void 0;if(n&&!n.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(n&&!t.overrideWindow&&!cC(n,this.now()))throw Error("Upgrade is outside its maintenance window.");if(n?.requireApproval&&!t.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let i=this.queue.enqueue({projectId:r.projectId,actorId:t.approvedBy,kind:"maintenance.upgrade",input:{campaignId:e},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(e,{status:"queued"}),operation:i}}async previewCleanup(e,t){let r=t.find((n)=>n.kind===e.kind);if(!r)throw Error(`No ${e.kind} cleanup driver is configured.`);return this.store.createCleanup({...e,candidates:await r.discover(e.criteria)})}enqueueCleanup(e,t){let r=this.store.cleanup(e);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let n=`DELETE ${r.candidates.length} ${r.kind}`;if(t!==n)throw Error(`Exact confirmation ${n} is required.`);let i=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:e},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(e,{status:"approved",confirmation:t}),operation:i}}enqueueDrill(e){let t=this.store.drill(e);if(!t||t.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.drill",input:{drillId:e},lockKey:`drill:${t.scenario}:${t.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(e,{status:"queued",operationId:r.id}),operation:r}}}var Sl=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function eh(e){return{"maintenance.upgrade":async(i)=>{let o=e.store.campaign(String(Sl(i.operation.input).campaignId??""));if(!o||!e.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let s=e.store.manifest(o.manifestId);if(!s?.compatibility.compatible||s.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let c=s.document.artifacts.find((a)=>a.platform===process.platform&&a.architecture===process.arch)??s.document.artifacts[0];if(!c)throw Error("No update artifact matches this platform.");e.store.updateCampaign(o.id,{status:"running",currentStage:"preflight"});let l=[];try{for(let a of[...new Set(e.store.targets(o.id).map((f)=>f.cohort))].sort((f,T)=>f-T)){e.store.updateCampaign(o.id,{currentStage:`cohort:${a}`});for(let f of e.store.targets(o.id).filter((T)=>T.cohort===a)){i.throwIfCancellationRequested(),i.checkpoint(`download:${f.target}`,"Downloading signed platform artifact."),e.store.updateTarget(f.id,{status:"downloading",startedAt:new Date().toISOString()});let T=await e.platform.download({target:f,artifact:c,signal:i.signal});if(T.sha256!==c.sha256)throw Error(`Artifact checksum mismatch for ${f.target}.`);i.checkpoint(`install:${f.target}`,"Installing verified artifact."),e.store.updateTarget(f.id,{status:"installing"}),await e.platform.install({target:f,path:T.path,version:s.version,signal:i.signal}),l.push(f);let D=await e.platform.health({target:f,gate:o.healthGate});if(!D.healthy)throw Error(`Upgrade health gate failed for ${f.target}.`);e.store.updateTarget(f.id,{status:"healthy",evidence:D.evidence,finishedAt:new Date().toISOString()})}}return e.store.updateCampaign(o.id,{status:"succeeded",currentStage:void 0}),{campaignId:o.id,version:s.version,targets:l.length}}catch(a){e.store.updateCampaign(o.id,{status:"rolling_back",currentStage:"rollback"});for(let f of l.reverse())e.store.updateTarget(f.id,{status:"rolling_back"}),await e.platform.rollback({target:f,version:f.previousVersion,signal:i.signal}),e.store.updateTarget(f.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw e.store.updateCampaign(o.id,{status:"rolled_back",currentStage:void 0}),a}},"maintenance.cleanup":async(i)=>{let o=e.store.cleanup(String(Sl(i.operation.input).planId??""));if(!o||o.status!=="approved")throw Error("Approved cleanup plan was not found.");if(nd([...o.candidates].sort((f,T)=>f.id.localeCompare(T.id)))!==o.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let s=e.cleanup?.find((f)=>f.kind===o.kind);if(!s)throw Error(`No ${o.kind} cleanup driver is configured.`);e.store.updateCleanup(o.id,{status:"running"});let c=[],l=[];for(let f of o.candidates){i.throwIfCancellationRequested();try{await s.remove(f),c.push(f.id)}catch(T){l.push({id:f.id,error:T instanceof Error?T.message:String(T)})}}let a=l.length?c.length?"partial":"failed":"succeeded";if(e.store.updateCleanup(o.id,{status:a,result:{removed:c,failed:l,reclaimedBytes:o.candidates.filter((f)=>c.includes(f.id)).reduce((f,T)=>f+T.bytes,0)}}),l.length)throw Error(`Cleanup failed for ${l.length} candidate(s).`);return{planId:o.id,removed:c.length,reclaimedBytes:o.estimatedBytes}},"maintenance.drill":async(i)=>{let o=e.store.drill(String(Sl(i.operation.input).drillId??""));if(!o)throw Error("DR drill was not found.");let s=e.recovery?.find((T)=>T.scenario===o.scenario);if(!s)throw Error(`No ${o.scenario} recovery driver is configured.`);let c=new Date;e.store.updateDrill(o.id,{status:"restoring",startedAt:c.toISOString()});let l=o.isolatedTarget,a={},f={};try{i.checkpoint("restore","Restoring into isolated drill target.");let T=await s.restore({drill:o,signal:i.signal});if(!T.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");l=T.target,a=T.evidence;let D=(c.getTime()-new Date(T.recoveryPointAt).getTime())/60000;e.store.updateDrill(o.id,{status:"verifying",measuredRpoMinutes:D,evidence:{restore:a}}),i.checkpoint("verify","Running recovery health checks without production traffic.");let N=await s.verify({drill:o,target:l});f=N.evidence;let W=(Date.now()-c.getTime())/60000;if(!N.healthy||D>o.expectedRpoMinutes||W>o.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");e.store.updateDrill(o.id,{measuredRpoMinutes:D,measuredRtoMinutes:W,evidence:{restore:a,verify:f}})}catch(T){throw e.store.updateDrill(o.id,{status:"failed",error:T instanceof Error?T.message:String(T),evidence:{restore:a,verify:f}}),T}finally{e.store.updateDrill(o.id,{status:"cleaning"});try{await s.cleanup({drill:o,target:l});let T=e.store.drill(o.id);e.store.updateDrill(o.id,{status:T.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(T){e.store.updateDrill(o.id,{status:"cleanup_required",cleanupVerified:!1,error:T instanceof Error?T.message:String(T),finishedAt:new Date().toISOString()})}}return{drillId:o.id,status:e.store.drill(o.id).status}}}}var th={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class $n{kind;control;projectId;organizationId;constructor(e,t,r,n){this.kind=e;this.control=t;this.projectId=r;this.organizationId=n}async discover(e){let t=Math.max(1,Math.min(3650,Number(e.olderThanDays??30))),r=new Date(Date.now()-t*86400000).toISOString(),n=th[this.kind],i=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(n.select).all(i,r).map((s)=>({id:String(s.id),kind:this.kind,label:`${this.kind}:${String(s.id)}`,bytes:Number(s.bytes??0),metadata:{createdAt:String(s.created_at)}}))}async remove(e){if(this.control.database.run(th[this.kind].remove,[e.id]).changes!==1)throw Error(`${e.label} changed or is no longer removable.`)}}var wi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},yn=(e)=>e==null?void 0:String(e),ih=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),Qs=(e={})=>({...ih(),...e});function rh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),purpose:String(e.purpose),backend:String(e.backend),region:yn(e.region),architecture:yn(e.architecture),labels:wi(e.labels,{}),requiredServerLabels:wi(e.required_server_labels,{}),toleratedTaints:wi(e.tolerated_taints,[]),capacity:Qs(wi(e.capacity,{})),reserved:wi(e.reserved,{}),maxWorkloads:Number(e.max_workloads),costWeight:Number(e.cost_weight),spreadKey:yn(e.spread_key),concurrency:Number(e.concurrency),ephemeralWorkspaces:Number(e.ephemeral_workspaces)===1,allowProductionSecrets:Number(e.allow_production_secrets)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function nh(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:yn(e.environment_id),resourceId:String(e.resource_id),releaseId:yn(e.release_id),poolId:String(e.pool_id),serverId:yn(e.server_id),purpose:String(e.purpose),requirements:wi(e.requirements,{}),decision:wi(e.decision,{}),stateful:Number(e.stateful)===1,autoReschedule:Number(e.auto_reschedule)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function dC(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:yn(e.resource_id),poolId:String(e.pool_id),placementId:yn(e.placement_id),operationId:yn(e.operation_id),sourceSha:String(e.source_sha),buildSpec:wi(e.build_spec,{}),credentialPolicy:wi(e.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:yn(e.workspace),cacheKey:yn(e.cache_key),artifactUri:yn(e.artifact_uri),artifactDigest:yn(e.artifact_digest),status:String(e.status),cleanupAt:yn(e.cleanup_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Dn{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}createPool(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.purpose,e.backend,e.region??null,e.architecture??null,JSON.stringify(e.labels),JSON.stringify(e.requiredServerLabels),JSON.stringify(e.toleratedTaints),JSON.stringify(Qs(e.capacity)),"{}",e.maxWorkloads,e.costWeight,e.spreadKey??null,e.concurrency,e.ephemeralWorkspaces?1:0,e.allowProductionSecrets?1:0,e.status,r,r]),this.getPool(t)}getPool(e){let t=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(e);return t?rh(t):void 0}listPools(e){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(e).map(rh)}updatePool(e,t){let r=this.getPool(e);if(!r)throw Error("Capacity pool was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[n.status,JSON.stringify(n.reserved),JSON.stringify(n.capacity),n.concurrency,i,e]),this.getPool(e)}addMember(e,t,r={}){let n=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[e,t,JSON.stringify(r),n,n])}members(e){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(e).map((t)=>({serverId:String(t.server_id),status:String(t.status),capacityOverride:wi(t.capacity_override,{})}))}memberStatus(e,t,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),e,t])}listPlacements(e,t){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(e).map(nh);return t?.length?r.filter((n)=>t.includes(n.status)):r}getPlacement(e){let t=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(e);return t?nh(t):void 0}activeUsage(e,t){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(e,this.now().toISOString()),n=t?r.filter((i)=>String(i.server_id)===t):r;return{resources:n.reduce((i,o)=>{let s=Qs(wi(o.resources,{}));for(let c of Object.keys(i))i[c]+=s[c];return i},ih()),count:n.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(e){return this.control.transaction(()=>{this.expireLeases();let t=this.id(),r=this.id(),n=this.now().toISOString(),i=new Date(this.now().getTime()+(e.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[t,e.projectId,e.environmentId??null,e.resourceId,e.releaseId??null,e.decision.poolId,e.decision.serverId??null,e.requirements.purpose,JSON.stringify(e.requirements),JSON.stringify(e.decision),e.requirements.stateful?1:0,e.requirements.autoReschedule&&!e.requirements.stateful?1:0,n,n]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,t,e.decision.poolId,e.decision.serverId??null,JSON.stringify(Qs(e.requirements.resources)),i,n,n]),this.getPlacement(t)})}transitionPlacement(e,t){if(!this.getPlacement(e))throw Error("Placement was not found.");let n=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[t,n,e]),["released","failed","blocked"].includes(t))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[n,e]);return this.getPlacement(e)}createBuild(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[t,e.projectId,e.resourceId??null,e.poolId,e.placementId??null,e.operationId??null,e.sourceSha,JSON.stringify(e.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:e.tokenExpiresAt}),r,r]),this.getBuild(t)}getBuild(e){let t=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(e);return t?dC(t):void 0}updateBuild(e,t){let r=this.getBuild(e);if(!r)throw Error("Remote build was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[n.operationId??null,n.workspace??null,n.cacheKey??null,n.artifactUri??null,n.artifactDigest??null,n.status,n.cleanupAt??null,i,e]),this.getBuild(e)}}var id=["cpu","memoryBytes","diskBytes","gpu"],oh=(e,t={})=>Object.entries(t).every(([r,n])=>e[r]===n),uC=(e,t,r)=>Object.fromEntries(id.map((n)=>[n,Math.max(0,e[n]-t[n]-(r[n]??0))])),lC=(e,t)=>id.every((r)=>e[r]>=(t[r]??0)),pC=(e,t)=>id.reduce((r,n)=>r+(t[n]??0)/(e[n]||1),0);class Nn{store;fleet;constructor(e,t){this.store=e;this.fleet=t}poolCandidates(e,t,r){let n=[];for(let i of this.store.listPools(e)){if(i.id===r)continue;let o=[];if(i.status!=="active")o.push(`pool is ${i.status}`);if(i.purpose!==t.purpose)o.push(`purpose is ${i.purpose}`);if(t.region&&i.region!==t.region)o.push(`region is ${i.region??"unset"}`);if(t.architecture&&i.architecture!==t.architecture)o.push(`architecture is ${i.architecture??"unset"}`);if(!oh(i.labels,t.labels))o.push("pool labels do not match");if(i.backend==="server"){let s=this.store.members(i.id);if(!s.length)n.push(this.decision(i,void 0,t,[...o,"pool has no servers"]));for(let c of s){let l=this.fleet.get(c.serverId),a=[...o];if(!l)a.push("server is missing");else this.serverReasons(i,l,c.status,t,a);n.push(this.decision(i,l,t,a,c.capacityOverride))}}else n.push(this.decision(i,void 0,t,o))}return n.sort((i,o)=>Number(o.eligible)-Number(i.eligible)||i.score.cost-o.score.cost||i.score.spread-o.score.spread||i.score.fit-o.score.fit||i.poolName.localeCompare(o.poolName)||(i.serverId??"").localeCompare(o.serverId??""))}serverReasons(e,t,r,n,i){if(r!=="active")i.push(`member is ${r}`);if(t.status!=="ready")i.push(`server is ${t.status}`);if(!t.roles.includes(n.purpose==="build"?"build":n.purpose))i.push(`server lacks ${n.purpose} role`);if(!oh(t.labels,e.requiredServerLabels))i.push("server labels do not match pool selector");for(let o of t.taints)if(!e.toleratedTaints.includes(o))i.push(`taint ${o} is not tolerated`)}decision(e,t,r,n,i={}){let o=Qs({...t?.capacity,...i}),s=t?Object.fromEntries(id.map((a)=>[a,Math.min(e.capacity[a],o[a])])):e.capacity,c=this.store.activeUsage(e.id,t?.id),l=uC(s,c.resources,e.reserved);if(c.count>=e.maxWorkloads)n.push("workload limit reached");if(r.purpose==="build"&&c.count>=e.concurrency)n.push("build concurrency reached");if(!lC(l,r.resources))n.push("insufficient capacity");return{poolId:e.id,poolName:e.name,serverId:t?.id,eligible:n.length===0,reasons:n,available:l,score:{fit:pC(l,r.resources),spread:c.count,cost:e.costWeight}}}explain(e,t){return this.poolCandidates(e,t)}place(e){return this.store.control.transaction(()=>{let t=this.poolCandidates(e.projectId,e.requirements).find((r)=>r.eligible);if(!t)throw Error(`No eligible capacity: ${this.explain(e.projectId,e.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...e,decision:t})})}activate(e){return this.store.transitionPlacement(e,"active")}release(e){return this.store.transitionPlacement(e,"released")}drainPool(e){let t=this.store.updatePool(e,{status:"draining"}),r=[],n=[];for(let i of this.store.listPlacements(t.projectId,["reserved","active"]).filter((o)=>o.poolId===e)){if(i.stateful){n.push(this.store.transitionPlacement(i.id,"blocked"));continue}this.store.transitionPlacement(i.id,"moving");let o=this.place({projectId:i.projectId,environmentId:i.environmentId,resourceId:i.resourceId,releaseId:i.releaseId,requirements:i.requirements});r.push(this.activate(o.id)),this.store.transitionPlacement(i.id,"released")}return{pool:t,moved:r,blocked:n}}drainServer(e,t){this.store.memberStatus(e,t,"draining");let r=this.store.getPool(e);if(!r)throw Error("Capacity pool was not found.");let n=[],i=[];for(let o of this.store.listPlacements(r.projectId,["reserved","active"]).filter((s)=>s.poolId===e&&s.serverId===t)){if(o.stateful){i.push(this.store.transitionPlacement(o.id,"blocked"));continue}this.store.transitionPlacement(o.id,"moving");let s=this.poolCandidates(o.projectId,o.requirements).find((l)=>l.eligible);if(!s){i.push(this.store.transitionPlacement(o.id,"blocked"));continue}let c=this.store.reserve({projectId:o.projectId,environmentId:o.environmentId,resourceId:o.resourceId,releaseId:o.releaseId,requirements:o.requirements,decision:s});n.push(this.activate(c.id)),this.store.transitionPlacement(o.id,"released")}return{moved:n,blocked:i}}reconcileFailure(e){let t=this.fleet.get(e);if(!t)throw Error("Server was not found.");let r=[],n=[];for(let i of this.store.listPlacements(t.projectId,["active"]).filter((o)=>o.serverId===e)){if(i.stateful||!i.autoReschedule){n.push(this.store.transitionPlacement(i.id,"blocked"));continue}this.store.transitionPlacement(i.id,"failed");let o=this.place({projectId:i.projectId,environmentId:i.environmentId,resourceId:i.resourceId,releaseId:i.releaseId,requirements:i.requirements});r.push(this.activate(o.id))}return{rescheduled:r,blocked:n}}}var ro=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},li=(e)=>e==null?void 0:String(e),sh=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:li(e.environment_id),name:String(e.name),hostname:String(e.hostname),homeRegion:String(e.home_region),regions:ro(e.regions,[]),trafficPolicy:String(e.traffic_policy),dataPolicy:ro(e.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(e.status),activeRegion:String(e.active_region),revision:li(e.revision),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),vl=(e)=>({id:String(e.id),topologyId:String(e.topology_id),region:String(e.region),role:String(e.role),provider:String(e.provider),stackId:li(e.stack_id),stackRevision:li(e.stack_revision),status:String(e.status),health:ro(e.health,{}),lastHealthyAt:li(e.last_healthy_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),wl=(e)=>({id:String(e.id),topologyId:String(e.topology_id),kind:String(e.kind),sourceRegion:String(e.source_region),targetRegion:String(e.target_region),config:ro(e.config,{}),status:String(e.status),checkpoint:li(e.checkpoint),lagSeconds:e.lag_seconds==null?void 0:Number(e.lag_seconds),lastVerifiedAt:li(e.last_verified_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Il=(e)=>({id:String(e.id),topologyId:String(e.topology_id),hostname:String(e.hostname),dnsProvider:String(e.dns_provider),cdnEnabled:Number(e.cdn_enabled)===1,wafEnabled:Number(e.waf_enabled)===1,weights:ro(e.weights,{}),desiredWeights:ro(e.desired_weights,{}),status:String(e.status),providerState:ro(e.provider_state,{}),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),ah=(e)=>({id:String(e.id),topologyId:String(e.topology_id),operationId:li(e.operation_id),kind:String(e.kind),requestedRegion:li(e.requested_region),revision:li(e.revision),plan:ro(e.plan,[]),currentStep:li(e.current_step),completedSteps:ro(e.completed_steps,[]),status:String(e.status),error:li(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class kn{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}create(e){return this.control.transaction(()=>{if(e.regions.length<2||new Set(e.regions.map((o)=>o.region)).size!==e.regions.length||e.regions.filter((o)=>o.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let t=e.regions.find((o)=>o.role==="primary"),r=this.id(),n=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.name,e.hostname,t.region,JSON.stringify(e.regions),e.trafficPolicy,JSON.stringify(e.dataPolicy),t.region,n,n]);for(let o of e.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,o.region,o.role,o.provider,n,n]);for(let o of e.dataPolicy.replicate)for(let s of e.regions)for(let c of e.regions.filter((l)=>l.region!==s.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,o,s.region,c.region,"{}",n,n]);let i=Object.fromEntries(e.regions.map((o)=>[o.region,o.region===t.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,e.hostname,e.dnsProvider??"route53",e.cdnEnabled?1:0,e.wafEnabled?1:0,JSON.stringify(i),JSON.stringify(i),n,n]),this.get(r)})}get(e){let t=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(e);return t?sh(t):void 0}list(e){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(e).map(sh)}targets(e){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(e).map(vl)}channels(e){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(e).map(wl)}route(e){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(e);return t?Il(t):void 0}updateTopology(e,t){let r=this.get(e);if(!r)throw Error("Regional topology was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[n.status,n.activeRegion,n.revision??null,JSON.stringify(n.regions),i,e]),this.get(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e);if(!r)throw Error("Regional target was not found.");let n=vl(r),i={...n,...t},o=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[i.role,i.stackId??null,i.stackRevision??null,i.status,JSON.stringify(i.health),i.lastHealthyAt??null,o,e]),vl(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e))}updateChannel(e,t){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e);if(!r)throw Error("Replication channel was not found.");let n=wl(r),i={...n,...t},o=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[i.status,i.checkpoint??null,i.lagSeconds??null,i.lastVerifiedAt??null,o,e]),wl(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e))}updateRoute(e,t){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e);if(!r)throw Error("Traffic route was not found.");let n=Il(r),i={...n,...t},o=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(i.weights),JSON.stringify(i.desiredWeights),i.status,JSON.stringify(i.providerState),o,e]),Il(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e))}createExecution(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[t,e.topologyId,e.operationId??null,e.kind,e.requestedRegion??null,e.revision??null,JSON.stringify(e.plan),r,r]),this.execution(t)}execution(e){let t=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(e);return t?ah(t):void 0}executions(e){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(e).map(ah)}updateExecution(e,t){let r=this.execution(e);if(!r)throw Error("Regional execution was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[n.operationId??null,n.currentStep??null,JSON.stringify(n.completedSteps),n.status,n.error??null,i,e]),this.execution(e)}}class xn{store;queue;constructor(e,t){this.store=e;this.queue=t??new S(e.control)}create(e){return this.store.create(e)}plan(e,t,r){if(!this.store.get(e))throw Error("Regional topology was not found.");let i=this.store.targets(e),o=this.store.channels(e);if(t==="rollout")return[...i.filter((s)=>s.role==="secondary").map((s)=>`apply:${s.region}`),...i.filter((s)=>s.role==="primary").map((s)=>`apply:${s.region}`),...o.map((s)=>`replicate:${s.kind}:${s.targetRegion}`),"traffic:activate"];if(t==="failover"||t==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(t==="destroy")return["traffic:drain",...i.filter((s)=>s.role==="secondary").map((s)=>`delete:${s.region}`),...i.filter((s)=>s.role==="primary").map((s)=>`delete:${s.region}`),"complete"];return["observe","repair"]}enqueue(e){let t=this.store.get(e.topologyId);if(!t)throw Error("Regional topology was not found.");if(["failover","failback"].includes(e.kind)&&(!e.targetRegion||!t.regions.some((o)=>o.region===e.targetRegion)))throw Error("A topology target region is required.");if(e.kind==="failover"&&e.targetRegion===t.activeRegion)throw Error("Target region is already active.");if((e.kind==="destroy"||e.deleteData)&&e.confirmation!==t.name)throw Error("Exact topology name confirmation is required.");if(e.deleteData&&t.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(e.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(e.revision??""))throw Error("An immutable revision is required.");let r=this.plan(t.id,e.kind,e.targetRegion),n=this.store.createExecution({topologyId:t.id,kind:e.kind,requestedRegion:e.targetRegion,revision:e.revision,plan:r}),i=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,kind:`region.${e.kind}`,input:{executionId:n.id,manifest:e.manifest??{},deleteData:e.deleteData===!0},lockKey:`regional-topology:${t.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(n.id,{operationId:i.id}),{execution:this.store.execution(n.id),operation:i}}}var gC=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function ch(e,t){let r=(a)=>{let f=t.find((T)=>T.provider===a.provider);if(!f)throw Error(`No ${a.provider} regional driver is configured.`);return f},n=(a,f,T)=>{a.throwIfCancellationRequested(),a.checkpoint(T,T),e.updateExecution(f.id,{status:"running",currentStep:T,completedSteps:[...e.execution(f.id).completedSteps,T]})},i=async(a,f)=>{let T=e.route(a.id);if(!T)throw Error("Regional traffic route was not found.");let D=e.targets(a.id).find((W)=>W.region===a.activeRegion)??e.targets(a.id)[0];if(!D)throw Error("Regional traffic target was not found.");e.updateRoute(T.id,{status:"applying",desiredWeights:f});let N=await r(D).applyTraffic({route:e.route(a.id),topology:a,weights:f});e.updateRoute(T.id,{status:Object.values(f).every((W)=>W===0)?"drained":"in_sync",weights:f,providerState:N.providerState})},o=async(a,f,T,D)=>{e.updateTopology(T.id,{status:"provisioning"});let N=f.revision,W=D.manifest??{},Y=e.targets(T.id).sort((ne,he)=>Number(ne.role==="primary")-Number(he.role==="primary"));for(let ne of Y){n(a,f,`apply:${ne.region}`),e.updateTarget(ne.id,{status:"provisioning"});let he=await r(ne).applyStack({target:ne,revision:N,manifest:W,signal:a.signal}),te=await r(ne).health({target:e.updateTarget(ne.id,{stackId:he.stackId,stackRevision:N})});if(!te.healthy)throw Error(`Regional health gate failed in ${ne.region}.`);e.updateTarget(ne.id,{status:"ready",health:te.evidence,lastHealthyAt:new Date().toISOString()})}for(let ne of e.channels(T.id)){n(a,f,`replicate:${ne.kind}:${ne.targetRegion}`),e.updateChannel(ne.id,{status:"configuring"});let he=Y.find((tt)=>tt.region===ne.sourceRegion),te=await r(he).configureReplication({channel:ne,topology:T}),xe=await r(he).verifyReplication({channel:e.updateChannel(ne.id,{checkpoint:te.checkpoint,lagSeconds:te.lagSeconds}),topology:T});if(!xe.healthy||xe.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${ne.kind} replication to ${ne.targetRegion} exceeds the RPO.`);e.updateChannel(ne.id,{status:"in_sync",checkpoint:xe.checkpoint,lagSeconds:xe.lagSeconds,lastVerifiedAt:new Date().toISOString()})}n(a,f,"traffic:activate");let ee=Object.fromEntries(T.regions.map((ne)=>[ne.region,ne.region===T.activeRegion?100:0]));return await i(T,ee),e.updateTopology(T.id,{status:"ready",revision:N}),{revision:N,activeRegion:T.activeRegion}},s=async(a,f,T)=>{let D=f.requestedRegion,N=e.targets(T.id).find((ee)=>ee.region===D);if(!N)throw Error("Requested regional target was not found.");e.updateTopology(T.id,{status:f.kind==="failover"?"failing_over":"failing_back"}),n(a,f,`health:${D}`);let W=await r(N).health({target:N});if(!W.healthy)throw Error(`Target region ${D} is unhealthy.`);e.updateTarget(N.id,{status:"ready",health:W.evidence,lastHealthyAt:new Date().toISOString()}),n(a,f,`replication:${D}`);for(let ee of e.channels(T.id).filter((ne)=>ne.targetRegion===D)){let ne=await r(N).verifyReplication({channel:ee,topology:T});if(!ne.healthy||ne.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${ee.kind} replication is outside the failover RPO.`);e.updateChannel(ee.id,{status:"in_sync",checkpoint:ne.checkpoint,lagSeconds:ne.lagSeconds,lastVerifiedAt:new Date().toISOString()})}n(a,f,`traffic:${D}`),await i(T,Object.fromEntries(T.regions.map((ee)=>[ee.region,ee.region===D?100:0]))),n(a,f,`roles:${D}`);let Y=T.regions.map((ee)=>({...ee,role:ee.region===D?"primary":"secondary"}));for(let ee of e.targets(T.id))e.updateTarget(ee.id,{role:ee.region===D?"primary":"secondary"});return e.updateTopology(T.id,{status:f.kind==="failover"?"failed_over":"ready",activeRegion:D,regions:Y}),{activeRegion:D}},c=async(a,f,T,D)=>{e.updateTopology(T.id,{status:"destroying"}),n(a,f,"traffic:drain"),await i(T,Object.fromEntries(T.regions.map((W)=>[W.region,0])));let N=D.deleteData!==!0;for(let W of e.targets(T.id).sort((Y,ee)=>Number(Y.role==="primary")-Number(ee.role==="primary")))n(a,f,`delete:${W.region}`),e.updateTarget(W.id,{status:"deleting"}),await r(W).deleteStack({target:W,retainData:N,signal:a.signal}),e.updateTarget(W.id,{status:"deleted"});return n(a,f,"complete"),e.updateTopology(T.id,{status:"destroyed"}),{destroyed:!0,dataRetained:N}},l=async(a)=>{let f=gC(a.operation.input),T=e.execution(String(f.executionId??""));if(!T)throw Error("Regional execution was not found.");let D=e.get(T.topologyId);if(!D)throw Error("Regional topology was not found.");try{let N;if(T.kind==="rollout")N=await o(a,T,D,f);else if(T.kind==="failover"||T.kind==="failback")N=await s(a,T,D);else if(T.kind==="destroy")N=await c(a,T,D,f);else throw Error("Regional reconciliation is not configured.");return e.updateExecution(T.id,{status:"succeeded",currentStep:void 0}),{executionId:T.id,...N}}catch(N){if(e.updateExecution(T.id,{status:a.cancellationRequested()?"cancelled":"failed",error:N instanceof Error?N.message:String(N)}),e.get(D.id)?.status!=="destroyed")e.updateTopology(D.id,{status:"failed"});throw N}};return{"region.rollout":l,"region.failover":l,"region.failback":l,"region.destroy":l,"region.reconcile":l}}class Cl{provider;reason;constructor(e,t="Configure a regional provider transport before executing this operation."){this.provider=e;this.reason=t}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function $i(e,t,r){return[e,t,r].map((n)=>encodeURIComponent(n)).join(":")}function mC(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function ds(e,t,r=["exec","files"]){let n=mC(t);for(let i of e)n[i]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(i),requiresRecentAuth:r.includes(i)};return n}var fC=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function io(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function no(e){if(Array.isArray(e))return e.map((r)=>no(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,n]of Object.entries(e))t[r]=fC.test(r)?"[REDACTED]":no(n);return t}function us(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function dh(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function hC(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function uh(e,t={},r={}){let n=t.now??new Date,i=Math.max(100,r.timeoutMs??1e4),o=Math.max(1,r.staleAfterSeconds??60),s=await Promise.all(e.map(async(l)=>{try{let a=await Promise.race([l.discover({...t,now:n}),new Promise((f,T)=>setTimeout(()=>T(Error(`Runtime source ${l.id} timed out after ${i}ms`)),i))]);return{workloads:a,source:{id:l.id,provider:l.provider,status:"fresh",discoveredAt:n.toISOString(),staleAfterSeconds:o,itemCount:a.length}}}catch(a){return{workloads:[],source:{id:l.id,provider:l.provider,status:hC(a),discoveredAt:n.toISOString(),staleAfterSeconds:o,itemCount:0,message:String(a?.message??a).slice(0,500)}}}})),c=s.map((l)=>l.source);return{generatedAt:n.toISOString(),workloads:s.flatMap((l)=>l.workloads).sort((l,a)=>l.name.localeCompare(a.name)||l.id.localeCompare(a.id)),sources:c,degraded:c.some((l)=>l.status!=="fresh")}}function yC(e,t){if(!t)return e;return e.startsWith(t)?e.slice(t.length):e}function lh(e,t,r){let n=yC(e,t);return`${r??""}${n}`}function ph(e,t,r){if(r&&r.some((n)=>e.startsWith(n)))return!1;if(t&&t.length>0)return t.some((n)=>e.startsWith(n));return!0}async function bC(e,t,r){let n=0,i=[],o=Math.max(1,Math.min(t,e.length||1));for(let s=0;s<o;s++)i.push((async()=>{while(!0){let c=n++;if(c>=e.length)return;await r(e[c],c)}})());await Promise.all(i)}function gh(e){if(e.client)return e.client;return mh({provider:e.provider,region:e.region,endpoint:e.endpoint,forcePathStyle:e.forcePathStyle,credentials:e.credentials})}async function Xs(e){let t=e.concurrency??8,r=gh(e.from),n=gh(e.to),i=await r.listAllObjects({bucket:e.from.bucket,prefix:e.from.prefix}),o={copied:0,skipped:0,excluded:0,bytesCopied:0,errors:[],excludedKeys:[],deleted:[]},s=[];for(let f of i){if(!ph(f.Key,e.include,e.exclude)){o.excluded++,o.excludedKeys.push(f.Key);continue}s.push({source:f,destKey:lh(f.Key,e.from.prefix,e.to.prefix)})}if(e.dryRun){o.plan=s.map(({source:D,destKey:N})=>({key:D.Key,destKey:N,size:D.Size}));let f=i.length,T=0;for(let D of i){T++;let N=!ph(D.Key,e.include,e.exclude);e.onProgress?.({key:D.Key,destKey:N?"":lh(D.Key,e.from.prefix,e.to.prefix),size:D.Size,action:N?"excluded":"planned",index:T,total:f})}return o}let c=s.length,l=0;await bC(s,t,async({source:f,destKey:T})=>{let D=++l;try{if(!e.force){let Y=await n.headObject(e.to.bucket,T);if(Y&&Y.ContentLength===f.Size){o.skipped++,e.onProgress?.({key:f.Key,destKey:T,size:f.Size,action:"skipped",index:D,total:c});return}}let{body:N,contentType:W}=await r.getObjectBytes(e.from.bucket,f.Key);await n.putObject({bucket:e.to.bucket,key:T,body:N,contentType:W}),o.copied++,o.bytesCopied+=N.byteLength,e.onProgress?.({key:f.Key,destKey:T,size:f.Size,action:"copied",index:D,total:c})}catch(N){o.errors.push({key:f.Key,message:N?.message??String(N)}),e.onProgress?.({key:f.Key,destKey:T,size:f.Size,action:"error",index:D,total:c})}});let a=new Set(s.map((f)=>f.destKey));if(e.deleteExtraneous){let T=(await n.listAllObjects({bucket:e.to.bucket,prefix:e.to.prefix})).filter((D)=>!a.has(D.Key)).map((D)=>D.Key);for(let D of T)try{await n.deleteObject(e.to.bucket,D),o.deleted.push(D)}catch(N){o.errors.push({key:D,message:`delete failed: ${N?.message??String(N)}`})}}if(e.verify){let f=await n.listAllObjects({bucket:e.to.bucket,prefix:e.to.prefix}),T=new Map(f.map((Y)=>[Y.Key,Y.Size])),D=[],N=[],W=0;for(let{source:Y,destKey:ee}of s){if(!T.has(ee)){D.push(ee);continue}let ne=T.get(ee);if(ne!==Y.Size){N.push({key:ee,expected:Y.Size,actual:ne});continue}W++}o.verification={ok:D.length===0&&N.length===0,matched:W,missing:D,sizeMismatches:N}}return o}var SC={aws:"us-east-1",backblaze:"us-west-004",hetzner:"fsn1"};function vC(e,t){switch(e){case"backblaze":return`s3.${t}.backblazeb2.com`;case"hetzner":return`${t}.your-objectstorage.com`;case"aws":default:return}}function Cn(...e){for(let t of e){let r=process.env[t];if(r)return r}return}function wC(e,t){if(t?.accessKeyId&&t.secretAccessKey)return t;let r,n;if(e==="backblaze")r=Cn("B2_APPLICATION_KEY_ID","B2_KEY_ID","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),n=Cn("B2_APPLICATION_KEY","B2_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else if(e==="hetzner")r=Cn("HETZNER_S3_ACCESS_KEY","HETZNER_ACCESS_KEY","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),n=Cn("HETZNER_S3_SECRET_KEY","HETZNER_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else r=Cn("S3_ACCESS_KEY_ID"),n=Cn("S3_SECRET_ACCESS_KEY");if(r&&n)return{accessKeyId:r,secretAccessKey:n,sessionToken:Cn("AWS_SESSION_TOKEN")};return}function IC(e={}){let t=e.provider||Cn("OBJECT_STORAGE_PROVIDER","STORAGE_PROVIDER")||"aws",r=e.region||(t==="backblaze"?Cn("B2_REGION"):void 0)||(t==="hetzner"?Cn("HETZNER_S3_REGION","HETZNER_REGION"):void 0)||Cn("S3_REGION","AWS_REGION","AWS_DEFAULT_REGION")||SC[t],n=e.endpoint||Cn("S3_ENDPOINT")||vC(t,r),i=e.forcePathStyle??Cn("S3_FORCE_PATH_STYLE")==="true",o=wC(t,e.credentials),s=(c)=>{let l=n||`s3.${r}.amazonaws.com`;return i?`https://${l}/${c}`:`https://${c}.${l}`};return{provider:t,region:r,endpoint:n,forcePathStyle:i,credentials:o,profile:e.profile,publicBaseUrl:s}}function mh(e={}){let t=IC(e),r={endpoint:t.endpoint,forcePathStyle:t.forcePathStyle,credentials:t.credentials};return new g(t.region,t.profile,r)}class kt{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new u(void 0,{profile:t})}async describeServices(e){let t={cluster:e.cluster,services:e.services};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async listServices(e,t={}){let r={cluster:e,...t};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTasks(e,t,r={}){let n={cluster:e,...r};if(t)n.serviceName=t;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(n)})}async describeTasks(e,t){let r={cluster:e,tasks:t};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async updateService(e){let t={cluster:e.cluster,service:e.service};if(e.forceNewDeployment!==void 0)t.forceNewDeployment=e.forceNewDeployment;if(e.desiredCount!==void 0)t.desiredCount=e.desiredCount;if(e.taskDefinition)t.taskDefinition=e.taskDefinition;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.UpdateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async createService(e){let t={cluster:e.cluster,serviceName:e.serviceName,taskDefinition:e.taskDefinition,desiredCount:e.desiredCount};if(e.launchType)t.launchType=e.launchType;if(e.networkConfiguration)t.networkConfiguration=e.networkConfiguration;if(e.loadBalancers)t.loadBalancers=e.loadBalancers;if(e.healthCheckGracePeriodSeconds!==void 0)t.healthCheckGracePeriodSeconds=e.healthCheckGracePeriodSeconds;if(e.deploymentConfiguration)t.deploymentConfiguration=e.deploymentConfiguration;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.CreateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async deleteService(e){let t={cluster:e.cluster,service:e.service};if(e.force!==void 0)t.force=e.force;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeleteService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async listClusters(e={}){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async describeClusters(e){let t={clusters:e,include:["ATTACHMENTS","CONFIGURATIONS","SETTINGS","STATISTICS","TAGS"]};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async stopTask(e){let t={cluster:e.cluster,task:e.task};if(e.reason)t.reason=e.reason;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.StopTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async runTask(e){let t={cluster:e.cluster,taskDefinition:e.taskDefinition};if(e.count!==void 0)t.count=e.count;if(e.launchType)t.launchType=e.launchType;if(e.networkConfiguration)t.networkConfiguration=e.networkConfiguration;if(e.overrides)t.overrides=e.overrides;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RunTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async registerTaskDefinition(e){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async deregisterTaskDefinition(e){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeregisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:e})})}async describeTaskDefinition(e){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:e,include:["TAGS"]})})}async listTaskDefinitionFamilies(e){let t={};if(e?.familyPrefix)t.familyPrefix=e.familyPrefix;if(e?.status)t.status=e.status;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTaskDefinitionFamilies","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async waitForServiceStable(e,t,r=40,n=15000){for(let i=0;i<r;i++){let s=(await this.describeServices({cluster:e,services:[t]})).services?.[0];if(s){let c=s.deployments?.find((l)=>l.status==="PRIMARY");if(c&&c.runningCount===c.desiredCount&&s.deployments?.length===1)return!0}await new Promise((c)=>setTimeout(c,n))}return!1}async forceNewDeployment(e,t){return this.updateService({cluster:e,service:t,forceNewDeployment:!0})}async scaleService(e,t,r){return this.updateService({cluster:e,service:t,desiredCount:r})}}class de{client;region;constructor(e="us-east-1"){this.region=e,this.client=new u}buildFormBody(e){return Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>`${encodeURIComponent(r)}=${encodeURIComponent(n)}`).join("&")}async createTopic(e){let t={Action:"CreateTopic",Version:"2010-03-31",Name:e.Name};if(e.DisplayName)t["Attributes.entry.1.key"]="DisplayName",t["Attributes.entry.1.value"]=e.DisplayName;if(e.Tags)e.Tags.forEach((n,i)=>{t[`Tags.member.${i+1}.Key`]=n.Key,t[`Tags.member.${i+1}.Value`]=n.Value});if(e.Attributes){let n=e.DisplayName?2:1;Object.entries(e.Attributes).forEach(([i,o])=>{t[`Attributes.entry.${n}.key`]=i,t[`Attributes.entry.${n}.value`]=o,n++})}let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{TopicArn:_(r,"CreateTopic")?.TopicArn}}async deleteTopic(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteTopic",Version:"2010-03-31",TopicArn:e})})}async listTopics(e){let t={Action:"ListTopics",Version:"2010-03-31"};if(e)t.NextToken=e;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),n=r?.ListTopicsResponse?.ListTopicsResult||r?.ListTopicsResult,i=n?.Topics?.member;return{Topics:Array.isArray(i)?i:i?[i]:[],NextToken:n?.NextToken}}async getTopicAttributes(e){let t=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetTopicAttributes",Version:"2010-03-31",TopicArn:e})}),r=k(_(t,"GetTopicAttributes")?.Attributes?.entry),n={TopicArn:e};for(let i of r)n[i.key]=String(i.value);return n}async setTopicAttributes(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetTopicAttributes",Version:"2010-03-31",TopicArn:e.TopicArn,AttributeName:e.AttributeName,AttributeValue:e.AttributeValue})})}async subscribe(e){let t={Action:"Subscribe",Version:"2010-03-31",TopicArn:e.TopicArn,Protocol:e.Protocol,Endpoint:e.Endpoint};if(e.ReturnSubscriptionArn)t.ReturnSubscriptionArn="true";if(e.Attributes){let n=1;Object.entries(e.Attributes).forEach(([i,o])=>{t[`Attributes.entry.${n}.key`]=i,t[`Attributes.entry.${n}.value`]=o,n++})}let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{SubscriptionArn:_(r,"Subscribe")?.SubscriptionArn}}async unsubscribe(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"Unsubscribe",Version:"2010-03-31",SubscriptionArn:e})})}async listSubscriptionsByTopic(e,t){let r={Action:"ListSubscriptionsByTopic",Version:"2010-03-31",TopicArn:e};if(t)r.NextToken=t;let n=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)}),i=_(n,"ListSubscriptionsByTopic");return{Subscriptions:k(i?.Subscriptions?.member),NextToken:i?.NextToken||void 0}}async publish(e){let t={Action:"Publish",Version:"2010-03-31",Message:e.Message};if(e.TopicArn)t.TopicArn=e.TopicArn;if(e.TargetArn)t.TargetArn=e.TargetArn;if(e.PhoneNumber)t.PhoneNumber=e.PhoneNumber;if(e.Subject)t.Subject=e.Subject;if(e.MessageStructure)t.MessageStructure=e.MessageStructure;if(e.MessageAttributes){let n=1;Object.entries(e.MessageAttributes).forEach(([i,o])=>{if(t[`MessageAttributes.entry.${n}.Name`]=i,t[`MessageAttributes.entry.${n}.Value.DataType`]=o.DataType,o.StringValue)t[`MessageAttributes.entry.${n}.Value.StringValue`]=o.StringValue;if(o.BinaryValue)t[`MessageAttributes.entry.${n}.Value.BinaryValue`]=o.BinaryValue;n++})}let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{MessageId:_(r,"Publish")?.MessageId}}async publishSMS(e,t,r){let n={};if(r)n["AWS.SNS.SMS.SenderID"]={DataType:"String",StringValue:r};return this.publish({PhoneNumber:e,Message:t,MessageAttributes:Object.keys(n).length>0?n:void 0})}async subscribeEmail(e,t){return this.subscribe({TopicArn:e,Protocol:"email",Endpoint:t})}async subscribeLambda(e,t){return this.subscribe({TopicArn:e,Protocol:"lambda",Endpoint:t})}async subscribeSqs(e,t,r){let n={};if(r)n.RawMessageDelivery="true";return this.subscribe({TopicArn:e,Protocol:"sqs",Endpoint:t,Attributes:Object.keys(n).length>0?n:void 0})}async subscribeHttp(e,t,r){let n=t.startsWith("https")?"https":"http",i={};if(r)i.RawMessageDelivery="true";return this.subscribe({TopicArn:e,Protocol:n,Endpoint:t,Attributes:Object.keys(i).length>0?i:void 0})}async subscribeSms(e,t){return this.subscribe({TopicArn:e,Protocol:"sms",Endpoint:t})}async topicExists(e){try{return await this.getTopicAttributes(e),!0}catch(t){if(t.code==="NotFound"||t.statusCode===404)return!1;throw t}}async getSMSAttributes(){let e=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSAttributes",Version:"2010-03-31"})}),t=k(_(e,"GetSMSAttributes")?.attributes?.entry),r={};for(let n of t)r[n.key]=String(n.value);return r}async setSMSAttributes(e){let t={Action:"SetSMSAttributes",Version:"2010-03-31"},r=1;Object.entries(e).forEach(([n,i])=>{if(i!==void 0)t[`attributes.entry.${r}.key`]=n,t[`attributes.entry.${r}.value`]=i,r++}),await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async checkIfPhoneNumberIsOptedOut(e){let t=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CheckIfPhoneNumberIsOptedOut",Version:"2010-03-31",phoneNumber:e})});return Xo(_(t,"CheckIfPhoneNumberIsOptedOut")?.isOptedOut)}async listPhoneNumbersOptedOut(e){let t={Action:"ListPhoneNumbersOptedOut",Version:"2010-03-31"};if(e)t.nextToken=e;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),n=_(r,"ListPhoneNumbersOptedOut");return{phoneNumbers:k(n?.phoneNumbers?.member).map(String),nextToken:n?.nextToken||void 0}}async optInPhoneNumber(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"OptInPhoneNumber",Version:"2010-03-31",phoneNumber:e})})}async listSMSSandboxPhoneNumbers(e){let t={Action:"ListSMSSandboxPhoneNumbers",Version:"2010-03-31"};if(e)t.NextToken=e;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),n=_(r,"ListSMSSandboxPhoneNumbers");return{PhoneNumbers:k(n?.PhoneNumbers?.member),NextToken:n?.NextToken||void 0}}async createSMSSandboxPhoneNumber(e,t){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:e,LanguageCode:t||"en-US"})})}async verifySMSSandboxPhoneNumber(e,t){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"VerifySMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:e,OneTimePassword:t})})}async deleteSMSSandboxPhoneNumber(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:e})})}async getSMSSandboxAccountStatus(){let e=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSSandboxAccountStatus",Version:"2010-03-31"})});return{IsInSandbox:Xo(_(e,"GetSMSSandboxAccountStatus")?.IsInSandbox)}}}class G{client;region;endpoint;constructor(e="us-east-1",t){this.region=e,this.endpoint=t?.endpoint,this.client=new u}async request(e,t){if(this.endpoint){let r=await fetch(this.endpoint,{method:"POST",headers:{"Content-Type":"application/x-amz-json-1.0","X-Amz-Target":`DynamoDB_20120810.${e}`},body:JSON.stringify(t)});if(!r.ok){let n=await r.text();throw Error(`DynamoDB request failed: ${r.status} ${n}`)}return r.json()}return this.client.request({service:"dynamodb",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.0","X-Amz-Target":`DynamoDB_20120810.${e}`},body:JSON.stringify(t)})}async createTable(e){return this.request("CreateTable",e)}async deleteTable(e){return this.request("DeleteTable",e)}async describeTable(e){return this.request("DescribeTable",e)}async listTables(e){return this.request("ListTables",e||{})}async putItem(e){return this.request("PutItem",e)}async getItem(e){return this.request("GetItem",e)}async updateItem(e){return this.request("UpdateItem",e)}async deleteItem(e){return this.request("DeleteItem",e)}async query(e){return this.request("Query",e)}async scan(e){return this.request("Scan",e)}async batchWriteItem(e){return this.request("BatchWriteItem",e)}async batchGetItem(e){return this.request("BatchGetItem",e)}async updateTimeToLive(e){return this.request("UpdateTimeToLive",e)}static marshal(e){let t={};for(let[r,n]of Object.entries(e))t[r]=G.marshalValue(n);return t}static marshalValue(e){if(e===null||e===void 0)return{NULL:!0};if(typeof e==="string")return{S:e};if(typeof e==="number")return{N:String(e)};if(typeof e==="boolean")return{BOOL:e};if(Array.isArray(e))return{L:e.map((t)=>G.marshalValue(t))};if(typeof e==="object")return{M:G.marshal(e)};return{S:String(e)}}static unmarshal(e){let t={};for(let[r,n]of Object.entries(e))t[r]=G.unmarshalValue(n);return t}static unmarshalValue(e){if(e.S!==void 0)return e.S;if(e.N!==void 0)return Number(e.N);if(e.BOOL!==void 0)return e.BOOL;if(e.NULL!==void 0)return null;if(e.L!==void 0)return e.L.map((t)=>G.unmarshalValue(t));if(e.M!==void 0)return G.unmarshal(e.M);if(e.SS!==void 0)return e.SS;if(e.NS!==void 0)return e.NS.map(Number);return null}}class ye{client;region;constructor(e="us-east-1"){this.region=e,this.client=new u}async request(e,t){return this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSEvents.${e}`},body:JSON.stringify(t)})}async putRule(e){return this.request("PutRule",e)}async deleteRule(e){return this.request("DeleteRule",e)}async describeRule(e){return this.request("DescribeRule",e)}async listRules(e){return this.request("ListRules",e||{})}async listEventBuses(e){return this.request("ListEventBuses",e||{})}async enableRule(e){return this.request("EnableRule",e)}async disableRule(e){return this.request("DisableRule",e)}async putTargets(e){return this.request("PutTargets",e)}async removeTargets(e){return this.request("RemoveTargets",e)}async listTargetsByRule(e){return this.request("ListTargetsByRule",e)}async putEvents(e){return this.request("PutEvents",e)}async createSchedule(e){return this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${e.Name}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}}class Oe{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new u}async createRule(e){let t={Action:"PutRule",Name:e.name,ScheduleExpression:e.scheduleExpression,Version:"2015-10-07"};if(e.description)t.Description=e.description;if(e.state)t.State=e.state;else t.State="ENABLED";return{RuleArn:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e.name,ScheduleExpression:e.scheduleExpression,State:e.state||"ENABLED",Description:e.description})})).RuleArn}}async putTargets(e,t){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:e,Targets:t})})}async listRules(e){let t={};if(e)t.NamePrefix=e;return{Rules:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListRules","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})).Rules||[]}}async describeRule(e){let t=await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DescribeRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e})});return{Name:t.Name,Arn:t.Arn,ScheduleExpression:t.ScheduleExpression,State:t.State,Description:t.Description}}async listTargetsByRule(e){return{Targets:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListTargetsByRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:e})})).Targets||[]}}async deleteRule(e,t){if(t)try{let r=await this.listTargetsByRule(e);if(r.Targets&&r.Targets.length>0)await this.removeTargets(e,r.Targets.map((n)=>n.Id))}catch{}await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DeleteRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e,Force:t||!1})})}async removeTargets(e,t){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.RemoveTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:e,Ids:t})})}async enableRule(e){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.EnableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e})})}async disableRule(e){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DisableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e})})}async createLambdaSchedule(e){let t=await this.createRule({name:e.name,scheduleExpression:e.scheduleExpression,description:e.description,state:"ENABLED"});return await this.putTargets(e.name,[{Id:"1",Arn:e.functionArn,Input:e.input}]),t}async createEcsSchedule(e){let t=await this.createRule({name:e.name,scheduleExpression:e.scheduleExpression,description:e.description,state:"ENABLED"});return await this.putTargets(e.name,[{Id:"1",Arn:e.clusterArn,RoleArn:e.roleArn,Input:JSON.stringify({containerOverrides:[]})}]),t}async listSchedules(e){let t={};if(e?.NamePrefix)t.NamePrefix=e.NamePrefix;if(e?.State)t.State=e.State;let r=e?.GroupName||"default";return{Schedules:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedules",queryParams:{...t,ScheduleGroup:r}}))?.Schedules||[]}}async getSchedule(e){try{let t={};if(e.GroupName)t.groupName=e.GroupName;return await this.client.request({service:"scheduler",region:this.region,method:"GET",path:`/schedules/${encodeURIComponent(e.Name)}`,queryParams:Object.keys(t).length>0?t:void 0})}catch(t){if(t.statusCode===404||t.code==="ResourceNotFoundException")return null;throw t}}async createSchedule(e){let t={ScheduleExpression:e.ScheduleExpression,FlexibleTimeWindow:e.FlexibleTimeWindow,Target:e.Target};if(e.GroupName)t.GroupName=e.GroupName;if(e.ScheduleExpressionTimezone)t.ScheduleExpressionTimezone=e.ScheduleExpressionTimezone;if(e.Description)t.Description=e.Description;if(e.State)t.State=e.State;if(e.StartDate)t.StartDate=e.StartDate.toISOString();if(e.EndDate)t.EndDate=e.EndDate.toISOString();return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${encodeURIComponent(e.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)}))?.ScheduleArn||""}}async updateSchedule(e){let t={};if(e.GroupName)t.GroupName=e.GroupName;if(e.ScheduleExpression)t.ScheduleExpression=e.ScheduleExpression;if(e.ScheduleExpressionTimezone)t.ScheduleExpressionTimezone=e.ScheduleExpressionTimezone;if(e.Description!==void 0)t.Description=e.Description;if(e.State)t.State=e.State;if(e.FlexibleTimeWindow)t.FlexibleTimeWindow=e.FlexibleTimeWindow;if(e.Target)t.Target=e.Target;return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"PUT",path:`/schedules/${encodeURIComponent(e.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)}))?.ScheduleArn||""}}async deleteSchedule(e){let t={};if(e.GroupName)t.groupName=e.GroupName;await this.client.request({service:"scheduler",region:this.region,method:"DELETE",path:`/schedules/${encodeURIComponent(e.Name)}`,queryParams:Object.keys(t).length>0?t:void 0})}async listScheduleGroups(e){let t={};if(e?.NamePrefix)t.NamePrefix=e.NamePrefix;return{ScheduleGroups:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedule-groups",queryParams:Object.keys(t).length>0?t:void 0}))?.ScheduleGroups||[]}}}function Ys(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function fh(e,t,r,n="ecs:aws",i=[]){let o=r.now??new Date;return e.map((s)=>{let c=s.serviceName??Ys(s.serviceArn),l=t.filter((ne)=>!s.clusterArn||ne.clusterArn===s.clusterArn),a=l.some((ne)=>!!ne.group)?l.filter((ne)=>ne.group===`service:${c}`):l,f=s.status==="ACTIVE"?(s.runningCount??0)<(s.desiredCount??0)?"degraded":"running":io(s.status),T=i.find((ne)=>ne.taskDefinitionArn===s.taskDefinition),D=Array.isArray(T?.containerDefinitions)?T.containerDefinitions:[],N=[...new Set(D.map((ne)=>ne.logConfiguration?.options?.["awslogs-group"]).filter((ne)=>typeof ne==="string"))],W=D.flatMap((ne)=>(ne.mountPoints??[]).map((he)=>({source:he.sourceVolume,target:he.containerPath,type:"volume",readOnly:!!he.readOnly}))),Y=D.flatMap((ne)=>(ne.portMappings??[]).map((he,te)=>({id:`${ne.name??"container"}:${te}`,name:ne.name,mode:T?.networkMode,ports:[{container:he.containerPort,host:he.hostPort,protocol:he.protocol}]}))),ee=r.project&&r.environment&&c.startsWith(`${r.project}-${r.environment}-`)?c.slice(`${r.project}-${r.environment}-`.length):c;return{id:$i("ecs",n,s.serviceArn??c),provider:"ecs",kind:"service",name:c,status:f,rawStatus:s.status,health:f==="running"?"healthy":f==="failed"||f==="degraded"?"unhealthy":"unknown",desiredReplicas:s.desiredCount,runningReplicas:s.runningCount,image:D[0]?.image,runtime:s.launchType??"ECS",version:Ys(s.taskDefinition),ageSeconds:us(s.deployments?.[0]?.createdAt,o),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:ee,release:Ys(s.taskDefinition),providerId:s.serviceArn},replicas:a.map((ne)=>{let he=io(ne.lastStatus);return{id:$i("ecs",n,ne.taskArn??Ys(ne.taskArn)),name:Ys(ne.taskArn),status:he,rawStatus:ne.lastStatus,createdAt:ne.createdAt,startedAt:ne.startedAt,stoppedAt:ne.stoppedAt,host:ne.containerInstanceArn,containers:(ne.containers??[]).map((te)=>({id:te.containerArn??te.name??"container",name:te.name??"container",image:D.find((xe)=>xe.name===te.name)?.image,imageDigest:te.imageDigest,status:io(te.lastStatus),rawStatus:te.lastStatus,exitCode:te.exitCode,reason:te.reason,runtime:"ecs"}))}}),networks:Y,mounts:W,capabilities:ds(["start","stop","restart","redeploy","scale","inspect",...N.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:no({clusterArn:s.clusterArn,taskDefinition:s.taskDefinition,launchType:s.launchType,pendingCount:s.pendingCount,deployments:s.deployments,logGroups:N,executionRoleArn:T?.executionRoleArn,taskRoleArn:T?.taskRoleArn,cpu:T?.cpu,memory:T?.memory}),discoveredAt:o.toISOString(),sourceId:n}})}function hh(e,t,r="lambda:aws"){let n=t.now??new Date;return e.map((i)=>{let o=i.FunctionName??Ys(i.FunctionArn),s=i.State==="Active"?"running":io(i.State);return{id:$i("lambda",r,i.FunctionArn??o),provider:"lambda",kind:"function",name:o,status:s,rawStatus:i.State,health:s==="running"?"healthy":s==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:i.Runtime,version:i.Version,architecture:i.Architectures?.join(", "),ageSeconds:us(i.LastModified,n),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:o,providerId:i.FunctionArn},resources:{memoryLimitBytes:i.MemorySize==null?void 0:i.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:ds(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:no({handler:i.Handler,timeout:i.Timeout,codeSize:i.CodeSize,stateReason:i.StateReason,environmentKeys:Object.keys(i.Environment?.Variables??{})}),discoveredAt:n.toISOString(),sourceId:r}})}function CC(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((n)=>n&&typeof n.Id==="string")}function EC(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,n])=>{let[i,o]=r.split("/");return(n??[]).map((s)=>({container:Number(i)||void 0,host:Number(s.HostPort)||void 0,protocol:o,address:s.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,n])=>({id:n.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[n.IPAddress,n.GlobalIPv6Address].filter(Boolean),ports:t}))}function TC(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function AC(e,t,r=t.server??"local"){let n=t.now??new Date;return e.map((i)=>{let o=i.State?.OOMKilled?"oomkilled":i.State?.Restarting?"starting":i.State?.Status,s=io(o),c=(i.Name??i.Id.slice(0,12)).replace(/^\//,""),l=i.Config?.Labels??{},a=TC(i),f=EC(i),T={id:i.Id,name:c,image:i.Config?.Image,imageDigest:i.Image,runtime:"docker",status:s,rawStatus:o,exitCode:i.State?.ExitCode,reason:i.State?.Error,resources:{memoryLimitBytes:i.HostConfig?.Memory||void 0},networks:f,mounts:a};return{id:$i("docker",r,i.Id),provider:"docker",kind:"container",name:c,status:s,rawStatus:o,health:s==="running"?"healthy":s==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:s==="running"?1:0,image:i.Config?.Image,runtime:"docker",ageSeconds:us(i.State?.StartedAt,n),restartCount:i.RestartCount??0,tags:l,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:l["com.docker.compose.service"]??l["ts-cloud.service"]??c,release:l["ts-cloud.release"],providerId:i.Id},resources:T.resources,replicas:[{id:$i("docker",r,`${i.Id}:0`),name:c,status:s,rawStatus:o,startedAt:i.State?.StartedAt,stoppedAt:i.State?.FinishedAt,restartCount:i.RestartCount,containers:[T],resources:T.resources}],networks:f,mounts:a,capabilities:ds(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:no({image:i.Config?.Image,labels:l,environmentKeys:(i.Config?.Env??[]).map((D)=>D.split("=",1)[0]),networkMode:i.HostConfig?.NetworkMode}),discoveredAt:n.toISOString(),sourceId:r}})}class El{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return AC(CC(await this.inspect(e)),e,this.id)}}function kC(e){let t=[];for(let r of e.split(`
+`;return r}}function VI(e,t,r={}){return _f(e,t,r,new WeakMap)}function _f(e,t,r,n){let{arrayMergeMode:i="replace",skipNullish:o=!1,customMerger:s}=r;if(t===null||t===void 0)return o?e:t;if(s){let c=s(e,t);if(c!==void 0)return c}if(Array.isArray(t)||Array.isArray(e))return Nf(e,t,i,n);if(!ci(t)||!ci(e))return t;return WI(e,t,r,n)}function Nf(e,t,r,n){if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(e)&&!Array.isArray(t))return t;if(Array.isArray(t)&&Array.isArray(e))switch(r){case"replace":return t;case"concat":return qI(e,t);case"smart":return JI(e,t,n);default:return t}return t}function qI(e,t){let r=[...t];for(let n of e)if(!r.some((i)=>ol(i,n)))r.push(n);return r}function JI(e,t,r){if(t.length===0)return e;if(e.length===0)return t;if(ci(t[0])&&ci(e[0]))return GI(e,t,r);if(t.every((n)=>typeof n==="string")&&e.every((n)=>typeof n==="string")){let n=[...t];for(let i of e)if(!n.includes(i))n.push(i);return n}return t}function GI(e,t,r){let n=[...t];for(let i of e){if(!ci(i)){n.push(i);continue}let o=["id","name","key","path","type"],s=!1;for(let c of o)if(c in i){if(n.find((a)=>ci(a)&&(c in a)&&a[c]===i[c])){s=!0;break}}if(!s)n.push(i)}return n}function WI(e,t,r,n){let i=t;if(ci(i)&&n.has(i))return n.get(i);let o={...e};if(ci(i))n.set(i,o);for(let s in i){if(!Object.prototype.hasOwnProperty.call(i,s))continue;let c=i[s],l=o[s];if(r.skipNullish&&(c===null||c===void 0))continue;if(c===null||c===void 0){o[s]=c;continue}if(ci(c)&&ci(l))o[s]=_f(l,c,r,n);else if(Array.isArray(c)||Array.isArray(l))o[s]=Nf(l,c,r.arrayMergeMode||"smart",n);else o[s]=c}return o}function $f(e,t,r="replace"){return VI(e,t,{arrayMergeMode:r==="replace"?"replace":"smart",skipNullish:!0})}function ol(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!ol(e[r],t[r]))return!1;return!0}if(ci(e)&&ci(t)){let r=Object.keys(e),n=Object.keys(t);if(r.length!==n.length)return!1;for(let i of r){if(!Object.prototype.hasOwnProperty.call(t,i))return!1;if(!ol(e[i],t[i]))return!1}return!0}return!1}function ci(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}class Mf{extensions=rf;async loadFromPath(e,t,r={}){let{arrayStrategy:n="replace",useCache:i=!0,cacheTtl:o,trackPerformance:s=!0,verbose:c=!1}=r;if(i){let a=jc.getWithFileCheck("file",e);if(a){if(c)console.log(`Configuration loaded from cache: ${e}`);return a}}let l=async()=>{if(!_c(e))return null;try{let a=`?t=${Date.now()}`,f=await import(e+a),T=f.default||f,D="default"in f,N=Object.keys(f).length>0;if(!D&&!N)throw new Yc(e,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof T!=="object"||T===null||Array.isArray(T))throw new Yc(e,Error("Configuration must export a valid object"),"unknown");let ee={config:$f(t,T,n),source:{type:"file",path:e,priority:100,timestamp:new Date}};if(i)jc.setWithFileCheck("file",ee,e,o);return ee}catch(a){throw a instanceof Error?os.configLoad(e,a):os.configLoad(e,Error(String(a)))}};if(s)return sl.track("loadFromPath",l,{path:e});return l()}async tryLoadFromPaths(e,t,r={}){for(let n of e)try{let i=await this.loadFromPath(n,t,r);if(i)return i}catch(i){if(i instanceof Error&&i.name==="ConfigLoadError")throw i;if(r.verbose)console.warn(`Failed to load config from ${n}:`,i)}return null}generateConfigPaths(e,t,r){return Uv({name:e,directory:t,alias:r})}generateNamePatterns(e,t){return nf({name:e,alias:t})}checkFileAccess(e){return zI(async()=>_c(e),{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(e,t,r){let n=[];if(!_c(e))return n;if(t||r){let i=this.generateNamePatterns(t||"",r);for(let o of i)for(let s of this.extensions){let c=Zm(e,`${o}${s}`);if(await this.checkFileAccess(c))n.push(c)}}else try{let{readdirSync:i}=await import("fs"),o=i(e);for(let s of o)if(this.looksLikeConfigFile(s)){let c=Zm(e,s);if(await this.checkFileAccess(c))n.push(c)}}catch{return[]}return n}looksLikeConfigFile(e){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((r)=>r.test(e))}async validateConfigFile(e){let t=[];try{if(!_c(e))return t.push("Configuration file does not exist"),t;let r=await import(e),n=r.default||r;if(n===void 0)t.push("Configuration file must export a default value or named exports");else if(typeof n!=="object"||n===null)t.push("Configuration must be an object");else if(Array.isArray(n))t.push("Configuration cannot be an array at the root level");if(e.endsWith(".json"))try{let{readFileSync:i}=await import("fs"),o=i(e,"utf8");JSON.parse(o)}catch(i){t.push(`Invalid JSON syntax: ${i}`)}}catch(r){t.push(`Failed to load configuration file: ${r}`)}return t}async getFileModificationTime(e){try{let{statSync:t}=await import("fs");return t(e).mtime}catch{return null}}async preloadConfigurations(e,t={}){let r=new Map;return await Promise.allSettled(e.map(async(n)=>{try{let i=await this.loadFromPath(n,{},t);if(i)r.set(n,i.config)}catch(i){if(t.verbose)console.warn(`Failed to preload ${n}:`,i)}})),r}}var KI=/^https?:\/\//;class Lf{async validateConfiguration(e,t,r={}){let{stopOnFirstError:n=!1,validateRequired:i=!0,validateTypes:o=!0,customRules:s=[],trackPerformance:c=!0,verbose:l=!1}=r,a=async()=>{let f=[],T=[],D={stopOnFirstError:n,validateRequired:i,validateTypes:o,customRules:s,trackPerformance:c,verbose:l};try{if(typeof t==="string")return await this.validateWithSchemaFile(e,t,D);else if(Array.isArray(t))return this.validateWithRules(e,[...t,...s],D);else return this.validateWithJSONSchema(e,t,D)}catch(N){return f.push({path:"",message:`Validation failed: ${N}`,rule:"system"}),{isValid:!1,errors:f,warnings:T}}};if(c)return await sl.track("validateConfiguration",a);return a()}async validateWithSchemaFile(e,t,r){try{if(!HI(t))throw new Xc(t,[{path:"",message:"Schema file does not exist"}]);let n=await import(t),i=n.default||n;if(Array.isArray(i))return this.validateWithRules(e,i,r);else return this.validateWithJSONSchema(e,i,r)}catch(n){throw new Xc(t,[{path:"",message:`Failed to load schema: ${n}`}])}}validateWithJSONSchema(e,t,r){let n=[],i=[];return this.validateObjectAgainstSchema(e,t,"",n,i,r),{isValid:n.length===0,errors:n,warnings:i}}validateObjectAgainstSchema(e,t,r,n,i,o){if(o.validateTypes&&t.type){let s=Array.isArray(e)?"array":typeof e,c=Array.isArray(t.type)?t.type:[t.type];if(!c.includes(s)){if(n.push({path:r,message:`Expected type ${c.join(" or ")}, got ${s}`,expected:c.join(" or "),actual:s,rule:"type"}),o.stopOnFirstError)return}}if(t.enum&&!t.enum.includes(e)){if(n.push({path:r,message:`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"}),o.stopOnFirstError)return}if(typeof e==="string"){if(t.minLength!==void 0&&e.length<t.minLength)n.push({path:r,message:`String length must be at least ${t.minLength}`,expected:`>= ${t.minLength}`,actual:e.length,rule:"minLength"});if(t.maxLength!==void 0&&e.length>t.maxLength)n.push({path:r,message:`String length must not exceed ${t.maxLength}`,expected:`<= ${t.maxLength}`,actual:e.length,rule:"maxLength"});if(t.pattern){if(!new RegExp(t.pattern).test(e))n.push({path:r,message:`String does not match pattern ${t.pattern}`,expected:t.pattern,actual:e,rule:"pattern"})}}if(typeof e==="number"){if(t.minimum!==void 0&&e<t.minimum)n.push({path:r,message:`Value must be at least ${t.minimum}`,expected:`>= ${t.minimum}`,actual:e,rule:"minimum"});if(t.maximum!==void 0&&e>t.maximum)n.push({path:r,message:`Value must not exceed ${t.maximum}`,expected:`<= ${t.maximum}`,actual:e,rule:"maximum"})}if(Array.isArray(e)&&t.items)for(let s=0;s<e.length;s++){let c=r?`${r}[${s}]`:`[${s}]`;if(this.validateObjectAgainstSchema(e[s],t.items,c,n,i,o),o.stopOnFirstError&&n.length>0)return}if(e&&typeof e==="object"&&!Array.isArray(e)){let s=e;if(o.validateRequired&&t.required){for(let c of t.required)if(!(c in s)){if(n.push({path:r?`${r}.${c}`:c,message:`Missing required property '${c}'`,expected:"required",rule:"required"}),o.stopOnFirstError)return}}if(t.properties){for(let[c,l]of Object.entries(t.properties))if(c in s){let a=r?`${r}.${c}`:c;if(this.validateObjectAgainstSchema(s[c],l,a,n,i,o),o.stopOnFirstError&&n.length>0)return}}if(t.additionalProperties===!1){let c=new Set(Object.keys(t.properties||{}));for(let l of Object.keys(s))if(!c.has(l))i.push({path:r?`${r}.${l}`:l,message:`Additional property '${l}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(e,t,r){let n=[],i=[];for(let o of t)try{let s=this.getValueByPath(e,o.path),c=this.validateWithRule(s,o,o.path);if(n.push(...c),r.stopOnFirstError&&n.length>0)break}catch(s){n.push({path:o.path,message:`Rule validation failed: ${s}`,rule:"system"})}return{isValid:n.length===0,errors:n,warnings:i}}validateWithRule(e,t,r){let n=[];if(t.required&&(e===void 0||e===null))return n.push({path:r,message:t.message||`Property '${r}' is required`,expected:"required",rule:"required"}),n;if(e===void 0||e===null)return n;if(t.type){let i=Array.isArray(e)?"array":typeof e;if(i!==t.type)n.push({path:r,message:t.message||`Expected type ${t.type}, got ${i}`,expected:t.type,actual:i,rule:"type"})}if(t.min!==void 0){let i=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(i<t.min)n.push({path:r,message:t.message||`Value must be at least ${t.min}`,expected:`>= ${t.min}`,actual:i,rule:"min"})}if(t.max!==void 0){let i=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(i>t.max)n.push({path:r,message:t.message||`Value must not exceed ${t.max}`,expected:`<= ${t.max}`,actual:i,rule:"max"})}if(t.pattern&&typeof e==="string"){if(!t.pattern.test(e))n.push({path:r,message:t.message||`Value does not match pattern ${t.pattern}`,expected:t.pattern.toString(),actual:e,rule:"pattern"})}if(t.enum&&!t.enum.includes(e))n.push({path:r,message:t.message||`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"});if(t.validator){let i=t.validator(e);if(i)n.push({path:r,message:t.message||i,rule:"custom"})}return n}getValueByPath(e,t){if(!t)return e;let r=t.split("."),n=e;for(let i of r)if(n&&typeof n==="object"&&i in n)n=n[i];else return;return n}generateRulesFromInterface(e){let t=[],r=e.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let n of r){let[,i,o,s]=n;t.push({path:i,required:!o,type:this.mapTypeScriptType(s)})}return t}mapTypeScriptType(e){switch(e.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:KI},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}var bi=new rd("bunfig",{showTags:!0});function QI(e){if(!e)return"";let t=Array.isArray(e)?e.filter(Boolean):[e];if(t.length===0)return"";if(t.length===1)return` or alias "${t[0]}"`;return` or aliases ${t.map((r)=>`"${r}"`).join(", ")}`}class Bf{fileLoader=new Mf;envProcessor=new fl;validator=new Lf;async loadConfig(e){let t=Date.now(),{cache:r,performance:n,schema:i,validate:o,...s}=e;try{if(r?.enabled){let l=this.checkCache(s.name||"",s);if(l)return l}let c;try{c=await this.loadConfigurationStrategies(s,!0,r)}catch(l){if(s.configFile)throw l;let a=s.__strictErrorHandling;if(l instanceof Error&&l.name==="ConfigNotFoundError"){if(a)throw l;c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:[`No configuration file found for "${s.name||"config"}", using defaults with environment variables`]}}else if(l instanceof Error&&l.name==="ConfigLoadError"){let f=l.message.includes("EACCES")||l.message.includes("EPERM")||l.message.includes("permission denied"),T=!f&&(l.message.includes("syntax")||l.message.includes("Expected")||l.message.includes("Unexpected")||l.message.includes("BuildMessage")||l.message.includes("errors building")),D=l.message.includes("Configuration must export a valid object")||l.message.includes("Configuration file is empty and exports nothing");if(a&&(D||f))throw l;if(T&&(!a||!D))c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!a)c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:[`Configuration loading error, using defaults: ${l.message}`]};else throw l}else c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${l instanceof Error?l.message:String(l)}`]}}if(i||o)await this.validateConfiguration(c.config,i,o,s.name);if(r?.enabled&&c)this.cacheResult(s.name||"",c,r,s);if(n?.enabled){let l={operation:"loadConfig",duration:Date.now()-t,configName:s.name,timestamp:new Date};if(n.onMetrics)n.onMetrics(l);if(n.slowThreshold&&l.duration>n.slowThreshold)bi.warn(`Slow configuration loading detected: ${l.duration}ms for ${s.name}`);c.metrics=l}return c}catch(c){if(c instanceof Error&&c.name==="ConfigNotFoundError")throw c;let l=Date.now()-t;throw bi.error(`Configuration loading failed after ${l}ms:`,[c instanceof Error?c:Error(String(c))]),c}}async loadConfigurationStrategies(e,t=!1,r){let{name:n="",alias:i,configFile:o,cwd:s,configDir:c,defaultConfig:l,checkEnv:a=!0,arrayStrategy:f="replace",verbose:T=!1}=e,D=s||Zc.cwd(),N=[];if(o){let he=_i(D,o);N.push(he);let te=a?Ia(n,l,T):l,xe=await this.fileLoader.tryLoadFromPaths([he],te,{arrayStrategy:f,verbose:T,cacheTtl:r?.ttl,useCache:!r?.ttl||r.ttl>100});if(!xe)throw os.configNotFound(n||o,N,i);if(T)bi.success(`Configuration loaded from explicit path: ${he}`);return this.finalizeResult(xe,N,a,n,T)}let W=await this.loadLocalConfiguration(n,i,D,c,l,f,T,a,r);if(W)return N.push(...this.getLocalSearchPaths(n,i,D,c)),this.finalizeResult(W,N,a,n,T);let Y=await this.loadHomeConfiguration(n,i,l,f,T,a);if(Y)return N.push(...this.getHomeSearchPaths(n,i)),this.finalizeResult(Y,N,a,n,T);let ee=await this.loadPackageJsonConfiguration(n,i,D,l,f,T,a);if(ee)return N.push(_i(D,"package.json")),this.finalizeResult(ee,N,a,n,T);if(N.push(...this.getAllSearchPaths(n,i,D,c)),t)throw os.configNotFound(n,N,i);return{...await this.applyEnvironmentVariables(n,l,a,T),warnings:[`No configuration file found for "${n}"${QI(i)}, using defaults with environment variables`]}}async loadLocalConfiguration(e,t,r,n,i,o,s,c,l){let a=c?Ia(e,i,s):i,f=this.getLocalDirectories(r,n);for(let T of f){if(s)bi.info(`Searching for configuration in: ${T}`);let D=this.fileLoader.generateConfigPaths(e,T,t),N=await this.fileLoader.tryLoadFromPaths(D,a,{arrayStrategy:o,verbose:s,cacheTtl:l?.ttl,useCache:!l?.ttl||l.ttl>100});if(N){if(s)bi.success(`Configuration loaded from: ${N.source.path}`);return N}}return null}async loadHomeConfiguration(e,t,r,n,i,o){if(!e)return null;let s=o?Ia(e,r,i):r,c=[_i(Ls(),".config",e),_i(Ls(),".config"),Ls()];for(let l of c){if(i)bi.info(`Checking home directory: ${l}`);let a=this.fileLoader.generateConfigPaths(e,l,t),f=await this.fileLoader.tryLoadFromPaths(a,s,{arrayStrategy:n,verbose:i});if(f){if(i)bi.success(`Configuration loaded from home directory: ${f.source.path}`);return f}}return null}async loadPackageJsonConfiguration(e,t,r,n,i,o,s){let c=s?Ia(e,n,o):n;try{let l=_i(r,"package.json");if(!Vv(l))return null;let a={};try{a=JSON.parse(qv(l,"utf8"))}catch(D){if(o)bi.warn("Failed to parse package.json:",[D instanceof Error?D:Error(String(D))]);return null}let f=a[e],T=e;if(!f&&t){let D=Array.isArray(t)?t:[t];for(let N of D){if(!N)continue;if(a[N]){f=a[N],T=N;break}}}if(f&&typeof f==="object"&&!Array.isArray(f)){if(o)bi.success(`Configuration loaded from package.json: ${T}`);return{config:$f(c,f,i),source:{type:"package.json",path:l,priority:30,timestamp:new Date}}}}catch(l){if(o)bi.warn("Failed to load package.json:",[l instanceof Error?l:Error(String(l))])}return null}async applyEnvironmentVariables(e,t,r,n){if(!r||!e||typeof t!=="object"||t===null||Array.isArray(t))return{config:t,source:{type:"default",priority:10,timestamp:new Date}};return{config:Ia(e,t,n),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(e,t,r,n,i){return{config:e.config,source:e.source,path:e.source.path}}async validateConfiguration(e,t,r,n){let i=[];if(r){let o=r(e);if(o)i.push(...o)}if(t){let o=await this.validator.validateConfiguration(e,t);if(!o.isValid)i.push(...o.errors.map((s)=>s.path?`${s.path}: ${s.message}`:s.message))}if(i.length>0)throw os.configValidation(n||"unknown",i,n)}checkCache(e,t){let r=this.generateCacheKey(e,t);return jc.get(r)||null}cacheResult(e,t,r,n){let i=this.generateCacheKey(e,n);jc.set(i,t,void 0,r.ttl)}generateCacheKey(e,t){let r=[e];if(t.alias){let n=Array.isArray(t.alias)?t.alias.join(","):t.alias;r.push(`alias:${n}`)}if(t.cwd)r.push(`cwd:${t.cwd}`);if(t.configFile)r.push(`configFile:${t.configFile}`);if(t.configDir)r.push(`configDir:${t.configDir}`);if("checkEnv"in t)r.push(`checkEnv:${t.checkEnv}`);return r.join("|")}getLocalDirectories(e,t){return zv({cwd:e,configDir:t})}getAllSearchPaths(e,t,r,n){let i=[];return i.push(...this.getLocalSearchPaths(e,t,r,n)),i.push(...this.getHomeSearchPaths(e,t)),i.push(_i(r,"package.json")),i}getLocalSearchPaths(e,t,r,n){let i=this.getLocalDirectories(r,n),o=[];for(let s of i)o.push(...this.fileLoader.generateConfigPaths(e,s,t));return o}getHomeSearchPaths(e,t){if(!e)return[];let r=[_i(Ls(),".config",e),_i(Ls(),".config"),Ls()],n=[];for(let i of r)n.push(...this.fileLoader.generateConfigPaths(e,i,t));return n}async loadConfigWithResult(e){return this.loadConfig(e)}}var Wu=new Bf;async function jf(e){let t="defaultConfig"in e&&e.defaultConfig!==void 0?e.defaultConfig:{},r="cache"in e||"performance"in e||"schema"in e||"validate"in e;try{let n;if(r)n=await Wu.loadConfig(e);else n=await Wu.loadConfig({...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}});return n?.config??t}catch(n){if(e.configFile)throw n;let i=n instanceof Error?n.name:"UnknownError",o=n instanceof Error?n.message:String(n);if(!(i==="ConfigNotFoundError"||i==="ConfigLoadError"||i==="ConfigValidationError"||o.includes("config"))&&e.verbose)bi.warn("Unexpected error loading config, using defaults:",[n instanceof Error?n:Error(String(n))]);let c=r?{...e,defaultConfig:t}:{...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in e?e.checkEnv!==!1:!0)return(await Wu.applyEnvironmentVariables(c.name||"",t,!0,c.verbose||!1))?.config??t;return t}}function Ia(e,t,r=!1){let n=new fl,i=e.toUpperCase().replace(/[^A-Z0-9]/g,"_");function o(s,c=[]){let l={...s};for(let[a,f]of Object.entries(s)){let T=[...c,a],D=[`${i}_${T.join("_").toUpperCase()}`,`${i}_${T.map((Y)=>Y.toUpperCase()).join("")}`,`${i}_${T.map((Y)=>Y.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],N,W;for(let Y of D)if(N=Zc.env[Y],N!==void 0){W=Y;break}if(N!==void 0&&W)if(typeof f==="boolean")l[a]=["true","1","yes"].includes(N.toLowerCase());else if(typeof f==="number"){let Y=Number(N);if(!Number.isNaN(Y))l[a]=Y}else if(Array.isArray(f))try{l[a]=JSON.parse(N)}catch{l[a]=N.split(",").map((Y)=>Y.trim())}else l[a]=N;else if(f&&typeof f==="object"&&!Array.isArray(f))l[a]=o(f,T)}return l}return o(t)}var aO=_i(Zc.cwd(),"config"),cO=_i(Zc.cwd(),"src/generated");var Rn={project:{name:"my-project",slug:"my-project",region:"us-east-1"},environments:{production:{type:"production"}}},as=null;function ZI(e){return e.project?.slug===Rn.project?.slug&&Object.keys(e.environments??{}).length===1&&!!e.environments?.production}async function eC(){let e=[Ff(process.cwd(),"config","cloud.ts"),Ff(process.cwd(),"config","cloud.js")];for(let t of e){if(!YI(t))continue;let r=await import(`${XI(t).href}?t=${Date.now()}`),n=r.tsCloud??r.default?.tsCloud??r.default??r.cloud??r.config;if(n)return n}return null}async function tC(){if(!as){if(as=await jf({name:"cloud",defaultConfig:Rn}),ZI(as))as=await eC()??as;ea(as.stateDir)}return as}var Bi=tC;var rC=async(e)=>{let t=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),[r,n,i]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:n,stderr:i}};class Mr{async scan(e,t){return Ki(e,t)}async exec(e,t){if(e.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return rC(["ssh","-p",String(e.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${e.sshUser}@${e.endpoint}`,t])}}var nC=ur,iC=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class it{provider;transport;discoverer;constructor(e,t=new Mr,r){this.provider=e;this.transport=t;this.discoverer=r}discover(e){return this.discoverer?.(e)??Promise.resolve([])}async test(e){try{let t=await this.transport.scan(e.endpoint,e.sshPort);return{reachable:!0,hostKeyAlgorithm:t.algorithm,hostKeyFingerprint:nC(t.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(e){let t=await this.transport.exec(e,iC);if(t.code!==0)throw Error(`Fleet validation failed: ${t.stderr.trim()||t.code}`);try{return JSON.parse(t.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(e,t){let r=await this.transport.exec(e,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${t.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function Uf(e,t){return{"fleet.bootstrap":async(r)=>{let n=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},i=e.get(String(n.serverId??""));if(!i)throw Error("Queued fleet server was not found.");let o=t.find((l)=>l.provider===i.provider);if(!o)throw Error(`No ${i.provider} fleet driver is configured.`);let s=Array.isArray(n.steps)?n.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),i.trustState!=="pinned"||!i.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let c=await o.bootstrap(i,s);return e.update(i.id,{bootstrapVersion:c.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:i.id,bootstrapVersion:c.version,steps:s.length}}}}var Ni=(e)=>e==null?void 0:String(e),cs=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},hl=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),resourceId:String(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:Ni(e.provider_id),region:Ni(e.region),zone:Ni(e.zone),endpoint:String(e.endpoint),sshUser:String(e.ssh_user),sshPort:Number(e.ssh_port),credentialRef:String(e.credential_ref),hostKeyAlgorithm:Ni(e.host_key_algorithm),hostKeyFingerprint:Ni(e.host_key_fingerprint),pendingHostKey:Ni(e.pending_host_key),roles:cs(e.roles,[]),labels:cs(e.labels,{}),taints:cs(e.taints,[]),capacity:cs(e.capacity,{}),usage:cs(e.usage,{}),capabilities:cs(e.capabilities,{}),status:String(e.status),trustState:String(e.trust_state),validation:cs(e.validation,void 0),bootstrapVersion:Ni(e.bootstrap_version),heartbeatAt:Ni(e.heartbeat_at),lastSeenAt:Ni(e.last_seen_at),archivedAt:Ni(e.archived_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class De{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}get(e){let t=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(e);return t?hl(t):void 0}list(e,t=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(e).map(hl).filter((r)=>t||r.status!=="archived")}findProvider(e,t,r){let n=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(e,t,r);return n?hl(n):void 0}create(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.resourceId,e.name,e.provider,e.providerId??null,e.region??null,e.zone??null,e.endpoint,e.sshUser,e.sshPort,e.credentialRef,e.hostKeyAlgorithm??null,e.hostKeyFingerprint??null,e.pendingHostKey??null,JSON.stringify(e.roles),JSON.stringify(e.labels),JSON.stringify(e.taints),JSON.stringify(e.capacity),JSON.stringify(e.usage),JSON.stringify(e.capabilities),e.status,e.trustState,JSON.stringify(e.validation??{}),e.bootstrapVersion??null,e.heartbeatAt??null,e.lastSeenAt??null,e.archivedAt??null,r,r]),this.get(t)}update(e,t){let r=this.get(e);if(!r)throw Error("Server was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[n.name,n.providerId??null,n.region??null,n.zone??null,n.endpoint,n.sshUser,n.sshPort,n.credentialRef,n.hostKeyAlgorithm??null,n.hostKeyFingerprint??null,n.pendingHostKey??null,JSON.stringify(n.roles),JSON.stringify(n.labels),JSON.stringify(n.taints),JSON.stringify(n.capacity),JSON.stringify(n.usage),JSON.stringify(n.capabilities),n.status,n.trustState,JSON.stringify(n.validation??{}),n.bootstrapVersion??null,n.heartbeatAt??null,n.lastSeenAt??null,n.archivedAt??null,i,e]),this.get(e)}}var oC=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class Pn{store;drivers;now;queue;constructor(e,t,r,n=()=>new Date){this.store=e;this.drivers=t;this.now=n;this.queue=r??new S(e.control)}driver(e){let t=this.drivers.find((r)=>r.provider===e);if(!t)throw Error(`No ${e} fleet driver is configured.`);return t}enroll(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Server name is invalid.");if(!oC.test(e.endpoint)||e.sshUser==="root"||!e.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let t=e.providerId?this.store.findProvider(e.organizationId,e.provider,e.providerId):void 0;if(t)return this.store.update(t.id,{endpoint:e.endpoint,region:e.region,zone:e.zone});let r=this.store.control.createResource({projectId:e.projectId,kind:"server",slug:e.name,name:e.name,provider:e.provider,providerId:e.providerId}),n=this.driver(e.provider);return this.store.create({...e,resourceId:r.id,sshPort:e.sshPort??22,labels:e.labels??{},taints:[],capacity:{},usage:{},capabilities:n.capabilities(),status:"pending",trustState:"unverified"})}async test(e){let t=this.store.get(e);if(!t)throw Error("Server was not found.");let r=await this.driver(t.provider).test(t);if(!r.reachable)return this.store.update(e,{status:"unreachable"});if(t.hostKeyFingerprint&&t.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(e,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(e,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(e,t){let r=this.store.get(e);if(!r||r.pendingHostKey!==t)throw Error("Pending host key does not match.");return this.store.update(e,{hostKeyFingerprint:t,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(e){let t=this.store.get(e);if(!t||t.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(t.provider).validate(t),n=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))n.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let s of["curl","tar"])if(!r.tools?.[s])n.push({code:`tool.${s}`,severity:"error",message:`${s} is missing.`,remediation:`Install ${s} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)n.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)n.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let i={valid:!n.some((s)=>s.severity==="error"),facts:r,findings:n,validatedAt:this.now().toISOString(),validatorVersion:"1"},o={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(e,{validation:i,capacity:o,status:i.valid?"ready":"degraded"})}bootstrap(e,t=!1){let r=this.store.get(e);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let n=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!t)return{preview:!0,steps:n};let i=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:e,steps:n},lockKey:`server:${e}`,providerKey:r.provider}).operation;return{preview:!1,steps:n,operation:i}}heartbeat(e,t){let r=this.store.get(e);if(!r)throw Error("Server was not found.");let n=this.now().toISOString();return this.store.update(e,{usage:t.usage,capabilities:t.capabilities??r.capabilities,heartbeatAt:n,lastSeenAt:n,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(e,t=!1){return this.store.update(e,{status:t?"drained":"draining"})}uncordon(e){return this.store.update(e,{status:"ready"})}archive(e,t){let r=this.store.get(e);if(!r||t!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(e,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as yl,createPublicKey as qf,verify as sC}from"node:crypto";function Pa(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(Pa).join(",")}]`;return`{${Object.keys(e).sort().map((t)=>`${JSON.stringify(t)}:${Pa(e[t])}`).join(",")}}`}var Jf=(e)=>yl("sha256").update(Pa(e)).digest("hex"),nd=(e)=>yl("sha256").update(Pa(e)).digest("hex"),Gf=(e)=>yl("sha256").update(qf(e).export({type:"spki",format:"der"})).digest("hex");function Wf(e,t,r){try{return sC(null,Buffer.from(Pa(e)),qf(r),Buffer.from(t,"base64"))}catch{return!1}}var zf=(e)=>e.replace(/^v/,"").split(/[.-]/).slice(0,3).map((t)=>Number(t)||0),Vf=(e,t)=>{let r=zf(e),n=zf(t);for(let i=0;i<3;i++){let o=(r[i]??0)-(n[i]??0);if(o)return o}return 0};function Hf(e,t){let r=[];if(t.schemaVersion<e.minimumSchema)r.push(`schema ${t.schemaVersion} is below ${e.minimumSchema}`);if(t.schemaVersion>e.maximumSchema)r.push(`schema ${t.schemaVersion} is above ${e.maximumSchema}`);if(e.minimumVersion&&Vf(t.currentVersion,e.minimumVersion)<0)r.push(`platform ${t.currentVersion} is below ${e.minimumVersion}`);if(Vf(e.version,t.currentVersion)<=0)r.push(`version ${e.version} is not newer than ${t.currentVersion}`);if(!e.artifacts.some((n)=>n.platform===t.platform&&n.architecture===t.architecture))r.push(`no artifact for ${t.platform}/${t.architecture}`);return{compatible:r.length===0,reasons:r}}var to=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},_r=(e)=>e==null?void 0:String(e),aC=(e)=>({id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),algorithm:"ed25519",publicKeyPem:String(e.public_key_pem),fingerprint:String(e.fingerprint),revokedAt:_r(e.revoked_at),createdAt:String(e.created_at)}),Kf=(e)=>({id:String(e.id),organizationId:String(e.organization_id),version:String(e.version),channel:String(e.channel),publishedAt:String(e.published_at),keyId:String(e.key_id),digest:String(e.digest),document:to(e.document,{}),signature:String(e.signature),verificationStatus:String(e.verification_status),compatibility:to(e.compatibility,{compatible:!1,reasons:[]}),createdAt:String(e.created_at)}),Qf=(e)=>({id:String(e.id),projectId:String(e.project_id),name:String(e.name),schedule:String(e.schedule),timezone:String(e.timezone),durationMinutes:Number(e.duration_minutes),allowedOperations:to(e.allowed_operations,[]),requireApproval:Number(e.require_approval)===1,enabled:Number(e.enabled)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Yf=(e)=>({id:String(e.id),projectId:String(e.project_id),manifestId:String(e.manifest_id),windowId:_r(e.window_id),fromVersion:String(e.from_version),strategy:String(e.strategy),batchSize:Number(e.batch_size),healthGate:to(e.health_gate,{}),status:String(e.status),currentStage:_r(e.current_stage),backupId:_r(e.backup_id),approvedBy:_r(e.approved_by),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),bl=(e)=>({id:String(e.id),campaignId:String(e.campaign_id),serverId:_r(e.server_id),target:String(e.target),cohort:Number(e.cohort),previousVersion:String(e.previous_version),status:String(e.status),evidence:to(e.evidence,{}),error:_r(e.error),startedAt:_r(e.started_at),finishedAt:_r(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Xf=(e)=>({id:String(e.id),projectId:String(e.project_id),kind:String(e.kind),criteria:to(e.criteria,{}),candidates:to(e.candidates,[]),candidateDigest:String(e.candidate_digest),estimatedBytes:Number(e.estimated_bytes),status:String(e.status),confirmation:_r(e.confirmation),expiresAt:String(e.expires_at),result:to(e.result,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Zf=(e)=>({id:String(e.id),projectId:String(e.project_id),backupPolicyId:_r(e.backup_policy_id),recoveryPointId:_r(e.recovery_point_id),topologyId:_r(e.topology_id),scenario:String(e.scenario),isolatedTarget:String(e.isolated_target),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),status:String(e.status),operationId:_r(e.operation_id),evidence:to(e.evidence,{}),measuredRpoMinutes:e.measured_rpo_minutes==null?void 0:Number(e.measured_rpo_minutes),measuredRtoMinutes:e.measured_rto_minutes==null?void 0:Number(e.measured_rto_minutes),cleanupVerified:Number(e.cleanup_verified)===1,error:_r(e.error),startedAt:_r(e.started_at),finishedAt:_r(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class _n{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}addTrustedKey(e){let t=this.id(),r=this.now().toISOString(),n=Gf(e.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[t,e.organizationId,e.name,e.publicKeyPem,n,r]),this.key(t)}key(e){let t=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(e);return t?aC(t):void 0}revokeKey(e){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),e]),this.key(e)}importManifest(e){let t=this.key(e.keyId);if(!t||t.organizationId!==e.organizationId)throw Error("Trusted update key was not found.");if(t.revokedAt)throw Error("Update signing key is revoked.");if(!Wf(e.document,e.signature,t.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=Hf(e.document,e.current),n=Jf(e.document),i=this.id(),o=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[i,e.organizationId,e.document.version,e.document.channel,new Date(e.document.publishedAt).toISOString(),e.keyId,n,JSON.stringify(e.document),e.signature,JSON.stringify(r),o]),this.manifest(i)}manifest(e){let t=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(e);return t?Kf(t):void 0}manifests(e){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(e).map(Kf)}createWindow(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[t,e.projectId,e.name,e.schedule,e.timezone,e.durationMinutes,JSON.stringify(e.allowedOperations),e.requireApproval===!1?0:1,r,r]),this.window(t)}window(e){let t=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(e);return t?Qf(t):void 0}windows(e){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(e).map(Qf)}createCampaign(e){return this.control.transaction(()=>{let t=this.manifest(e.manifestId);if(!t?.compatibility.compatible||t.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!e.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),n=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,e.projectId,e.manifestId,e.windowId??null,e.fromVersion,e.strategy,e.batchSize,JSON.stringify(e.healthGate),e.backupId,e.approvedBy??null,n,n]),e.targets.forEach((i,o)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,i.serverId??null,i.target,e.strategy==="canary"?o===0?0:1+Math.floor((o-1)/e.batchSize):Math.floor(o/e.batchSize),i.previousVersion,n,n])),this.campaign(r)})}campaign(e){let t=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(e);return t?Yf(t):void 0}campaigns(e){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(e).map(Yf)}targets(e){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(e).map(bl)}updateCampaign(e,t){let r=this.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let n={...r,...t};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[n.status,n.currentStage??null,this.now().toISOString(),e]),this.campaign(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e);if(!r)throw Error("Upgrade target was not found.");let n={...bl(r),...t};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[n.status,JSON.stringify(n.evidence),n.error??null,n.startedAt??null,n.finishedAt??null,this.now().toISOString(),e]),bl(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e))}createCleanup(e){let t=[...e.candidates].sort((s,c)=>s.id.localeCompare(c.id)),r=nd(t),n=this.id(),i=this.now().toISOString(),o=new Date(this.now().getTime()+(e.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[n,e.projectId,e.kind,JSON.stringify(e.criteria),JSON.stringify(t),r,t.reduce((s,c)=>s+c.bytes,0),o,i,i]),this.cleanup(n)}cleanup(e){let t=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(e);return t?Xf(t):void 0}cleanups(e){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(e).map(Xf)}updateCleanup(e,t){let r=this.cleanup(e);if(!r)throw Error("Cleanup plan was not found.");let n={...r,...t};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[n.status,n.confirmation??null,JSON.stringify(n.result),this.now().toISOString(),e]),this.cleanup(e)}createDrill(e){if(!/^isolated:\/\//.test(e.isolatedTarget))throw Error("DR drills require an isolated target.");let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[t,e.projectId,e.backupPolicyId??null,e.recoveryPointId??null,e.topologyId??null,e.scenario,e.isolatedTarget,e.expectedRpoMinutes,e.expectedRtoMinutes,r,r]),this.drill(t)}drill(e){let t=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(e);return t?Zf(t):void 0}drills(e){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(e).map(Zf)}updateDrill(e,t){let r=this.drill(e);if(!r)throw Error("DR drill was not found.");let n={...r,...t};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[n.status,n.operationId??null,JSON.stringify(n.evidence),n.measuredRpoMinutes??null,n.measuredRtoMinutes??null,n.cleanupVerified?1:0,n.error??null,n.startedAt??null,n.finishedAt??null,this.now().toISOString(),e]),this.drill(e)}}function cC(e,t=new Date){if(!e.enabled)return!1;let r=new Date(e.schedule);if(!Number.isNaN(r.getTime()))return t>=r&&t.getTime()<=r.getTime()+e.durationMinutes*60000;let n=/^(\d{2}):(\d{2})$/.exec(e.schedule);if(!n)return!1;let i=new Intl.DateTimeFormat("en-US",{timeZone:e.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(t),o=Number(i.find((c)=>c.type==="hour")?.value)*60+Number(i.find((c)=>c.type==="minute")?.value),s=Number(n[1])*60+Number(n[2]);return o>=s&&o<s+e.durationMinutes}class On{store;now;queue;constructor(e,t,r=()=>new Date){this.store=e;this.now=r;this.queue=t??new S(e.control)}enqueueCampaign(e,t={}){let r=this.store.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let n=r.windowId?this.store.window(r.windowId):void 0;if(n&&!n.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(n&&!t.overrideWindow&&!cC(n,this.now()))throw Error("Upgrade is outside its maintenance window.");if(n?.requireApproval&&!t.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let i=this.queue.enqueue({projectId:r.projectId,actorId:t.approvedBy,kind:"maintenance.upgrade",input:{campaignId:e},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(e,{status:"queued"}),operation:i}}async previewCleanup(e,t){let r=t.find((n)=>n.kind===e.kind);if(!r)throw Error(`No ${e.kind} cleanup driver is configured.`);return this.store.createCleanup({...e,candidates:await r.discover(e.criteria)})}enqueueCleanup(e,t){let r=this.store.cleanup(e);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let n=`DELETE ${r.candidates.length} ${r.kind}`;if(t!==n)throw Error(`Exact confirmation ${n} is required.`);let i=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:e},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(e,{status:"approved",confirmation:t}),operation:i}}enqueueDrill(e){let t=this.store.drill(e);if(!t||t.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.drill",input:{drillId:e},lockKey:`drill:${t.scenario}:${t.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(e,{status:"queued",operationId:r.id}),operation:r}}}var Sl=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function eh(e){return{"maintenance.upgrade":async(i)=>{let o=e.store.campaign(String(Sl(i.operation.input).campaignId??""));if(!o||!e.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let s=e.store.manifest(o.manifestId);if(!s?.compatibility.compatible||s.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let c=s.document.artifacts.find((a)=>a.platform===process.platform&&a.architecture===process.arch)??s.document.artifacts[0];if(!c)throw Error("No update artifact matches this platform.");e.store.updateCampaign(o.id,{status:"running",currentStage:"preflight"});let l=[];try{for(let a of[...new Set(e.store.targets(o.id).map((f)=>f.cohort))].sort((f,T)=>f-T)){e.store.updateCampaign(o.id,{currentStage:`cohort:${a}`});for(let f of e.store.targets(o.id).filter((T)=>T.cohort===a)){i.throwIfCancellationRequested(),i.checkpoint(`download:${f.target}`,"Downloading signed platform artifact."),e.store.updateTarget(f.id,{status:"downloading",startedAt:new Date().toISOString()});let T=await e.platform.download({target:f,artifact:c,signal:i.signal});if(T.sha256!==c.sha256)throw Error(`Artifact checksum mismatch for ${f.target}.`);i.checkpoint(`install:${f.target}`,"Installing verified artifact."),e.store.updateTarget(f.id,{status:"installing"}),await e.platform.install({target:f,path:T.path,version:s.version,signal:i.signal}),l.push(f);let D=await e.platform.health({target:f,gate:o.healthGate});if(!D.healthy)throw Error(`Upgrade health gate failed for ${f.target}.`);e.store.updateTarget(f.id,{status:"healthy",evidence:D.evidence,finishedAt:new Date().toISOString()})}}return e.store.updateCampaign(o.id,{status:"succeeded",currentStage:void 0}),{campaignId:o.id,version:s.version,targets:l.length}}catch(a){e.store.updateCampaign(o.id,{status:"rolling_back",currentStage:"rollback"});for(let f of l.reverse())e.store.updateTarget(f.id,{status:"rolling_back"}),await e.platform.rollback({target:f,version:f.previousVersion,signal:i.signal}),e.store.updateTarget(f.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw e.store.updateCampaign(o.id,{status:"rolled_back",currentStage:void 0}),a}},"maintenance.cleanup":async(i)=>{let o=e.store.cleanup(String(Sl(i.operation.input).planId??""));if(!o||o.status!=="approved")throw Error("Approved cleanup plan was not found.");if(nd([...o.candidates].sort((f,T)=>f.id.localeCompare(T.id)))!==o.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let s=e.cleanup?.find((f)=>f.kind===o.kind);if(!s)throw Error(`No ${o.kind} cleanup driver is configured.`);e.store.updateCleanup(o.id,{status:"running"});let c=[],l=[];for(let f of o.candidates){i.throwIfCancellationRequested();try{await s.remove(f),c.push(f.id)}catch(T){l.push({id:f.id,error:T instanceof Error?T.message:String(T)})}}let a=l.length?c.length?"partial":"failed":"succeeded";if(e.store.updateCleanup(o.id,{status:a,result:{removed:c,failed:l,reclaimedBytes:o.candidates.filter((f)=>c.includes(f.id)).reduce((f,T)=>f+T.bytes,0)}}),l.length)throw Error(`Cleanup failed for ${l.length} candidate(s).`);return{planId:o.id,removed:c.length,reclaimedBytes:o.estimatedBytes}},"maintenance.drill":async(i)=>{let o=e.store.drill(String(Sl(i.operation.input).drillId??""));if(!o)throw Error("DR drill was not found.");let s=e.recovery?.find((T)=>T.scenario===o.scenario);if(!s)throw Error(`No ${o.scenario} recovery driver is configured.`);let c=new Date;e.store.updateDrill(o.id,{status:"restoring",startedAt:c.toISOString()});let l=o.isolatedTarget,a={},f={};try{i.checkpoint("restore","Restoring into isolated drill target.");let T=await s.restore({drill:o,signal:i.signal});if(!T.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");l=T.target,a=T.evidence;let D=(c.getTime()-new Date(T.recoveryPointAt).getTime())/60000;e.store.updateDrill(o.id,{status:"verifying",measuredRpoMinutes:D,evidence:{restore:a}}),i.checkpoint("verify","Running recovery health checks without production traffic.");let N=await s.verify({drill:o,target:l});f=N.evidence;let W=(Date.now()-c.getTime())/60000;if(!N.healthy||D>o.expectedRpoMinutes||W>o.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");e.store.updateDrill(o.id,{measuredRpoMinutes:D,measuredRtoMinutes:W,evidence:{restore:a,verify:f}})}catch(T){throw e.store.updateDrill(o.id,{status:"failed",error:T instanceof Error?T.message:String(T),evidence:{restore:a,verify:f}}),T}finally{e.store.updateDrill(o.id,{status:"cleaning"});try{await s.cleanup({drill:o,target:l});let T=e.store.drill(o.id);e.store.updateDrill(o.id,{status:T.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(T){e.store.updateDrill(o.id,{status:"cleanup_required",cleanupVerified:!1,error:T instanceof Error?T.message:String(T),finishedAt:new Date().toISOString()})}}return{drillId:o.id,status:e.store.drill(o.id).status}}}}var th={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class $n{kind;control;projectId;organizationId;constructor(e,t,r,n){this.kind=e;this.control=t;this.projectId=r;this.organizationId=n}async discover(e){let t=Math.max(1,Math.min(3650,Number(e.olderThanDays??30))),r=new Date(Date.now()-t*86400000).toISOString(),n=th[this.kind],i=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(n.select).all(i,r).map((s)=>({id:String(s.id),kind:this.kind,label:`${this.kind}:${String(s.id)}`,bytes:Number(s.bytes??0),metadata:{createdAt:String(s.created_at)}}))}async remove(e){if(this.control.database.run(th[this.kind].remove,[e.id]).changes!==1)throw Error(`${e.label} changed or is no longer removable.`)}}var wi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},yn=(e)=>e==null?void 0:String(e),ih=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),Qs=(e={})=>({...ih(),...e});function rh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),purpose:String(e.purpose),backend:String(e.backend),region:yn(e.region),architecture:yn(e.architecture),labels:wi(e.labels,{}),requiredServerLabels:wi(e.required_server_labels,{}),toleratedTaints:wi(e.tolerated_taints,[]),capacity:Qs(wi(e.capacity,{})),reserved:wi(e.reserved,{}),maxWorkloads:Number(e.max_workloads),costWeight:Number(e.cost_weight),spreadKey:yn(e.spread_key),concurrency:Number(e.concurrency),ephemeralWorkspaces:Number(e.ephemeral_workspaces)===1,allowProductionSecrets:Number(e.allow_production_secrets)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function nh(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:yn(e.environment_id),resourceId:String(e.resource_id),releaseId:yn(e.release_id),poolId:String(e.pool_id),serverId:yn(e.server_id),purpose:String(e.purpose),requirements:wi(e.requirements,{}),decision:wi(e.decision,{}),stateful:Number(e.stateful)===1,autoReschedule:Number(e.auto_reschedule)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function dC(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:yn(e.resource_id),poolId:String(e.pool_id),placementId:yn(e.placement_id),operationId:yn(e.operation_id),sourceSha:String(e.source_sha),buildSpec:wi(e.build_spec,{}),credentialPolicy:wi(e.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:yn(e.workspace),cacheKey:yn(e.cache_key),artifactUri:yn(e.artifact_uri),artifactDigest:yn(e.artifact_digest),status:String(e.status),cleanupAt:yn(e.cleanup_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Dn{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}createPool(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.purpose,e.backend,e.region??null,e.architecture??null,JSON.stringify(e.labels),JSON.stringify(e.requiredServerLabels),JSON.stringify(e.toleratedTaints),JSON.stringify(Qs(e.capacity)),"{}",e.maxWorkloads,e.costWeight,e.spreadKey??null,e.concurrency,e.ephemeralWorkspaces?1:0,e.allowProductionSecrets?1:0,e.status,r,r]),this.getPool(t)}getPool(e){let t=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(e);return t?rh(t):void 0}listPools(e){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(e).map(rh)}updatePool(e,t){let r=this.getPool(e);if(!r)throw Error("Capacity pool was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[n.status,JSON.stringify(n.reserved),JSON.stringify(n.capacity),n.concurrency,i,e]),this.getPool(e)}addMember(e,t,r={}){let n=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[e,t,JSON.stringify(r),n,n])}members(e){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(e).map((t)=>({serverId:String(t.server_id),status:String(t.status),capacityOverride:wi(t.capacity_override,{})}))}memberStatus(e,t,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),e,t])}listPlacements(e,t){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(e).map(nh);return t?.length?r.filter((n)=>t.includes(n.status)):r}getPlacement(e){let t=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(e);return t?nh(t):void 0}activeUsage(e,t){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(e,this.now().toISOString()),n=t?r.filter((i)=>String(i.server_id)===t):r;return{resources:n.reduce((i,o)=>{let s=Qs(wi(o.resources,{}));for(let c of Object.keys(i))i[c]+=s[c];return i},ih()),count:n.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(e){return this.control.transaction(()=>{this.expireLeases();let t=this.id(),r=this.id(),n=this.now().toISOString(),i=new Date(this.now().getTime()+(e.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[t,e.projectId,e.environmentId??null,e.resourceId,e.releaseId??null,e.decision.poolId,e.decision.serverId??null,e.requirements.purpose,JSON.stringify(e.requirements),JSON.stringify(e.decision),e.requirements.stateful?1:0,e.requirements.autoReschedule&&!e.requirements.stateful?1:0,n,n]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,t,e.decision.poolId,e.decision.serverId??null,JSON.stringify(Qs(e.requirements.resources)),i,n,n]),this.getPlacement(t)})}transitionPlacement(e,t){if(!this.getPlacement(e))throw Error("Placement was not found.");let n=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[t,n,e]),["released","failed","blocked"].includes(t))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[n,e]);return this.getPlacement(e)}createBuild(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[t,e.projectId,e.resourceId??null,e.poolId,e.placementId??null,e.operationId??null,e.sourceSha,JSON.stringify(e.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:e.tokenExpiresAt}),r,r]),this.getBuild(t)}getBuild(e){let t=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(e);return t?dC(t):void 0}updateBuild(e,t){let r=this.getBuild(e);if(!r)throw Error("Remote build was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[n.operationId??null,n.workspace??null,n.cacheKey??null,n.artifactUri??null,n.artifactDigest??null,n.status,n.cleanupAt??null,i,e]),this.getBuild(e)}}var id=["cpu","memoryBytes","diskBytes","gpu"],oh=(e,t={})=>Object.entries(t).every(([r,n])=>e[r]===n),uC=(e,t,r)=>Object.fromEntries(id.map((n)=>[n,Math.max(0,e[n]-t[n]-(r[n]??0))])),lC=(e,t)=>id.every((r)=>e[r]>=(t[r]??0)),pC=(e,t)=>id.reduce((r,n)=>r+(t[n]??0)/(e[n]||1),0);class Nn{store;fleet;constructor(e,t){this.store=e;this.fleet=t}poolCandidates(e,t,r){let n=[];for(let i of this.store.listPools(e)){if(i.id===r)continue;let o=[];if(i.status!=="active")o.push(`pool is ${i.status}`);if(i.purpose!==t.purpose)o.push(`purpose is ${i.purpose}`);if(t.region&&i.region!==t.region)o.push(`region is ${i.region??"unset"}`);if(t.architecture&&i.architecture!==t.architecture)o.push(`architecture is ${i.architecture??"unset"}`);if(!oh(i.labels,t.labels))o.push("pool labels do not match");if(i.backend==="server"){let s=this.store.members(i.id);if(!s.length)n.push(this.decision(i,void 0,t,[...o,"pool has no servers"]));for(let c of s){let l=this.fleet.get(c.serverId),a=[...o];if(!l)a.push("server is missing");else this.serverReasons(i,l,c.status,t,a);n.push(this.decision(i,l,t,a,c.capacityOverride))}}else n.push(this.decision(i,void 0,t,o))}return n.sort((i,o)=>Number(o.eligible)-Number(i.eligible)||i.score.cost-o.score.cost||i.score.spread-o.score.spread||i.score.fit-o.score.fit||i.poolName.localeCompare(o.poolName)||(i.serverId??"").localeCompare(o.serverId??""))}serverReasons(e,t,r,n,i){if(r!=="active")i.push(`member is ${r}`);if(t.status!=="ready")i.push(`server is ${t.status}`);if(!t.roles.includes(n.purpose==="build"?"build":n.purpose))i.push(`server lacks ${n.purpose} role`);if(!oh(t.labels,e.requiredServerLabels))i.push("server labels do not match pool selector");for(let o of t.taints)if(!e.toleratedTaints.includes(o))i.push(`taint ${o} is not tolerated`)}decision(e,t,r,n,i={}){let o=Qs({...t?.capacity,...i}),s=t?Object.fromEntries(id.map((a)=>[a,Math.min(e.capacity[a],o[a])])):e.capacity,c=this.store.activeUsage(e.id,t?.id),l=uC(s,c.resources,e.reserved);if(c.count>=e.maxWorkloads)n.push("workload limit reached");if(r.purpose==="build"&&c.count>=e.concurrency)n.push("build concurrency reached");if(!lC(l,r.resources))n.push("insufficient capacity");return{poolId:e.id,poolName:e.name,serverId:t?.id,eligible:n.length===0,reasons:n,available:l,score:{fit:pC(l,r.resources),spread:c.count,cost:e.costWeight}}}explain(e,t){return this.poolCandidates(e,t)}place(e){return this.store.control.transaction(()=>{let t=this.poolCandidates(e.projectId,e.requirements).find((r)=>r.eligible);if(!t)throw Error(`No eligible capacity: ${this.explain(e.projectId,e.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...e,decision:t})})}activate(e){return this.store.transitionPlacement(e,"active")}release(e){return this.store.transitionPlacement(e,"released")}drainPool(e){let t=this.store.updatePool(e,{status:"draining"}),r=[],n=[];for(let i of this.store.listPlacements(t.projectId,["reserved","active"]).filter((o)=>o.poolId===e)){if(i.stateful){n.push(this.store.transitionPlacement(i.id,"blocked"));continue}this.store.transitionPlacement(i.id,"moving");let o=this.place({projectId:i.projectId,environmentId:i.environmentId,resourceId:i.resourceId,releaseId:i.releaseId,requirements:i.requirements});r.push(this.activate(o.id)),this.store.transitionPlacement(i.id,"released")}return{pool:t,moved:r,blocked:n}}drainServer(e,t){this.store.memberStatus(e,t,"draining");let r=this.store.getPool(e);if(!r)throw Error("Capacity pool was not found.");let n=[],i=[];for(let o of this.store.listPlacements(r.projectId,["reserved","active"]).filter((s)=>s.poolId===e&&s.serverId===t)){if(o.stateful){i.push(this.store.transitionPlacement(o.id,"blocked"));continue}this.store.transitionPlacement(o.id,"moving");let s=this.poolCandidates(o.projectId,o.requirements).find((l)=>l.eligible);if(!s){i.push(this.store.transitionPlacement(o.id,"blocked"));continue}let c=this.store.reserve({projectId:o.projectId,environmentId:o.environmentId,resourceId:o.resourceId,releaseId:o.releaseId,requirements:o.requirements,decision:s});n.push(this.activate(c.id)),this.store.transitionPlacement(o.id,"released")}return{moved:n,blocked:i}}reconcileFailure(e){let t=this.fleet.get(e);if(!t)throw Error("Server was not found.");let r=[],n=[];for(let i of this.store.listPlacements(t.projectId,["active"]).filter((o)=>o.serverId===e)){if(i.stateful||!i.autoReschedule){n.push(this.store.transitionPlacement(i.id,"blocked"));continue}this.store.transitionPlacement(i.id,"failed");let o=this.place({projectId:i.projectId,environmentId:i.environmentId,resourceId:i.resourceId,releaseId:i.releaseId,requirements:i.requirements});r.push(this.activate(o.id))}return{rescheduled:r,blocked:n}}}var ro=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},li=(e)=>e==null?void 0:String(e),sh=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:li(e.environment_id),name:String(e.name),hostname:String(e.hostname),homeRegion:String(e.home_region),regions:ro(e.regions,[]),trafficPolicy:String(e.traffic_policy),dataPolicy:ro(e.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(e.status),activeRegion:String(e.active_region),revision:li(e.revision),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),vl=(e)=>({id:String(e.id),topologyId:String(e.topology_id),region:String(e.region),role:String(e.role),provider:String(e.provider),stackId:li(e.stack_id),stackRevision:li(e.stack_revision),status:String(e.status),health:ro(e.health,{}),lastHealthyAt:li(e.last_healthy_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),wl=(e)=>({id:String(e.id),topologyId:String(e.topology_id),kind:String(e.kind),sourceRegion:String(e.source_region),targetRegion:String(e.target_region),config:ro(e.config,{}),status:String(e.status),checkpoint:li(e.checkpoint),lagSeconds:e.lag_seconds==null?void 0:Number(e.lag_seconds),lastVerifiedAt:li(e.last_verified_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Il=(e)=>({id:String(e.id),topologyId:String(e.topology_id),hostname:String(e.hostname),dnsProvider:String(e.dns_provider),cdnEnabled:Number(e.cdn_enabled)===1,wafEnabled:Number(e.waf_enabled)===1,weights:ro(e.weights,{}),desiredWeights:ro(e.desired_weights,{}),status:String(e.status),providerState:ro(e.provider_state,{}),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),ah=(e)=>({id:String(e.id),topologyId:String(e.topology_id),operationId:li(e.operation_id),kind:String(e.kind),requestedRegion:li(e.requested_region),revision:li(e.revision),plan:ro(e.plan,[]),currentStep:li(e.current_step),completedSteps:ro(e.completed_steps,[]),status:String(e.status),error:li(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class kn{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}create(e){return this.control.transaction(()=>{if(e.regions.length<2||new Set(e.regions.map((o)=>o.region)).size!==e.regions.length||e.regions.filter((o)=>o.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let t=e.regions.find((o)=>o.role==="primary"),r=this.id(),n=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.name,e.hostname,t.region,JSON.stringify(e.regions),e.trafficPolicy,JSON.stringify(e.dataPolicy),t.region,n,n]);for(let o of e.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,o.region,o.role,o.provider,n,n]);for(let o of e.dataPolicy.replicate)for(let s of e.regions)for(let c of e.regions.filter((l)=>l.region!==s.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,o,s.region,c.region,"{}",n,n]);let i=Object.fromEntries(e.regions.map((o)=>[o.region,o.region===t.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,e.hostname,e.dnsProvider??"route53",e.cdnEnabled?1:0,e.wafEnabled?1:0,JSON.stringify(i),JSON.stringify(i),n,n]),this.get(r)})}get(e){let t=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(e);return t?sh(t):void 0}list(e){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(e).map(sh)}targets(e){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(e).map(vl)}channels(e){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(e).map(wl)}route(e){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(e);return t?Il(t):void 0}updateTopology(e,t){let r=this.get(e);if(!r)throw Error("Regional topology was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[n.status,n.activeRegion,n.revision??null,JSON.stringify(n.regions),i,e]),this.get(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e);if(!r)throw Error("Regional target was not found.");let n=vl(r),i={...n,...t},o=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[i.role,i.stackId??null,i.stackRevision??null,i.status,JSON.stringify(i.health),i.lastHealthyAt??null,o,e]),vl(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e))}updateChannel(e,t){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e);if(!r)throw Error("Replication channel was not found.");let n=wl(r),i={...n,...t},o=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[i.status,i.checkpoint??null,i.lagSeconds??null,i.lastVerifiedAt??null,o,e]),wl(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e))}updateRoute(e,t){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e);if(!r)throw Error("Traffic route was not found.");let n=Il(r),i={...n,...t},o=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(i.weights),JSON.stringify(i.desiredWeights),i.status,JSON.stringify(i.providerState),o,e]),Il(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e))}createExecution(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[t,e.topologyId,e.operationId??null,e.kind,e.requestedRegion??null,e.revision??null,JSON.stringify(e.plan),r,r]),this.execution(t)}execution(e){let t=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(e);return t?ah(t):void 0}executions(e){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(e).map(ah)}updateExecution(e,t){let r=this.execution(e);if(!r)throw Error("Regional execution was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[n.operationId??null,n.currentStep??null,JSON.stringify(n.completedSteps),n.status,n.error??null,i,e]),this.execution(e)}}class xn{store;queue;constructor(e,t){this.store=e;this.queue=t??new S(e.control)}create(e){return this.store.create(e)}plan(e,t,r){if(!this.store.get(e))throw Error("Regional topology was not found.");let i=this.store.targets(e),o=this.store.channels(e);if(t==="rollout")return[...i.filter((s)=>s.role==="secondary").map((s)=>`apply:${s.region}`),...i.filter((s)=>s.role==="primary").map((s)=>`apply:${s.region}`),...o.map((s)=>`replicate:${s.kind}:${s.targetRegion}`),"traffic:activate"];if(t==="failover"||t==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(t==="destroy")return["traffic:drain",...i.filter((s)=>s.role==="secondary").map((s)=>`delete:${s.region}`),...i.filter((s)=>s.role==="primary").map((s)=>`delete:${s.region}`),"complete"];return["observe","repair"]}enqueue(e){let t=this.store.get(e.topologyId);if(!t)throw Error("Regional topology was not found.");if(["failover","failback"].includes(e.kind)&&(!e.targetRegion||!t.regions.some((o)=>o.region===e.targetRegion)))throw Error("A topology target region is required.");if(e.kind==="failover"&&e.targetRegion===t.activeRegion)throw Error("Target region is already active.");if((e.kind==="destroy"||e.deleteData)&&e.confirmation!==t.name)throw Error("Exact topology name confirmation is required.");if(e.deleteData&&t.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(e.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(e.revision??""))throw Error("An immutable revision is required.");let r=this.plan(t.id,e.kind,e.targetRegion),n=this.store.createExecution({topologyId:t.id,kind:e.kind,requestedRegion:e.targetRegion,revision:e.revision,plan:r}),i=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,kind:`region.${e.kind}`,input:{executionId:n.id,manifest:e.manifest??{},deleteData:e.deleteData===!0},lockKey:`regional-topology:${t.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(n.id,{operationId:i.id}),{execution:this.store.execution(n.id),operation:i}}}var gC=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function ch(e,t){let r=(a)=>{let f=t.find((T)=>T.provider===a.provider);if(!f)throw Error(`No ${a.provider} regional driver is configured.`);return f},n=(a,f,T)=>{a.throwIfCancellationRequested(),a.checkpoint(T,T),e.updateExecution(f.id,{status:"running",currentStep:T,completedSteps:[...e.execution(f.id).completedSteps,T]})},i=async(a,f)=>{let T=e.route(a.id);if(!T)throw Error("Regional traffic route was not found.");let D=e.targets(a.id).find((W)=>W.region===a.activeRegion)??e.targets(a.id)[0];if(!D)throw Error("Regional traffic target was not found.");e.updateRoute(T.id,{status:"applying",desiredWeights:f});let N=await r(D).applyTraffic({route:e.route(a.id),topology:a,weights:f});e.updateRoute(T.id,{status:Object.values(f).every((W)=>W===0)?"drained":"in_sync",weights:f,providerState:N.providerState})},o=async(a,f,T,D)=>{e.updateTopology(T.id,{status:"provisioning"});let N=f.revision,W=D.manifest??{},Y=e.targets(T.id).sort((ne,he)=>Number(ne.role==="primary")-Number(he.role==="primary"));for(let ne of Y){n(a,f,`apply:${ne.region}`),e.updateTarget(ne.id,{status:"provisioning"});let he=await r(ne).applyStack({target:ne,revision:N,manifest:W,signal:a.signal}),te=await r(ne).health({target:e.updateTarget(ne.id,{stackId:he.stackId,stackRevision:N})});if(!te.healthy)throw Error(`Regional health gate failed in ${ne.region}.`);e.updateTarget(ne.id,{status:"ready",health:te.evidence,lastHealthyAt:new Date().toISOString()})}for(let ne of e.channels(T.id)){n(a,f,`replicate:${ne.kind}:${ne.targetRegion}`),e.updateChannel(ne.id,{status:"configuring"});let he=Y.find((tt)=>tt.region===ne.sourceRegion),te=await r(he).configureReplication({channel:ne,topology:T}),xe=await r(he).verifyReplication({channel:e.updateChannel(ne.id,{checkpoint:te.checkpoint,lagSeconds:te.lagSeconds}),topology:T});if(!xe.healthy||xe.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${ne.kind} replication to ${ne.targetRegion} exceeds the RPO.`);e.updateChannel(ne.id,{status:"in_sync",checkpoint:xe.checkpoint,lagSeconds:xe.lagSeconds,lastVerifiedAt:new Date().toISOString()})}n(a,f,"traffic:activate");let ee=Object.fromEntries(T.regions.map((ne)=>[ne.region,ne.region===T.activeRegion?100:0]));return await i(T,ee),e.updateTopology(T.id,{status:"ready",revision:N}),{revision:N,activeRegion:T.activeRegion}},s=async(a,f,T)=>{let D=f.requestedRegion,N=e.targets(T.id).find((ee)=>ee.region===D);if(!N)throw Error("Requested regional target was not found.");e.updateTopology(T.id,{status:f.kind==="failover"?"failing_over":"failing_back"}),n(a,f,`health:${D}`);let W=await r(N).health({target:N});if(!W.healthy)throw Error(`Target region ${D} is unhealthy.`);e.updateTarget(N.id,{status:"ready",health:W.evidence,lastHealthyAt:new Date().toISOString()}),n(a,f,`replication:${D}`);for(let ee of e.channels(T.id).filter((ne)=>ne.targetRegion===D)){let ne=await r(N).verifyReplication({channel:ee,topology:T});if(!ne.healthy||ne.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${ee.kind} replication is outside the failover RPO.`);e.updateChannel(ee.id,{status:"in_sync",checkpoint:ne.checkpoint,lagSeconds:ne.lagSeconds,lastVerifiedAt:new Date().toISOString()})}n(a,f,`traffic:${D}`),await i(T,Object.fromEntries(T.regions.map((ee)=>[ee.region,ee.region===D?100:0]))),n(a,f,`roles:${D}`);let Y=T.regions.map((ee)=>({...ee,role:ee.region===D?"primary":"secondary"}));for(let ee of e.targets(T.id))e.updateTarget(ee.id,{role:ee.region===D?"primary":"secondary"});return e.updateTopology(T.id,{status:f.kind==="failover"?"failed_over":"ready",activeRegion:D,regions:Y}),{activeRegion:D}},c=async(a,f,T,D)=>{e.updateTopology(T.id,{status:"destroying"}),n(a,f,"traffic:drain"),await i(T,Object.fromEntries(T.regions.map((W)=>[W.region,0])));let N=D.deleteData!==!0;for(let W of e.targets(T.id).sort((Y,ee)=>Number(Y.role==="primary")-Number(ee.role==="primary")))n(a,f,`delete:${W.region}`),e.updateTarget(W.id,{status:"deleting"}),await r(W).deleteStack({target:W,retainData:N,signal:a.signal}),e.updateTarget(W.id,{status:"deleted"});return n(a,f,"complete"),e.updateTopology(T.id,{status:"destroyed"}),{destroyed:!0,dataRetained:N}},l=async(a)=>{let f=gC(a.operation.input),T=e.execution(String(f.executionId??""));if(!T)throw Error("Regional execution was not found.");let D=e.get(T.topologyId);if(!D)throw Error("Regional topology was not found.");try{let N;if(T.kind==="rollout")N=await o(a,T,D,f);else if(T.kind==="failover"||T.kind==="failback")N=await s(a,T,D);else if(T.kind==="destroy")N=await c(a,T,D,f);else throw Error("Regional reconciliation is not configured.");return e.updateExecution(T.id,{status:"succeeded",currentStep:void 0}),{executionId:T.id,...N}}catch(N){if(e.updateExecution(T.id,{status:a.cancellationRequested()?"cancelled":"failed",error:N instanceof Error?N.message:String(N)}),e.get(D.id)?.status!=="destroyed")e.updateTopology(D.id,{status:"failed"});throw N}};return{"region.rollout":l,"region.failover":l,"region.failback":l,"region.destroy":l,"region.reconcile":l}}class Cl{provider;reason;constructor(e,t="Configure a regional provider transport before executing this operation."){this.provider=e;this.reason=t}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function $i(e,t,r){return[e,t,r].map((n)=>encodeURIComponent(n)).join(":")}function mC(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function ds(e,t,r=["exec","files"]){let n=mC(t);for(let i of e)n[i]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(i),requiresRecentAuth:r.includes(i)};return n}var fC=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function io(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function no(e){if(Array.isArray(e))return e.map((r)=>no(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,n]of Object.entries(e))t[r]=fC.test(r)?"[REDACTED]":no(n);return t}function us(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function dh(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function hC(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function uh(e,t={},r={}){let n=t.now??new Date,i=Math.max(100,r.timeoutMs??1e4),o=Math.max(1,r.staleAfterSeconds??60),s=await Promise.all(e.map(async(l)=>{try{let a=await Promise.race([l.discover({...t,now:n}),new Promise((f,T)=>setTimeout(()=>T(Error(`Runtime source ${l.id} timed out after ${i}ms`)),i))]);return{workloads:a,source:{id:l.id,provider:l.provider,status:"fresh",discoveredAt:n.toISOString(),staleAfterSeconds:o,itemCount:a.length}}}catch(a){return{workloads:[],source:{id:l.id,provider:l.provider,status:hC(a),discoveredAt:n.toISOString(),staleAfterSeconds:o,itemCount:0,message:String(a?.message??a).slice(0,500)}}}})),c=s.map((l)=>l.source);return{generatedAt:n.toISOString(),workloads:s.flatMap((l)=>l.workloads).sort((l,a)=>l.name.localeCompare(a.name)||l.id.localeCompare(a.id)),sources:c,degraded:c.some((l)=>l.status!=="fresh")}}function yC(e,t){if(!t)return e;return e.startsWith(t)?e.slice(t.length):e}function lh(e,t,r){let n=yC(e,t);return`${r??""}${n}`}function ph(e,t,r){if(r&&r.some((n)=>e.startsWith(n)))return!1;if(t&&t.length>0)return t.some((n)=>e.startsWith(n));return!0}async function bC(e,t,r){let n=0,i=[],o=Math.max(1,Math.min(t,e.length||1));for(let s=0;s<o;s++)i.push((async()=>{while(!0){let c=n++;if(c>=e.length)return;await r(e[c],c)}})());await Promise.all(i)}function gh(e){if(e.client)return e.client;return mh({provider:e.provider,region:e.region,endpoint:e.endpoint,forcePathStyle:e.forcePathStyle,credentials:e.credentials})}async function Xs(e){let t=e.concurrency??8,r=gh(e.from),n=gh(e.to),i=await r.listAllObjects({bucket:e.from.bucket,prefix:e.from.prefix}),o={copied:0,skipped:0,excluded:0,bytesCopied:0,errors:[],excludedKeys:[],deleted:[]},s=[];for(let f of i){if(!ph(f.Key,e.include,e.exclude)){o.excluded++,o.excludedKeys.push(f.Key);continue}s.push({source:f,destKey:lh(f.Key,e.from.prefix,e.to.prefix)})}if(e.dryRun){o.plan=s.map(({source:D,destKey:N})=>({key:D.Key,destKey:N,size:D.Size}));let f=i.length,T=0;for(let D of i){T++;let N=!ph(D.Key,e.include,e.exclude);e.onProgress?.({key:D.Key,destKey:N?"":lh(D.Key,e.from.prefix,e.to.prefix),size:D.Size,action:N?"excluded":"planned",index:T,total:f})}return o}let c=s.length,l=0;await bC(s,t,async({source:f,destKey:T})=>{let D=++l;try{if(!e.force){let Y=await n.headObject(e.to.bucket,T);if(Y&&Y.ContentLength===f.Size){o.skipped++,e.onProgress?.({key:f.Key,destKey:T,size:f.Size,action:"skipped",index:D,total:c});return}}let{body:N,contentType:W}=await r.getObjectBytes(e.from.bucket,f.Key);await n.putObject({bucket:e.to.bucket,key:T,body:N,contentType:W}),o.copied++,o.bytesCopied+=N.byteLength,e.onProgress?.({key:f.Key,destKey:T,size:f.Size,action:"copied",index:D,total:c})}catch(N){o.errors.push({key:f.Key,message:N?.message??String(N)}),e.onProgress?.({key:f.Key,destKey:T,size:f.Size,action:"error",index:D,total:c})}});let a=new Set(s.map((f)=>f.destKey));if(e.deleteExtraneous){let T=(await n.listAllObjects({bucket:e.to.bucket,prefix:e.to.prefix})).filter((D)=>!a.has(D.Key)).map((D)=>D.Key);for(let D of T)try{await n.deleteObject(e.to.bucket,D),o.deleted.push(D)}catch(N){o.errors.push({key:D,message:`delete failed: ${N?.message??String(N)}`})}}if(e.verify){let f=await n.listAllObjects({bucket:e.to.bucket,prefix:e.to.prefix}),T=new Map(f.map((Y)=>[Y.Key,Y.Size])),D=[],N=[],W=0;for(let{source:Y,destKey:ee}of s){if(!T.has(ee)){D.push(ee);continue}let ne=T.get(ee);if(ne!==Y.Size){N.push({key:ee,expected:Y.Size,actual:ne});continue}W++}o.verification={ok:D.length===0&&N.length===0,matched:W,missing:D,sizeMismatches:N}}return o}var SC={aws:"us-east-1",backblaze:"us-west-004",hetzner:"fsn1"};function vC(e,t){switch(e){case"backblaze":return`s3.${t}.backblazeb2.com`;case"hetzner":return`${t}.your-objectstorage.com`;case"aws":default:return}}function Cn(...e){for(let t of e){let r=process.env[t];if(r)return r}return}function wC(e,t){if(t?.accessKeyId&&t.secretAccessKey)return t;let r,n;if(e==="backblaze")r=Cn("B2_APPLICATION_KEY_ID","B2_KEY_ID","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),n=Cn("B2_APPLICATION_KEY","B2_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else if(e==="hetzner")r=Cn("HETZNER_S3_ACCESS_KEY","HETZNER_ACCESS_KEY","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),n=Cn("HETZNER_S3_SECRET_KEY","HETZNER_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else r=Cn("S3_ACCESS_KEY_ID"),n=Cn("S3_SECRET_ACCESS_KEY");if(r&&n)return{accessKeyId:r,secretAccessKey:n,sessionToken:Cn("AWS_SESSION_TOKEN")};return}function IC(e={}){let t=e.provider||Cn("OBJECT_STORAGE_PROVIDER","STORAGE_PROVIDER")||"aws",r=e.region||(t==="backblaze"?Cn("B2_REGION"):void 0)||(t==="hetzner"?Cn("HETZNER_S3_REGION","HETZNER_REGION"):void 0)||Cn("S3_REGION","AWS_REGION","AWS_DEFAULT_REGION")||SC[t],n=e.endpoint||Cn("S3_ENDPOINT")||vC(t,r),i=e.forcePathStyle??Cn("S3_FORCE_PATH_STYLE")==="true",o=wC(t,e.credentials),s=(c)=>{let l=n||`s3.${r}.amazonaws.com`;return i?`https://${l}/${c}`:`https://${c}.${l}`};return{provider:t,region:r,endpoint:n,forcePathStyle:i,credentials:o,profile:e.profile,publicBaseUrl:s}}function mh(e={}){let t=IC(e),r={endpoint:t.endpoint,forcePathStyle:t.forcePathStyle,credentials:t.credentials};return new g(t.region,t.profile,r)}class kt{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new u(void 0,{profile:t})}async describeServices(e){let t={cluster:e.cluster,services:e.services};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async listServices(e,t={}){let r={cluster:e,...t};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTasks(e,t,r={}){let n={cluster:e,...r};if(t)n.serviceName=t;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(n)})}async describeTasks(e,t){let r={cluster:e,tasks:t};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async updateService(e){let t={cluster:e.cluster,service:e.service};if(e.forceNewDeployment!==void 0)t.forceNewDeployment=e.forceNewDeployment;if(e.desiredCount!==void 0)t.desiredCount=e.desiredCount;if(e.taskDefinition)t.taskDefinition=e.taskDefinition;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.UpdateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async createService(e){let t={cluster:e.cluster,serviceName:e.serviceName,taskDefinition:e.taskDefinition,desiredCount:e.desiredCount};if(e.launchType)t.launchType=e.launchType;if(e.networkConfiguration)t.networkConfiguration=e.networkConfiguration;if(e.loadBalancers)t.loadBalancers=e.loadBalancers;if(e.healthCheckGracePeriodSeconds!==void 0)t.healthCheckGracePeriodSeconds=e.healthCheckGracePeriodSeconds;if(e.deploymentConfiguration)t.deploymentConfiguration=e.deploymentConfiguration;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.CreateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async deleteService(e){let t={cluster:e.cluster,service:e.service};if(e.force!==void 0)t.force=e.force;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeleteService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async listClusters(e={}){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async describeClusters(e){let t={clusters:e,include:["ATTACHMENTS","CONFIGURATIONS","SETTINGS","STATISTICS","TAGS"]};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async stopTask(e){let t={cluster:e.cluster,task:e.task};if(e.reason)t.reason=e.reason;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.StopTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async runTask(e){let t={cluster:e.cluster,taskDefinition:e.taskDefinition};if(e.count!==void 0)t.count=e.count;if(e.launchType)t.launchType=e.launchType;if(e.networkConfiguration)t.networkConfiguration=e.networkConfiguration;if(e.overrides)t.overrides=e.overrides;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RunTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async registerTaskDefinition(e){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async deregisterTaskDefinition(e){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeregisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:e})})}async describeTaskDefinition(e){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:e,include:["TAGS"]})})}async listTaskDefinitionFamilies(e){let t={};if(e?.familyPrefix)t.familyPrefix=e.familyPrefix;if(e?.status)t.status=e.status;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTaskDefinitionFamilies","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async waitForServiceStable(e,t,r=40,n=15000){for(let i=0;i<r;i++){let s=(await this.describeServices({cluster:e,services:[t]})).services?.[0];if(s){let c=s.deployments?.find((l)=>l.status==="PRIMARY");if(c&&c.runningCount===c.desiredCount&&s.deployments?.length===1)return!0}await new Promise((c)=>setTimeout(c,n))}return!1}async forceNewDeployment(e,t){return this.updateService({cluster:e,service:t,forceNewDeployment:!0})}async scaleService(e,t,r){return this.updateService({cluster:e,service:t,desiredCount:r})}}class de{client;region;constructor(e="us-east-1"){this.region=e,this.client=new u}buildFormBody(e){return Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>`${encodeURIComponent(r)}=${encodeURIComponent(n)}`).join("&")}async createTopic(e){let t={Action:"CreateTopic",Version:"2010-03-31",Name:e.Name};if(e.DisplayName)t["Attributes.entry.1.key"]="DisplayName",t["Attributes.entry.1.value"]=e.DisplayName;if(e.Tags)e.Tags.forEach((n,i)=>{t[`Tags.member.${i+1}.Key`]=n.Key,t[`Tags.member.${i+1}.Value`]=n.Value});if(e.Attributes){let n=e.DisplayName?2:1;Object.entries(e.Attributes).forEach(([i,o])=>{t[`Attributes.entry.${n}.key`]=i,t[`Attributes.entry.${n}.value`]=o,n++})}let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{TopicArn:_(r,"CreateTopic")?.TopicArn}}async deleteTopic(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteTopic",Version:"2010-03-31",TopicArn:e})})}async listTopics(e){let t={Action:"ListTopics",Version:"2010-03-31"};if(e)t.NextToken=e;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),n=r?.ListTopicsResponse?.ListTopicsResult||r?.ListTopicsResult,i=n?.Topics?.member;return{Topics:Array.isArray(i)?i:i?[i]:[],NextToken:n?.NextToken}}async getTopicAttributes(e){let t=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetTopicAttributes",Version:"2010-03-31",TopicArn:e})}),r=k(_(t,"GetTopicAttributes")?.Attributes?.entry),n={TopicArn:e};for(let i of r)n[i.key]=String(i.value);return n}async setTopicAttributes(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetTopicAttributes",Version:"2010-03-31",TopicArn:e.TopicArn,AttributeName:e.AttributeName,AttributeValue:e.AttributeValue})})}async subscribe(e){let t={Action:"Subscribe",Version:"2010-03-31",TopicArn:e.TopicArn,Protocol:e.Protocol,Endpoint:e.Endpoint};if(e.ReturnSubscriptionArn)t.ReturnSubscriptionArn="true";if(e.Attributes){let n=1;Object.entries(e.Attributes).forEach(([i,o])=>{t[`Attributes.entry.${n}.key`]=i,t[`Attributes.entry.${n}.value`]=o,n++})}let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{SubscriptionArn:_(r,"Subscribe")?.SubscriptionArn}}async unsubscribe(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"Unsubscribe",Version:"2010-03-31",SubscriptionArn:e})})}async listSubscriptionsByTopic(e,t){let r={Action:"ListSubscriptionsByTopic",Version:"2010-03-31",TopicArn:e};if(t)r.NextToken=t;let n=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)}),i=_(n,"ListSubscriptionsByTopic");return{Subscriptions:k(i?.Subscriptions?.member),NextToken:i?.NextToken||void 0}}async publish(e){let t={Action:"Publish",Version:"2010-03-31",Message:e.Message};if(e.TopicArn)t.TopicArn=e.TopicArn;if(e.TargetArn)t.TargetArn=e.TargetArn;if(e.PhoneNumber)t.PhoneNumber=e.PhoneNumber;if(e.Subject)t.Subject=e.Subject;if(e.MessageStructure)t.MessageStructure=e.MessageStructure;if(e.MessageAttributes){let n=1;Object.entries(e.MessageAttributes).forEach(([i,o])=>{if(t[`MessageAttributes.entry.${n}.Name`]=i,t[`MessageAttributes.entry.${n}.Value.DataType`]=o.DataType,o.StringValue)t[`MessageAttributes.entry.${n}.Value.StringValue`]=o.StringValue;if(o.BinaryValue)t[`MessageAttributes.entry.${n}.Value.BinaryValue`]=o.BinaryValue;n++})}let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{MessageId:_(r,"Publish")?.MessageId}}async publishSMS(e,t,r){let n={};if(r)n["AWS.SNS.SMS.SenderID"]={DataType:"String",StringValue:r};return this.publish({PhoneNumber:e,Message:t,MessageAttributes:Object.keys(n).length>0?n:void 0})}async subscribeEmail(e,t){return this.subscribe({TopicArn:e,Protocol:"email",Endpoint:t})}async subscribeLambda(e,t){return this.subscribe({TopicArn:e,Protocol:"lambda",Endpoint:t})}async subscribeSqs(e,t,r){let n={};if(r)n.RawMessageDelivery="true";return this.subscribe({TopicArn:e,Protocol:"sqs",Endpoint:t,Attributes:Object.keys(n).length>0?n:void 0})}async subscribeHttp(e,t,r){let n=t.startsWith("https")?"https":"http",i={};if(r)i.RawMessageDelivery="true";return this.subscribe({TopicArn:e,Protocol:n,Endpoint:t,Attributes:Object.keys(i).length>0?i:void 0})}async subscribeSms(e,t){return this.subscribe({TopicArn:e,Protocol:"sms",Endpoint:t})}async topicExists(e){try{return await this.getTopicAttributes(e),!0}catch(t){if(t.code==="NotFound"||t.statusCode===404)return!1;throw t}}async getSMSAttributes(){let e=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSAttributes",Version:"2010-03-31"})}),t=k(_(e,"GetSMSAttributes")?.attributes?.entry),r={};for(let n of t)r[n.key]=String(n.value);return r}async setSMSAttributes(e){let t={Action:"SetSMSAttributes",Version:"2010-03-31"},r=1;Object.entries(e).forEach(([n,i])=>{if(i!==void 0)t[`attributes.entry.${r}.key`]=n,t[`attributes.entry.${r}.value`]=i,r++}),await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async checkIfPhoneNumberIsOptedOut(e){let t=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CheckIfPhoneNumberIsOptedOut",Version:"2010-03-31",phoneNumber:e})});return Xo(_(t,"CheckIfPhoneNumberIsOptedOut")?.isOptedOut)}async listPhoneNumbersOptedOut(e){let t={Action:"ListPhoneNumbersOptedOut",Version:"2010-03-31"};if(e)t.nextToken=e;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),n=_(r,"ListPhoneNumbersOptedOut");return{phoneNumbers:k(n?.phoneNumbers?.member).map(String),nextToken:n?.nextToken||void 0}}async optInPhoneNumber(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"OptInPhoneNumber",Version:"2010-03-31",phoneNumber:e})})}async listSMSSandboxPhoneNumbers(e){let t={Action:"ListSMSSandboxPhoneNumbers",Version:"2010-03-31"};if(e)t.NextToken=e;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),n=_(r,"ListSMSSandboxPhoneNumbers");return{PhoneNumbers:k(n?.PhoneNumbers?.member),NextToken:n?.NextToken||void 0}}async createSMSSandboxPhoneNumber(e,t){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:e,LanguageCode:t||"en-US"})})}async verifySMSSandboxPhoneNumber(e,t){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"VerifySMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:e,OneTimePassword:t})})}async deleteSMSSandboxPhoneNumber(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:e})})}async getSMSSandboxAccountStatus(){let e=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSSandboxAccountStatus",Version:"2010-03-31"})});return{IsInSandbox:Xo(_(e,"GetSMSSandboxAccountStatus")?.IsInSandbox)}}}class q{client;region;endpoint;constructor(e="us-east-1",t){this.region=e,this.endpoint=t?.endpoint,this.client=new u}async request(e,t){if(this.endpoint){let r=await fetch(this.endpoint,{method:"POST",headers:{"Content-Type":"application/x-amz-json-1.0","X-Amz-Target":`DynamoDB_20120810.${e}`},body:JSON.stringify(t)});if(!r.ok){let n=await r.text();throw Error(`DynamoDB request failed: ${r.status} ${n}`)}return r.json()}return this.client.request({service:"dynamodb",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.0","X-Amz-Target":`DynamoDB_20120810.${e}`},body:JSON.stringify(t)})}async createTable(e){return this.request("CreateTable",e)}async deleteTable(e){return this.request("DeleteTable",e)}async describeTable(e){return this.request("DescribeTable",e)}async listTables(e){return this.request("ListTables",e||{})}async putItem(e){return this.request("PutItem",e)}async getItem(e){return this.request("GetItem",e)}async updateItem(e){return this.request("UpdateItem",e)}async deleteItem(e){return this.request("DeleteItem",e)}async query(e){return this.request("Query",e)}async scan(e){return this.request("Scan",e)}async batchWriteItem(e){return this.request("BatchWriteItem",e)}async batchGetItem(e){return this.request("BatchGetItem",e)}async updateTimeToLive(e){return this.request("UpdateTimeToLive",e)}static marshal(e){let t={};for(let[r,n]of Object.entries(e))t[r]=q.marshalValue(n);return t}static marshalValue(e){if(e===null||e===void 0)return{NULL:!0};if(typeof e==="string")return{S:e};if(typeof e==="number")return{N:String(e)};if(typeof e==="boolean")return{BOOL:e};if(Array.isArray(e))return{L:e.map((t)=>q.marshalValue(t))};if(typeof e==="object")return{M:q.marshal(e)};return{S:String(e)}}static unmarshal(e){let t={};for(let[r,n]of Object.entries(e))t[r]=q.unmarshalValue(n);return t}static unmarshalValue(e){if(e.S!==void 0)return e.S;if(e.N!==void 0)return Number(e.N);if(e.BOOL!==void 0)return e.BOOL;if(e.NULL!==void 0)return null;if(e.L!==void 0)return e.L.map((t)=>q.unmarshalValue(t));if(e.M!==void 0)return q.unmarshal(e.M);if(e.SS!==void 0)return e.SS;if(e.NS!==void 0)return e.NS.map(Number);return null}}class ye{client;region;constructor(e="us-east-1"){this.region=e,this.client=new u}async request(e,t){return this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSEvents.${e}`},body:JSON.stringify(t)})}async putRule(e){return this.request("PutRule",e)}async deleteRule(e){return this.request("DeleteRule",e)}async describeRule(e){return this.request("DescribeRule",e)}async listRules(e){return this.request("ListRules",e||{})}async listEventBuses(e){return this.request("ListEventBuses",e||{})}async enableRule(e){return this.request("EnableRule",e)}async disableRule(e){return this.request("DisableRule",e)}async putTargets(e){return this.request("PutTargets",e)}async removeTargets(e){return this.request("RemoveTargets",e)}async listTargetsByRule(e){return this.request("ListTargetsByRule",e)}async putEvents(e){return this.request("PutEvents",e)}async createSchedule(e){return this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${e.Name}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}}class Oe{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new u}async createRule(e){let t={Action:"PutRule",Name:e.name,ScheduleExpression:e.scheduleExpression,Version:"2015-10-07"};if(e.description)t.Description=e.description;if(e.state)t.State=e.state;else t.State="ENABLED";return{RuleArn:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e.name,ScheduleExpression:e.scheduleExpression,State:e.state||"ENABLED",Description:e.description})})).RuleArn}}async putTargets(e,t){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:e,Targets:t})})}async listRules(e){let t={};if(e)t.NamePrefix=e;return{Rules:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListRules","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})).Rules||[]}}async describeRule(e){let t=await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DescribeRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e})});return{Name:t.Name,Arn:t.Arn,ScheduleExpression:t.ScheduleExpression,State:t.State,Description:t.Description}}async listTargetsByRule(e){return{Targets:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListTargetsByRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:e})})).Targets||[]}}async deleteRule(e,t){if(t)try{let r=await this.listTargetsByRule(e);if(r.Targets&&r.Targets.length>0)await this.removeTargets(e,r.Targets.map((n)=>n.Id))}catch{}await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DeleteRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e,Force:t||!1})})}async removeTargets(e,t){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.RemoveTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:e,Ids:t})})}async enableRule(e){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.EnableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e})})}async disableRule(e){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DisableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e})})}async createLambdaSchedule(e){let t=await this.createRule({name:e.name,scheduleExpression:e.scheduleExpression,description:e.description,state:"ENABLED"});return await this.putTargets(e.name,[{Id:"1",Arn:e.functionArn,Input:e.input}]),t}async createEcsSchedule(e){let t=await this.createRule({name:e.name,scheduleExpression:e.scheduleExpression,description:e.description,state:"ENABLED"});return await this.putTargets(e.name,[{Id:"1",Arn:e.clusterArn,RoleArn:e.roleArn,Input:JSON.stringify({containerOverrides:[]})}]),t}async listSchedules(e){let t={};if(e?.NamePrefix)t.NamePrefix=e.NamePrefix;if(e?.State)t.State=e.State;let r=e?.GroupName||"default";return{Schedules:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedules",queryParams:{...t,ScheduleGroup:r}}))?.Schedules||[]}}async getSchedule(e){try{let t={};if(e.GroupName)t.groupName=e.GroupName;return await this.client.request({service:"scheduler",region:this.region,method:"GET",path:`/schedules/${encodeURIComponent(e.Name)}`,queryParams:Object.keys(t).length>0?t:void 0})}catch(t){if(t.statusCode===404||t.code==="ResourceNotFoundException")return null;throw t}}async createSchedule(e){let t={ScheduleExpression:e.ScheduleExpression,FlexibleTimeWindow:e.FlexibleTimeWindow,Target:e.Target};if(e.GroupName)t.GroupName=e.GroupName;if(e.ScheduleExpressionTimezone)t.ScheduleExpressionTimezone=e.ScheduleExpressionTimezone;if(e.Description)t.Description=e.Description;if(e.State)t.State=e.State;if(e.StartDate)t.StartDate=e.StartDate.toISOString();if(e.EndDate)t.EndDate=e.EndDate.toISOString();return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${encodeURIComponent(e.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)}))?.ScheduleArn||""}}async updateSchedule(e){let t={};if(e.GroupName)t.GroupName=e.GroupName;if(e.ScheduleExpression)t.ScheduleExpression=e.ScheduleExpression;if(e.ScheduleExpressionTimezone)t.ScheduleExpressionTimezone=e.ScheduleExpressionTimezone;if(e.Description!==void 0)t.Description=e.Description;if(e.State)t.State=e.State;if(e.FlexibleTimeWindow)t.FlexibleTimeWindow=e.FlexibleTimeWindow;if(e.Target)t.Target=e.Target;return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"PUT",path:`/schedules/${encodeURIComponent(e.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)}))?.ScheduleArn||""}}async deleteSchedule(e){let t={};if(e.GroupName)t.groupName=e.GroupName;await this.client.request({service:"scheduler",region:this.region,method:"DELETE",path:`/schedules/${encodeURIComponent(e.Name)}`,queryParams:Object.keys(t).length>0?t:void 0})}async listScheduleGroups(e){let t={};if(e?.NamePrefix)t.NamePrefix=e.NamePrefix;return{ScheduleGroups:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedule-groups",queryParams:Object.keys(t).length>0?t:void 0}))?.ScheduleGroups||[]}}}function Ys(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function fh(e,t,r,n="ecs:aws",i=[]){let o=r.now??new Date;return e.map((s)=>{let c=s.serviceName??Ys(s.serviceArn),l=t.filter((ne)=>!s.clusterArn||ne.clusterArn===s.clusterArn),a=l.some((ne)=>!!ne.group)?l.filter((ne)=>ne.group===`service:${c}`):l,f=s.status==="ACTIVE"?(s.runningCount??0)<(s.desiredCount??0)?"degraded":"running":io(s.status),T=i.find((ne)=>ne.taskDefinitionArn===s.taskDefinition),D=Array.isArray(T?.containerDefinitions)?T.containerDefinitions:[],N=[...new Set(D.map((ne)=>ne.logConfiguration?.options?.["awslogs-group"]).filter((ne)=>typeof ne==="string"))],W=D.flatMap((ne)=>(ne.mountPoints??[]).map((he)=>({source:he.sourceVolume,target:he.containerPath,type:"volume",readOnly:!!he.readOnly}))),Y=D.flatMap((ne)=>(ne.portMappings??[]).map((he,te)=>({id:`${ne.name??"container"}:${te}`,name:ne.name,mode:T?.networkMode,ports:[{container:he.containerPort,host:he.hostPort,protocol:he.protocol}]}))),ee=r.project&&r.environment&&c.startsWith(`${r.project}-${r.environment}-`)?c.slice(`${r.project}-${r.environment}-`.length):c;return{id:$i("ecs",n,s.serviceArn??c),provider:"ecs",kind:"service",name:c,status:f,rawStatus:s.status,health:f==="running"?"healthy":f==="failed"||f==="degraded"?"unhealthy":"unknown",desiredReplicas:s.desiredCount,runningReplicas:s.runningCount,image:D[0]?.image,runtime:s.launchType??"ECS",version:Ys(s.taskDefinition),ageSeconds:us(s.deployments?.[0]?.createdAt,o),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:ee,release:Ys(s.taskDefinition),providerId:s.serviceArn},replicas:a.map((ne)=>{let he=io(ne.lastStatus);return{id:$i("ecs",n,ne.taskArn??Ys(ne.taskArn)),name:Ys(ne.taskArn),status:he,rawStatus:ne.lastStatus,createdAt:ne.createdAt,startedAt:ne.startedAt,stoppedAt:ne.stoppedAt,host:ne.containerInstanceArn,containers:(ne.containers??[]).map((te)=>({id:te.containerArn??te.name??"container",name:te.name??"container",image:D.find((xe)=>xe.name===te.name)?.image,imageDigest:te.imageDigest,status:io(te.lastStatus),rawStatus:te.lastStatus,exitCode:te.exitCode,reason:te.reason,runtime:"ecs"}))}}),networks:Y,mounts:W,capabilities:ds(["start","stop","restart","redeploy","scale","inspect",...N.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:no({clusterArn:s.clusterArn,taskDefinition:s.taskDefinition,launchType:s.launchType,pendingCount:s.pendingCount,deployments:s.deployments,logGroups:N,executionRoleArn:T?.executionRoleArn,taskRoleArn:T?.taskRoleArn,cpu:T?.cpu,memory:T?.memory}),discoveredAt:o.toISOString(),sourceId:n}})}function hh(e,t,r="lambda:aws"){let n=t.now??new Date;return e.map((i)=>{let o=i.FunctionName??Ys(i.FunctionArn),s=i.State==="Active"?"running":io(i.State);return{id:$i("lambda",r,i.FunctionArn??o),provider:"lambda",kind:"function",name:o,status:s,rawStatus:i.State,health:s==="running"?"healthy":s==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:i.Runtime,version:i.Version,architecture:i.Architectures?.join(", "),ageSeconds:us(i.LastModified,n),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:o,providerId:i.FunctionArn},resources:{memoryLimitBytes:i.MemorySize==null?void 0:i.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:ds(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:no({handler:i.Handler,timeout:i.Timeout,codeSize:i.CodeSize,stateReason:i.StateReason,environmentKeys:Object.keys(i.Environment?.Variables??{})}),discoveredAt:n.toISOString(),sourceId:r}})}function CC(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((n)=>n&&typeof n.Id==="string")}function EC(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,n])=>{let[i,o]=r.split("/");return(n??[]).map((s)=>({container:Number(i)||void 0,host:Number(s.HostPort)||void 0,protocol:o,address:s.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,n])=>({id:n.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[n.IPAddress,n.GlobalIPv6Address].filter(Boolean),ports:t}))}function TC(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function AC(e,t,r=t.server??"local"){let n=t.now??new Date;return e.map((i)=>{let o=i.State?.OOMKilled?"oomkilled":i.State?.Restarting?"starting":i.State?.Status,s=io(o),c=(i.Name??i.Id.slice(0,12)).replace(/^\//,""),l=i.Config?.Labels??{},a=TC(i),f=EC(i),T={id:i.Id,name:c,image:i.Config?.Image,imageDigest:i.Image,runtime:"docker",status:s,rawStatus:o,exitCode:i.State?.ExitCode,reason:i.State?.Error,resources:{memoryLimitBytes:i.HostConfig?.Memory||void 0},networks:f,mounts:a};return{id:$i("docker",r,i.Id),provider:"docker",kind:"container",name:c,status:s,rawStatus:o,health:s==="running"?"healthy":s==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:s==="running"?1:0,image:i.Config?.Image,runtime:"docker",ageSeconds:us(i.State?.StartedAt,n),restartCount:i.RestartCount??0,tags:l,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:l["com.docker.compose.service"]??l["ts-cloud.service"]??c,release:l["ts-cloud.release"],providerId:i.Id},resources:T.resources,replicas:[{id:$i("docker",r,`${i.Id}:0`),name:c,status:s,rawStatus:o,startedAt:i.State?.StartedAt,stoppedAt:i.State?.FinishedAt,restartCount:i.RestartCount,containers:[T],resources:T.resources}],networks:f,mounts:a,capabilities:ds(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:no({image:i.Config?.Image,labels:l,environmentKeys:(i.Config?.Env??[]).map((D)=>D.split("=",1)[0]),networkMode:i.HostConfig?.NetworkMode}),discoveredAt:n.toISOString(),sourceId:r}})}class El{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return AC(CC(await this.inspect(e)),e,this.id)}}function kC(e){let t=[];for(let r of e.split(`
 `)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,n,i,o,s,c,l,a,f,T,D,N,W,Y]=r.split("\t");if(!n||!/^[A-Za-z0-9_.@:-]+\.service$/.test(n))continue;t.push({unit:n,load:i,active:o,sub:s,description:c,enabled:l,pid:Number(a)||void 0,memoryBytes:dh(f),restartCount:Number(T)||0,activeSince:D||void 0,fragmentPath:N||void 0,workingDirectory:W?.startsWith("/")?W:void 0,user:Y||void 0})}return t}function RC(e,t,r=t.server??"local"){let n=t.now??new Date;return e.map((i)=>{let o=io(i.active==="active"?i.sub||i.active:i.active),s=i.unit.replace(/\.service$/,""),c=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(i.description??"")?.[1]??(t.project&&s.startsWith(`${t.project}-`)?s.slice(t.project.length+1).split("@",1)[0]:void 0),l=s.includes("@")?s.slice(s.indexOf("@")+1):void 0,a=i.workingDirectory?[{target:i.workingDirectory,type:"working-directory"}]:[],f=["start","stop","restart","logs","exec","inspect",...a.length?["files"]:[]];return{id:$i("systemd",r,i.unit),provider:"systemd",kind:"service",name:s,displayName:i.description||s,status:o,rawStatus:[i.load,i.active,i.sub].filter(Boolean).join("/"),health:o==="running"?"healthy":o==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:o==="running"?1:0,ageSeconds:us(i.activeSince,n),restartCount:i.restartCount,tags:{enabled:i.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:c,release:l,providerId:i.unit},resources:{memoryBytes:i.memoryBytes},replicas:[{id:$i("systemd",r,`${i.unit}:main`),name:"main",status:o,pid:i.pid,startedAt:i.activeSince,restartCount:i.restartCount,resources:{memoryBytes:i.memoryBytes}}],networks:[],mounts:a,capabilities:ds(f,a.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:no({fragmentPath:i.fragmentPath,workingDirectory:i.workingDirectory,user:i.user,environment:i.environment,enabled:i.enabled}),discoveredAt:n.toISOString(),sourceId:r}})}class Tl{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return RC(kC(await this.read(e)),e,this.id)}}function PC(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function xC(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function DC(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function yh(e,t,r,n,i){let o=`${e}:${r.id}`,s=async()=>PC(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?xC():DC(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:n.project.slug,Environment:i,Role:"app"}}),o);return e==="systemd"?new Tl(s,o):new El(s,o)}async function od(e,t=100){let r=[],n;for(let i=0;i<t;i++){let o=await e(n);if(r.push(...o.items),!o.nextToken)return r;n=o.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class bh{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await od(async(o)=>{let s=await this.client.listClusters({nextToken:o,maxResults:100});return{items:s.clusterArns??[],nextToken:s.nextToken}}),r=[],n=[],i=[];for(let o of t){let s=(await od(async(c)=>{let l=await this.client.listServices(o,{nextToken:c,maxResults:100});return{items:l.serviceArns??[],nextToken:l.nextToken}})).filter((c)=>c.split("/").at(-1)?.startsWith(this.prefix));for(let c=0;c<s.length;c+=10){let l=await this.client.describeServices({cluster:o,services:s.slice(c,c+10)});r.push(...l.services??[])}for(let c of r.filter((l)=>l.clusterArn===o||!l.clusterArn)){let l=await od(async(a)=>{let f=await this.client.listTasks(o,c.serviceName,{nextToken:a,maxResults:100});return{items:f.taskArns??[],nextToken:f.nextToken}});for(let a=0;a<l.length;a+=100){let f=await this.client.describeTasks(o,l.slice(a,a+100));n.push(...f.tasks??[])}}}if(this.client.describeTaskDefinition)for(let o of[...new Set(r.map((s)=>s.taskDefinition).filter((s)=>!!s))]){let s=await this.client.describeTaskDefinition(o);if(s.taskDefinition)i.push(s.taskDefinition)}return fh(r,n,e,this.id,i)}}class Sh{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await od(async(r)=>{let n=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:n.Functions??[],nextToken:n.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return hh(t,e,this.id)}}async function OC(e,t,r={}){let n=[],i=H(e),o=B(e),s=e.aws?.profile,c=e.aws?.region??e.project.region??"us-east-1",l=`${e.project.slug}-${t}`;if(i!=="serverless"){let a=r.driver??O({config:e}),f=await a.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let T of f)n.push(yh("systemd",a,T,e,t)),n.push(yh("docker",a,T,e,t))}if(o==="aws")n.push(new bh(r.ecs??new kt(c,s),l)),n.push(new Sh(r.lambda??new I(c,s),l));return n}async function Ii(e,t,r={}){let n={project:e.project.slug,environment:t};try{return await uh(await OC(e,t,r),n)}catch(i){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:B(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(i?.message??i).slice(0,500)}],degraded:!0}}}var vh=65536,xa=49152,ad=/^[A-Za-z0-9_.@:-]+\.service$/,cd=/^[a-fA-F0-9]{12,128}$/,_C=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function Zs(e){let t=Buffer.from(e);return t.byteLength<=vh?e:`${t.subarray(0,vh-24).toString("utf8")}
 [output truncated]`}function sd(e){return{success:!1,instanceCount:0,perInstance:[],error:e instanceof Error?e.message:String(e)}}function gi(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function NC(e,t){return Number.isFinite(e)?Math.min(1e4,Math.max(0,Math.floor(e))):t}function $C(e){let t=e.config,r=typeof t.clusterArn==="string"?t.clusterArn:void 0,n=e.links.providerId||e.name;return r&&n?{cluster:r,service:n}:void 0}function MC(e,t){return e.find((r)=>r.id===t.links.server)??(e.length===1?e[0]:void 0)}function LC(e,t){if(e.provider==="systemd"){let r=e.links.providerId;if(!r||!ad.test(r)||!["start","stop","restart"].includes(t))return;return[`systemctl ${t} ${r}`,`systemctl is-active ${r} 2>/dev/null || true`]}if(e.provider==="docker"){let r=e.links.providerId;if(!r||!cd.test(r)||!["start","stop","restart"].includes(t))return;return[`docker ${t} ${r}`,`docker inspect --format '{{.State.Status}}' ${r}`]}return}function BC(e,t){if(!t.startsWith("/")||t.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let r=[];for(let c of t.split("/")){if(!c||c===".")continue;if(c===".."){if(!r.length)return{ok:!1,error:"Path traversal is not allowed."};r.pop()}else r.push(c)}let n=`/${r.join("/")}`;if(_C.some((c)=>n===c||n.startsWith(`${c}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let i=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),o=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...i&&o?[`/var/www/${i}/${o}`,`/srv/${i}/${o}`]:[],...e.mounts.map((c)=>c.target).filter((c)=>c.startsWith("/"))].some((c)=>n===c||n.startsWith(`${c.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:n}}function jC(e,t){let r=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),n=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...r&&n?[`/var/www/${r}/${n}`,`/srv/${r}/${n}`]:[],...e.mounts.map((i)=>i.target).filter((i)=>i.startsWith("/"))].sort((i,o)=>o.length-i.length).find((i)=>t===i||t.startsWith(`${i.replace(/\/$/,"")}/`))}var wh={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class be{config;environment;dependencies;region;profile;constructor(e,t,r={}){this.config=e;this.environment=t;this.dependencies=r;this.region=e.aws?.region??e.project.region??"us-east-1",this.profile=e.aws?.profile}async inventory(){return this.dependencies.inventory?.()??Ii(this.config,this.environment,{driver:this.dependencies.driver})}async workload(e){return(await this.inventory()).workloads.find((t)=>t.id===e)}async remote(e,t,r,n){let i=this.dependencies.driver??O({config:this.config}),o=await i.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),s=MC(o,e);if(!s)throw Error("The workload server is no longer reachable in this scope.");return i.runRemoteDeploy({targets:[s],commands:t,timeoutSeconds:r,comment:n,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(e){let t=await this.workload(e.workloadId),r={workloadId:e.workloadId,action:e.action};if(!t)return{...r,ok:!1,error:"Workload was not found in the current project and environment."};let n=t.capabilities[e.action];if(!n.supported)return{...r,ok:!1,error:n.reason??`${e.action} is unsupported for ${t.provider}.`};if(n.requiresConfirmation&&e.confirm!==t.name)return{...r,ok:!1,error:`Type "${t.name}" to ${e.action} this workload.`};if(n.requiresRecentAuth&&!e.recentAuth)return{...r,ok:!1,error:"Sign in again before using elevated runtime access."};if(e.action==="inspect")return{...r,ok:!0,workload:t};if(t.provider==="systemd"||t.provider==="docker"){let i=LC(t,e.action);if(!i)return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`};let o=await this.remote(t,["set -uo pipefail",...i],60,`ts-cloud runtime:${e.action}`).catch(sd);return{...r,ok:o.success,command:i[0],stdout:Zs(o.perInstance?.[0]?.output??""),stderr:Zs(o.perInstance?.[0]?.error??o.error??""),error:o.success?void 0:o.error??"Runtime operation failed."}}if(t.provider==="ecs"){let i=$C(t);if(!i)return{...r,ok:!1,error:"ECS cluster or service identity is unavailable."};let o=this.dependencies.ecs??new kt(this.region,this.profile);if(e.action==="scale"){let s=NC(e.replicas,t.desiredReplicas??1);return await o.scaleService(i.cluster,i.service,s),{...r,ok:!0,command:`ecs scale ${t.name} ${s}`}}if(e.action==="start"||e.action==="stop"){let s=e.action==="stop"?0:Math.max(1,t.desiredReplicas??1);return await o.scaleService(i.cluster,i.service,s),{...r,ok:!0,command:`ecs scale ${t.name} ${s}`}}if(e.action==="restart"||e.action==="redeploy")return await o.forceNewDeployment(i.cluster,i.service),{...r,ok:!0,command:`ecs redeploy ${t.name}`}}return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`}}async exec(e){let t={workloadId:e.workloadId,preset:e.preset},r=await this.workload(e.workloadId);if(!r)return{...t,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{...t,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!r.capabilities.exec.supported)return{...t,ok:!1,error:r.capabilities.exec.reason??"Exec is unsupported for this workload."};if(e.confirm!==r.name)return{...t,ok:!1,error:`Type "${r.name}" to open exec access.`};if(!e.recentAuth)return{...t,ok:!1,error:"Sign in again before using elevated runtime access."};let n=e.preset&&wh[e.preset];if(!n&&!e.command?.trim())return{...t,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(e.command&&r.provider!=="docker")return{...t,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let i=r.links.providerId??"",o;if(r.provider==="docker"&&cd.test(i)){let c=e.command?.trim()||n.map(gi).join(" ");o=`docker exec ${i} sh -lc ${gi(c)}`}else if(r.provider==="systemd"&&ad.test(i)&&e.preset)o=e.preset==="process"?`systemctl status ${i} --no-pager --full`:wh[e.preset].map(gi).join(" ");if(!o)return{...t,ok:!1,error:"Exec target identity is invalid or unsupported."};let s=await this.remote(r,["set -uo pipefail",o],60,"ts-cloud runtime:exec").catch(sd);return{...t,ok:s.success,command:o,stdout:Zs(s.perInstance?.[0]?.output??""),stderr:Zs(s.perInstance?.[0]?.error??s.error??""),error:s.success?void 0:s.error??"Exec command failed."}}async readFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};let{workload:n,path:i,root:o,providerId:s}=r,l=`sh -c ${gi('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${gi(i)} ${xa} ${gi(o)}`,a=n.provider==="docker"?`docker exec ${s} ${l}`:l,f=await this.remote(n,[a],30,"ts-cloud runtime:file-read").catch(sd);if(!f.success)return{...t,ok:!1,error:f.error??f.perInstance?.[0]?.error??"File read failed."};let T=f.perInstance?.[0]?.output??"",D=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(T);if(!D)return{...t,ok:!1,error:"The remote file response was invalid."};let N=Number(D[1]),W=T.slice((D.index??0)+D[0].length).replace(/\s+/g,"");if(Buffer.from(W,"base64").byteLength>xa)return{...t,ok:!1,error:"The remote file exceeded the transfer limit."};return{...t,ok:!0,contentBase64:W,size:N,truncated:N>xa}}async writeFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(e.contentBase64))return{...t,ok:!1,error:"File content must be valid base64."};let n=Buffer.from(e.contentBase64,"base64");if(n.toString("base64")!==e.contentBase64)return{...t,ok:!1,error:"File content must be canonical base64."};if(n.byteLength>xa)return{...t,ok:!1,error:`File uploads are limited to ${xa} bytes.`};let{workload:i,path:o,root:s,providerId:c}=r,a=`sh -c ${gi('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${gi(o)} ${gi(s)}`,f=i.provider==="docker"?`printf %s ${gi(e.contentBase64)} | docker exec -i ${c} ${a}`:`printf %s ${gi(e.contentBase64)} | ${a}`,T=await this.remote(i,[f],30,"ts-cloud runtime:file-write").catch(sd);return{...t,ok:T.success,size:n.byteLength,truncated:!1,error:T.success?void 0:T.error??T.perInstance?.[0]?.error??"File write failed."}}async fileTarget(e){let t=await this.workload(e.workloadId);if(!t)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!t.capabilities.files.supported)return{error:t.capabilities.files.reason??"File access is unsupported for this workload."};if(e.confirm!==t.name)return{error:`Type "${t.name}" to access workload files.`};if(!e.recentAuth)return{error:"Sign in again before using elevated runtime access."};let r=BC(t,e.path);if(!r.ok)return{error:r.error};let n=jC(t,r.path),i=t.links.providerId??"";if(!n||t.provider==="systemd"&&!ad.test(i)||t.provider==="docker"&&!cd.test(i))return{error:"File target identity is invalid or unsupported."};return{workload:t,path:r.path,root:n,providerId:i}}async logs(e,t={}){let r=await this.workload(e);if(!r)throw Error("Workload was not found in the current project and environment.");if(!r.capabilities.logs.supported)throw Error(r.capabilities.logs.reason??"Logs are unsupported for this workload.");let n=Math.min(1000,Math.max(1,Math.floor(t.limit??200)));if(r.provider==="lambda"||r.provider==="ecs"){let f=this.dependencies.logs??new se(this.region,this.profile),T=r.config.logGroups,D=r.provider==="lambda"?`/aws/lambda/${r.name}`:Array.isArray(T)&&typeof T[0]==="string"?T[0]:void 0;if(!D)throw Error("The ECS task definition does not declare an awslogs group.");let N=await f.filterLogEvents({logGroupName:D,startTime:t.since?.getTime(),limit:n}),W=(N.events??[]).slice(0,n).map((Y)=>({timestamp:Y.timestamp==null?void 0:new Date(Y.timestamp).toISOString(),message:Zs(String(Y.message??""))}));return{workloadId:e,provider:r.provider,lines:W,nextCursor:N.nextToken,truncated:(N.events?.length??0)>=n}}let i=r.links.providerId??"",o=t.since&&Number.isFinite(t.since.getTime())?t.since:void 0,s=r.provider==="systemd"&&ad.test(i)?`journalctl -u ${i} --no-pager -n ${n} -o short-iso${o?` --since ${gi(o.toISOString())}`:""}`:r.provider==="docker"&&cd.test(i)?`docker logs --timestamps --tail ${n}${o?` --since ${Math.floor(o.getTime()/1000)}`:""} ${i} 2>&1`:void 0;if(!s)throw Error("Log target identity is invalid.");let c=await this.remote(r,[s],30,"ts-cloud runtime:logs");if(!c.success)throw Error(c.error??c.perInstance?.[0]?.error??"Log read failed.");let l=Zs(c.perInstance?.[0]?.output??""),a=l.split(`
 `).filter(Boolean).slice(-n).map((f)=>{let T=/^(\d{4}-\d{2}-\d{2}T\S+)\s+(.*)$/.exec(f);return{timestamp:T?.[1],message:T?.[2]??f}});return{workloadId:e,provider:r.provider,lines:a,truncated:l.includes("[output truncated]")||a.length>=n}}}import{randomUUID as FC}from"node:crypto";class Al{records=new Map;maxBufferBytes;ttlMs;now;constructor(e={}){this.maxBufferBytes=Math.max(1024,e.maxBufferBytes??262144),this.ttlMs=Math.max(1000,e.ttlMs??900000),this.now=e.now??(()=>new Date)}create(e,t){this.sweep();let r=this.now().toISOString(),n={id:FC(),workloadId:t,kind:e,state:"open",chunks:[],cursor:0,droppedBytes:0,bufferedBytes:0,createdAt:r,updatedAt:r,abort:new AbortController,listeners:new Set};return this.records.set(n.id,n),this.snapshot(n,0)}signal(e){return this.records.get(e)?.abort.signal}append(e,t,r="stdout"){let n=this.records.get(e);if(!n||n.state!=="open"||!t)return n?this.snapshot(n,n.cursor):void 0;let i=Buffer.from(t),o=i.byteLength>this.maxBufferBytes?i.subarray(i.byteLength-this.maxBufferBytes).toString("utf8"):t,s={cursor:++n.cursor,stream:r,data:o,at:this.now().toISOString()};n.chunks.push(s),n.bufferedBytes+=Buffer.byteLength(o),n.updatedAt=s.at;while(n.bufferedBytes>this.maxBufferBytes&&n.chunks.length>1){let c=n.chunks.shift(),l=Buffer.byteLength(c.data);n.bufferedBytes-=l,n.droppedBytes+=l}return this.publish(n),this.snapshot(n,s.cursor-1)}read(e,t,r=0){let n=this.records.get(e);if(!n||n.workloadId!==t)return;return n.updatedAt=this.now().toISOString(),this.snapshot(n,Math.max(0,Math.floor(r)))}close(e,t="complete",r){let n=this.records.get(e);if(!n||n.state!=="open")return n?this.snapshot(n,n.cursor):void 0;if(n.state=t,n.error=r,n.updatedAt=this.now().toISOString(),t==="cancelled")n.abort.abort();return this.publish(n),this.snapshot(n,n.cursor)}cancel(e,t){let r=this.records.get(e);if(!r||r.workloadId!==t)return;return this.close(e,"cancelled")}subscribe(e,t,r){let n=this.records.get(e);if(!n||n.workloadId!==t)return;return n.listeners.add(r),()=>n.listeners.delete(r)}sweep(){let e=this.now().getTime()-this.ttlMs,t=0;for(let[r,n]of this.records){if(new Date(n.updatedAt).getTime()>e)continue;n.abort.abort(),this.records.delete(r),t++}return t}clear(){for(let e of this.records.values())e.abort.abort();this.records.clear()}snapshot(e,t){let r=e.chunks[0]?.cursor??e.cursor+1,n=t>0&&t<r-1;return{id:e.id,workloadId:e.workloadId,kind:e.kind,state:e.state,chunks:e.chunks.filter((i)=>n||i.cursor>t),cursor:e.cursor,reset:n,droppedBytes:e.droppedBytes,createdAt:e.createdAt,updatedAt:e.updatedAt,error:e.error}}publish(e){let t=this.snapshot(e,0);for(let r of e.listeners)r(t)}}import{createHash as UC}from"node:crypto";var xl={info:0,low:1,medium:2,high:3,critical:4},Dl={record:0,warn:1,block:2},Ih=new Set(["skipped","unavailable","unsupported","stale"]);function Vt(e){return typeof e==="string"?e:void 0}function _o(e,t){try{return JSON.parse(String(e))}catch{return t}}function Ci(e){return JSON.stringify(h(e))}function zC(e){if(!e)return;return String(h(e,2000))}function kl(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:Vt(e.project_id),environmentId:Vt(e.environment_id),resourceId:Vt(e.resource_id),releaseId:Vt(e.release_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),status:String(e.status),error:Vt(e.error),metadata:_o(e.metadata,{}),findingsCount:Number(e.findings_count),startedAt:String(e.started_at),completedAt:String(e.completed_at),durationMs:Number(e.duration_ms)}}function Ch(e){return{id:String(e.id),fingerprint:String(e.fingerprint),organizationId:String(e.organization_id),projectId:Vt(e.project_id),environmentId:Vt(e.environment_id),resourceId:Vt(e.resource_id),releaseId:Vt(e.release_id),scanRunId:String(e.scan_run_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),ruleId:String(e.rule_id),severity:String(e.severity),title:String(e.title),description:String(e.description),evidence:_o(e.evidence,{}),remediation:Vt(e.remediation),subject:String(e.subject),status:String(e.status),ownerActorId:Vt(e.owner_actor_id),recurrenceCount:Number(e.recurrence_count),firstSeenAt:String(e.first_seen_at),lastSeenAt:String(e.last_seen_at),resolvedAt:Vt(e.resolved_at),updatedAt:String(e.updated_at)}}function Rl(e){return{id:String(e.id),organizationId:String(e.organization_id),environmentId:Vt(e.environment_id),name:String(e.name),rules:_o(e.rules,[]),requiredScanners:_o(e.required_scanners,[]),scannerFailMode:String(e.scanner_fail_mode),enabled:Number(e.enabled)===1,version:Number(e.version),createdByActorId:Vt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Eh(e,t){let r=Vt(e.revoked_at),n=String(e.expires_at);return{id:String(e.id),findingId:String(e.finding_id),policyId:Vt(e.policy_id),reason:String(e.reason),referenceUrl:Vt(e.reference_url),createdByActorId:String(e.created_by_actor_id),expiresAt:n,revokedAt:r,state:r?"revoked":n<=t?"expired":"active",createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Pl(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Vt(e.environment_id),releaseId:String(e.release_id),kind:String(e.kind),format:String(e.format),digest:String(e.digest),summary:_o(e.summary,{}),content:Vt(e.content),sensitive:Number(e.sensitive)===1,createdAt:String(e.created_at)}}function Th(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),operationId:Vt(e.operation_id),policyId:String(e.policy_id),policyVersion:Number(e.policy_version),outcome:String(e.outcome),scannerVersions:_o(e.scanner_versions,{}),findingIds:_o(e.finding_ids,[]),waiverIds:_o(e.waiver_ids,[]),explanation:String(e.explanation),createdAt:String(e.created_at)}}function VC(e,t){let r=[e.trim().toLowerCase(),t.ruleId.trim().toLowerCase(),t.organizationId,t.projectId??"",t.environmentId??"",t.resourceId??"",t.releaseId??"",t.subject.trim().toLowerCase()].join("\x00");return UC("sha256").update(r).digest("hex")}function Ah(e){if(!e)return;let t=new URL(e);if(t.protocol!=="https:"&&t.protocol!=="http:")throw Error("Security references must use HTTP or HTTPS");return t.toString()}function kh(e){if(!e.length)throw Error("A security policy needs at least one rule");return e.map((t)=>{if(!(t.minimumSeverity in xl))throw Error(`Unknown security severity: ${t.minimumSeverity}`);if(!(t.action in Dl))throw Error(`Unknown security policy action: ${t.action}`);return{minimumSeverity:t.minimumSeverity,action:t.action,...t.scannerId?{scannerId:t.scannerId.trim()}:{}}})}class xt{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}recordScan(e){if(!e.organizationId||!e.scannerId.trim()||!e.scannerVersion.trim())throw Error("Organization, scanner id, and scanner version are required");let t=e.completedAt??this.now(),r=e.startedAt??t,n=e.durationMs??Math.max(0,new Date(t).getTime()-new Date(r).getTime()),i=e.findings??[],o=this.idFn(),s=new Set,c=[];return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_scan_runs
@@ -437,7 +437,7 @@ export type ConfigOf = Config
       },
     ${l}`}class Ql{client;region;constructor(e="us-east-1"){this.region=e,this.client=new u}async getTraceSummaries(e){let t={StartTime:Math.floor(e.startTime.getTime()/1000),EndTime:Math.floor(e.endTime.getTime()/1000),TimeRangeType:"Event",Sampling:!1};if(e.filterExpression)t.FilterExpression=e.filterExpression;if(e.nextToken)t.NextToken=e.nextToken;let r=await this.client.request({service:"xray",region:this.region,method:"POST",path:"/TraceSummaries",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)});return{summaries:r?.TraceSummaries??[],nextToken:r?.NextToken}}async batchGetTraces(e){if(!e.length)return[];return(await this.client.request({service:"xray",region:this.region,method:"POST",path:"/Traces",headers:{"Content-Type":"application/json"},body:JSON.stringify({TraceIds:e.slice(0,5)})}))?.Traces??[]}}var xy=65536;function Kr(e){return e.length<=xy?e:`${e.slice(0,xy)}
 
-[output truncated]`}function Xl(e,t){return e.environments?.[t]?.app}function Zl(e,t,r){let n=[],i=Xl(e,t);n.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),n.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let o=r.maintenance?.enabled;if(o!==!0)n.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(o!==!1)n.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(i?.assets||r.assetsInfo)n.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(i?.database?.connection==="aurora-serverless")n.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(i.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(i.database.maxCapacity??4)}]});for(let s of r.queues??[]){let c=String(s?.name??"").trim();if(c&&/^[A-Za-z0-9_-]+$/.test(c))n.push({id:`queue:purge:${c}`,label:`Purge queue (${c})`,group:"queue",target:c,mutates:!0,confirm:c,danger:!0})}return n}function Dy(e,t,r,n){return Zl(t,r,n).find((i)=>i.id===e)}async function ET(e,t,r){try{let n=new v(r),{Stacks:i}=await n.describeStacks({stackName:ke(e,t)}),o={};for(let l of i?.[0]?.Outputs??[])if(l.OutputKey)o[l.OutputKey]=l.OutputValue??"";let s=o.AssetsCdnDomain;if(!s)return null;return(await new E(r).findDistributionByDomain(s))?.Id??null}catch{return null}}async function Oy(e,t,r,n={}){try{if(r.id==="redeploy")return await No(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await ko(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await Es(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await Es(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let i=Number(n.min),o=Number(n.max);if(!Number.isFinite(i)||!Number.isFinite(o)||i<=0||o<i)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await xo(e,t,i,o),{operation:r.id,command:`db:scale ${i}-${o} ACU`,ok:!0,stdout:`Scaling applied (${i}-${o} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let i=await z(e,t),o=await ET(e,t,i.region);if(!o)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let c=await new E(i.region).invalidateAll(o);return{operation:r.id,command:`cloudfront invalidate ${o} /*`,ok:!0,stdout:`Invalidation ${c?.Id??"created"} for ${o} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let i=r.target,o=await z(e,t),s=new V(o.region),c=`${o.slug}-${t}-${i}`,{QueueUrl:l}=await s.getQueueUrl(c);return await s.purgeQueue(l),{operation:r.id,command:`sqs purge ${c}`,ok:!0,stdout:`Purged queue ${c}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(i){return{operation:r.id,ok:!1,error:Kr(i?.message??String(i))}}}async function _y(e,t,r){let n=r.trim();if(!n)return{operation:"command",ok:!1,error:"A command is required."};try{let i=await Bt(e,t,n);return{operation:"command",command:n,ok:!0,stdout:Kr(i||"(no output)")}}catch(i){return{operation:"command",command:n,ok:!1,error:Kr(i?.message??String(i))}}}var ep="No dead-letter queue is provisioned for this environment.";async function tp(e,t,r){try{let{QueueUrl:n}=await e.getQueueUrl(`${t}-${r}-dlq`);return n}catch{return null}}async function Ny(e,t,r=10){try{let n=await z(e,t),i=new V(n.region),o=await tp(i,n.slug,t);if(!o)return{ok:!1,messages:[],error:ep};return{ok:!0,messages:((await i.receiveMessages({queueUrl:o,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((l)=>({id:l.MessageId,receiptHandle:l.ReceiptHandle,body:Kr(String(l.Body??""))}))}}catch(n){return{ok:!1,messages:[],error:Kr(n?.message??String(n))}}}async function $y(e,t,r={}){try{let n=await z(e,t),i=Xl(e,t),s=(i?Jt(i,n.slug,t):[]).map((N)=>N.name.replace(`${n.slug}-${t}-`,"")),c=r.targetQueue&&s.includes(r.targetQueue)?r.targetQueue:s[0];if(!c)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let l=new V(n.region),a=await tp(l,n.slug,t);if(!a)return{operation:"dlq:redrive",ok:!1,error:ep};let{QueueUrl:f}=await l.getQueueUrl(`${n.slug}-${t}-${c}`),T=Math.min(50,Math.max(1,r.max??10)),D=0;while(D<T){let W=(await l.receiveMessages({queueUrl:a,maxMessages:Math.min(10,T-D),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!W.length)break;for(let Y of W)await l.sendMessage({queueUrl:f,messageBody:String(Y.Body??"")}),await l.deleteMessage(a,Y.ReceiptHandle),D++}return{operation:"dlq:redrive",command:`redrive → ${c}`,ok:!0,stdout:`Moved ${D} message(s) from the DLQ to ${c}.`}}catch(n){return{operation:"dlq:redrive",ok:!1,error:Kr(n?.message??String(n))}}}async function My(e,t){try{let r=await z(e,t),n=new V(r.region),i=await tp(n,r.slug,t);if(!i)return{operation:"dlq:purge",ok:!1,error:ep};return await n.purgeQueue(i),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:Kr(r?.message??String(r))}}}function Ly(e,t){let r=Xl(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((n)=>({key:n.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:n})):Object.entries(r.secrets).map(([n,i])=>({key:n,secretId:String(i)}))}async function By(e,t,r,n){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let i=await z(e,t),o=new K(i.region);try{await o.putSecretValue({SecretId:r,SecretString:n})}catch{await o.createSecret({Name:r,SecretString:n})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(i){return{operation:"secret:set",ok:!1,error:Kr(i?.message??String(i))}}}async function jy(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let n=await z(e,t);return await new K(n.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(n){return{operation:"secret:delete",ok:!1,error:Kr(n?.message??String(n))}}}var TT=new Set(["http","queue","cli"]);async function Fy(e,t,r,n){if(!TT.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let i=n.memory==null?void 0:Number(n.memory),o=n.timeout==null?void 0:Number(n.timeout);if(i!=null&&(!Number.isInteger(i)||i<128||i>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(o!=null&&(!Number.isInteger(o)||o<1||o>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(i==null&&o==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let s=await z(e,t),c=new I(s.region),l=`${s.slug}-${t}-${r}`;await c.updateFunctionConfiguration({FunctionName:l,...i!=null?{MemorySize:i}:{},...o!=null?{Timeout:o}:{}});let a=[i!=null?`${i} MB`:"",o!=null?`${o}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${l} (${a})`,ok:!0,stdout:`Updated ${l}: ${a}.`}}catch(s){return{operation:"function:config",ok:!1,error:Kr(s?.message??String(s))}}}var Yl=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function AT(e){return Yl.find((t)=>t.key===e)}async function Uy(e,t){try{let r=await z(e,t);return{ok:!0,alarms:await new q(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:Yl}}catch(r){return{ok:!1,alarms:[],presets:Yl,error:Kr(r?.message??String(r))}}}async function zy(e,t,r,n){let i=AT(r);if(!i)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(n)||n<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let o=await z(e,t),s=new q(o.region),c=`${o.slug}-${t}-${i.key}`,l=i.fnMode?[{Name:"FunctionName",Value:`${o.slug}-${t}-${i.fnMode}`}]:[];return await s.putMetricAlarm({AlarmName:c,Namespace:i.namespace,MetricName:i.metricName,ComparisonOperator:i.comparison,Threshold:n,EvaluationPeriods:1,Period:300,Statistic:i.statistic,Dimensions:l,AlarmDescription:`ts-cloud: ${i.label} > ${n} ${i.unit}`}),{operation:"alarm:create",command:`alarm ${c}`,ok:!0,stdout:`Alarm ${c} armed at ${n} ${i.unit}.`}}catch(o){return{operation:"alarm:create",ok:!1,error:Kr(o?.message??String(o))}}}async function Vy(e,t,r){try{let n=await z(e,t);if(!r.startsWith(`${n.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new q(n.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(n){return{operation:"alarm:delete",ok:!1,error:Kr(n?.message??String(n))}}}function kT(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function Cd(e,t,r=30){try{let n=await z(e,t),i=new Ql(n.region),o=new Date,s=new Date(o.getTime()-Math.min(360,Math.max(1,r))*60000),c=`${n.slug}-${t}-http`,l=await i.getTraceSummaries({startTime:s,endTime:o,filterExpression:`service("${c}")`});if(!l.summaries.length)l=await i.getTraceSummaries({startTime:s,endTime:o});return{ok:!0,traces:l.summaries.slice(0,100).map(kT)}}catch(n){return{ok:!1,traces:[],error:Kr(n?.message??String(n))}}}async function rp(e,t,r){try{let n=await z(e,t),i=`${n.slug}-${t}-scheduler`;if(r==="run"){let s=await Bt(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:Kr(s||"Scheduler run triggered.")}}let o=new ye(n.region);if(r==="enable")await o.enableRule({Name:i});else await o.disableRule({Name:i});return{operation:`scheduler:${r}`,command:`${r} ${i}`,ok:!0,stdout:`Scheduler rule ${i} ${r}d.`}}catch(n){return{operation:`scheduler:${r}`,ok:!1,error:Kr(n?.message??String(n))}}}function In(e){let t=Ed(e.name),r=ip(e.configText);if(xT(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let n=PT({...e,name:t}),i=e.configText.slice(0,r.end).trimEnd(),o=e.configText.slice(r.end),s=i.endsWith("{")?`
+[output truncated]`}function Xl(e,t){return e.environments?.[t]?.app}function Zl(e,t,r){let n=[],i=Xl(e,t);n.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),n.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let o=r.maintenance?.enabled;if(o!==!0)n.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(o!==!1)n.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(i?.assets||r.assetsInfo)n.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(i?.database?.connection==="aurora-serverless")n.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(i.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(i.database.maxCapacity??4)}]});for(let s of r.queues??[]){let c=String(s?.name??"").trim();if(c&&/^[A-Za-z0-9_-]+$/.test(c))n.push({id:`queue:purge:${c}`,label:`Purge queue (${c})`,group:"queue",target:c,mutates:!0,confirm:c,danger:!0})}return n}function Dy(e,t,r,n){return Zl(t,r,n).find((i)=>i.id===e)}async function ET(e,t,r){try{let n=new v(r),{Stacks:i}=await n.describeStacks({stackName:ke(e,t)}),o={};for(let l of i?.[0]?.Outputs??[])if(l.OutputKey)o[l.OutputKey]=l.OutputValue??"";let s=o.AssetsCdnDomain;if(!s)return null;return(await new E(r).findDistributionByDomain(s))?.Id??null}catch{return null}}async function Oy(e,t,r,n={}){try{if(r.id==="redeploy")return await No(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await ko(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await Es(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await Es(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let i=Number(n.min),o=Number(n.max);if(!Number.isFinite(i)||!Number.isFinite(o)||i<=0||o<i)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await xo(e,t,i,o),{operation:r.id,command:`db:scale ${i}-${o} ACU`,ok:!0,stdout:`Scaling applied (${i}-${o} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let i=await z(e,t),o=await ET(e,t,i.region);if(!o)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let c=await new E(i.region).invalidateAll(o);return{operation:r.id,command:`cloudfront invalidate ${o} /*`,ok:!0,stdout:`Invalidation ${c?.Id??"created"} for ${o} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let i=r.target,o=await z(e,t),s=new V(o.region),c=`${o.slug}-${t}-${i}`,{QueueUrl:l}=await s.getQueueUrl(c);return await s.purgeQueue(l),{operation:r.id,command:`sqs purge ${c}`,ok:!0,stdout:`Purged queue ${c}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(i){return{operation:r.id,ok:!1,error:Kr(i?.message??String(i))}}}async function _y(e,t,r){let n=r.trim();if(!n)return{operation:"command",ok:!1,error:"A command is required."};try{let i=await Bt(e,t,n);return{operation:"command",command:n,ok:!0,stdout:Kr(i||"(no output)")}}catch(i){return{operation:"command",command:n,ok:!1,error:Kr(i?.message??String(i))}}}var ep="No dead-letter queue is provisioned for this environment.";async function tp(e,t,r){try{let{QueueUrl:n}=await e.getQueueUrl(`${t}-${r}-dlq`);return n}catch{return null}}async function Ny(e,t,r=10){try{let n=await z(e,t),i=new V(n.region),o=await tp(i,n.slug,t);if(!o)return{ok:!1,messages:[],error:ep};return{ok:!0,messages:((await i.receiveMessages({queueUrl:o,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((l)=>({id:l.MessageId,receiptHandle:l.ReceiptHandle,body:Kr(String(l.Body??""))}))}}catch(n){return{ok:!1,messages:[],error:Kr(n?.message??String(n))}}}async function $y(e,t,r={}){try{let n=await z(e,t),i=Xl(e,t),s=(i?Jt(i,n.slug,t):[]).map((N)=>N.name.replace(`${n.slug}-${t}-`,"")),c=r.targetQueue&&s.includes(r.targetQueue)?r.targetQueue:s[0];if(!c)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let l=new V(n.region),a=await tp(l,n.slug,t);if(!a)return{operation:"dlq:redrive",ok:!1,error:ep};let{QueueUrl:f}=await l.getQueueUrl(`${n.slug}-${t}-${c}`),T=Math.min(50,Math.max(1,r.max??10)),D=0;while(D<T){let W=(await l.receiveMessages({queueUrl:a,maxMessages:Math.min(10,T-D),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!W.length)break;for(let Y of W)await l.sendMessage({queueUrl:f,messageBody:String(Y.Body??"")}),await l.deleteMessage(a,Y.ReceiptHandle),D++}return{operation:"dlq:redrive",command:`redrive → ${c}`,ok:!0,stdout:`Moved ${D} message(s) from the DLQ to ${c}.`}}catch(n){return{operation:"dlq:redrive",ok:!1,error:Kr(n?.message??String(n))}}}async function My(e,t){try{let r=await z(e,t),n=new V(r.region),i=await tp(n,r.slug,t);if(!i)return{operation:"dlq:purge",ok:!1,error:ep};return await n.purgeQueue(i),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:Kr(r?.message??String(r))}}}function Ly(e,t){let r=Xl(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((n)=>({key:n.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:n})):Object.entries(r.secrets).map(([n,i])=>({key:n,secretId:String(i)}))}async function By(e,t,r,n){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let i=await z(e,t),o=new K(i.region);try{await o.putSecretValue({SecretId:r,SecretString:n})}catch{await o.createSecret({Name:r,SecretString:n})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(i){return{operation:"secret:set",ok:!1,error:Kr(i?.message??String(i))}}}async function jy(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let n=await z(e,t);return await new K(n.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(n){return{operation:"secret:delete",ok:!1,error:Kr(n?.message??String(n))}}}var TT=new Set(["http","queue","cli"]);async function Fy(e,t,r,n){if(!TT.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let i=n.memory==null?void 0:Number(n.memory),o=n.timeout==null?void 0:Number(n.timeout);if(i!=null&&(!Number.isInteger(i)||i<128||i>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(o!=null&&(!Number.isInteger(o)||o<1||o>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(i==null&&o==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let s=await z(e,t),c=new I(s.region),l=`${s.slug}-${t}-${r}`;await c.updateFunctionConfiguration({FunctionName:l,...i!=null?{MemorySize:i}:{},...o!=null?{Timeout:o}:{}});let a=[i!=null?`${i} MB`:"",o!=null?`${o}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${l} (${a})`,ok:!0,stdout:`Updated ${l}: ${a}.`}}catch(s){return{operation:"function:config",ok:!1,error:Kr(s?.message??String(s))}}}var Yl=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function AT(e){return Yl.find((t)=>t.key===e)}async function Uy(e,t){try{let r=await z(e,t);return{ok:!0,alarms:await new G(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:Yl}}catch(r){return{ok:!1,alarms:[],presets:Yl,error:Kr(r?.message??String(r))}}}async function zy(e,t,r,n){let i=AT(r);if(!i)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(n)||n<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let o=await z(e,t),s=new G(o.region),c=`${o.slug}-${t}-${i.key}`,l=i.fnMode?[{Name:"FunctionName",Value:`${o.slug}-${t}-${i.fnMode}`}]:[];return await s.putMetricAlarm({AlarmName:c,Namespace:i.namespace,MetricName:i.metricName,ComparisonOperator:i.comparison,Threshold:n,EvaluationPeriods:1,Period:300,Statistic:i.statistic,Dimensions:l,AlarmDescription:`ts-cloud: ${i.label} > ${n} ${i.unit}`}),{operation:"alarm:create",command:`alarm ${c}`,ok:!0,stdout:`Alarm ${c} armed at ${n} ${i.unit}.`}}catch(o){return{operation:"alarm:create",ok:!1,error:Kr(o?.message??String(o))}}}async function Vy(e,t,r){try{let n=await z(e,t);if(!r.startsWith(`${n.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new G(n.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(n){return{operation:"alarm:delete",ok:!1,error:Kr(n?.message??String(n))}}}function kT(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function Cd(e,t,r=30){try{let n=await z(e,t),i=new Ql(n.region),o=new Date,s=new Date(o.getTime()-Math.min(360,Math.max(1,r))*60000),c=`${n.slug}-${t}-http`,l=await i.getTraceSummaries({startTime:s,endTime:o,filterExpression:`service("${c}")`});if(!l.summaries.length)l=await i.getTraceSummaries({startTime:s,endTime:o});return{ok:!0,traces:l.summaries.slice(0,100).map(kT)}}catch(n){return{ok:!1,traces:[],error:Kr(n?.message??String(n))}}}async function rp(e,t,r){try{let n=await z(e,t),i=`${n.slug}-${t}-scheduler`;if(r==="run"){let s=await Bt(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:Kr(s||"Scheduler run triggered.")}}let o=new ye(n.region);if(r==="enable")await o.enableRule({Name:i});else await o.disableRule({Name:i});return{operation:`scheduler:${r}`,command:`${r} ${i}`,ok:!0,stdout:`Scheduler rule ${i} ${r}d.`}}catch(n){return{operation:`scheduler:${r}`,ok:!1,error:Kr(n?.message??String(n))}}}function In(e){let t=Ed(e.name),r=ip(e.configText);if(xT(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let n=PT({...e,name:t}),i=e.configText.slice(0,r.end).trimEnd(),o=e.configText.slice(r.end),s=i.endsWith("{")?`
 `:i.endsWith(",")?`
 
 `:`,
@@ -456,7 +456,7 @@ ${t.map(([r,n])=>`        '${Bo(r)}': '${Bo(n)}',`).join(`
 `)}
       }`}function RT(e,t,r){let n=t;while(n<r&&/\s/.test(e[n]))n++;let i=0,o,s=!1;for(;n<r;n++){let c=e[n];if(o){if(s){s=!1;continue}if(c==="\\"){s=!0;continue}if(c===o)o=void 0;continue}if(c==='"'||c==="'"||c==="`"){o=c;continue}if(c==="{"||c==="["||c==="("){i++;continue}if(c==="}"||c==="]"||c===")"){if(i===0)return n;i--;continue}if(c===","&&i===0)return n}return r}function Yy(e,t,r,n){let i=e.slice(t+1,r),o=new RegExp(`(^|[\\s,{])(${op(n)})\\s*:\\s*\\{`,"m").exec(i);if(!o)return null;let s=t+1+o.index+o[1].length,c=e.indexOf("{",s);return{nameStart:s,end:Xy(e,c)}}function PT(e){let r=[`    ${Ed(e.name)}: {`];if(Lo(r,"deploy",e.deploy),Lo(r,"root",e.root),Lo(r,"path",e.path),Lo(r,"domain",e.domain),Lo(r,"type",e.type),Lo(r,"build",e.build),Lo(r,"start",e.start),e.port!==void 0)r.push(`      port: ${e.port},`);if(Lo(r,"pathRewriteStyle",e.pathRewriteStyle),e.ssl!==void 0)if(e.ssl===!1)r.push("      ssl: false,");else if(e.ssl===!0)r.push("      ssl: true,");else r.push(`      ssl: { provider: '${Bo(e.ssl.provider||"letsencrypt")}' },`);if(e.env&&Object.keys(e.env).length>0){r.push("      env: {");for(let[n,i]of Object.entries(e.env)){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(n))continue;r.push(`        ${n}: '${Bo(String(i))}',`)}r.push("      },")}return r.push("    },"),r.join(`
 `)}function Bo(e){return e.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'").replace(/\r/g,"\\r").replace(/\n/g,"\\n")}function Ed(e){let t=e.trim();if(!/^[A-Za-z_$][\w$]*$/.test(t))throw Error(`Invalid site name '${e}'. Use a valid JavaScript object key, e.g. docs or marketingSite.`);return t}function Lo(e,t,r){if(r===void 0||r==="")return;let n=r.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'");e.push(`      ${t}: '${n}',`)}function ip(e){let t=/\bsites\s*:\s*{/g.exec(e);if(!t)throw Error("Could not find a top-level sites: { ... } block in cloud.config.ts");let r=e.indexOf("{",t.index),n=Xy(e,r);return{start:r,end:n}}function xT(e,t,r,n){let i=e.slice(t+1,r);return new RegExp(`(^|[\\s,{])${op(n)}\\s*:`,"m").test(i)}function op(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Xy(e,t){let r=0,n,i=!1,o=!1,s=!1;for(let c=t;c<e.length;c++){let l=e[c],a=e[c+1];if(o){if(l===`
-`)o=!1;continue}if(s){if(l==="*"&&a==="/")s=!1,c++;continue}if(n){if(i){i=!1;continue}if(l==="\\"){i=!0;continue}if(l===n)n=void 0;continue}if(l==="/"&&a==="/"){o=!0,c++;continue}if(l==="/"&&a==="*"){s=!0,c++;continue}if(l==='"'||l==="'"||l==="`"){n=l;continue}if(l==="{")r++;if(l==="}"){if(r--,r===0)return c}}throw Error("Could not find the closing brace for sites: { ... } in cloud.config.ts")}function Zy(e,t,r){let n=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!n.length){if(t)return;let o=e.map((s)=>s.id);return o.length?o:["__no_authorized_telemetry_resources__"]}let i=n.map((o)=>e.find((s)=>s.id===o||s.slug===o)?.id).filter((o)=>!!o);if(i.length!==n.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(i)]}import{createHash as rb}from"node:crypto";function jo(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:null}function DT(e){if(!/^\d{4}-\d{2}-\d{2}$/.test(e))return null;let t=Date.parse(`${e}T12:00:00.000Z`);return Number.isFinite(t)?new Date(t).toISOString():null}function OT(e,t){if(!e||typeof e!=="object")return[];let r={source:t.name},n=[],i=t.now,o=(a,f,T,D=i)=>{if(f!==null)n.push({name:a,value:f,unit:T,timestamp:D,attributes:r})};o("storage.egress.month",jo(e.monthBytes),"bytes"),o("storage.egress.today",jo(e.todayBytes),"bytes"),o("storage.egress.projected_month",jo(e.projectedMonthBytes),"bytes");let s=jo(e.budgetBytes);if(s!==null&&s>0){o("storage.egress.budget",s,"bytes");let a=e.budgetUsedPercent,f=typeof a==="number"&&Number.isFinite(a)?a:jo(e.monthBytes)!==null?Math.round(jo(e.monthBytes)/s*1000)/10:null;o("storage.egress.budget_used_percent",f,"percent")}let c=t.maxReplayDays??45,l=Array.isArray(e.days)?e.days.slice(-c):[];for(let a of l){let f=DT(String(a?.date??"")),T=jo(a?.bytes);if(!f||T===null)continue;n.push({name:"storage.egress.day",value:T,unit:"bytes",timestamp:f,attributes:r});let D=jo(a?.downloads);if(D!==null)n.push({name:"storage.egress.day_downloads",value:D,unit:"count",timestamp:f,attributes:r})}return n}async function _T(e,t=process.env,r=fetch){let n=e.tokenEnv?t[e.tokenEnv]:void 0,i=await r(e.url,{headers:n?{Authorization:`Bearer ${n}`}:{},signal:AbortSignal.timeout(1e4)});if(!i.ok)throw Error(`HTTP ${i.status}`);return await i.json()}async function eb(e,t){let r=[],n=[];if(!Array.isArray(e)||e.length===0)return{metrics:r,errors:n};let i=await Promise.all(e.map(async(o)=>{if(!o?.name||!o?.url)return{endpoint:o,error:"egress endpoint needs both a name and a url"};try{let s=await _T(o,t.env,t.fetchImpl);return{endpoint:o,report:s}}catch(s){return{endpoint:o,error:s instanceof Error?s.message:String(s)}}}));for(let o of i){let s=`egress:${o.endpoint?.name??"unnamed"}`;if("error"in o&&o.error){n.push({source:s,message:o.error});continue}r.push(...OT(o.report,{name:o.endpoint.name,now:t.now}))}return{metrics:r,errors:n}}class nb{now;entries=new Map;constructor(e=Date.now){this.now=e}async getOrCreate(e,t,r,n){let i=this.entries.get(e);if(!r&&i&&i.expiresAt>this.now())return{value:await i.promise,cached:!0};let o=n().catch((s)=>{throw this.entries.delete(e),s});return this.entries.set(e,{expiresAt:this.now()+t,promise:o}),{value:await o,cached:!1}}invalidate(e){for(let t of this.entries.keys())if(t.startsWith(e))this.entries.delete(t)}}class ib{now;lastRun=new Map;constructor(e=Date.now){this.now=e}shouldRun(e,t,r=!1){let n=this.now(),i=this.lastRun.get(e);if(!r&&i!=null&&n-i<t)return!1;return this.lastRun.set(e,n),!0}}var ob=new nb,NT=new ib,$T=2000,MT=3600000;function LT(e,t){if(e.kind==="log"&&!t.collectLogs)return!1;if(e.kind==="trace"&&!t.collectTraces)return!1;if((e.kind==="request"||e.name.startsWith("request."))&&!t.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(e.kind)&&!e.name.startsWith("request."))return!0;let r=e.requestId??e.traceId??`${e.source}\x00${e.workloadId??""}\x00${e.timestamp}`;return Number.parseInt(rb("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=t.samplingRate}function Qr(...e){return`telemetry:${rb("sha256").update(e.map((t)=>String(t??"")).join("\x00")).digest("hex").slice(0,40)}`}function La(e,t,r,n){if(!n)return;return e.listResources(t,r).find((i)=>i.slug===n)?.id}function BT(e,t){let r=String(t??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(e)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(e)?"warning":"info"}function tb(e){let t=e.timestamp&&Number.isFinite(new Date(e.timestamp).getTime())?new Date(e.timestamp).toISOString():new Date().toISOString(),r={};try{let Y=JSON.parse(e.message);if(Y&&typeof Y==="object"&&!Array.isArray(Y))r=Y}catch{}let n=Object.fromEntries(Object.entries(r).filter(([Y])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(Y))),i=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,o=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,s=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),c=Number(r.statusCode??r.status_code??r.status),l=String(r.method??r.httpMethod??"")||void 0,a=es(String(r.pathTemplate??r.path??r.url??"")||void 0),f=String(r.releaseId??r.release_id??"")||void 0,T=String(r.deploymentId??r.deployment_id??"")||void 0,D={projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,source:e.source,timestamp:t,requestId:i,traceId:o,releaseId:f,deploymentId:T,workloadId:e.workloadId},N=Object.keys(r).length?JSON.stringify(n):e.message,W=[{...D,id:Qr(e.source,e.name,t,N),kind:"log",name:e.name,level:BT(N,r.level),message:N,attributes:n}];if(l&&a&&Number.isFinite(c)){if(W.push({...D,id:Qr("request",i,t,l,a,c),kind:"request",name:"http.request",method:l,pathTemplate:a,host:r.host,statusCode:c,durationMs:Number.isFinite(s)?s:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(s))W.push({...D,id:Qr("request-duration",i,t),kind:"metric",name:"request.duration",value:s,unit:"ms",attributes:{method:l,pathTemplate:a,statusCode:c}});if(W.push({...D,id:Qr("request-count",i,t),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:l,pathTemplate:a,statusCode:c}}),c>=500)W.push({...D,id:Qr("request-error",i,t),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:l,pathTemplate:a,statusCode:c}})}return W}async function jT(e){let t=new Qe(e.controlPlane),r=Xe(e.controlPlane,e.projectId),n=new Date,i=[],o=[],s={projectId:e.projectId,environmentId:e.environmentId},c=H(e.config);try{let D=(c==="serverless"?await ni(e.config,e.environment):await ai(e.config,e.environment,{includeSiteHealth:e.includeSiteHealth,telemetryOnly:e.lightweight}))??{};if(c==="serverless"){for(let W of D.functionsDetail??[]){let Y=La(e.controlPlane,e.projectId,e.environmentId,W.key),ee={...s,resourceId:Y,source:"cloudwatch",timestamp:n.toISOString(),workloadId:W.name,attributes:{provider:"aws",functionName:W.name,aggregationWindow:"24h"}};for(let[ne,he,te]of[["snapshot.traffic.requests_24h",W.invocations,"count"],["snapshot.errors.count_24h",W.errors,"count"],["snapshot.latency.p50_24h",W.p50,"ms"],["snapshot.latency.p95_24h",W.p95,"ms"],["snapshot.latency.p99_24h",W.p99,"ms"],["snapshot.saturation.throttles_24h",W.throttles,"count"],["snapshot.memory.max_24h",W.maxMem,"MB"]])if(Number.isFinite(Number(he)))i.push({...ee,id:Qr("cloudwatch",W.name,ne,n.toISOString()),kind:"metric",name:ne,value:Number(he),unit:te})}try{let W=await z(e.config,e.environment),Y=new q(W.region),ee=new Date(n.getTime()-3600000),ne=300;for(let he of W.functions){let te=[{Name:"FunctionName",Value:he.name}],[xe,tt,Fe,Gt,dt]=await Promise.all([Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:te,StartTime:ee,EndTime:n,Period:300,Statistics:["Sum"]}),Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:te,StartTime:ee,EndTime:n,Period:300,Statistics:["Sum"]}),Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:te,StartTime:ee,EndTime:n,Period:300,ExtendedStatistics:["p50","p95","p99"]}),Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:te,StartTime:ee,EndTime:n,Period:300,Statistics:["Sum"]}),Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:te,StartTime:ee,EndTime:n,Period:300,Statistics:["Maximum"]})]),Re=La(e.controlPlane,e.projectId,e.environmentId,he.mode),Ye=(Et,Ti,uo,hi)=>{for(let Ai of Et){let ki=Ai.Timestamp&&Number.isFinite(new Date(Ai.Timestamp).getTime())?new Date(Ai.Timestamp).toISOString():void 0,Ri=uo(Ai);if(ki&&Ri!=null&&Number.isFinite(Ri))i.push({...s,resourceId:Re,id:Qr("cloudwatch-series",he.name,Ti,ki),kind:"metric",source:"cloudwatch",name:Ti,timestamp:ki,value:Ri,unit:hi,workloadId:he.name,region:W.region,attributes:{provider:"aws",functionName:he.name,aggregationWindow:"300s"}})}};Ye(xe,"traffic.requests",(Et)=>Et.Sum,"count"),Ye(tt,"errors.count",(Et)=>Et.Sum,"count"),Ye(Fe,"latency.p50",(Et)=>Et.Percentiles?.p50,"ms"),Ye(Fe,"latency.p95",(Et)=>Et.Percentiles?.p95,"ms"),Ye(Fe,"latency.p99",(Et)=>Et.Percentiles?.p99,"ms"),Ye(Gt,"saturation.throttles",(Et)=>Et.Sum,"count"),Ye(dt,"saturation.concurrency",(Et)=>Et.Maximum,"count")}}catch(W){o.push({source:"cloudwatch:series",message:W instanceof Error?W.message:String(W)})}for(let W of(D.serverlessLogs??[]).slice(0,$T))i.push(...tb({...s,source:`cloudwatch:${W.source}`,name:`${W.source}.log`,timestamp:W.timestamp,message:String(W.message),resourceId:La(e.controlPlane,e.projectId,e.environmentId,W.source)}));for(let W of D.queuesDetail??[]){let Y={...s,source:"cloudwatch",timestamp:n.toISOString(),attributes:{queue:W.name}};i.push({...Y,id:Qr("queue-depth",W.name,n.toISOString()),kind:"metric",name:"queue.depth",value:Number(W.visible??W.depth??0),unit:"count"}),i.push({...Y,id:Qr("queue-inflight",W.name,n.toISOString()),kind:"metric",name:"queue.inflight",value:Number(W.inFlight??0),unit:"count"})}let N=await Cd(e.config,e.environment,30);if(!N.ok)o.push({source:"xray",message:N.error??"X-Ray traces are unavailable."});for(let W of N.traces)i.push({...s,id:Qr("xray",W.id),kind:"trace",source:"xray",name:"http.trace",timestamp:W.timestamp??n.toISOString(),traceId:W.id,durationMs:W.durationMs,statusCode:W.httpStatus,method:W.method,pathTemplate:W.url,attributes:{status:W.status,responseMs:W.responseMs}})}else{let N=D.systemMetrics;if(D.metricsUnavailable||!N)o.push({source:"host",message:"The host metrics probe is unavailable."});else{let W=Number(N.memTotalMb)>0?Number(N.memUsedMb)/Number(N.memTotalMb)*100:0,Y=Number(N.swapTotalMb)>0?Number(N.swapUsedMb)/Number(N.swapTotalMb)*100:0,ee=[["host.load",Number(N.load),"load"],["host.load.5m",Number(N.load5),"load"],["host.load.15m",Number(N.load15),"load"],["host.cpu.capacity",Number(N.cpus),"count"],["host.cpu.used_percent",Number(N.cpuUsedPct),"percent"],["host.memory.used",Number(N.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(N.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(N.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(N.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",W,"percent"],["host.swap.used",Number(N.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(N.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",Y,"percent"],["host.disk.used_percent",Number(N.diskUsedPct),"percent"],["host.disk.used",Number(N.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(N.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(N.inodeUsedPct),"percent"],["host.network.rx",Number(N.networkRxBytes),"bytes"],["host.network.tx",Number(N.networkTxBytes),"bytes"],["host.network.rx_rate",Number(N.networkRxBytesPerSec),"bytes_per_second"],["host.network.tx_rate",Number(N.networkTxBytesPerSec),"bytes_per_second"],["host.network.rx_today",Number(N.networkRxBytesToday),"bytes"],["host.network.tx_today",Number(N.networkTxBytesToday),"bytes"],["host.network.rx_month",Number(N.networkRxBytesMonth),"bytes"],["host.network.tx_month",Number(N.networkTxBytesMonth),"bytes"],["host.processes",Number(N.processes),"count"],["host.uptime",Number(N.uptimeSeconds),"seconds"]];for(let[ne,he,te]of ee)if(Number.isFinite(he))i.push({...s,id:Qr("host",ne,n.toISOString()),kind:"metric",source:"host",name:ne,timestamp:n.toISOString(),value:he,unit:te});for(let ne of D.siteHealth??[]){let he=String(ne.project??e.config.project.slug),te=String(ne.name),xe=te.startsWith(`${he}:`)?te.slice(he.length+1):te,tt=`site:${he}:${xe}`,Fe=La(e.controlPlane,e.projectId,e.environmentId,te),Gt={...s,resourceId:Fe,source:tt,timestamp:ne.checkedAt||n.toISOString(),host:ne.route,attributes:{project:he,site:xe,route:String(ne.route),status:String(ne.status)}},dt=[["site.health.up",ne.status==="live"?1:0,"boolean"],["site.http.status",Number(ne.httpStatus),"status"],["site.response.time",Number(ne.responseMs),"ms"]];if(ne.tlsDaysRemaining!=null)dt.push(["site.tls.days_remaining",Number(ne.tlsDaysRemaining),"days"]);for(let[Re,Ye,Et]of dt)if(Number.isFinite(Ye))i.push({...Gt,id:Qr(tt,Re,Gt.timestamp),kind:"metric",name:Re,value:Ye,unit:Et})}}}}catch(D){o.push({source:c==="serverless"?"aws":"host",message:D instanceof Error?D.message:String(D)})}{let D=e.config.infrastructure?.compute?.monitoring,N=typeof D==="object"?D?.egressEndpoints:void 0,W=await eb(N,{now:n.toISOString()});o.push(...W.errors);for(let Y of W.metrics)i.push({...s,id:Qr(Y.attributes.source,Y.name,Y.timestamp),kind:"metric",source:`egress:${Y.attributes.source}`,name:Y.name,timestamp:Y.timestamp,value:Y.value,unit:Y.unit,attributes:Y.attributes})}if(!e.lightweight)try{let D=await Ii(e.config,e.environment),N=new be(e.config,e.environment,{inventory:async()=>D});for(let W of D.workloads){let Y=La(e.controlPlane,e.projectId,e.environmentId,W.links.service),ee={...s,resourceId:Y,source:`runtime:${W.provider}`,timestamp:n.toISOString(),workloadId:W.id,releaseId:W.links.release,attributes:{status:W.status,provider:W.provider,service:W.links.service??""}};if(i.push({...ee,id:Qr(W.id,"health",n.toISOString()),kind:"metric",name:"health.up",value:W.status==="running"?1:0,unit:"boolean"}),i.push({...ee,id:Qr(W.id,"restarts",n.toISOString()),kind:"metric",name:"saturation.restarts",value:W.restartCount??0,unit:"count"}),W.resources?.memoryBytes!=null)i.push({...ee,id:Qr(W.id,"memory",n.toISOString()),kind:"metric",name:"runtime.memory.used",value:W.resources.memoryBytes,unit:"bytes"});if(!W.capabilities.logs.supported)continue;try{let ne=await N.logs(W.id,{limit:100,since:new Date(n.getTime()-300000)});for(let he of ne.lines)i.push(...tb({...s,resourceId:Y,source:`runtime:${W.provider}`,name:`${W.links.service??W.name}.log`,timestamp:he.timestamp,message:he.message,workloadId:W.id}))}catch(ne){o.push({source:`runtime:${W.provider}`,message:ne instanceof Error?ne.message:String(ne)})}}for(let W of D.sources.filter((Y)=>Y.status!=="fresh"))o.push({source:W.id,message:W.message??`Runtime source is ${W.status}.`})}catch(D){o.push({source:"runtime",message:D instanceof Error?D.message:String(D)})}if(!e.lightweight)for(let D of e.controlPlane.listEvents({projectId:e.projectId,limit:1000})){let N=D.payload;i.push({...s,id:`telemetry:event:${D.id}`,resourceId:D.resourceId,kind:"event",source:"control-plane",name:D.type,timestamp:D.createdAt,level:D.level,message:D.type,deploymentId:D.operationId,releaseId:typeof N.releaseId==="string"?N.releaseId:void 0,traceId:D.correlationId,attributes:N})}let l=i.filter((D)=>LT(D,r)).map((D)=>({...D,sampled:r.samplingRate<1&&(D.kind==="log"||D.kind==="trace"||D.kind==="request"||D.name.startsWith("request."))})),a=t.appendMany(l).length;if(NT.shouldRun(e.projectId,MT,!e.lightweight))t.enforceRetention(r,e.projectId);let f=t.status(e.projectId,e.environmentId,r.rawDays,r.samplingRate);for(let D of o)if(!f.some((N)=>N.source===D.source))f.push({source:D.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:D.message});let T=n.toISOString();return e.controlPlane.setSetting(`telemetry.collection:${e.projectId}:${e.environmentId??"all"}`,{generatedAt:T,errors:o,statuses:f,policy:r}),{collected:a,cached:!1,generatedAt:T,statuses:f,errors:o,policy:r}}async function ri(e){let r=`${`${e.projectId}:${e.environmentId??"all"}:${e.environment}`}:${e.lightweight?"lightweight":"full"}`,n=H(e.config)==="serverless"?300000:60000,i=await ob.getOrCreate(r,n,!!e.force,()=>jT(e));return{...i.value,cached:i.cached}}function sb(e){ob.invalidate(`${e}:`)}function ab(e,t={}){let r=t.shell||(process.platform==="win32"?"powershell.exe":"bash"),n=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:t.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),i=new TextDecoder,o=async(s)=>{if(!s)return;let c=s.getReader();try{for(;;){let{done:l,value:a}=await c.read();if(l)break;if(a)e(i.decode(a))}}catch{}};if(o(n.stdout),o(n.stderr),t.onExit)n.exited.then((s)=>t.onExit(s)).catch(()=>{});return{write(s){try{n.stdin.write(s),n.stdin.flush()}catch{}},close(){try{n.stdin.end()}catch{}try{n.kill()}catch{}}}}var WT="127.0.0.1",HT=7676,db=65536,vb="ts-cloud-dashboard-",ca=UT(GT(import.meta.url));function KT(e){try{return process.kill(e,0),!0}catch(t){return t?.code!=="ESRCH"}}function QT(e=kd(),t=KT){let r=0;for(let n of cb(e,{withFileTypes:!0})){if(!n.isDirectory()||!n.name.startsWith(vb))continue;let i=Ct(e,n.name),o=n.name.match(/^ts-cloud-dashboard-(\d+)-/);if(o){let s=Number(o[1]);if(s===process.pid||t(s))continue}else if(cb(i).length>0)continue;vs(i,{recursive:!0,force:!0}),r+=1}return r}var YT={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function b(e,t=200,r={}){return new Response(JSON.stringify(e,null,2),{status:t,headers:{"content-type":"application/json; charset=utf-8",...r}})}function XT(e,t,r,n){let i=new TextEncoder,o=Math.max(0,Math.floor(r)),s,c,l=!1,a=new ReadableStream({start(f){let T=()=>{if(l)return;if(l=!0,s?.(),c)clearInterval(c);n.removeEventListener("abort",T);try{f.close()}catch{}},D=(W)=>{if(l)return;if(W.reset)f.enqueue(i.encode(`event: reset
+`)o=!1;continue}if(s){if(l==="*"&&a==="/")s=!1,c++;continue}if(n){if(i){i=!1;continue}if(l==="\\"){i=!0;continue}if(l===n)n=void 0;continue}if(l==="/"&&a==="/"){o=!0,c++;continue}if(l==="/"&&a==="*"){s=!0,c++;continue}if(l==='"'||l==="'"||l==="`"){n=l;continue}if(l==="{")r++;if(l==="}"){if(r--,r===0)return c}}throw Error("Could not find the closing brace for sites: { ... } in cloud.config.ts")}function Zy(e,t,r){let n=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!n.length){if(t)return;let o=e.map((s)=>s.id);return o.length?o:["__no_authorized_telemetry_resources__"]}let i=n.map((o)=>e.find((s)=>s.id===o||s.slug===o)?.id).filter((o)=>!!o);if(i.length!==n.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(i)]}import{createHash as rb}from"node:crypto";function jo(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:null}function DT(e){if(!/^\d{4}-\d{2}-\d{2}$/.test(e))return null;let t=Date.parse(`${e}T12:00:00.000Z`);return Number.isFinite(t)?new Date(t).toISOString():null}function OT(e,t){if(!e||typeof e!=="object")return[];let r={source:t.name},n=[],i=t.now,o=(a,f,T,D=i)=>{if(f!==null)n.push({name:a,value:f,unit:T,timestamp:D,attributes:r})};o("storage.egress.month",jo(e.monthBytes),"bytes"),o("storage.egress.today",jo(e.todayBytes),"bytes"),o("storage.egress.projected_month",jo(e.projectedMonthBytes),"bytes");let s=jo(e.budgetBytes);if(s!==null&&s>0){o("storage.egress.budget",s,"bytes");let a=e.budgetUsedPercent,f=typeof a==="number"&&Number.isFinite(a)?a:jo(e.monthBytes)!==null?Math.round(jo(e.monthBytes)/s*1000)/10:null;o("storage.egress.budget_used_percent",f,"percent")}let c=t.maxReplayDays??45,l=Array.isArray(e.days)?e.days.slice(-c):[];for(let a of l){let f=DT(String(a?.date??"")),T=jo(a?.bytes);if(!f||T===null)continue;n.push({name:"storage.egress.day",value:T,unit:"bytes",timestamp:f,attributes:r});let D=jo(a?.downloads);if(D!==null)n.push({name:"storage.egress.day_downloads",value:D,unit:"count",timestamp:f,attributes:r})}return n}async function _T(e,t=process.env,r=fetch){let n=e.tokenEnv?t[e.tokenEnv]:void 0,i=await r(e.url,{headers:n?{Authorization:`Bearer ${n}`}:{},signal:AbortSignal.timeout(1e4)});if(!i.ok)throw Error(`HTTP ${i.status}`);return await i.json()}async function eb(e,t){let r=[],n=[];if(!Array.isArray(e)||e.length===0)return{metrics:r,errors:n};let i=await Promise.all(e.map(async(o)=>{if(!o?.name||!o?.url)return{endpoint:o,error:"egress endpoint needs both a name and a url"};try{let s=await _T(o,t.env,t.fetchImpl);return{endpoint:o,report:s}}catch(s){return{endpoint:o,error:s instanceof Error?s.message:String(s)}}}));for(let o of i){let s=`egress:${o.endpoint?.name??"unnamed"}`;if("error"in o&&o.error){n.push({source:s,message:o.error});continue}r.push(...OT(o.report,{name:o.endpoint.name,now:t.now}))}return{metrics:r,errors:n}}class nb{now;entries=new Map;constructor(e=Date.now){this.now=e}async getOrCreate(e,t,r,n){let i=this.entries.get(e);if(!r&&i&&i.expiresAt>this.now())return{value:await i.promise,cached:!0};let o=n().catch((s)=>{throw this.entries.delete(e),s});return this.entries.set(e,{expiresAt:this.now()+t,promise:o}),{value:await o,cached:!1}}invalidate(e){for(let t of this.entries.keys())if(t.startsWith(e))this.entries.delete(t)}}class ib{now;lastRun=new Map;constructor(e=Date.now){this.now=e}shouldRun(e,t,r=!1){let n=this.now(),i=this.lastRun.get(e);if(!r&&i!=null&&n-i<t)return!1;return this.lastRun.set(e,n),!0}}var ob=new nb,NT=new ib,$T=2000,MT=3600000;function LT(e,t){if(e.kind==="log"&&!t.collectLogs)return!1;if(e.kind==="trace"&&!t.collectTraces)return!1;if((e.kind==="request"||e.name.startsWith("request."))&&!t.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(e.kind)&&!e.name.startsWith("request."))return!0;let r=e.requestId??e.traceId??`${e.source}\x00${e.workloadId??""}\x00${e.timestamp}`;return Number.parseInt(rb("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=t.samplingRate}function Qr(...e){return`telemetry:${rb("sha256").update(e.map((t)=>String(t??"")).join("\x00")).digest("hex").slice(0,40)}`}function La(e,t,r,n){if(!n)return;return e.listResources(t,r).find((i)=>i.slug===n)?.id}function BT(e,t){let r=String(t??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(e)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(e)?"warning":"info"}function tb(e){let t=e.timestamp&&Number.isFinite(new Date(e.timestamp).getTime())?new Date(e.timestamp).toISOString():new Date().toISOString(),r={};try{let Y=JSON.parse(e.message);if(Y&&typeof Y==="object"&&!Array.isArray(Y))r=Y}catch{}let n=Object.fromEntries(Object.entries(r).filter(([Y])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(Y))),i=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,o=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,s=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),c=Number(r.statusCode??r.status_code??r.status),l=String(r.method??r.httpMethod??"")||void 0,a=es(String(r.pathTemplate??r.path??r.url??"")||void 0),f=String(r.releaseId??r.release_id??"")||void 0,T=String(r.deploymentId??r.deployment_id??"")||void 0,D={projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,source:e.source,timestamp:t,requestId:i,traceId:o,releaseId:f,deploymentId:T,workloadId:e.workloadId},N=Object.keys(r).length?JSON.stringify(n):e.message,W=[{...D,id:Qr(e.source,e.name,t,N),kind:"log",name:e.name,level:BT(N,r.level),message:N,attributes:n}];if(l&&a&&Number.isFinite(c)){if(W.push({...D,id:Qr("request",i,t,l,a,c),kind:"request",name:"http.request",method:l,pathTemplate:a,host:r.host,statusCode:c,durationMs:Number.isFinite(s)?s:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(s))W.push({...D,id:Qr("request-duration",i,t),kind:"metric",name:"request.duration",value:s,unit:"ms",attributes:{method:l,pathTemplate:a,statusCode:c}});if(W.push({...D,id:Qr("request-count",i,t),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:l,pathTemplate:a,statusCode:c}}),c>=500)W.push({...D,id:Qr("request-error",i,t),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:l,pathTemplate:a,statusCode:c}})}return W}async function jT(e){let t=new Qe(e.controlPlane),r=Xe(e.controlPlane,e.projectId),n=new Date,i=[],o=[],s={projectId:e.projectId,environmentId:e.environmentId},c=H(e.config);try{let D=(c==="serverless"?await ni(e.config,e.environment):await ai(e.config,e.environment,{includeSiteHealth:e.includeSiteHealth,telemetryOnly:e.lightweight}))??{};if(c==="serverless"){for(let W of D.functionsDetail??[]){let Y=La(e.controlPlane,e.projectId,e.environmentId,W.key),ee={...s,resourceId:Y,source:"cloudwatch",timestamp:n.toISOString(),workloadId:W.name,attributes:{provider:"aws",functionName:W.name,aggregationWindow:"24h"}};for(let[ne,he,te]of[["snapshot.traffic.requests_24h",W.invocations,"count"],["snapshot.errors.count_24h",W.errors,"count"],["snapshot.latency.p50_24h",W.p50,"ms"],["snapshot.latency.p95_24h",W.p95,"ms"],["snapshot.latency.p99_24h",W.p99,"ms"],["snapshot.saturation.throttles_24h",W.throttles,"count"],["snapshot.memory.max_24h",W.maxMem,"MB"]])if(Number.isFinite(Number(he)))i.push({...ee,id:Qr("cloudwatch",W.name,ne,n.toISOString()),kind:"metric",name:ne,value:Number(he),unit:te})}try{let W=await z(e.config,e.environment),Y=new G(W.region),ee=new Date(n.getTime()-3600000),ne=300;for(let he of W.functions){let te=[{Name:"FunctionName",Value:he.name}],[xe,tt,Fe,Gt,dt]=await Promise.all([Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:te,StartTime:ee,EndTime:n,Period:300,Statistics:["Sum"]}),Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:te,StartTime:ee,EndTime:n,Period:300,Statistics:["Sum"]}),Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:te,StartTime:ee,EndTime:n,Period:300,ExtendedStatistics:["p50","p95","p99"]}),Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:te,StartTime:ee,EndTime:n,Period:300,Statistics:["Sum"]}),Y.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:te,StartTime:ee,EndTime:n,Period:300,Statistics:["Maximum"]})]),Re=La(e.controlPlane,e.projectId,e.environmentId,he.mode),Ye=(Et,Ti,uo,hi)=>{for(let Ai of Et){let ki=Ai.Timestamp&&Number.isFinite(new Date(Ai.Timestamp).getTime())?new Date(Ai.Timestamp).toISOString():void 0,Ri=uo(Ai);if(ki&&Ri!=null&&Number.isFinite(Ri))i.push({...s,resourceId:Re,id:Qr("cloudwatch-series",he.name,Ti,ki),kind:"metric",source:"cloudwatch",name:Ti,timestamp:ki,value:Ri,unit:hi,workloadId:he.name,region:W.region,attributes:{provider:"aws",functionName:he.name,aggregationWindow:"300s"}})}};Ye(xe,"traffic.requests",(Et)=>Et.Sum,"count"),Ye(tt,"errors.count",(Et)=>Et.Sum,"count"),Ye(Fe,"latency.p50",(Et)=>Et.Percentiles?.p50,"ms"),Ye(Fe,"latency.p95",(Et)=>Et.Percentiles?.p95,"ms"),Ye(Fe,"latency.p99",(Et)=>Et.Percentiles?.p99,"ms"),Ye(Gt,"saturation.throttles",(Et)=>Et.Sum,"count"),Ye(dt,"saturation.concurrency",(Et)=>Et.Maximum,"count")}}catch(W){o.push({source:"cloudwatch:series",message:W instanceof Error?W.message:String(W)})}for(let W of(D.serverlessLogs??[]).slice(0,$T))i.push(...tb({...s,source:`cloudwatch:${W.source}`,name:`${W.source}.log`,timestamp:W.timestamp,message:String(W.message),resourceId:La(e.controlPlane,e.projectId,e.environmentId,W.source)}));for(let W of D.queuesDetail??[]){let Y={...s,source:"cloudwatch",timestamp:n.toISOString(),attributes:{queue:W.name}};i.push({...Y,id:Qr("queue-depth",W.name,n.toISOString()),kind:"metric",name:"queue.depth",value:Number(W.visible??W.depth??0),unit:"count"}),i.push({...Y,id:Qr("queue-inflight",W.name,n.toISOString()),kind:"metric",name:"queue.inflight",value:Number(W.inFlight??0),unit:"count"})}let N=await Cd(e.config,e.environment,30);if(!N.ok)o.push({source:"xray",message:N.error??"X-Ray traces are unavailable."});for(let W of N.traces)i.push({...s,id:Qr("xray",W.id),kind:"trace",source:"xray",name:"http.trace",timestamp:W.timestamp??n.toISOString(),traceId:W.id,durationMs:W.durationMs,statusCode:W.httpStatus,method:W.method,pathTemplate:W.url,attributes:{status:W.status,responseMs:W.responseMs}})}else{let N=D.systemMetrics;if(D.metricsUnavailable||!N)o.push({source:"host",message:"The host metrics probe is unavailable."});else{let W=Number(N.memTotalMb)>0?Number(N.memUsedMb)/Number(N.memTotalMb)*100:0,Y=Number(N.swapTotalMb)>0?Number(N.swapUsedMb)/Number(N.swapTotalMb)*100:0,ee=[["host.load",Number(N.load),"load"],["host.load.5m",Number(N.load5),"load"],["host.load.15m",Number(N.load15),"load"],["host.cpu.capacity",Number(N.cpus),"count"],["host.cpu.used_percent",Number(N.cpuUsedPct),"percent"],["host.memory.used",Number(N.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(N.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(N.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(N.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",W,"percent"],["host.swap.used",Number(N.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(N.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",Y,"percent"],["host.disk.used_percent",Number(N.diskUsedPct),"percent"],["host.disk.used",Number(N.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(N.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(N.inodeUsedPct),"percent"],["host.network.rx",Number(N.networkRxBytes),"bytes"],["host.network.tx",Number(N.networkTxBytes),"bytes"],["host.network.rx_rate",Number(N.networkRxBytesPerSec),"bytes_per_second"],["host.network.tx_rate",Number(N.networkTxBytesPerSec),"bytes_per_second"],["host.network.rx_today",Number(N.networkRxBytesToday),"bytes"],["host.network.tx_today",Number(N.networkTxBytesToday),"bytes"],["host.network.rx_month",Number(N.networkRxBytesMonth),"bytes"],["host.network.tx_month",Number(N.networkTxBytesMonth),"bytes"],["host.processes",Number(N.processes),"count"],["host.uptime",Number(N.uptimeSeconds),"seconds"]];for(let[ne,he,te]of ee)if(Number.isFinite(he))i.push({...s,id:Qr("host",ne,n.toISOString()),kind:"metric",source:"host",name:ne,timestamp:n.toISOString(),value:he,unit:te});for(let ne of D.siteHealth??[]){let he=String(ne.project??e.config.project.slug),te=String(ne.name),xe=te.startsWith(`${he}:`)?te.slice(he.length+1):te,tt=`site:${he}:${xe}`,Fe=La(e.controlPlane,e.projectId,e.environmentId,te),Gt={...s,resourceId:Fe,source:tt,timestamp:ne.checkedAt||n.toISOString(),host:ne.route,attributes:{project:he,site:xe,route:String(ne.route),status:String(ne.status)}},dt=[["site.health.up",ne.status==="live"?1:0,"boolean"],["site.http.status",Number(ne.httpStatus),"status"],["site.response.time",Number(ne.responseMs),"ms"]];if(ne.tlsDaysRemaining!=null)dt.push(["site.tls.days_remaining",Number(ne.tlsDaysRemaining),"days"]);for(let[Re,Ye,Et]of dt)if(Number.isFinite(Ye))i.push({...Gt,id:Qr(tt,Re,Gt.timestamp),kind:"metric",name:Re,value:Ye,unit:Et})}}}}catch(D){o.push({source:c==="serverless"?"aws":"host",message:D instanceof Error?D.message:String(D)})}{let D=e.config.infrastructure?.compute?.monitoring,N=typeof D==="object"?D?.egressEndpoints:void 0,W=await eb(N,{now:n.toISOString()});o.push(...W.errors);for(let Y of W.metrics)i.push({...s,id:Qr(Y.attributes.source,Y.name,Y.timestamp),kind:"metric",source:`egress:${Y.attributes.source}`,name:Y.name,timestamp:Y.timestamp,value:Y.value,unit:Y.unit,attributes:Y.attributes})}if(!e.lightweight)try{let D=await Ii(e.config,e.environment),N=new be(e.config,e.environment,{inventory:async()=>D});for(let W of D.workloads){let Y=La(e.controlPlane,e.projectId,e.environmentId,W.links.service),ee={...s,resourceId:Y,source:`runtime:${W.provider}`,timestamp:n.toISOString(),workloadId:W.id,releaseId:W.links.release,attributes:{status:W.status,provider:W.provider,service:W.links.service??""}};if(i.push({...ee,id:Qr(W.id,"health",n.toISOString()),kind:"metric",name:"health.up",value:W.status==="running"?1:0,unit:"boolean"}),i.push({...ee,id:Qr(W.id,"restarts",n.toISOString()),kind:"metric",name:"saturation.restarts",value:W.restartCount??0,unit:"count"}),W.resources?.memoryBytes!=null)i.push({...ee,id:Qr(W.id,"memory",n.toISOString()),kind:"metric",name:"runtime.memory.used",value:W.resources.memoryBytes,unit:"bytes"});if(!W.capabilities.logs.supported)continue;try{let ne=await N.logs(W.id,{limit:100,since:new Date(n.getTime()-300000)});for(let he of ne.lines)i.push(...tb({...s,resourceId:Y,source:`runtime:${W.provider}`,name:`${W.links.service??W.name}.log`,timestamp:he.timestamp,message:he.message,workloadId:W.id}))}catch(ne){o.push({source:`runtime:${W.provider}`,message:ne instanceof Error?ne.message:String(ne)})}}for(let W of D.sources.filter((Y)=>Y.status!=="fresh"))o.push({source:W.id,message:W.message??`Runtime source is ${W.status}.`})}catch(D){o.push({source:"runtime",message:D instanceof Error?D.message:String(D)})}if(!e.lightweight)for(let D of e.controlPlane.listEvents({projectId:e.projectId,limit:1000})){let N=D.payload;i.push({...s,id:`telemetry:event:${D.id}`,resourceId:D.resourceId,kind:"event",source:"control-plane",name:D.type,timestamp:D.createdAt,level:D.level,message:D.type,deploymentId:D.operationId,releaseId:typeof N.releaseId==="string"?N.releaseId:void 0,traceId:D.correlationId,attributes:N})}let l=i.filter((D)=>LT(D,r)).map((D)=>({...D,sampled:r.samplingRate<1&&(D.kind==="log"||D.kind==="trace"||D.kind==="request"||D.name.startsWith("request."))})),a=t.appendMany(l).length;if(NT.shouldRun(e.projectId,MT,!e.lightweight))t.enforceRetention(r,e.projectId);let f=t.status(e.projectId,e.environmentId,r.rawDays,r.samplingRate);for(let D of o)if(!f.some((N)=>N.source===D.source))f.push({source:D.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:D.message});let T=n.toISOString();return e.controlPlane.setSetting(`telemetry.collection:${e.projectId}:${e.environmentId??"all"}`,{generatedAt:T,errors:o,statuses:f,policy:r}),{collected:a,cached:!1,generatedAt:T,statuses:f,errors:o,policy:r}}async function ri(e){let r=`${`${e.projectId}:${e.environmentId??"all"}:${e.environment}`}:${e.lightweight?"lightweight":"full"}`,n=H(e.config)==="serverless"?300000:60000,i=await ob.getOrCreate(r,n,!!e.force,()=>jT(e));return{...i.value,cached:i.cached}}function sb(e){ob.invalidate(`${e}:`)}function ab(e,t={}){let r=t.shell||(process.platform==="win32"?"powershell.exe":"bash"),n=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:t.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),i=new TextDecoder,o=async(s)=>{if(!s)return;let c=s.getReader();try{for(;;){let{done:l,value:a}=await c.read();if(l)break;if(a)e(i.decode(a))}}catch{}};if(o(n.stdout),o(n.stderr),t.onExit)n.exited.then((s)=>t.onExit(s)).catch(()=>{});return{write(s){try{n.stdin.write(s),n.stdin.flush()}catch{}},close(){try{n.stdin.end()}catch{}try{n.kill()}catch{}}}}var WT="127.0.0.1",HT=7676,db=65536,vb="ts-cloud-dashboard-",ca=UT(GT(import.meta.url));function KT(e){try{return process.kill(e,0),!0}catch(t){return t?.code!=="ESRCH"}}function QT(e=kd(),t=KT){let r=0;for(let n of cb(e,{withFileTypes:!0})){if(!n.isDirectory()||!n.name.startsWith(vb))continue;let i=Ct(e,n.name),o=n.name.match(/^ts-cloud-dashboard-(\d+)-/);if(o){let s=Number(o[1]);if(s===process.pid||t(s))continue}else if(cb(i).length>0)continue;vs(i,{recursive:!0,force:!0}),r+=1}return r}var YT={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function b(e,t=200,r={}){return new Response(JSON.stringify(e,null,2),{status:t,headers:{"content-type":"application/json; charset=utf-8",...r}})}function XT(e,t,r,n){let i=new TextEncoder,o=Math.max(0,Math.floor(r)),s,c,l=!1,a=new ReadableStream({start(f){let T=()=>{if(l)return;if(l=!0,s?.(),c)clearInterval(c);n.removeEventListener("abort",T);try{f.close()}catch{}},D=(W)=>{if(l)return;if(W.reset)f.enqueue(i.encode(`event: reset
 data: ${JSON.stringify({cursor:W.cursor,droppedBytes:W.droppedBytes})}
 
 `));for(let Y of W.chunks.filter((ee)=>ee.cursor>o))o=Y.cursor,f.enqueue(i.encode(`id: ${Y.cursor}
@@ -474,7 +474,7 @@ data: ${JSON.stringify({cursor:o,at:new Date().toISOString()})}
 ${c}
 ${l}`);return null}return n}catch(i){if(n)vs(n,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${i.message}`);return null}}function fA(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:_t(da(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,n])=>[r,{domain:n.domain,path:n.path,type:n.type,deploy:n.deploy,root:n.root,port:n.port,ssl:n.ssl}]))}}function wb(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function hA(e,t){return wb(t).find((r)=>r.id===e)}function gb(e){if(e.length<=db)return e;return`${e.slice(0,db)}
 
-[output truncated]`}async function mb(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:l}=await n.read();if(c)break;let a=i.decode(l,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function ap(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([mb(r.stdout,"stdout",t.onOutput),mb(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:gb(i),stderr:gb(o)}}finally{t.signal?.removeEventListener("abort",n)}}function yA(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var bA=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function SA(e){let t=ja(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!bA.has(r)}var vA={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function fb(e,t){if(t.role==="admin")return!0;let r=ja(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!SA(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=vA[n];return!!i&&!!t.capabilities?.includes(i)}function wA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=zT(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Ct(e,i);if(ao(o)&&!Sb(o).isDirectory())return o;if(!ja(o)&&ao(`${o}.html`))return`${o}.html`;if(!ja(o)&&ao(Ct(o,"index.html")))return Ct(o,"index.html");return null}async function hb(e,t){let r=wA(e,t);if(!r){let o=Ct(e,"404.html");if(ao(o))return new Response(await Li(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Rd("Not found",404)}if(Sb(r).isDirectory())return Rd("Not found",404);let n=await Li(r),i=YT[ja(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var Ad=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],yb=new WeakMap;async function bb(e){let t=yb.get(e);if(t)return t;let r=await import("./chunk-hfswzdzj.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return yb.set(e,i),i}async function cr(e={}){QT();let t=e.cwd??process.cwd(),r=e.host??WT,n=e.port??HT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await oA(t);let o=e.config??await Bi(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=w(o);if(s&&c&&!c.password)c.password=s;let l=o.infrastructure?.compute?.managedServices?.vitess;if(s&&l&&typeof l==="object"&&!l.password)l.password=s;let a=y(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let f=Object.keys(o.environments??{}),T=nA(o,e.environment),D=sA(t),N=await bs(o,T),W=new Map([[T,N]]),Y=new Map([[T,Date.now()]]),ee=new Map([[T,Date.now()]]),ne=new Map,he=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),te=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),xe=H(o)!=="serverless",tt=(C)=>{let Te=W.get(C);if(Te&&!ub(Y.get(C),Date.now(),he))return Promise.resolve(Te);let Ne=ne.get(C);if(Ne)return Ne;let Ce=!xe||ub(ee.get(C),Date.now(),te),qe=bs(o,C,{includeSiteHealth:Ce}).then((gt)=>{let L=W.get(C),Lr=Ce?gt:pA(L,gt);if(W.set(C,Lr),Y.set(C,Date.now()),Ce)ee.set(C,Date.now());if(L?._serverReachable!==Lr._serverReachable||L?._metricsStatus!==Lr._metricsStatus||(L?.sitesDetail?.length??0)!==(Lr.sitesDetail?.length??0))hi();return Lr}).finally(()=>ne.delete(C));return ne.set(C,qe),qe},Fe=Ss(t),Gt=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Gt!=="0"&&(Gt==="1"||!o.cloud?.attachTo)){let C=!1,Te=Date.now()+300000,Ne=async()=>{if(C)return;C=!0;try{let qe=Date.now(),gt=qe>=Te;if(gt)Te=qe+300000;let L=a.environments.get(T);await ri({controlPlane:a.store,projectId:a.project.id,environmentId:L?.id,config:o,environment:T,force:!0,lightweight:!0,includeSiteHealth:gt})}catch(qe){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${qe instanceof Error?qe.message:String(qe)}`)}finally{C=!1}};Ne(),setInterval(()=>void Ne(),60000).unref?.()}let Re=new Map,Ye=new Map,Et=new Set,Ti=0;function uo(C,Te){if(C.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`))return C;let Ne=a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),Ce=Ne?a.store.getMembershipForActor(a.organization.id,Ne.id):void 0;if(!Ce||Ce.status!=="active")return{...C,role:"member",sites:{},capabilities:[]};let qe=a.store.listGrants(Ce.id),gt=a.store.resolveAuthorizationTarget(a.organization.id,Ce.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),L=mn({membership:Ce,grants:qe,target:gt});if(Ce.roleTemplate==="owner"||Ce.roleTemplate==="admin")return{...C,role:"admin",sites:{},organizationRole:Ce.roleTemplate,organizationSource:Ce.source,capabilities:L};let Lr=a.environments.get(Te),Kt={};for(let Ze of a.store.listResources(a.project.id,Lr?.id).filter((nt)=>nt.kind==="application")){let nt=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:Ze.id});if(!nt||!re({membership:Ce,grants:qe,capability:"project:read",target:nt}).allowed)continue;Kt[Ze.slug]=re({membership:Ce,grants:qe,capability:"config:write",target:nt}).allowed?"owner":"collaborator"}return{...C,role:"member",sites:Kt,organizationRole:Ce.roleTemplate,organizationSource:Ce.source,capabilities:L}}function hi(){Ti+=1,Re.clear();for(let C of Et)vs(C,{recursive:!0,force:!0});Et.clear()}let Ai=(C,Te)=>`${Te}:${C.role==="admin"?"admin":`member:${Object.entries(C.sites).sort(([Ne],[Ce])=>Ne.localeCompare(Ce)).map(([Ne,Ce])=>`${Ne}=${Ce}`).join(",")}`}:${[...C.capabilities??[]].sort().join(",")}`;async function ki(C,Te){let Ne=uo(C,Te),Ce=Ai(Ne,Te),qe=Re.get(Ce);if(qe)return qe;let gt=Ye.get(Ce);if(gt)return gt;let L=Ti,Lr=(async()=>{let Kt=W.get(Te)??await bs(o,Te);W.set(Te,Kt);let Ze={...Hl(Kt,{user:Ne,slug:o.project.slug}),viewer:{role:Ne.role,organizationRole:Ne.organizationRole,organizationSource:Ne.organizationSource,capabilities:Ne.capabilities??[]}},nt=await mA(t,Ze);if(nt&&L!==Ti)return vs(nt,{recursive:!0,force:!0}),Fe?.uiRoot;if(nt)Et.add(nt);let Cr=nt??Fe?.uiRoot;if(Cr)Re.set(Ce,Cr);return Cr})();Ye.set(Ce,Lr);try{return await Lr}finally{Ye.delete(Ce)}}let Ri=await ki({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!Ri)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ge=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ee=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ee&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Pe=!Ee,Ot=ny(t),Wt=Pe?ay(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Ie=new _e(a.store,{encryptionKey:x(t)}),lt=new Ve(a.store),rt=new xt(a.store),ze=new rr(a.store,{encryptionKey:x(t)}),$r=new Wn(a.store),ws=new Jn(a.store,{cwd:t}),Pi=new Kn(a.store,{encryptionKey:x(t)}),At=new S(a.store,{workerId:`dashboard:${process.pid}`}),Mt=new er(a.store),Fi=new tr(a.store,x(t)),po=new Rr(a.store),Fa=new Ur(Mt,At,Fi),go=o.project?.region??"us-east-1",dp=x(t),gn=new Nr(po,{encryptionKey:dp,backends:[new Tt(a.store,dp),new Ir(new K(go),go),new Pr(new He(go),go),new Dr]});await un(gn,a,o);let Pd=new me(go),Ib={aws_rds:new Mn(new zn(Pd)),aws_aurora:new Un(new Hn(Pd)),aws_elasticache:new Bn(new Gn(new ie(go))),server:new jn(new st),container:new Vn(new st)},up=(C)=>Ib[C.provider],Qt=new ei(a.store),Fo=new qr(Qt,At),lp=new ti(Fi),Cb={managed_database:new yu(Mt,Pd),logical_database:new Iu(Mt,Fi),volume:new Eu,files:new wu(t),control_plane:new Au(a.store,t),infrastructure:new Ru(new Sa(go))},Eb=(C)=>Cb[C.resourceKind],Tb=(C)=>C.provider==="aws_backup"?void 0:lp,xd=new mt(a.store),Dd=[new $t,new tn(A(t,"volumes"))],Ui=new en(xd,Dd,At),ua=new De(a.store),xi=new Pn(ua,[new it("aws"),new it("hetzner"),new it("ssh")],At),mo=new Dn(a.store),pp=new Nn(mo,ua),zo=new kn(a.store),gp=new xn(zo,At),zi=new _n(a.store),Od=new On(zi,At),mp=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((C)=>new $n(C,a.store,a.project.id,a.organization.id)),br=new Hr(a.store),fp=new Zn(br,{queue:At}),Ht=new Je(a.store),fo=new Ke(a.store),En=new ot(a.store),We=new ft(a.store,{encryptionKey:x(t)}),Ab=()=>bb(a.store);for(let C of a.environments.values())Gr(br,o,{organization:a.organization,project:a.project,environment:C,resources:a.store.listResources(a.project.id,C.id)});let Tn=new yr(We,{emailImpl:async(C)=>{let{email:Te}=await import("./chunk-9pvkb6br.js");return Te.send(C)}}),hp=async(C)=>{let Te=rn(We,a.project.id,C),Ne=[];for(let Ce of Te.filter((qe)=>qe.notify&&qe.alert))Ne.push(...await Tn.deliverAll(Tn.enqueue(a.organization.id,Ce.alert,Ce.transition)));return Ne.push(...await Tn.deliverAll(Tn.enqueueRemindersAndEscalations(a.organization.id,We.listAlerts(a.project.id,{environmentId:C,states:["firing"]})))),Ne.push(...await Tn.retryDue()),{evaluations:Te,deliveries:Ne}},_d=!1,kb=async()=>{if(_d)return;_d=!0;try{for(let C of a.environments.values())for(let Te of We.listHealthChecks(a.project.id,C.id).filter((Ne)=>Ne.enabled)){let Ne=We.listHealthResults(Te.id,1)[0];if(Ne&&Date.now()-new Date(Ne.checkedAt).getTime()<Te.intervalSeconds*1000)continue;let Ce=await new Me(We).runAndEvaluate(Te);for(let qe of Ce.evaluations.filter((gt)=>gt.notify&&gt.alert))await Tn.deliverAll(Tn.enqueue(a.organization.id,qe.alert,qe.transition))}}finally{_d=!1}},yp=setInterval(()=>{for(let C of a.environments.values())hp(C.id).catch((Te)=>console.error("ts-cloud alert evaluation failed:",Te))},60000);yp.unref?.();let bp=setInterval(()=>{kb().catch((C)=>console.error("ts-cloud health check evaluation failed:",C))},30000);bp.unref?.();let Sp=setInterval(()=>{try{fp.tick()}catch(C){console.error("ts-cloud scheduled job evaluation failed:",C)}},30000);Sp.unref?.();let vp=setInterval(()=>{try{Fo.enqueueDue(),Fo.enqueueRetention()}catch(C){console.error("ts-cloud backup policy evaluation failed:",C)}},30000);vp.unref?.(),Ht.cleanup();let wp=setInterval(()=>{try{Ht.cleanup()}catch(C){console.error("ts-cloud preview cleanup failed:",C)}},3600000);wp.unref?.();let Rb=e.queueWorker??!0,Pb=yA(),xb=async(C,Te)=>{let Ce=(C.environmentId?a.store.listEnvironments(C.projectId).find((qe)=>qe.id===C.environmentId):void 0)?.slug??String(T);if(Te.kind==="dashboard_operation"&&Te.operationId){let qe=W.get(Ce)??N,gt=Xn(Te.operationId,o,qe);if(!gt||gt.danger||!["scheduler","backup","worker"].includes(gt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let L=await Vr(o,Ce,gt);return{ok:L.ok,stdout:L.stdout,stderr:L.stderr??L.error,retryable:/temporar|unavailable|timeout|network/i.test(L.stderr??L.error??""),output:{command:L.command??null,operation:L.operation}}}if(Te.kind==="serverless_scheduler"){let qe=await rp(o,Ce,"run");return{ok:qe.ok,stdout:qe.stdout,stderr:qe.error,retryable:/temporar|unavailable|timeout|network/i.test(qe.error??""),output:{command:qe.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Te.kind}.`}},Ua=Rb?new lo(At,{...yc({store:a.store,execute:async(C,Te)=>{let Ne=Te.operation.input&&typeof Te.operation.input==="object"&&!Array.isArray(Te.operation.input)?Te.operation.input:{},Ce=Ne.source&&typeof Ne.source==="object"?Ne.source:void 0,qe=t,gt,L,Lr;try{if(Ce?.bindingId&&Ce?.connectionId&&Ce?.commitSha){let Ze=ze.getBinding(String(Ce.bindingId)),nt=ze.getConnection(String(Ce.connectionId));if(!Ze||!nt||Ze.connectionId!==nt.id)throw Error("Queued source binding is no longer available");let mr=(Ze.repositoryId?ze.getRepository(Ze.repositoryId):ze.listRepositories(nt.id).find((As)=>As.fullName.toLowerCase()===Ze.repositoryFullName.toLowerCase()))?.cloneUrl;if(!mr&&nt.provider==="generic_ssh")mr=`git@${new URL(nt.host).hostname}:${Ze.repositoryFullName}.git`;if(!mr)mr=new URL(`/${Ze.repositoryFullName}.git`,nt.host.endsWith("/")?nt.host:`${nt.host}/`).href;let Se=Ze.deployKeyId?ze.getDeployKey(Ze.deployKeyId):void 0,Lt=Se&&Ze.deployKeyId?{...Se,privateKey:ze.getDeployPrivateKey(Ze.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(nt.provider)&&C.target.previewId){let As=vo(nt,ze.getCredential(nt.id)),ue=Ht.previews.getInstance(C.target.previewId);Lr=async(Fn,Ga)=>{try{await As.setCommitStatus(Ze.repositoryFullName,String(Ce.commitSha),{state:Fn,url:ue?.url,description:Ga})}catch(ks){Te.log(`Could not publish source status: ${ks instanceof Error?ks.message:String(ks)}`,{stream:"stderr"})}},await Lr("pending",`Preview deployment started for ${String(Ce.commitSha).slice(0,12)}`)}gt=cp(Ct(kd(),"ts-cloud-queued-source-")),Te.log(`Checking out immutable source commit ${Ce.commitSha}.`,{stream:"system"}),qe=(await Qd({remote:mr,binding:Ze,destination:Ct(gt,"checkout"),ref:String(Ce.branch??Ze.defaultBranch),commitSha:String(Ce.commitSha)},{credential:ze.getCredential(nt.id),deployKey:Lt})).directory}if(Te.operation.kind!=="preview.destroy"){let Ze=C.target.previewId?Ht.previews.getInstance(C.target.previewId):void 0,nt=Ze?Ht.previews.getDefinition(Ze.definitionId):void 0,Cr=Te.operation.resourceId?a.store.getResource(Te.operation.resourceId):void 0;if(L=await gn.resolve({projectId:a.project.id,environmentId:Te.operation.environmentId,resourceId:Te.operation.resourceId,functionId:Cr?.kind==="function"?Cr.id:void 0,previewId:Ze?.id,trustedPreview:!!Ze&&!Ze.fork,allowedPreviewSecrets:nt?.inheritedSecrets}),L.warnings.some((mr)=>mr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${L.warnings.filter((mr)=>mr.code==="missing_required").map((mr)=>mr.key).join(", ")}`);if(Te.operation.resourceId)for(let mr of Object.values(L.entries))po.setDependency({entryId:mr.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:mr.required,requiresRedeploy:!0});Te.log(`Resolved configuration ${L.configurationHash.slice(0,18)} for ${Object.keys(L.values).length} keys.`,{stream:"system"})}let Kt=await ap(C,{cwd:qe,cliEntry:i,signal:Te.signal,env:L?.values,onOutput:(Ze,nt)=>Te.log(nt,{stream:Ze,step:"execute",secrets:[...Pb,...Object.entries(L?.entries??{}).filter(([,Cr])=>Cr.kind==="secret").map(([Cr])=>L.values[Cr]).filter(Boolean)]})});if(Kt.ok&&Te.operation.resourceId&&L)for(let Ze of Object.values(L.entries))po.setDependency({entryId:Ze.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:Ze.required,requiresRedeploy:!1,lastDeployedVersion:Ze.version});return await Lr?.(Kt.ok?"success":"failure",Kt.ok?`Preview is ready at ${String(Ce?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Ce?.commitSha).slice(0,12)}`),Kt}catch(Kt){throw await Lr?.("error",`Preview deployment could not complete at ${String(Ce?.commitSha).slice(0,12)}`),Kt}finally{if(gt)vs(gt,{recursive:!0,force:!0})}}}),...Vg({store:br,executor:xb}),...em({store:Mt,secrets:Fi,resolveAdapter:up}),...Uf(ua,xi.drivers),...ch(zo,[new Cl("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...eh({store:zi,cleanup:mp}),...hc(xd,Dd),...Yg({store:Qt,queue:At,resolveSource:Eb,resolveDestination:Tb,validateHealth:async(C,Te)=>{if(!C.healthCheckId)return{healthy:!0,mode:"adapter"};let Ne=We.getHealthCheck(C.healthCheckId);if(!Ne||Ne.projectId!==C.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Ce=await new Me(We).runAndEvaluate(Ne);return{healthy:Ce.result.status==="healthy",healthCheckId:Ne.id,healthResultId:Ce.result.id,target:Te}}}),...Qp({store:a.store,resolveDriver:e.releaseDriver??((C)=>({name:`${a.store.getResource(C.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:C.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(C,Te)=>{let Ne=We.listHealthChecks(Te.projectId,Te.environmentId).find((qe)=>qe.enabled&&qe.name===C&&(!qe.resourceId||qe.resourceId===Te.resourceId));if(!Ne)return{healthy:!1,message:`Named health gate ${C} was not found for this release.`};let Ce=await new Me(We).runAndEvaluate(Ne);return{healthy:Ce.result.status==="healthy",evidence:{healthCheckId:Ne.id,healthResultId:Ce.result.id,status:Ce.result.status,timings:Ce.result.timings},message:Ce.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(C)=>console.error("ts-cloud deployment queue worker failed:",C)}):void 0;if(Qn(a),dd(rt,le(a,String(T)),N),Wt)ud(a,Wt.users),uy(Ie,a,Wt.users);let Ft=cy({cwd:t,enabled:Pe,secret:Ot,authentication:Ie,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(T)}}),Yt=new Al,Ip=setInterval(()=>Yt.sweep(),60000);Ip.unref?.();let za=new $a,Nd=new $a(3,900000,900000),Va=new $a(8,900000,900000),Cp=setInterval(()=>za.prune(),300000),Ep=setInterval(()=>Nd.prune(),300000),Tp=setInterval(()=>Va.prune(),300000);if(Cp.unref?.(),Ep.unref?.(),Tp.unref?.(),Pe){if(Wt?.generated)console.warn(`
+[output truncated]`}async function mb(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:l}=await n.read();if(c)break;let a=i.decode(l,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function ap(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([mb(r.stdout,"stdout",t.onOutput),mb(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:gb(i),stderr:gb(o)}}finally{t.signal?.removeEventListener("abort",n)}}function yA(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var bA=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function SA(e){let t=ja(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!bA.has(r)}var vA={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function fb(e,t){if(t.role==="admin")return!0;let r=ja(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!SA(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=vA[n];return!!i&&!!t.capabilities?.includes(i)}function wA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=zT(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Ct(e,i);if(ao(o)&&!Sb(o).isDirectory())return o;if(!ja(o)&&ao(`${o}.html`))return`${o}.html`;if(!ja(o)&&ao(Ct(o,"index.html")))return Ct(o,"index.html");return null}async function hb(e,t){let r=wA(e,t);if(!r){let o=Ct(e,"404.html");if(ao(o))return new Response(await Li(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Rd("Not found",404)}if(Sb(r).isDirectory())return Rd("Not found",404);let n=await Li(r),i=YT[ja(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var Ad=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],yb=new WeakMap;async function bb(e){let t=yb.get(e);if(t)return t;let r=await import("./chunk-xpzkwgb4.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return yb.set(e,i),i}async function cr(e={}){QT();let t=e.cwd??process.cwd(),r=e.host??WT,n=e.port??HT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await oA(t);let o=e.config??await Bi(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=w(o);if(s&&c&&!c.password)c.password=s;let l=o.infrastructure?.compute?.managedServices?.vitess;if(s&&l&&typeof l==="object"&&!l.password)l.password=s;let a=y(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let f=Object.keys(o.environments??{}),T=nA(o,e.environment),D=sA(t),N=await bs(o,T),W=new Map([[T,N]]),Y=new Map([[T,Date.now()]]),ee=new Map([[T,Date.now()]]),ne=new Map,he=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),te=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),xe=H(o)!=="serverless",tt=(C)=>{let Te=W.get(C);if(Te&&!ub(Y.get(C),Date.now(),he))return Promise.resolve(Te);let Ne=ne.get(C);if(Ne)return Ne;let Ce=!xe||ub(ee.get(C),Date.now(),te),qe=bs(o,C,{includeSiteHealth:Ce}).then((gt)=>{let L=W.get(C),Lr=Ce?gt:pA(L,gt);if(W.set(C,Lr),Y.set(C,Date.now()),Ce)ee.set(C,Date.now());if(L?._serverReachable!==Lr._serverReachable||L?._metricsStatus!==Lr._metricsStatus||(L?.sitesDetail?.length??0)!==(Lr.sitesDetail?.length??0))hi();return Lr}).finally(()=>ne.delete(C));return ne.set(C,qe),qe},Fe=Ss(t),Gt=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Gt!=="0"&&(Gt==="1"||!o.cloud?.attachTo)){let C=!1,Te=Date.now()+300000,Ne=async()=>{if(C)return;C=!0;try{let qe=Date.now(),gt=qe>=Te;if(gt)Te=qe+300000;let L=a.environments.get(T);await ri({controlPlane:a.store,projectId:a.project.id,environmentId:L?.id,config:o,environment:T,force:!0,lightweight:!0,includeSiteHealth:gt})}catch(qe){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${qe instanceof Error?qe.message:String(qe)}`)}finally{C=!1}};Ne(),setInterval(()=>void Ne(),60000).unref?.()}let Re=new Map,Ye=new Map,Et=new Set,Ti=0;function uo(C,Te){if(C.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`))return C;let Ne=a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),Ce=Ne?a.store.getMembershipForActor(a.organization.id,Ne.id):void 0;if(!Ce||Ce.status!=="active")return{...C,role:"member",sites:{},capabilities:[]};let qe=a.store.listGrants(Ce.id),gt=a.store.resolveAuthorizationTarget(a.organization.id,Ce.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),L=mn({membership:Ce,grants:qe,target:gt});if(Ce.roleTemplate==="owner"||Ce.roleTemplate==="admin")return{...C,role:"admin",sites:{},organizationRole:Ce.roleTemplate,organizationSource:Ce.source,capabilities:L};let Lr=a.environments.get(Te),Kt={};for(let Ze of a.store.listResources(a.project.id,Lr?.id).filter((nt)=>nt.kind==="application")){let nt=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:Ze.id});if(!nt||!re({membership:Ce,grants:qe,capability:"project:read",target:nt}).allowed)continue;Kt[Ze.slug]=re({membership:Ce,grants:qe,capability:"config:write",target:nt}).allowed?"owner":"collaborator"}return{...C,role:"member",sites:Kt,organizationRole:Ce.roleTemplate,organizationSource:Ce.source,capabilities:L}}function hi(){Ti+=1,Re.clear();for(let C of Et)vs(C,{recursive:!0,force:!0});Et.clear()}let Ai=(C,Te)=>`${Te}:${C.role==="admin"?"admin":`member:${Object.entries(C.sites).sort(([Ne],[Ce])=>Ne.localeCompare(Ce)).map(([Ne,Ce])=>`${Ne}=${Ce}`).join(",")}`}:${[...C.capabilities??[]].sort().join(",")}`;async function ki(C,Te){let Ne=uo(C,Te),Ce=Ai(Ne,Te),qe=Re.get(Ce);if(qe)return qe;let gt=Ye.get(Ce);if(gt)return gt;let L=Ti,Lr=(async()=>{let Kt=W.get(Te)??await bs(o,Te);W.set(Te,Kt);let Ze={...Hl(Kt,{user:Ne,slug:o.project.slug}),viewer:{role:Ne.role,organizationRole:Ne.organizationRole,organizationSource:Ne.organizationSource,capabilities:Ne.capabilities??[]}},nt=await mA(t,Ze);if(nt&&L!==Ti)return vs(nt,{recursive:!0,force:!0}),Fe?.uiRoot;if(nt)Et.add(nt);let Cr=nt??Fe?.uiRoot;if(Cr)Re.set(Ce,Cr);return Cr})();Ye.set(Ce,Lr);try{return await Lr}finally{Ye.delete(Ce)}}let Ri=await ki({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!Ri)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ge=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ee=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ee&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Pe=!Ee,Ot=ny(t),Wt=Pe?ay(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Ie=new _e(a.store,{encryptionKey:x(t)}),lt=new Ve(a.store),rt=new xt(a.store),ze=new rr(a.store,{encryptionKey:x(t)}),$r=new Wn(a.store),ws=new Jn(a.store,{cwd:t}),Pi=new Kn(a.store,{encryptionKey:x(t)}),At=new S(a.store,{workerId:`dashboard:${process.pid}`}),Mt=new er(a.store),Fi=new tr(a.store,x(t)),po=new Rr(a.store),Fa=new Ur(Mt,At,Fi),go=o.project?.region??"us-east-1",dp=x(t),gn=new Nr(po,{encryptionKey:dp,backends:[new Tt(a.store,dp),new Ir(new K(go),go),new Pr(new He(go),go),new Dr]});await un(gn,a,o);let Pd=new me(go),Ib={aws_rds:new Mn(new zn(Pd)),aws_aurora:new Un(new Hn(Pd)),aws_elasticache:new Bn(new qn(new ie(go))),server:new jn(new st),container:new Vn(new st)},up=(C)=>Ib[C.provider],Qt=new ei(a.store),Fo=new Gr(Qt,At),lp=new ti(Fi),Cb={managed_database:new yu(Mt,Pd),logical_database:new Iu(Mt,Fi),volume:new Eu,files:new wu(t),control_plane:new Au(a.store,t),infrastructure:new Ru(new Sa(go))},Eb=(C)=>Cb[C.resourceKind],Tb=(C)=>C.provider==="aws_backup"?void 0:lp,xd=new mt(a.store),Dd=[new $t,new tn(A(t,"volumes"))],Ui=new en(xd,Dd,At),ua=new De(a.store),xi=new Pn(ua,[new it("aws"),new it("hetzner"),new it("ssh")],At),mo=new Dn(a.store),pp=new Nn(mo,ua),zo=new kn(a.store),gp=new xn(zo,At),zi=new _n(a.store),Od=new On(zi,At),mp=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((C)=>new $n(C,a.store,a.project.id,a.organization.id)),br=new Hr(a.store),fp=new Zn(br,{queue:At}),Ht=new Je(a.store),fo=new Ke(a.store),En=new ot(a.store),We=new ft(a.store,{encryptionKey:x(t)}),Ab=()=>bb(a.store);for(let C of a.environments.values())qr(br,o,{organization:a.organization,project:a.project,environment:C,resources:a.store.listResources(a.project.id,C.id)});let Tn=new yr(We,{emailImpl:async(C)=>{let{email:Te}=await import("./chunk-fawjv4dc.js");return Te.send(C)}}),hp=async(C)=>{let Te=rn(We,a.project.id,C),Ne=[];for(let Ce of Te.filter((qe)=>qe.notify&&qe.alert))Ne.push(...await Tn.deliverAll(Tn.enqueue(a.organization.id,Ce.alert,Ce.transition)));return Ne.push(...await Tn.deliverAll(Tn.enqueueRemindersAndEscalations(a.organization.id,We.listAlerts(a.project.id,{environmentId:C,states:["firing"]})))),Ne.push(...await Tn.retryDue()),{evaluations:Te,deliveries:Ne}},_d=!1,kb=async()=>{if(_d)return;_d=!0;try{for(let C of a.environments.values())for(let Te of We.listHealthChecks(a.project.id,C.id).filter((Ne)=>Ne.enabled)){let Ne=We.listHealthResults(Te.id,1)[0];if(Ne&&Date.now()-new Date(Ne.checkedAt).getTime()<Te.intervalSeconds*1000)continue;let Ce=await new Me(We).runAndEvaluate(Te);for(let qe of Ce.evaluations.filter((gt)=>gt.notify&&gt.alert))await Tn.deliverAll(Tn.enqueue(a.organization.id,qe.alert,qe.transition))}}finally{_d=!1}},yp=setInterval(()=>{for(let C of a.environments.values())hp(C.id).catch((Te)=>console.error("ts-cloud alert evaluation failed:",Te))},60000);yp.unref?.();let bp=setInterval(()=>{kb().catch((C)=>console.error("ts-cloud health check evaluation failed:",C))},30000);bp.unref?.();let Sp=setInterval(()=>{try{fp.tick()}catch(C){console.error("ts-cloud scheduled job evaluation failed:",C)}},30000);Sp.unref?.();let vp=setInterval(()=>{try{Fo.enqueueDue(),Fo.enqueueRetention()}catch(C){console.error("ts-cloud backup policy evaluation failed:",C)}},30000);vp.unref?.(),Ht.cleanup();let wp=setInterval(()=>{try{Ht.cleanup()}catch(C){console.error("ts-cloud preview cleanup failed:",C)}},3600000);wp.unref?.();let Rb=e.queueWorker??!0,Pb=yA(),xb=async(C,Te)=>{let Ce=(C.environmentId?a.store.listEnvironments(C.projectId).find((qe)=>qe.id===C.environmentId):void 0)?.slug??String(T);if(Te.kind==="dashboard_operation"&&Te.operationId){let qe=W.get(Ce)??N,gt=Xn(Te.operationId,o,qe);if(!gt||gt.danger||!["scheduler","backup","worker"].includes(gt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let L=await Vr(o,Ce,gt);return{ok:L.ok,stdout:L.stdout,stderr:L.stderr??L.error,retryable:/temporar|unavailable|timeout|network/i.test(L.stderr??L.error??""),output:{command:L.command??null,operation:L.operation}}}if(Te.kind==="serverless_scheduler"){let qe=await rp(o,Ce,"run");return{ok:qe.ok,stdout:qe.stdout,stderr:qe.error,retryable:/temporar|unavailable|timeout|network/i.test(qe.error??""),output:{command:qe.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Te.kind}.`}},Ua=Rb?new lo(At,{...yc({store:a.store,execute:async(C,Te)=>{let Ne=Te.operation.input&&typeof Te.operation.input==="object"&&!Array.isArray(Te.operation.input)?Te.operation.input:{},Ce=Ne.source&&typeof Ne.source==="object"?Ne.source:void 0,qe=t,gt,L,Lr;try{if(Ce?.bindingId&&Ce?.connectionId&&Ce?.commitSha){let Ze=ze.getBinding(String(Ce.bindingId)),nt=ze.getConnection(String(Ce.connectionId));if(!Ze||!nt||Ze.connectionId!==nt.id)throw Error("Queued source binding is no longer available");let mr=(Ze.repositoryId?ze.getRepository(Ze.repositoryId):ze.listRepositories(nt.id).find((As)=>As.fullName.toLowerCase()===Ze.repositoryFullName.toLowerCase()))?.cloneUrl;if(!mr&&nt.provider==="generic_ssh")mr=`git@${new URL(nt.host).hostname}:${Ze.repositoryFullName}.git`;if(!mr)mr=new URL(`/${Ze.repositoryFullName}.git`,nt.host.endsWith("/")?nt.host:`${nt.host}/`).href;let Se=Ze.deployKeyId?ze.getDeployKey(Ze.deployKeyId):void 0,Lt=Se&&Ze.deployKeyId?{...Se,privateKey:ze.getDeployPrivateKey(Ze.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(nt.provider)&&C.target.previewId){let As=vo(nt,ze.getCredential(nt.id)),ue=Ht.previews.getInstance(C.target.previewId);Lr=async(Fn,Ga)=>{try{await As.setCommitStatus(Ze.repositoryFullName,String(Ce.commitSha),{state:Fn,url:ue?.url,description:Ga})}catch(ks){Te.log(`Could not publish source status: ${ks instanceof Error?ks.message:String(ks)}`,{stream:"stderr"})}},await Lr("pending",`Preview deployment started for ${String(Ce.commitSha).slice(0,12)}`)}gt=cp(Ct(kd(),"ts-cloud-queued-source-")),Te.log(`Checking out immutable source commit ${Ce.commitSha}.`,{stream:"system"}),qe=(await Qd({remote:mr,binding:Ze,destination:Ct(gt,"checkout"),ref:String(Ce.branch??Ze.defaultBranch),commitSha:String(Ce.commitSha)},{credential:ze.getCredential(nt.id),deployKey:Lt})).directory}if(Te.operation.kind!=="preview.destroy"){let Ze=C.target.previewId?Ht.previews.getInstance(C.target.previewId):void 0,nt=Ze?Ht.previews.getDefinition(Ze.definitionId):void 0,Cr=Te.operation.resourceId?a.store.getResource(Te.operation.resourceId):void 0;if(L=await gn.resolve({projectId:a.project.id,environmentId:Te.operation.environmentId,resourceId:Te.operation.resourceId,functionId:Cr?.kind==="function"?Cr.id:void 0,previewId:Ze?.id,trustedPreview:!!Ze&&!Ze.fork,allowedPreviewSecrets:nt?.inheritedSecrets}),L.warnings.some((mr)=>mr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${L.warnings.filter((mr)=>mr.code==="missing_required").map((mr)=>mr.key).join(", ")}`);if(Te.operation.resourceId)for(let mr of Object.values(L.entries))po.setDependency({entryId:mr.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:mr.required,requiresRedeploy:!0});Te.log(`Resolved configuration ${L.configurationHash.slice(0,18)} for ${Object.keys(L.values).length} keys.`,{stream:"system"})}let Kt=await ap(C,{cwd:qe,cliEntry:i,signal:Te.signal,env:L?.values,onOutput:(Ze,nt)=>Te.log(nt,{stream:Ze,step:"execute",secrets:[...Pb,...Object.entries(L?.entries??{}).filter(([,Cr])=>Cr.kind==="secret").map(([Cr])=>L.values[Cr]).filter(Boolean)]})});if(Kt.ok&&Te.operation.resourceId&&L)for(let Ze of Object.values(L.entries))po.setDependency({entryId:Ze.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:Ze.required,requiresRedeploy:!1,lastDeployedVersion:Ze.version});return await Lr?.(Kt.ok?"success":"failure",Kt.ok?`Preview is ready at ${String(Ce?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Ce?.commitSha).slice(0,12)}`),Kt}catch(Kt){throw await Lr?.("error",`Preview deployment could not complete at ${String(Ce?.commitSha).slice(0,12)}`),Kt}finally{if(gt)vs(gt,{recursive:!0,force:!0})}}}),...Vg({store:br,executor:xb}),...em({store:Mt,secrets:Fi,resolveAdapter:up}),...Uf(ua,xi.drivers),...ch(zo,[new Cl("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...eh({store:zi,cleanup:mp}),...hc(xd,Dd),...Yg({store:Qt,queue:At,resolveSource:Eb,resolveDestination:Tb,validateHealth:async(C,Te)=>{if(!C.healthCheckId)return{healthy:!0,mode:"adapter"};let Ne=We.getHealthCheck(C.healthCheckId);if(!Ne||Ne.projectId!==C.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Ce=await new Me(We).runAndEvaluate(Ne);return{healthy:Ce.result.status==="healthy",healthCheckId:Ne.id,healthResultId:Ce.result.id,target:Te}}}),...Qp({store:a.store,resolveDriver:e.releaseDriver??((C)=>({name:`${a.store.getResource(C.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:C.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(C,Te)=>{let Ne=We.listHealthChecks(Te.projectId,Te.environmentId).find((qe)=>qe.enabled&&qe.name===C&&(!qe.resourceId||qe.resourceId===Te.resourceId));if(!Ne)return{healthy:!1,message:`Named health gate ${C} was not found for this release.`};let Ce=await new Me(We).runAndEvaluate(Ne);return{healthy:Ce.result.status==="healthy",evidence:{healthCheckId:Ne.id,healthResultId:Ce.result.id,status:Ce.result.status,timings:Ce.result.timings},message:Ce.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(C)=>console.error("ts-cloud deployment queue worker failed:",C)}):void 0;if(Qn(a),dd(rt,le(a,String(T)),N),Wt)ud(a,Wt.users),uy(Ie,a,Wt.users);let Ft=cy({cwd:t,enabled:Pe,secret:Ot,authentication:Ie,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(T)}}),Yt=new Al,Ip=setInterval(()=>Yt.sweep(),60000);Ip.unref?.();let za=new $a,Nd=new $a(3,900000,900000),Va=new $a(8,900000,900000),Cp=setInterval(()=>za.prune(),300000),Ep=setInterval(()=>Nd.prune(),300000),Tp=setInterval(()=>Va.prune(),300000);if(Cp.unref?.(),Ep.unref?.(),Tp.unref?.(),Pe){if(Wt?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${Wt.generated.username}
     password: ${Wt.generated.password}
@@ -483,7 +483,7 @@ ${l}`);return null}return n}catch(i){if(n)vs(n,{recursive:!0,force:!0});if(proce
 `),C.close();return}let Te=ab((Ne)=>C.send(Ne),{cwd:t,onExit:()=>{try{C.close()}catch{}}});Q.set(C,Te),C.send(`Connected to ${r==="127.0.0.1"?"localhost":r} shell. This is a line-oriented shell (no full-screen apps).\r
 `)},message(C,Te){Q.get(C)?.write(typeof Te==="string"?Te:new TextDecoder().decode(Te))},close(C){Q.get(C)?.close(),Q.delete(C)}},async fetch(C,Te){let Ne=Date.now(),Ce=C.clone(),qe=C.headers.get("x-request-id")?.slice(0,128)||crypto.randomUUID(),gt=!["GET","HEAD","OPTIONS"].includes(C.method.toUpperCase()),L=new URL(C.url),Kt=await(async()=>{let Ze=Te??Ts,nt=rA(r,Ze.port??n),Cr=await Db(C,$d(Ze.requestIP(C)?.address??"unknown"));if(Cr)return Cr;let mr=L.searchParams.get("env"),Se=iA(f,T,mr),Lt=W.get(Se);if(!Lt)Lt=await tt(Se);try{if(!cA(C))return b({ok:!1,error:"Cross-site requests are not allowed."},403);let Vo=/^\/api\/source\/webhooks\/([A-Za-z0-9_-]{16,200})$/.exec(L.pathname);if(Vo&&C.method==="POST"){let d=await lg({sources:ze,controlPlane:a.store,endpointToken:Vo[1],headers:C.headers,rawBody:new Uint8Array(await C.arrayBuffer())});return b({accepted:d.accepted,duplicate:d.duplicate,status:d.status,operationIds:d.operations.map((p)=>p.id),message:d.message},d.accepted?202:404)}let As=/^\/auth\/oidc\/([a-z0-9-]+)\/(start|callback)$/.exec(L.pathname);if(As&&C.method==="GET"){let[,d,p]=As;if(!nt)return new Response(null,{status:302,headers:{location:"/login?sso_error=configuration"}});if(p==="start")try{let R=await cu(Ie,d,nt,L.searchParams.get("return")??void 0,e.oidcFetch);return new Response(null,{status:302,headers:{location:R.authorizationUrl,"cache-control":"no-store"}})}catch(R){return a.store.appendEvent({organizationId:a.organization.id,type:"auth.oidc.start_failed",level:"warning",payload:{provider:d,reason:R instanceof Error?R.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=start","cache-control":"no-store"}})}try{if(L.searchParams.has("error")){let X=Ie.getOidcProviderBySlug(d),F=L.searchParams.get("state");if(X&&F)Ie.consumeOidcTransaction(X.id,F);throw Error("OIDC provider returned an authorization error")}let R=await du(Ie,{providerSlug:d,state:L.searchParams.get("state")??"",code:L.searchParams.get("code")??"",origin:nt},e.oidcFetch),M=ly(Ie,a,t,R.identity);Ie.recordLogin(M.identity.id);let j=qa(M.identity.id,C,Ze.requestIP(C)?.address??"unknown","oidc");return hi(),a.store.appendEvent({organizationId:a.organization.id,actorId:M.identity.actorId,type:"auth.login.succeeded",payload:{method:"oidc",provider:d,provisioned:M.provisioned}}),new Response(null,{status:302,headers:{location:R.returnPath,"cache-control":"no-store","set-cookie":ia(j.token,{secure:ho,maxAgeMs:Co})}})}catch(R){return a.store.appendEvent({organizationId:a.organization.id,type:"auth.oidc.callback_failed",level:"warning",payload:{provider:d,reason:R instanceof Error?R.message.slice(0,200):"unknown"}}),new Response(null,{status:302,headers:{location:"/login?sso_error=callback","cache-control":"no-store"}})}}if(L.pathname==="/api/invitations/accept"&&C.method==="POST"){let d=await oe(C),p=String(d.token??"").trim(),R=String(d.username??"").trim(),M=String(d.password??"");if(!p||!Sd(R)||M.length<12)return b({ok:!1,error:"Invitation token, valid username, and a password of at least 12 characters are required."},422);let j=a.store.inspectInvitationToken(p);if(!j||j.state!=="pending")return b({ok:!1,error:j?`Invitation is ${j.state}`:"Invitation is invalid"},j?409:404);let X=fi(ln(t),R),F=Ie.getIdentityByUsername(R);if(X&&!Ei(M,F?.passwordHash??X.passwordHash))return b({ok:!1,error:"That username already exists; enter its current password to continue."},401);let Z=Ie.getIdentityByEmail(j.email);if(Z&&Z.id!==F?.id)return b({ok:!1,error:"This invitation belongs to an existing account. Sign in with that account or ask an owner to resend it."},409);let fe=Na(t,{username:R,password:X?void 0:M,name:typeof d.name==="string"?d.name:void 0,email:j.email,sites:X?.sites??{}}),pe=gr(a.store,fe.user);try{let Ge=a.store.acceptInvitation(p,pe.id),ve=F?Ie.setVerifiedEmail(F.id,Ge.invitation.email):Ie.createIdentity({actorId:pe.id,username:fe.user.username,email:Ge.invitation.email,emailVerified:!0,passwordHash:fe.user.passwordHash}),je=qa(ve.id,C,Ze.requestIP(C)?.address??"unknown");return hi(),b({ok:!0,user:oa(fe.user),organization:a.organization,membership:Ge.membership},200,{"set-cookie":ia(je.token,{secure:ho,maxAgeMs:Co})})}catch(Ge){if(!X)Gl(t,fe.user.username);let ve=Ge instanceof Error?Ge.message:"Invitation could not be accepted.";return b({ok:!1,error:ve},ve.includes("expired")||ve.includes("revoked")||ve.includes("accepted")?409:404)}}if(L.pathname==="/api/auth/password-reset/request"&&C.method==="POST"){let d=await oe(C),p=String(d.identifier??"").trim().toLowerCase(),R=Ze.requestIP(C)?.address??"unknown",M=Nd.check(p,R),j=p.includes("@")?Ie.getIdentityByEmail(p):Ie.getIdentityByUsername(p);if(M.allowed)Nd.recordFailure(p,R);if(M.allowed&&j?.email&&j.emailVerifiedAt&&!j.disabledAt){Ie.revokeActionTokens(j.id,"password_reset");let X=Ie.createActionToken(j.id,"password_reset"),F=`${L.origin}/reset-password?token=${encodeURIComponent(X.token)}`,Z=await ba(o,{to:j.email,subject:"Reset your ts-cloud password",text:`Reset your ts-cloud password: ${F}
 
-This link expires in one hour and can be used once.`});a.store.appendEvent({organizationId:a.organization.id,actorId:j.actorId,type:"auth.password_reset.requested",payload:{delivered:Z}})}return b({ok:!0,message:"If that account has a verified email, a reset link has been sent."},202)}if(L.pathname==="/api/auth/password-reset/complete"&&C.method==="POST"){let d=await oe(C),p=String(d.token??"").trim(),R=String(d.password??"");if(!p||R.length<12)return b({ok:!1,error:"A valid reset token and password of at least 12 characters are required."},422);try{let M=Ie.consumeActionToken(p,"password_reset"),j=$o(R),X=Ie.updatePassword(M.identityId,j);return wd(t,X.username,j),a.store.appendEvent({organizationId:a.organization.id,actorId:X.actorId,type:"auth.password_reset.completed"}),b({ok:!0,message:"Password changed. Sign in again."},200,{"set-cookie":bd({secure:ho})})}catch(M){let j=M instanceof Error?M.message:"Password reset failed.";return b({ok:!1,error:j.replace("Action token","Reset link")},j.includes("consumed")||j.includes("expired")?409:404)}}if(L.pathname==="/api/login"&&C.method==="POST"){let d=await oe(C),p=String(d.username??"").trim(),R=String(d.password??""),M=Ze.requestIP(C)?.address??"unknown",j=za.check(p,M);if(!j.allowed)return b({ok:!1,error:`Too many failed attempts. Try again in ${Math.ceil((j.retryAfterSeconds??0)/60)} minute(s).`},429,{"retry-after":String(j.retryAfterSeconds??60)});let X=fi(ln(t),p),F=Ie.getIdentityByUsername(p),Z=F?.passwordHash??X?.passwordHash??tA;if(!(Ei(R,Z)&&!!X&&!!F&&!F.disabledAt))return za.recordFailure(p,M),b({ok:!1,error:"Incorrect username or password."},401);if(py(Ie,a,F))return b({ok:!1,error:"Single sign-on is required for this account."},403);za.recordSuccess(p,M);let pe=F,Ge=pe.requiresPasswordUpgrade||Bh(pe.passwordHash);if(Ge){let je=$o(R);pe=Ie.rehashPassword(pe.id,je),wd(t,pe.username,je)}if(Ie.recordLogin(pe.id),Ie.getMfaFactor(pe.id)?.state==="active"){let je=Ie.createMfaChallenge(pe.id,"login");return a.store.appendEvent({organizationId:a.organization.id,actorId:pe.actorId,type:"auth.mfa.challenge.created",payload:{purpose:"login"}}),b({ok:!0,mfaRequired:!0,challengeToken:je.token,passwordUpgraded:Ge})}let ve=qa(pe.id,C,M);return a.store.appendEvent({organizationId:a.organization.id,actorId:pe.actorId,type:"auth.login.succeeded",payload:{method:"local"}}),b({ok:!0,user:oa(X),passwordUpgraded:Ge},200,{"set-cookie":ia(ve.token,{secure:ho,maxAgeMs:Co})})}if(L.pathname==="/api/auth/mfa/complete"&&C.method==="POST"){let d=await oe(C),p=String(d.challengeToken??"").trim(),R=String(d.code??"").trim(),M=Ze.requestIP(C)?.address??"unknown",X=Ie.inspectMfaChallengeToken(p,"login")?.identityId??"unknown-mfa",F=Va.check(X,M);if(!F.allowed)return b({ok:!1,error:"Too many MFA attempts. Try again later."},429,{"retry-after":String(F.retryAfterSeconds??60)});try{let Z=Ie.completeMfaChallenge(p,R,"login");Va.recordSuccess(X,M);let fe=new Date().toISOString(),pe=Ie.createSession({identityId:Z.identity.id,userAgent:Ap(C),networkHint:$d(M),mfaAt:fe,recentAuthAt:fe});return a.store.appendEvent({organizationId:a.organization.id,actorId:Z.identity.actorId,type:"auth.mfa.succeeded",payload:{purpose:"login",method:Z.method}}),b({ok:!0},200,{"set-cookie":ia(pe.token,{secure:ho,maxAgeMs:Co})})}catch{return Va.recordFailure(X,M),b({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}}if(L.pathname==="/api/logout"&&C.method==="POST"){let d=Ft.resolveSession(C);if(d)Ie.revokeSession(d.identityId,d.id);let p=bd({secure:ho});if(C.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login","set-cookie":p}});return b({ok:!0},200,{"set-cookie":p})}if(L.pathname==="/login"){let d=Ie.listOidcProviders(a.organization.id).map((p)=>({slug:p.slug,name:p.name}));return new Response(gy(N?.mode==="serverless",d),{headers:{"content-type":"text/html; charset=utf-8"}})}if(L.pathname==="/forgot-password"||L.pathname==="/reset-password")return new Response(my(L.pathname==="/reset-password"?"reset":"request"),{headers:{"content-type":"text/html; charset=utf-8"}});if(L.pathname==="/accept-invitation")return hb(Ri,L.pathname);let ue=Ft.resolveUser(C);if(!ue){if(!L.pathname.startsWith("/api/")&&C.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login"}});return b({ok:!1,error:"Sign in to continue."},401)}let Fn=uo(ue,Se);if(L.pathname==="/api/me"){let d=a.store.getActorByExternalId("user",`dashboard:${ue.username.toLowerCase()}`),p=d?a.store.getMembershipForActor(a.organization.id,d.id):void 0,R=a.store.resolveAuthorizationTarget(a.organization.id,p?.scope??{type:"project",id:a.project.id})??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id});return b({ok:!0,user:oa(ue),authEnabled:Pe,organization:a.organization,membership:p,capabilities:mn({membership:p,grants:p?a.store.listGrants(p.id):[],target:R})})}if(L.pathname.startsWith("/api/")){let d=await dy(C,L.pathname),p=Ft.check(C,L.pathname,ue,d);if(!p.ok)return b({ok:!1,error:p.error},p.status??403);if(Pe&&lA.has(`${C.method.toUpperCase()} ${L.pathname}`)){let R=Ft.resolveSession(C);if(!R||!Ie.isRecentlyAuthenticated(R))return b({ok:!1,error:"Recent authentication is required for this change.",stepUpRequired:!0},401)}}if(L.pathname==="/api/auth/security"&&C.method==="GET"){let d=Be(ue),p=d.actor?Ie.getIdentityByActor(d.actor.id):void 0,R=Ft.resolveSession(C);return b({identity:p?{username:p.username,email:p.email,emailVerifiedAt:p.emailVerifiedAt,requiresPasswordUpgrade:p.requiresPasswordUpgrade,lastLoginAt:p.lastLoginAt}:void 0,currentSessionId:R?.id,sessions:p?Ie.listSessions(p.id,{includeInactive:!0}):[],mfa:p?{factor:Ie.getMfaFactor(p.id),recoveryCodesRemaining:Ie.remainingRecoveryCodes(p.id)}:void 0})}if(L.pathname==="/api/auth/oidc/providers"&&C.method==="GET")return b({providers:Ie.listOidcProviders(a.organization.id,{includeDisabled:!0}),callbackOrigin:nt,callbackPattern:nt?`${nt}/auth/oidc/{slug}/callback`:void 0,localOwnerRecovery:!0});if(L.pathname==="/api/auth/oidc/providers"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=p.actor?Ie.getIdentityByActor(p.actor.id):void 0,M=d.enforceSso===!0;if(M&&(!R?.emailVerifiedAt||Ie.remainingRecoveryCodes(R.id)<1))return b({ok:!1,error:"Verify the owner email and generate MFA recovery codes before enforcing SSO."},409);try{let j=Td(d.defaultRole),X=Ie.upsertOidcProvider({id:typeof d.id==="string"?d.id:void 0,organizationId:a.organization.id,slug:String(d.slug??""),name:String(d.name??""),issuer:String(d.issuer??""),clientId:String(d.clientId??""),clientSecret:typeof d.clientSecret==="string"&&d.clientSecret?d.clientSecret:void 0,scopes:Array.isArray(d.scopes)?d.scopes.map(String):void 0,allowedDomains:Array.isArray(d.allowedDomains)?d.allowedDomains.map(String):[],defaultRole:j&&j!=="owner"?j:void 0,enabled:d.enabled!==!1,enforceSso:M});return a.store.appendEvent({organizationId:a.organization.id,actorId:p.actor?.id,type:"auth.oidc.provider.configured",payload:{providerId:X.id,issuer:X.issuer,enabled:X.enabled,enforceSso:X.enforceSso}}),b({ok:!0,provider:X})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"OIDC provider could not be saved."},422)}}if(L.pathname==="/api/auth/oidc/providers"&&C.method==="PATCH"){let d=await oe(C),p=Ie.getOidcProvider(String(d.id??""));if(!p||p.organizationId!==a.organization.id)return b({ok:!1,error:"OIDC provider was not found."},404);let R=Be(ue),M=Ie.setOidcProviderEnabled(p.id,d.enabled===!0);return a.store.appendEvent({organizationId:a.organization.id,actorId:R.actor?.id,type:M.enabled?"auth.oidc.provider.enabled":"auth.oidc.provider.disabled",payload:{providerId:p.id}}),b({ok:!0,provider:M})}if(L.pathname==="/api/automation"&&C.method==="GET"){let d=lt.listServiceAccounts(a.organization.id,{includeDisabled:!0}).map((p)=>{let R=a.store.getMembershipForActor(a.organization.id,p.actorId),M=p.createdByActorId?a.store.getActor(p.createdByActorId):void 0,j=lt.listTokens(p.id,{includeInactive:!0}).map((X)=>({...X,createdBy:X.createdByActorId?a.store.getActor(X.createdByActorId):void 0}));return{account:p,createdBy:M,membership:R,tokens:j}});return b({accounts:d,apiBaseUrl:`${L.origin}/api/v1`,openApiUrl:`${L.origin}/api/v1/openapi.json`,tokenEnvironmentVariable:"TS_CLOUD_API_TOKEN"})}if(L.pathname==="/api/automation/service-accounts"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=Td(d.roleTemplate),M=Ba(d);if(!p.actor||!R||R==="owner"||!M)return b({ok:!1,error:"A non-owner role and valid organization scope are required."},422);try{let j=lt.createServiceAccount({organizationId:a.organization.id,slug:String(d.slug??""),name:String(d.name??""),description:typeof d.description==="string"?d.description:void 0,roleTemplate:R,scope:M,createdByActorId:p.actor.id});return b({ok:!0,...j},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"Service account could not be created."},422)}}if(L.pathname==="/api/automation/service-accounts"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=lt.getServiceAccount(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Service account was not found."},404);return b({ok:!0,account:lt.disableServiceAccount(R.id,p.actor?.id)})}if(L.pathname==="/api/automation/tokens"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=lt.getServiceAccount(String(d.serviceAccountId??"")),M=Ba(d);if(!p.actor||!R||R.organizationId!==a.organization.id||!M||!Array.isArray(d.capabilities))return b({ok:!1,error:"Service account, explicit capabilities, and valid scope are required."},422);try{let j=lt.createToken({serviceAccountId:R.id,name:String(d.name??"API token"),capabilities:d.capabilities.map(String),scope:M,expiresAt:typeof d.expiresAt==="string"?d.expiresAt:void 0,createdByActorId:p.actor.id});return b({ok:!0,token:j.token,secret:j.secret,revealOnce:!0},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"API token could not be created."},422)}}if(L.pathname==="/api/automation/tokens/rotate"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=lt.getToken(String(d.id??"")),M=R?lt.getServiceAccount(R.serviceAccountId):void 0;if(!p.actor||!R||M?.organizationId!==a.organization.id)return b({ok:!1,error:"API token was not found."},404);try{let j=lt.rotateToken(R.id,p.actor.id);return b({ok:!0,token:j.token,secret:j.secret,revealOnce:!0,overlap:!0},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"API token could not be rotated."},409)}}if(L.pathname==="/api/automation/tokens"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue),R=lt.getToken(String(d.id??"")),M=R?lt.getServiceAccount(R.serviceAccountId):void 0;if(!R||M?.organizationId!==a.organization.id)return b({ok:!1,error:"API token was not found."},404);return b({ok:!0,token:lt.revokeToken(R.id,p.actor?.id)})}if(L.pathname==="/api/onboarding"&&C.method==="GET"){let d=ze.listConnections(a.organization.id);return b({drafts:$r.list(a.project.id),artifacts:ws.list(a.project.id),registries:Pi.list(a.organization.id),sourceConnections:d,repositories:d.flatMap((p)=>ze.listRepositories(p.id)),project:{id:a.project.id,slug:a.project.slug,name:a.project.name},environments:[...a.environments.values()].map((p)=>({id:p.id,slug:p.slug,name:p.name,kind:p.kind,region:p.region})),resources:a.store.listResources(a.project.id).filter((p)=>p.kind==="application").map((p)=>({id:p.id,slug:p.slug,name:p.name,environmentId:p.environmentId}))})}if(L.pathname==="/api/onboarding/detect"&&C.method==="POST"){let d=await oe(C);try{if(d.source?.kind==="git"){let M=ze.getConnection(String(d.source.connectionId??"")),j=ze.getRepository(String(d.source.repositoryId??""));if(!M||M.organizationId!==a.organization.id||!j||j.connectionId!==M.id)throw Error("Authorized Git repository was not found");let X=typeof d.source.deployKeyId==="string"?ze.getDeployKey(d.source.deployKeyId):void 0;if(X&&X.connectionId!==M.id)throw Error("Deploy key does not belong to this connection");let F=cp(Ct(kd(),"ts-cloud-onboarding-git-"));try{let Z=await Qd({remote:j.cloneUrl,destination:Ct(F,"checkout"),ref:String(d.source.ref??j.defaultBranch),sparsePaths:Array.isArray(d.source.sparsePaths)?d.source.sparsePaths.map(String):void 0,binding:{id:"detection",projectId:a.project.id,connectionId:M.id,repositoryId:j.id,repositoryFullName:j.fullName,defaultBranch:j.defaultBranch,monorepoRoot:String(d.source.monorepoRoot??"."),includePaths:[],excludePaths:[],submodules:d.source.submodules===!0,cloneDepth:1,deployKeyId:X?.id,autoDeploy:!1,pullRequestPreviews:!1,status:"active",version:1,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()}},{credential:ze.getCredential(M.id),deployKey:X?{...X,privateKey:ze.getDeployPrivateKey(X.id)}:void 0,timeoutMs:120000});return b({ok:!0,commitSha:Z.commitSha,candidates:Nt(qn(Z.directory))})}finally{vs(F,{recursive:!0,force:!0})}}if(Array.isArray(d.files)){if(d.files.length>1e4)throw Error("Detection file-count limit exceeded");let M=d.files.map((j)=>({path:String(j.path??""),size:Number(j.size??0),content:typeof j.content==="string"?j.content.slice(0,262144):void 0}));return b({ok:!0,candidates:Nt(M)})}let p=qT(t,String(d.root??".")),R=VT(t,p);if(R===".."||R.startsWith(`..${JT}`))throw Error("Detection root must stay inside the project");return b({ok:!0,candidates:Nt(qn(p))})}catch(p){return b({ok:!1,error:p instanceof Error?p.message:"Application detection failed."},422)}}if(L.pathname==="/api/onboarding/plan"&&C.method==="POST"){let d=await oe(C);try{return b({ok:!0,plan:ce(d.draft,Array.isArray(d.suppliedSecretNames)?d.suppliedSecretNames.map(String):[])})}catch(p){return b({ok:!1,error:p instanceof Error?p.message:"Application plan could not be generated."},422)}}if(L.pathname==="/api/onboarding/drafts"&&C.method==="POST"){let d=await oe(C),p=Be(ue);try{return b({ok:!0,draft:$r.create({organizationId:a.organization.id,projectId:a.project.id,name:String(d.name??d.draft?.name??"Application draft"),draft:{...d.draft,projectId:a.project.id},step:d.step,suppliedSecretNames:Array.isArray(d.suppliedSecretNames)?d.suppliedSecretNames.map(String):[],actorId:p.actor?.id})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Application draft could not be saved."},422)}}if(L.pathname==="/api/onboarding/drafts"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=$r.get(String(d.id??""));if(!R||R.projectId!==a.project.id)return b({ok:!1,error:"Application draft was not found."},404);try{return b({ok:!0,draft:$r.update(R.id,Number(d.version),{draft:{...d.draft,projectId:a.project.id},step:d.step,suppliedSecretNames:Array.isArray(d.suppliedSecretNames)?d.suppliedSecretNames.map(String):void 0,actorId:p.actor?.id})})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Application draft could not be updated."},409)}}if(L.pathname==="/api/onboarding/artifacts"&&C.method==="POST"){let d=Be(ue);if(Number(C.headers.get("content-length")??0)>104857600)return b({ok:!1,error:"Artifact exceeds the 100 MB upload limit."},413);try{let R=new Uint8Array(await C.arrayBuffer());return b({ok:!0,artifact:ws.create({organizationId:a.organization.id,projectId:a.project.id,filename:C.headers.get("x-artifact-filename")??"application.zip",bytes:R,actorId:d.actor?.id})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Artifact could not be inspected."},422)}}if(L.pathname==="/api/onboarding/registries"&&C.method==="POST"){let d=await oe(C),p=Be(ue);try{return b({ok:!0,registry:Pi.create({organizationId:a.organization.id,provider:d.provider,name:String(d.name??"Container registry"),host:String(d.host??""),credential:d.token||d.password?{username:typeof d.username==="string"?d.username:void 0,password:typeof d.password==="string"?d.password:void 0,token:typeof d.token==="string"?d.token:void 0}:void 0,credentialExpiresAt:typeof d.credentialExpiresAt==="string"?d.credentialExpiresAt:void 0,actorId:p.actor?.id})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Registry connection could not be created."},422)}}if(L.pathname==="/api/onboarding/registries"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=Pi.get(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Registry connection was not found."},404);try{if(d.action==="test")return b({ok:!0,registry:await Pi.test(R.id,{image:typeof d.image==="string"?d.image:void 0})});if(d.action==="rotate")return b({ok:!0,registry:Pi.rotate(R.id,{username:typeof d.username==="string"?d.username:void 0,password:typeof d.password==="string"?d.password:void 0,token:typeof d.token==="string"?d.token:void 0},{expiresAt:typeof d.expiresAt==="string"?d.expiresAt:void 0,actorId:p.actor?.id})});return b({ok:!1,error:"Registry action must be test or rotate."},422)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Registry connection could not be updated."},422)}}if(L.pathname==="/api/onboarding/registries"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue),R=Pi.get(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Registry connection was not found."},404);let M=$r.list(a.project.id).filter((j)=>j.input.source.kind==="image"&&j.input.source.registryConnectionId===R.id||j.input.build.kind==="prebuilt_image"&&j.input.build.registryConnectionId===R.id);if(d.preview===!0)return b({ok:!0,preview:!0,affectedDrafts:M});return b({ok:!0,registry:Pi.disconnect(R.id,p.actor?.id),affectedDrafts:M})}if(L.pathname==="/api/onboarding/apply"&&C.method==="POST"){let d=await oe(C),p=Be(ue);try{let R=Br({controlPlane:a.store,drafts:$r,draftId:String(d.id??""),expectedVersion:Number(d.version),confirmEnvironment:String(d.confirmEnvironment??""),actorId:p.actor?.id});return b({ok:!0,resource:R.resource,operation:R.operation,plan:R.plan},202)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Application plan could not be applied."},422)}}if(L.pathname==="/api/sources"&&C.method==="GET"){let d=ze.listConnections(a.organization.id);return b({connections:d,bindings:ze.listBindings({projectId:a.project.id}),repositories:d.flatMap((p)=>ze.listRepositories(p.id)),deployKeys:d.flatMap((p)=>ze.listDeployKeys(p.id)),webhooks:d.flatMap((p)=>ze.listWebhooks(p.id)).map((p)=>({...p,deliveries:ze.listDeliveries(p.id,20)})),project:{id:a.project.id,slug:a.project.slug},environment:le(a,String(Se)),resources:a.store.listResources(a.project.id,le(a,String(Se)).environmentId).filter((p)=>p.kind==="application").map((p)=>({id:p.id,slug:p.slug,name:p.name}))})}if(L.pathname==="/api/sources/connections"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=String(d.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(R))return b({ok:!1,error:"A supported Git provider is required."},422);try{let M=R==="github"&&(d.privateKey||d.appId)?{appId:typeof d.appId==="string"?d.appId:void 0,installationId:typeof d.installationId==="string"?d.installationId:void 0,privateKey:typeof d.privateKey==="string"?d.privateKey:void 0}:R!=="generic_ssh"&&d.token?{token:typeof d.token==="string"?d.token:void 0,username:typeof d.username==="string"?d.username:void 0}:void 0,j={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"},X,F,Z;if(a.store.database.transaction(()=>{if(X=ze.createConnection({organizationId:a.organization.id,provider:R,name:String(d.name??R),host:String(d.host??j[R]??""),owner:typeof d.owner==="string"?d.owner:void 0,authKind:d.authKind,credential:M,grantedScopes:Array.isArray(d.grantedScopes)?d.grantedScopes.map(String):[],credentialExpiresAt:typeof d.credentialExpiresAt==="string"?d.credentialExpiresAt:void 0,createdByActorId:p.actor?.id}),typeof d.repositoryUrl==="string"&&typeof d.repositoryFullName==="string")F=ze.upsertRepository({connectionId:X.id,providerRepositoryId:`manual:${d.repositoryFullName}`,fullName:d.repositoryFullName,cloneUrl:d.repositoryUrl,defaultBranch:String(d.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"manual"}});if(R==="generic_ssh")Z=ze.createDeployKey({connectionId:X.id,name:String(d.deployKeyName??"Repository deploy key"),publicKey:String(d.publicKey??""),privateKey:String(d.deployPrivateKey??""),host:String(d.sshHost??""),hostKey:String(d.hostKey??""),actorId:p.actor?.id})})(),d.test===!0)X=await Yd(ze,X.id,F?.id);return b({ok:!0,connection:X,repository:F,deployKey:Z},201)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Source connection could not be created."},422)}}if(L.pathname==="/api/sources/connections"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=ze.getConnection(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{if(d.action==="test")return b({ok:!0,connection:await Yd(ze,R.id,typeof d.repositoryId==="string"?d.repositoryId:void 0)});if(d.action==="rotate")return b({ok:!0,connection:ze.rotateCredential(R.id,{token:typeof d.token==="string"?d.token:void 0,username:typeof d.username==="string"?d.username:void 0,appId:typeof d.appId==="string"?d.appId:void 0,installationId:typeof d.installationId==="string"?d.installationId:void 0,privateKey:typeof d.privateKey==="string"?d.privateKey:void 0},{expiresAt:typeof d.expiresAt==="string"?d.expiresAt:void 0,actorId:p.actor?.id})});return b({ok:!1,error:"Connection action must be test or rotate."},422)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Source connection could not be updated."},422)}}if(L.pathname==="/api/sources/connections"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue),R=ze.getConnection(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);let M=ze.listBindings({connectionId:R.id,status:"active"});if(d.preview===!0)return b({ok:!0,preview:!0,affectedBindings:M});return b({ok:!0,...ze.disconnectConnection(R.id,p.actor?.id)})}if(L.pathname==="/api/sources/deploy-keys"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=ze.getConnection(String(d.connectionId??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{return b({ok:!0,deployKey:ze.createDeployKey({connectionId:R.id,name:String(d.name??"Repository deploy key"),publicKey:String(d.publicKey??""),privateKey:String(d.privateKey??""),host:String(d.host??""),hostKey:String(d.hostKey??""),actorId:p.actor?.id})},201)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Deploy key could not be stored."},422)}}if(L.pathname==="/api/sources/deploy-keys"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue),R=ze.getDeployKey(String(d.id??"")),M=R?ze.getConnection(R.connectionId):void 0;if(!R||!M||M.organizationId!==a.organization.id)return b({ok:!1,error:"Deploy key was not found."},404);let j=ze.listBindings({connectionId:M.id}).filter((X)=>X.deployKeyId===R.id);if(d.preview===!0)return b({ok:!0,preview:!0,affectedBindings:j});return b({ok:!0,...ze.revokeDeployKey(R.id,p.actor?.id)})}if(L.pathname==="/api/sources/repositories/sync"&&C.method==="POST"){let d=await oe(C),p=ze.getConnection(String(d.connectionId??""));if(!p||p.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{return b({ok:!0,repositories:await Fr(ze,String(d.connectionId??""),{search:typeof d.search==="string"?d.search:void 0})})}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Repositories could not be synchronized."},422)}}if(L.pathname==="/api/sources/references"&&C.method==="GET"){let d=ze.getConnection(String(L.searchParams.get("connectionId")??""));if(!d||d.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{return b(await nr(ze,{connectionId:String(L.searchParams.get("connectionId")??""),repository:String(L.searchParams.get("repository")??""),repositoryId:L.searchParams.get("repositoryId")??void 0,deployKeyId:L.searchParams.get("deployKeyId")??void 0,type:L.searchParams.get("type")==="tags"?"tags":"branches",cursor:L.searchParams.get("cursor")??void 0}))}catch(p){return b({ok:!1,error:p instanceof Error?p.message:"References could not be listed."},422)}}if(L.pathname==="/api/sources/bindings"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=le(a,String(Se)),M=ze.getConnection(String(d.connectionId??""));if(!M||M.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{return b({ok:!0,binding:ze.createBinding({projectId:a.project.id,environmentId:R.environmentId,resourceId:typeof d.resourceId==="string"?d.resourceId:void 0,connectionId:String(d.connectionId??""),repositoryId:typeof d.repositoryId==="string"?d.repositoryId:void 0,repositoryFullName:String(d.repositoryFullName??""),defaultBranch:String(d.defaultBranch??"main"),branchRule:typeof d.branchRule==="string"?d.branchRule:void 0,tagRule:typeof d.tagRule==="string"?d.tagRule:void 0,monorepoRoot:String(d.monorepoRoot??"."),includePaths:Array.isArray(d.includePaths)?d.includePaths.map(String):[],excludePaths:Array.isArray(d.excludePaths)?d.excludePaths.map(String):[],submodules:d.submodules===!0,cloneDepth:d.cloneDepth?Number(d.cloneDepth):void 0,deployKeyId:typeof d.deployKeyId==="string"&&d.deployKeyId?d.deployKeyId:void 0,autoDeploy:d.autoDeploy!==!1,pullRequestPreviews:d.pullRequestPreviews!==!1,actorId:p.actor?.id})},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"Source binding could not be created."},422)}}if(L.pathname==="/api/sources/bindings"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=ze.getBinding(String(d.id??""));if(!R||R.projectId!==a.project.id)return b({ok:!1,error:"Source binding was not found."},404);try{return b({ok:!0,binding:ze.updateBinding(R.id,Number(d.version),{defaultBranch:d.defaultBranch,branchRule:d.branchRule,tagRule:d.tagRule,monorepoRoot:d.monorepoRoot,includePaths:d.includePaths,excludePaths:d.excludePaths,submodules:d.submodules,cloneDepth:d.cloneDepth,deployKeyId:d.deployKeyId,autoDeploy:d.autoDeploy,pullRequestPreviews:d.pullRequestPreviews,status:d.status,disabledReason:d.disabledReason,actorId:p.actor?.id})})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Source binding could not be updated."},409)}}if(L.pathname==="/api/sources/webhooks"&&C.method==="POST"){let d=await oe(C),p=ze.getConnection(String(d.connectionId??""));if(!p||p.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{let R=ze.createWebhook({connectionId:String(d.connectionId??""),repositoryId:typeof d.repositoryId==="string"?d.repositoryId:void 0,repositoryFullName:String(d.repositoryFullName??""),events:Array.isArray(d.events)?d.events.map(String):void 0,secret:typeof d.secret==="string"?d.secret:void 0}),M=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||nt,j=M?Dt(M,R.webhook):void 0,X=d.reconcile!==!1&&M?await ir(ze,R.webhook.id,M):R.webhook;return b({ok:!0,webhook:X,endpoint:j,endpointRevealOnce:!0},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Source webhook could not be created."},422)}}if(L.pathname==="/api/sources/webhooks"&&C.method==="PATCH"){let d=await oe(C),p=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||nt,R=ze.getWebhook(String(d.id??"")),M=R?ze.getConnection(R.connectionId):void 0;if(!R||!M||M.organizationId!==a.organization.id)return b({ok:!1,error:"Source webhook was not found."},404);if(!p)return b({ok:!1,error:"Set TS_CLOUD_WEBHOOK_BASE_URL to reconcile provider webhooks."},422);try{return b({ok:!0,webhook:await ir(ze,String(d.id??""),p)})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"Source webhook could not be reconciled."},422)}}if(L.pathname==="/api/sources/webhooks"&&C.method==="DELETE"){let d=await oe(C),p=ze.getWebhook(String(d.id??"")),R=p?ze.getConnection(p.connectionId):void 0;if(!p||!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Source webhook was not found."},404);try{return b({ok:!0,webhook:await ji(ze,String(d.id??""))})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Source webhook could not be removed."},422)}}if(L.pathname==="/api/security/posture"&&C.method==="GET"){let d=le(a,String(Se)),p=rt.listFindings({...d,limit:500});return b({scope:d,summary:rt.summary(d.organizationId,d.projectId,d.environmentId),findings:p,scans:rt.listScanRuns({...d,limit:100}),policies:rt.listPolicies(d.organizationId).filter((R)=>!R.environmentId||R.environmentId===d.environmentId),waivers:p.flatMap((R)=>rt.listWaivers(R.id)),decisions:rt.listDecisions(d.environmentId,50),actors:a.store.listMemberships(a.organization.id).map((R)=>a.store.getActor(R.actorId)).filter(Boolean)})}if(L.pathname==="/api/security/export"&&C.method==="GET")return b(rt.exportPosture(a.organization.id));if(L.pathname==="/api/security/scan"&&C.method==="POST"){let d=le(a,String(Se)),p=await new ps(rt).run(new Da,{...d,artifactRoot:t}),R=dd(rt,d,Lt??{});return b({ok:!0,source:p,host:R,summary:rt.summary(d.organizationId,d.projectId,d.environmentId)})}if(L.pathname==="/api/security/review"&&C.method==="POST")try{let d=le(a,String(Se));return b({ok:!0,...ar(rt,{scope:d,desiredConfigHash:a.project.desiredConfigHash})})}catch(d){return b({ok:!1,error:d instanceof Error?d.message:"Security change review failed."},409)}if(L.pathname==="/api/security/policies"&&C.method==="POST"){let d=await oe(C),p=Be(ue);if(!p.actor)return b({ok:!1,error:"An organization actor is required."},403);try{let R=rt.createPolicy({organizationId:a.organization.id,environmentId:d.environmentId===null?void 0:String(d.environmentId??le(a,String(Se)).environmentId),name:String(d.name??""),scannerFailMode:d.scannerFailMode==="open"?"open":"closed",requiredScanners:Array.isArray(d.requiredScanners)?d.requiredScanners.map(String):[],rules:Array.isArray(d.rules)?d.rules.map((M)=>({minimumSeverity:String(M.minimumSeverity),action:String(M.action),scannerId:M.scannerId?String(M.scannerId):void 0})):[],actorId:p.actor.id});return b({ok:!0,policy:R},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Security policy could not be created."},422)}}if(L.pathname==="/api/security/policies"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=rt.getPolicy(String(d.id??""));if(!p.actor||!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Security policy was not found."},404);try{return b({ok:!0,policy:rt.updatePolicy(R.id,Number(d.version),{name:typeof d.name==="string"?d.name:void 0,scannerFailMode:d.scannerFailMode==="open"||d.scannerFailMode==="closed"?d.scannerFailMode:void 0,requiredScanners:Array.isArray(d.requiredScanners)?d.requiredScanners.map(String):void 0,rules:Array.isArray(d.rules)?d.rules.map((M)=>({minimumSeverity:String(M.minimumSeverity),action:String(M.action),scannerId:M.scannerId?String(M.scannerId):void 0})):void 0,enabled:typeof d.enabled==="boolean"?d.enabled:void 0,actorId:p.actor.id})})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Security policy could not be updated."},409)}}if(L.pathname==="/api/security/waivers"&&C.method==="POST"){let d=await oe(C),p=Be(ue);if(!p.actor)return b({ok:!1,error:"An organization actor is required."},403);try{return b({ok:!0,waiver:rt.createWaiver({findingId:String(d.findingId??""),policyId:typeof d.policyId==="string"?d.policyId:void 0,reason:String(d.reason??""),referenceUrl:typeof d.referenceUrl==="string"?d.referenceUrl:void 0,expiresAt:String(d.expiresAt??""),actorId:p.actor.id})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Security waiver could not be created."},422)}}if(L.pathname==="/api/security/waivers"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue);if(!p.actor)return b({ok:!1,error:"An organization actor is required."},403);try{return b({ok:!0,waiver:rt.revokeWaiver(String(d.id??""),p.actor.id)})}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Security waiver could not be revoked."},404)}}if(L.pathname==="/api/security/findings"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=rt.getFinding(String(d.id??""));if(!p.actor||!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Security finding was not found."},404);try{let M=d.action==="acknowledge"?rt.acknowledgeFinding(R.id,p.actor.id):rt.assignFinding(R.id,typeof d.ownerActorId==="string"&&d.ownerActorId?d.ownerActorId:void 0,p.actor.id);return b({ok:!0,finding:M})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Security finding could not be updated."},422)}}if(L.pathname==="/api/security/comments"&&C.method==="POST"){let d=await oe(C),p=Be(ue);if(!p.actor)return b({ok:!1,error:"An organization actor is required."},403);try{return b({ok:!0,comment:rt.addComment({findingId:String(d.findingId??""),actorId:p.actor.id,body:String(d.body??""),referenceUrl:typeof d.referenceUrl==="string"?d.referenceUrl:void 0})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Comment could not be saved."},422)}}if(L.pathname==="/api/auth/sessions"&&C.method==="GET"){let d=Ft.resolveSession(C);return b({currentSessionId:d?.id,sessions:d?Ie.listSessions(d.identityId,{includeInactive:!0}):[]})}if(L.pathname==="/api/auth/sessions"&&C.method==="DELETE"){let d=await oe(C),p=Ft.resolveSession(C);if(!p)return b({ok:!1,error:"Sign in again to manage sessions."},401);let R=String(d.id??""),M=Ie.revokeSession(p.identityId,R),j=R===p.id&&M?{"set-cookie":bd({secure:ho})}:void 0;return b({ok:M,signedOut:R===p.id&&M},M?200:404,j)}if(L.pathname==="/api/auth/sessions/revoke-others"&&C.method==="POST"){let d=Ft.resolveSession(C);if(!d)return b({ok:!1,error:"Sign in again to manage sessions."},401);return b({ok:!0,revoked:Ie.revokeOtherSessions(d.identityId,d.id)})}if(L.pathname==="/api/auth/password/change"&&C.method==="POST"){let d=await oe(C),p=String(d.currentPassword??""),R=String(d.password??""),M=Be(ue),j=M.actor?Ie.getIdentityByActor(M.actor.id):void 0;if(!j||!Ei(p,j.passwordHash))return b({ok:!1,error:"Current password is incorrect."},401);if(R.length<12)return b({ok:!1,error:"New password must be at least 12 characters."},422);if(Ei(R,j.passwordHash))return b({ok:!1,error:"Choose a different password."},409);let X=$o(R),F=Ie.updatePassword(j.id,X);wd(t,F.username,X);let Z=qa(F.id,C,Ze.requestIP(C)?.address??"unknown");return a.store.appendEvent({organizationId:a.organization.id,actorId:F.actorId,type:"auth.password.changed"}),b({ok:!0,message:"Password changed and other sessions were signed out."},200,{"set-cookie":ia(Z.token,{secure:ho,maxAgeMs:Co})})}if(L.pathname==="/api/auth/mfa/enroll"&&C.method==="POST"){let d=await oe(C),p=Ft.resolveSession(C),R=Be(ue),M=R.actor?Ie.getIdentityByActor(R.actor.id):void 0;if(!p||!M)return b({ok:!1,error:"Sign in again before enabling MFA."},401);if(!Ei(String(d.password??""),M.passwordHash))return b({ok:!1,error:"Current password is incorrect."},401);try{let j=Ie.beginTotpEnrollment(M.id,{issuer:a.organization.name});return a.store.appendEvent({organizationId:a.organization.id,actorId:M.actorId,type:"auth.mfa.enrollment.started"}),b({factor:j.factor,secret:j.secret,uri:j.uri})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"MFA enrollment failed."},409)}}if(L.pathname==="/api/auth/mfa/verify"&&C.method==="POST"){let d=await oe(C),p=Ft.resolveSession(C),R=Be(ue),M=R.actor?Ie.getIdentityByActor(R.actor.id):void 0;if(!p||!M)return b({ok:!1,error:"Sign in again before enabling MFA."},401);try{let j=Ie.verifyTotpEnrollment(M.id,String(d.code??""));return Ie.markSessionStepUp(p.id,!0),a.store.appendEvent({organizationId:a.organization.id,actorId:M.actorId,type:"auth.mfa.enabled",payload:{recoveryCodeCount:j.recoveryCodes.length}}),b(j)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"MFA enrollment failed."},422)}}if(L.pathname==="/api/auth/mfa"&&C.method==="DELETE"){let d=await oe(C),p=Ft.resolveSession(C),R=Be(ue),M=R.actor?Ie.getIdentityByActor(R.actor.id):void 0;if(!p||!M||!Ei(String(d.password??""),M.passwordHash))return b({ok:!1,error:"Current password is incorrect."},401);let j=Ie.verifyMfaCode(M.id,String(d.code??""));if(!j.valid||!j.method)return b({ok:!1,error:"Authenticator or recovery code is incorrect."},401);return Ie.disableMfa(M.id),Ie.revokeOtherSessions(M.id,p.id),Ie.markSessionStepUp(p.id),a.store.appendEvent({organizationId:a.organization.id,actorId:M.actorId,type:"auth.mfa.disabled",payload:{method:j.method}}),b({ok:!0})}if(L.pathname==="/api/auth/step-up"&&C.method==="POST"){let d=await oe(C),p=Ft.resolveSession(C),R=Be(ue),M=R.actor?Ie.getIdentityByActor(R.actor.id):void 0;if(!p||!M||!Ei(String(d.password??""),M.passwordHash))return b({ok:!1,error:"Current password is incorrect."},401);let j=Ie.getMfaFactor(M.id);if(j?.state==="active"){if(!Ie.verifyMfaCode(M.id,String(d.code??"")).valid)return b({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}let X=Ie.markSessionStepUp(p.id,j?.state==="active");return a.store.appendEvent({organizationId:a.organization.id,actorId:M.actorId,type:"auth.step_up.succeeded",payload:{mfa:j?.state==="active"}}),b({ok:!0,recentAuthAt:X.recentAuthAt})}if(L.pathname==="/api/terminal"){if(!ge)return b({ok:!1,error:"The web terminal is disabled."},403);if(Ze.upgrade(C))return;return Rd("WebSocket upgrade failed",400)}if(L.pathname==="/api/health"){let d=a.store.health();return b({ok:!0,cwd:t,environment:Se,environments:f,uiRoot:await ki(ue,Se),liveData:Re.size>0,terminal:ge,localPackage:import.meta.url.includes("/Code/Libraries/ts-cloud/"),controlPlane:{schemaVersion:d.schemaVersion,supportedSchemaVersion:d.supportedSchemaVersion,integrity:d.integrity,pendingRetryableOperations:d.pendingRetryableOperations}})}if(L.pathname==="/api/control-plane/operations"){let d=L.searchParams.get("state"),p=d&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(d)?d:void 0;return b({operations:a.store.listOperations({projectId:a.project.id,state:p,kind:L.searchParams.get("kind")??void 0,limit:Number(L.searchParams.get("limit"))||100})})}if(L.pathname==="/api/queue"&&C.method==="GET"){let d=L.searchParams.get("state"),p=d&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(d)?d:void 0,R=At.list({projectId:a.project.id,state:p,limit:Number(L.searchParams.get("limit"))||250}).filter((M)=>Cs(ue,M.operation.id,"deployments:read")).map((M)=>{let j=M.operation.resourceId?a.store.getResource(M.operation.resourceId):void 0,X=M.operation.environmentId?a.store.listEnvironments(a.project.id).find((fe)=>fe.id===M.operation.environmentId):void 0,F=M.operation.actorId?a.store.getActor(M.operation.actorId):void 0,Z=M.operation.input;return{...M,target:j?{id:j.id,name:j.name,slug:j.slug,kind:j.kind}:X?{id:X.id,name:X.name,slug:X.slug,kind:"environment"}:{id:a.project.id,name:a.project.name,slug:a.project.slug,kind:"project"},actor:F?{id:F.id,name:F.displayName,kind:F.kind}:void 0,commit:Z.revision??Z.source?.commitSha??null}});return b({operations:R,concurrency:At.limits})}if(L.pathname==="/api/queue/logs"&&C.method==="GET"){let d=String(L.searchParams.get("id")??"");if(!Cs(ue,d,"deployments:read"))return b({ok:!1,error:"Operation was not found in this scope."},404);let p=At.logs(d,{after:Number(L.searchParams.get("after"))||0,limit:Number(L.searchParams.get("limit"))||500});return b({entries:p,cursor:p.at(-1)?.sequence??(Number(L.searchParams.get("after"))||0),operation:a.store.getOperation(d)})}if(L.pathname==="/api/queue/stream"&&C.method==="GET"){let d=String(L.searchParams.get("id")??"");if(!Cs(ue,d,"deployments:read"))return b({ok:!1,error:"Operation was not found in this scope."},404);let p=C.headers.get("last-event-id")?.trim(),R=Number(p||L.searchParams.get("after")||0),M=new TextEncoder,j,X=!1,F=new ReadableStream({start(Z){let fe=()=>{if(X)return;let pe=Ft.resolveUser(C);if(!pe||!Cs(pe,d,"deployments:read")){if(X=!0,j)clearInterval(j);Z.close();return}let Ge=At.logs(d,{after:R,limit:500});for(let je of Ge)R=je.sequence,Z.enqueue(M.encode(`id: ${je.sequence}
+This link expires in one hour and can be used once.`});a.store.appendEvent({organizationId:a.organization.id,actorId:j.actorId,type:"auth.password_reset.requested",payload:{delivered:Z}})}return b({ok:!0,message:"If that account has a verified email, a reset link has been sent."},202)}if(L.pathname==="/api/auth/password-reset/complete"&&C.method==="POST"){let d=await oe(C),p=String(d.token??"").trim(),R=String(d.password??"");if(!p||R.length<12)return b({ok:!1,error:"A valid reset token and password of at least 12 characters are required."},422);try{let M=Ie.consumeActionToken(p,"password_reset"),j=$o(R),X=Ie.updatePassword(M.identityId,j);return wd(t,X.username,j),a.store.appendEvent({organizationId:a.organization.id,actorId:X.actorId,type:"auth.password_reset.completed"}),b({ok:!0,message:"Password changed. Sign in again."},200,{"set-cookie":bd({secure:ho})})}catch(M){let j=M instanceof Error?M.message:"Password reset failed.";return b({ok:!1,error:j.replace("Action token","Reset link")},j.includes("consumed")||j.includes("expired")?409:404)}}if(L.pathname==="/api/login"&&C.method==="POST"){let d=await oe(C),p=String(d.username??"").trim(),R=String(d.password??""),M=Ze.requestIP(C)?.address??"unknown",j=za.check(p,M);if(!j.allowed)return b({ok:!1,error:`Too many failed attempts. Try again in ${Math.ceil((j.retryAfterSeconds??0)/60)} minute(s).`},429,{"retry-after":String(j.retryAfterSeconds??60)});let X=fi(ln(t),p),F=Ie.getIdentityByUsername(p),Z=F?.passwordHash??X?.passwordHash??tA;if(!(Ei(R,Z)&&!!X&&!!F&&!F.disabledAt))return za.recordFailure(p,M),b({ok:!1,error:"Incorrect username or password."},401);if(py(Ie,a,F))return b({ok:!1,error:"Single sign-on is required for this account."},403);za.recordSuccess(p,M);let pe=F,Ge=pe.requiresPasswordUpgrade||Bh(pe.passwordHash);if(Ge){let je=$o(R);pe=Ie.rehashPassword(pe.id,je),wd(t,pe.username,je)}if(Ie.recordLogin(pe.id),Ie.getMfaFactor(pe.id)?.state==="active"){let je=Ie.createMfaChallenge(pe.id,"login");return a.store.appendEvent({organizationId:a.organization.id,actorId:pe.actorId,type:"auth.mfa.challenge.created",payload:{purpose:"login"}}),b({ok:!0,mfaRequired:!0,challengeToken:je.token,passwordUpgraded:Ge})}let ve=qa(pe.id,C,M);return a.store.appendEvent({organizationId:a.organization.id,actorId:pe.actorId,type:"auth.login.succeeded",payload:{method:"local"}}),b({ok:!0,user:oa(X),passwordUpgraded:Ge},200,{"set-cookie":ia(ve.token,{secure:ho,maxAgeMs:Co})})}if(L.pathname==="/api/auth/mfa/complete"&&C.method==="POST"){let d=await oe(C),p=String(d.challengeToken??"").trim(),R=String(d.code??"").trim(),M=Ze.requestIP(C)?.address??"unknown",X=Ie.inspectMfaChallengeToken(p,"login")?.identityId??"unknown-mfa",F=Va.check(X,M);if(!F.allowed)return b({ok:!1,error:"Too many MFA attempts. Try again later."},429,{"retry-after":String(F.retryAfterSeconds??60)});try{let Z=Ie.completeMfaChallenge(p,R,"login");Va.recordSuccess(X,M);let fe=new Date().toISOString(),pe=Ie.createSession({identityId:Z.identity.id,userAgent:Ap(C),networkHint:$d(M),mfaAt:fe,recentAuthAt:fe});return a.store.appendEvent({organizationId:a.organization.id,actorId:Z.identity.actorId,type:"auth.mfa.succeeded",payload:{purpose:"login",method:Z.method}}),b({ok:!0},200,{"set-cookie":ia(pe.token,{secure:ho,maxAgeMs:Co})})}catch{return Va.recordFailure(X,M),b({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}}if(L.pathname==="/api/logout"&&C.method==="POST"){let d=Ft.resolveSession(C);if(d)Ie.revokeSession(d.identityId,d.id);let p=bd({secure:ho});if(C.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login","set-cookie":p}});return b({ok:!0},200,{"set-cookie":p})}if(L.pathname==="/login"){let d=Ie.listOidcProviders(a.organization.id).map((p)=>({slug:p.slug,name:p.name}));return new Response(gy(N?.mode==="serverless",d),{headers:{"content-type":"text/html; charset=utf-8"}})}if(L.pathname==="/forgot-password"||L.pathname==="/reset-password")return new Response(my(L.pathname==="/reset-password"?"reset":"request"),{headers:{"content-type":"text/html; charset=utf-8"}});if(L.pathname==="/accept-invitation")return hb(Ri,L.pathname);let ue=Ft.resolveUser(C);if(!ue){if(!L.pathname.startsWith("/api/")&&C.headers.get("accept")?.includes("text/html"))return new Response(null,{status:302,headers:{location:"/login"}});return b({ok:!1,error:"Sign in to continue."},401)}let Fn=uo(ue,Se);if(L.pathname==="/api/me"){let d=a.store.getActorByExternalId("user",`dashboard:${ue.username.toLowerCase()}`),p=d?a.store.getMembershipForActor(a.organization.id,d.id):void 0,R=a.store.resolveAuthorizationTarget(a.organization.id,p?.scope??{type:"project",id:a.project.id})??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id});return b({ok:!0,user:oa(ue),authEnabled:Pe,organization:a.organization,membership:p,capabilities:mn({membership:p,grants:p?a.store.listGrants(p.id):[],target:R})})}if(L.pathname.startsWith("/api/")){let d=await dy(C,L.pathname),p=Ft.check(C,L.pathname,ue,d);if(!p.ok)return b({ok:!1,error:p.error},p.status??403);if(Pe&&lA.has(`${C.method.toUpperCase()} ${L.pathname}`)){let R=Ft.resolveSession(C);if(!R||!Ie.isRecentlyAuthenticated(R))return b({ok:!1,error:"Recent authentication is required for this change.",stepUpRequired:!0},401)}}if(L.pathname==="/api/auth/security"&&C.method==="GET"){let d=Be(ue),p=d.actor?Ie.getIdentityByActor(d.actor.id):void 0,R=Ft.resolveSession(C);return b({identity:p?{username:p.username,email:p.email,emailVerifiedAt:p.emailVerifiedAt,requiresPasswordUpgrade:p.requiresPasswordUpgrade,lastLoginAt:p.lastLoginAt}:void 0,currentSessionId:R?.id,sessions:p?Ie.listSessions(p.id,{includeInactive:!0}):[],mfa:p?{factor:Ie.getMfaFactor(p.id),recoveryCodesRemaining:Ie.remainingRecoveryCodes(p.id)}:void 0})}if(L.pathname==="/api/auth/oidc/providers"&&C.method==="GET")return b({providers:Ie.listOidcProviders(a.organization.id,{includeDisabled:!0}),callbackOrigin:nt,callbackPattern:nt?`${nt}/auth/oidc/{slug}/callback`:void 0,localOwnerRecovery:!0});if(L.pathname==="/api/auth/oidc/providers"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=p.actor?Ie.getIdentityByActor(p.actor.id):void 0,M=d.enforceSso===!0;if(M&&(!R?.emailVerifiedAt||Ie.remainingRecoveryCodes(R.id)<1))return b({ok:!1,error:"Verify the owner email and generate MFA recovery codes before enforcing SSO."},409);try{let j=Td(d.defaultRole),X=Ie.upsertOidcProvider({id:typeof d.id==="string"?d.id:void 0,organizationId:a.organization.id,slug:String(d.slug??""),name:String(d.name??""),issuer:String(d.issuer??""),clientId:String(d.clientId??""),clientSecret:typeof d.clientSecret==="string"&&d.clientSecret?d.clientSecret:void 0,scopes:Array.isArray(d.scopes)?d.scopes.map(String):void 0,allowedDomains:Array.isArray(d.allowedDomains)?d.allowedDomains.map(String):[],defaultRole:j&&j!=="owner"?j:void 0,enabled:d.enabled!==!1,enforceSso:M});return a.store.appendEvent({organizationId:a.organization.id,actorId:p.actor?.id,type:"auth.oidc.provider.configured",payload:{providerId:X.id,issuer:X.issuer,enabled:X.enabled,enforceSso:X.enforceSso}}),b({ok:!0,provider:X})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"OIDC provider could not be saved."},422)}}if(L.pathname==="/api/auth/oidc/providers"&&C.method==="PATCH"){let d=await oe(C),p=Ie.getOidcProvider(String(d.id??""));if(!p||p.organizationId!==a.organization.id)return b({ok:!1,error:"OIDC provider was not found."},404);let R=Be(ue),M=Ie.setOidcProviderEnabled(p.id,d.enabled===!0);return a.store.appendEvent({organizationId:a.organization.id,actorId:R.actor?.id,type:M.enabled?"auth.oidc.provider.enabled":"auth.oidc.provider.disabled",payload:{providerId:p.id}}),b({ok:!0,provider:M})}if(L.pathname==="/api/automation"&&C.method==="GET"){let d=lt.listServiceAccounts(a.organization.id,{includeDisabled:!0}).map((p)=>{let R=a.store.getMembershipForActor(a.organization.id,p.actorId),M=p.createdByActorId?a.store.getActor(p.createdByActorId):void 0,j=lt.listTokens(p.id,{includeInactive:!0}).map((X)=>({...X,createdBy:X.createdByActorId?a.store.getActor(X.createdByActorId):void 0}));return{account:p,createdBy:M,membership:R,tokens:j}});return b({accounts:d,apiBaseUrl:`${L.origin}/api/v1`,openApiUrl:`${L.origin}/api/v1/openapi.json`,tokenEnvironmentVariable:"TS_CLOUD_API_TOKEN"})}if(L.pathname==="/api/automation/service-accounts"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=Td(d.roleTemplate),M=Ba(d);if(!p.actor||!R||R==="owner"||!M)return b({ok:!1,error:"A non-owner role and valid organization scope are required."},422);try{let j=lt.createServiceAccount({organizationId:a.organization.id,slug:String(d.slug??""),name:String(d.name??""),description:typeof d.description==="string"?d.description:void 0,roleTemplate:R,scope:M,createdByActorId:p.actor.id});return b({ok:!0,...j},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"Service account could not be created."},422)}}if(L.pathname==="/api/automation/service-accounts"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=lt.getServiceAccount(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Service account was not found."},404);return b({ok:!0,account:lt.disableServiceAccount(R.id,p.actor?.id)})}if(L.pathname==="/api/automation/tokens"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=lt.getServiceAccount(String(d.serviceAccountId??"")),M=Ba(d);if(!p.actor||!R||R.organizationId!==a.organization.id||!M||!Array.isArray(d.capabilities))return b({ok:!1,error:"Service account, explicit capabilities, and valid scope are required."},422);try{let j=lt.createToken({serviceAccountId:R.id,name:String(d.name??"API token"),capabilities:d.capabilities.map(String),scope:M,expiresAt:typeof d.expiresAt==="string"?d.expiresAt:void 0,createdByActorId:p.actor.id});return b({ok:!0,token:j.token,secret:j.secret,revealOnce:!0},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"API token could not be created."},422)}}if(L.pathname==="/api/automation/tokens/rotate"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=lt.getToken(String(d.id??"")),M=R?lt.getServiceAccount(R.serviceAccountId):void 0;if(!p.actor||!R||M?.organizationId!==a.organization.id)return b({ok:!1,error:"API token was not found."},404);try{let j=lt.rotateToken(R.id,p.actor.id);return b({ok:!0,token:j.token,secret:j.secret,revealOnce:!0,overlap:!0},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"API token could not be rotated."},409)}}if(L.pathname==="/api/automation/tokens"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue),R=lt.getToken(String(d.id??"")),M=R?lt.getServiceAccount(R.serviceAccountId):void 0;if(!R||M?.organizationId!==a.organization.id)return b({ok:!1,error:"API token was not found."},404);return b({ok:!0,token:lt.revokeToken(R.id,p.actor?.id)})}if(L.pathname==="/api/onboarding"&&C.method==="GET"){let d=ze.listConnections(a.organization.id);return b({drafts:$r.list(a.project.id),artifacts:ws.list(a.project.id),registries:Pi.list(a.organization.id),sourceConnections:d,repositories:d.flatMap((p)=>ze.listRepositories(p.id)),project:{id:a.project.id,slug:a.project.slug,name:a.project.name},environments:[...a.environments.values()].map((p)=>({id:p.id,slug:p.slug,name:p.name,kind:p.kind,region:p.region})),resources:a.store.listResources(a.project.id).filter((p)=>p.kind==="application").map((p)=>({id:p.id,slug:p.slug,name:p.name,environmentId:p.environmentId}))})}if(L.pathname==="/api/onboarding/detect"&&C.method==="POST"){let d=await oe(C);try{if(d.source?.kind==="git"){let M=ze.getConnection(String(d.source.connectionId??"")),j=ze.getRepository(String(d.source.repositoryId??""));if(!M||M.organizationId!==a.organization.id||!j||j.connectionId!==M.id)throw Error("Authorized Git repository was not found");let X=typeof d.source.deployKeyId==="string"?ze.getDeployKey(d.source.deployKeyId):void 0;if(X&&X.connectionId!==M.id)throw Error("Deploy key does not belong to this connection");let F=cp(Ct(kd(),"ts-cloud-onboarding-git-"));try{let Z=await Qd({remote:j.cloneUrl,destination:Ct(F,"checkout"),ref:String(d.source.ref??j.defaultBranch),sparsePaths:Array.isArray(d.source.sparsePaths)?d.source.sparsePaths.map(String):void 0,binding:{id:"detection",projectId:a.project.id,connectionId:M.id,repositoryId:j.id,repositoryFullName:j.fullName,defaultBranch:j.defaultBranch,monorepoRoot:String(d.source.monorepoRoot??"."),includePaths:[],excludePaths:[],submodules:d.source.submodules===!0,cloneDepth:1,deployKeyId:X?.id,autoDeploy:!1,pullRequestPreviews:!1,status:"active",version:1,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()}},{credential:ze.getCredential(M.id),deployKey:X?{...X,privateKey:ze.getDeployPrivateKey(X.id)}:void 0,timeoutMs:120000});return b({ok:!0,commitSha:Z.commitSha,candidates:Nt(Gn(Z.directory))})}finally{vs(F,{recursive:!0,force:!0})}}if(Array.isArray(d.files)){if(d.files.length>1e4)throw Error("Detection file-count limit exceeded");let M=d.files.map((j)=>({path:String(j.path??""),size:Number(j.size??0),content:typeof j.content==="string"?j.content.slice(0,262144):void 0}));return b({ok:!0,candidates:Nt(M)})}let p=qT(t,String(d.root??".")),R=VT(t,p);if(R===".."||R.startsWith(`..${JT}`))throw Error("Detection root must stay inside the project");return b({ok:!0,candidates:Nt(Gn(p))})}catch(p){return b({ok:!1,error:p instanceof Error?p.message:"Application detection failed."},422)}}if(L.pathname==="/api/onboarding/plan"&&C.method==="POST"){let d=await oe(C);try{return b({ok:!0,plan:ce(d.draft,Array.isArray(d.suppliedSecretNames)?d.suppliedSecretNames.map(String):[])})}catch(p){return b({ok:!1,error:p instanceof Error?p.message:"Application plan could not be generated."},422)}}if(L.pathname==="/api/onboarding/drafts"&&C.method==="POST"){let d=await oe(C),p=Be(ue);try{return b({ok:!0,draft:$r.create({organizationId:a.organization.id,projectId:a.project.id,name:String(d.name??d.draft?.name??"Application draft"),draft:{...d.draft,projectId:a.project.id},step:d.step,suppliedSecretNames:Array.isArray(d.suppliedSecretNames)?d.suppliedSecretNames.map(String):[],actorId:p.actor?.id})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Application draft could not be saved."},422)}}if(L.pathname==="/api/onboarding/drafts"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=$r.get(String(d.id??""));if(!R||R.projectId!==a.project.id)return b({ok:!1,error:"Application draft was not found."},404);try{return b({ok:!0,draft:$r.update(R.id,Number(d.version),{draft:{...d.draft,projectId:a.project.id},step:d.step,suppliedSecretNames:Array.isArray(d.suppliedSecretNames)?d.suppliedSecretNames.map(String):void 0,actorId:p.actor?.id})})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Application draft could not be updated."},409)}}if(L.pathname==="/api/onboarding/artifacts"&&C.method==="POST"){let d=Be(ue);if(Number(C.headers.get("content-length")??0)>104857600)return b({ok:!1,error:"Artifact exceeds the 100 MB upload limit."},413);try{let R=new Uint8Array(await C.arrayBuffer());return b({ok:!0,artifact:ws.create({organizationId:a.organization.id,projectId:a.project.id,filename:C.headers.get("x-artifact-filename")??"application.zip",bytes:R,actorId:d.actor?.id})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Artifact could not be inspected."},422)}}if(L.pathname==="/api/onboarding/registries"&&C.method==="POST"){let d=await oe(C),p=Be(ue);try{return b({ok:!0,registry:Pi.create({organizationId:a.organization.id,provider:d.provider,name:String(d.name??"Container registry"),host:String(d.host??""),credential:d.token||d.password?{username:typeof d.username==="string"?d.username:void 0,password:typeof d.password==="string"?d.password:void 0,token:typeof d.token==="string"?d.token:void 0}:void 0,credentialExpiresAt:typeof d.credentialExpiresAt==="string"?d.credentialExpiresAt:void 0,actorId:p.actor?.id})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Registry connection could not be created."},422)}}if(L.pathname==="/api/onboarding/registries"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=Pi.get(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Registry connection was not found."},404);try{if(d.action==="test")return b({ok:!0,registry:await Pi.test(R.id,{image:typeof d.image==="string"?d.image:void 0})});if(d.action==="rotate")return b({ok:!0,registry:Pi.rotate(R.id,{username:typeof d.username==="string"?d.username:void 0,password:typeof d.password==="string"?d.password:void 0,token:typeof d.token==="string"?d.token:void 0},{expiresAt:typeof d.expiresAt==="string"?d.expiresAt:void 0,actorId:p.actor?.id})});return b({ok:!1,error:"Registry action must be test or rotate."},422)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Registry connection could not be updated."},422)}}if(L.pathname==="/api/onboarding/registries"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue),R=Pi.get(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Registry connection was not found."},404);let M=$r.list(a.project.id).filter((j)=>j.input.source.kind==="image"&&j.input.source.registryConnectionId===R.id||j.input.build.kind==="prebuilt_image"&&j.input.build.registryConnectionId===R.id);if(d.preview===!0)return b({ok:!0,preview:!0,affectedDrafts:M});return b({ok:!0,registry:Pi.disconnect(R.id,p.actor?.id),affectedDrafts:M})}if(L.pathname==="/api/onboarding/apply"&&C.method==="POST"){let d=await oe(C),p=Be(ue);try{let R=Br({controlPlane:a.store,drafts:$r,draftId:String(d.id??""),expectedVersion:Number(d.version),confirmEnvironment:String(d.confirmEnvironment??""),actorId:p.actor?.id});return b({ok:!0,resource:R.resource,operation:R.operation,plan:R.plan},202)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Application plan could not be applied."},422)}}if(L.pathname==="/api/sources"&&C.method==="GET"){let d=ze.listConnections(a.organization.id);return b({connections:d,bindings:ze.listBindings({projectId:a.project.id}),repositories:d.flatMap((p)=>ze.listRepositories(p.id)),deployKeys:d.flatMap((p)=>ze.listDeployKeys(p.id)),webhooks:d.flatMap((p)=>ze.listWebhooks(p.id)).map((p)=>({...p,deliveries:ze.listDeliveries(p.id,20)})),project:{id:a.project.id,slug:a.project.slug},environment:le(a,String(Se)),resources:a.store.listResources(a.project.id,le(a,String(Se)).environmentId).filter((p)=>p.kind==="application").map((p)=>({id:p.id,slug:p.slug,name:p.name}))})}if(L.pathname==="/api/sources/connections"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=String(d.provider??"");if(!["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"].includes(R))return b({ok:!1,error:"A supported Git provider is required."},422);try{let M=R==="github"&&(d.privateKey||d.appId)?{appId:typeof d.appId==="string"?d.appId:void 0,installationId:typeof d.installationId==="string"?d.installationId:void 0,privateKey:typeof d.privateKey==="string"?d.privateKey:void 0}:R!=="generic_ssh"&&d.token?{token:typeof d.token==="string"?d.token:void 0,username:typeof d.username==="string"?d.username:void 0}:void 0,j={github:"https://github.com",gitlab:"https://gitlab.com",bitbucket:"https://bitbucket.org",gitea:"https://gitea.com"},X,F,Z;if(a.store.database.transaction(()=>{if(X=ze.createConnection({organizationId:a.organization.id,provider:R,name:String(d.name??R),host:String(d.host??j[R]??""),owner:typeof d.owner==="string"?d.owner:void 0,authKind:d.authKind,credential:M,grantedScopes:Array.isArray(d.grantedScopes)?d.grantedScopes.map(String):[],credentialExpiresAt:typeof d.credentialExpiresAt==="string"?d.credentialExpiresAt:void 0,createdByActorId:p.actor?.id}),typeof d.repositoryUrl==="string"&&typeof d.repositoryFullName==="string")F=ze.upsertRepository({connectionId:X.id,providerRepositoryId:`manual:${d.repositoryFullName}`,fullName:d.repositoryFullName,cloneUrl:d.repositoryUrl,defaultBranch:String(d.defaultBranch??"main"),visibility:"unknown",archived:!1,metadata:{source:"manual"}});if(R==="generic_ssh")Z=ze.createDeployKey({connectionId:X.id,name:String(d.deployKeyName??"Repository deploy key"),publicKey:String(d.publicKey??""),privateKey:String(d.deployPrivateKey??""),host:String(d.sshHost??""),hostKey:String(d.hostKey??""),actorId:p.actor?.id})})(),d.test===!0)X=await Yd(ze,X.id,F?.id);return b({ok:!0,connection:X,repository:F,deployKey:Z},201)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Source connection could not be created."},422)}}if(L.pathname==="/api/sources/connections"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=ze.getConnection(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{if(d.action==="test")return b({ok:!0,connection:await Yd(ze,R.id,typeof d.repositoryId==="string"?d.repositoryId:void 0)});if(d.action==="rotate")return b({ok:!0,connection:ze.rotateCredential(R.id,{token:typeof d.token==="string"?d.token:void 0,username:typeof d.username==="string"?d.username:void 0,appId:typeof d.appId==="string"?d.appId:void 0,installationId:typeof d.installationId==="string"?d.installationId:void 0,privateKey:typeof d.privateKey==="string"?d.privateKey:void 0},{expiresAt:typeof d.expiresAt==="string"?d.expiresAt:void 0,actorId:p.actor?.id})});return b({ok:!1,error:"Connection action must be test or rotate."},422)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Source connection could not be updated."},422)}}if(L.pathname==="/api/sources/connections"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue),R=ze.getConnection(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);let M=ze.listBindings({connectionId:R.id,status:"active"});if(d.preview===!0)return b({ok:!0,preview:!0,affectedBindings:M});return b({ok:!0,...ze.disconnectConnection(R.id,p.actor?.id)})}if(L.pathname==="/api/sources/deploy-keys"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=ze.getConnection(String(d.connectionId??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{return b({ok:!0,deployKey:ze.createDeployKey({connectionId:R.id,name:String(d.name??"Repository deploy key"),publicKey:String(d.publicKey??""),privateKey:String(d.privateKey??""),host:String(d.host??""),hostKey:String(d.hostKey??""),actorId:p.actor?.id})},201)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Deploy key could not be stored."},422)}}if(L.pathname==="/api/sources/deploy-keys"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue),R=ze.getDeployKey(String(d.id??"")),M=R?ze.getConnection(R.connectionId):void 0;if(!R||!M||M.organizationId!==a.organization.id)return b({ok:!1,error:"Deploy key was not found."},404);let j=ze.listBindings({connectionId:M.id}).filter((X)=>X.deployKeyId===R.id);if(d.preview===!0)return b({ok:!0,preview:!0,affectedBindings:j});return b({ok:!0,...ze.revokeDeployKey(R.id,p.actor?.id)})}if(L.pathname==="/api/sources/repositories/sync"&&C.method==="POST"){let d=await oe(C),p=ze.getConnection(String(d.connectionId??""));if(!p||p.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{return b({ok:!0,repositories:await Fr(ze,String(d.connectionId??""),{search:typeof d.search==="string"?d.search:void 0})})}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Repositories could not be synchronized."},422)}}if(L.pathname==="/api/sources/references"&&C.method==="GET"){let d=ze.getConnection(String(L.searchParams.get("connectionId")??""));if(!d||d.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{return b(await nr(ze,{connectionId:String(L.searchParams.get("connectionId")??""),repository:String(L.searchParams.get("repository")??""),repositoryId:L.searchParams.get("repositoryId")??void 0,deployKeyId:L.searchParams.get("deployKeyId")??void 0,type:L.searchParams.get("type")==="tags"?"tags":"branches",cursor:L.searchParams.get("cursor")??void 0}))}catch(p){return b({ok:!1,error:p instanceof Error?p.message:"References could not be listed."},422)}}if(L.pathname==="/api/sources/bindings"&&C.method==="POST"){let d=await oe(C),p=Be(ue),R=le(a,String(Se)),M=ze.getConnection(String(d.connectionId??""));if(!M||M.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{return b({ok:!0,binding:ze.createBinding({projectId:a.project.id,environmentId:R.environmentId,resourceId:typeof d.resourceId==="string"?d.resourceId:void 0,connectionId:String(d.connectionId??""),repositoryId:typeof d.repositoryId==="string"?d.repositoryId:void 0,repositoryFullName:String(d.repositoryFullName??""),defaultBranch:String(d.defaultBranch??"main"),branchRule:typeof d.branchRule==="string"?d.branchRule:void 0,tagRule:typeof d.tagRule==="string"?d.tagRule:void 0,monorepoRoot:String(d.monorepoRoot??"."),includePaths:Array.isArray(d.includePaths)?d.includePaths.map(String):[],excludePaths:Array.isArray(d.excludePaths)?d.excludePaths.map(String):[],submodules:d.submodules===!0,cloneDepth:d.cloneDepth?Number(d.cloneDepth):void 0,deployKeyId:typeof d.deployKeyId==="string"&&d.deployKeyId?d.deployKeyId:void 0,autoDeploy:d.autoDeploy!==!1,pullRequestPreviews:d.pullRequestPreviews!==!1,actorId:p.actor?.id})},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"Source binding could not be created."},422)}}if(L.pathname==="/api/sources/bindings"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=ze.getBinding(String(d.id??""));if(!R||R.projectId!==a.project.id)return b({ok:!1,error:"Source binding was not found."},404);try{return b({ok:!0,binding:ze.updateBinding(R.id,Number(d.version),{defaultBranch:d.defaultBranch,branchRule:d.branchRule,tagRule:d.tagRule,monorepoRoot:d.monorepoRoot,includePaths:d.includePaths,excludePaths:d.excludePaths,submodules:d.submodules,cloneDepth:d.cloneDepth,deployKeyId:d.deployKeyId,autoDeploy:d.autoDeploy,pullRequestPreviews:d.pullRequestPreviews,status:d.status,disabledReason:d.disabledReason,actorId:p.actor?.id})})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Source binding could not be updated."},409)}}if(L.pathname==="/api/sources/webhooks"&&C.method==="POST"){let d=await oe(C),p=ze.getConnection(String(d.connectionId??""));if(!p||p.organizationId!==a.organization.id)return b({ok:!1,error:"Source connection was not found."},404);try{let R=ze.createWebhook({connectionId:String(d.connectionId??""),repositoryId:typeof d.repositoryId==="string"?d.repositoryId:void 0,repositoryFullName:String(d.repositoryFullName??""),events:Array.isArray(d.events)?d.events.map(String):void 0,secret:typeof d.secret==="string"?d.secret:void 0}),M=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||nt,j=M?Dt(M,R.webhook):void 0,X=d.reconcile!==!1&&M?await ir(ze,R.webhook.id,M):R.webhook;return b({ok:!0,webhook:X,endpoint:j,endpointRevealOnce:!0},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Source webhook could not be created."},422)}}if(L.pathname==="/api/sources/webhooks"&&C.method==="PATCH"){let d=await oe(C),p=process.env.TS_CLOUD_WEBHOOK_BASE_URL?.trim()||nt,R=ze.getWebhook(String(d.id??"")),M=R?ze.getConnection(R.connectionId):void 0;if(!R||!M||M.organizationId!==a.organization.id)return b({ok:!1,error:"Source webhook was not found."},404);if(!p)return b({ok:!1,error:"Set TS_CLOUD_WEBHOOK_BASE_URL to reconcile provider webhooks."},422);try{return b({ok:!0,webhook:await ir(ze,String(d.id??""),p)})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"Source webhook could not be reconciled."},422)}}if(L.pathname==="/api/sources/webhooks"&&C.method==="DELETE"){let d=await oe(C),p=ze.getWebhook(String(d.id??"")),R=p?ze.getConnection(p.connectionId):void 0;if(!p||!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Source webhook was not found."},404);try{return b({ok:!0,webhook:await ji(ze,String(d.id??""))})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Source webhook could not be removed."},422)}}if(L.pathname==="/api/security/posture"&&C.method==="GET"){let d=le(a,String(Se)),p=rt.listFindings({...d,limit:500});return b({scope:d,summary:rt.summary(d.organizationId,d.projectId,d.environmentId),findings:p,scans:rt.listScanRuns({...d,limit:100}),policies:rt.listPolicies(d.organizationId).filter((R)=>!R.environmentId||R.environmentId===d.environmentId),waivers:p.flatMap((R)=>rt.listWaivers(R.id)),decisions:rt.listDecisions(d.environmentId,50),actors:a.store.listMemberships(a.organization.id).map((R)=>a.store.getActor(R.actorId)).filter(Boolean)})}if(L.pathname==="/api/security/export"&&C.method==="GET")return b(rt.exportPosture(a.organization.id));if(L.pathname==="/api/security/scan"&&C.method==="POST"){let d=le(a,String(Se)),p=await new ps(rt).run(new Da,{...d,artifactRoot:t}),R=dd(rt,d,Lt??{});return b({ok:!0,source:p,host:R,summary:rt.summary(d.organizationId,d.projectId,d.environmentId)})}if(L.pathname==="/api/security/review"&&C.method==="POST")try{let d=le(a,String(Se));return b({ok:!0,...ar(rt,{scope:d,desiredConfigHash:a.project.desiredConfigHash})})}catch(d){return b({ok:!1,error:d instanceof Error?d.message:"Security change review failed."},409)}if(L.pathname==="/api/security/policies"&&C.method==="POST"){let d=await oe(C),p=Be(ue);if(!p.actor)return b({ok:!1,error:"An organization actor is required."},403);try{let R=rt.createPolicy({organizationId:a.organization.id,environmentId:d.environmentId===null?void 0:String(d.environmentId??le(a,String(Se)).environmentId),name:String(d.name??""),scannerFailMode:d.scannerFailMode==="open"?"open":"closed",requiredScanners:Array.isArray(d.requiredScanners)?d.requiredScanners.map(String):[],rules:Array.isArray(d.rules)?d.rules.map((M)=>({minimumSeverity:String(M.minimumSeverity),action:String(M.action),scannerId:M.scannerId?String(M.scannerId):void 0})):[],actorId:p.actor.id});return b({ok:!0,policy:R},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Security policy could not be created."},422)}}if(L.pathname==="/api/security/policies"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=rt.getPolicy(String(d.id??""));if(!p.actor||!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Security policy was not found."},404);try{return b({ok:!0,policy:rt.updatePolicy(R.id,Number(d.version),{name:typeof d.name==="string"?d.name:void 0,scannerFailMode:d.scannerFailMode==="open"||d.scannerFailMode==="closed"?d.scannerFailMode:void 0,requiredScanners:Array.isArray(d.requiredScanners)?d.requiredScanners.map(String):void 0,rules:Array.isArray(d.rules)?d.rules.map((M)=>({minimumSeverity:String(M.minimumSeverity),action:String(M.action),scannerId:M.scannerId?String(M.scannerId):void 0})):void 0,enabled:typeof d.enabled==="boolean"?d.enabled:void 0,actorId:p.actor.id})})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Security policy could not be updated."},409)}}if(L.pathname==="/api/security/waivers"&&C.method==="POST"){let d=await oe(C),p=Be(ue);if(!p.actor)return b({ok:!1,error:"An organization actor is required."},403);try{return b({ok:!0,waiver:rt.createWaiver({findingId:String(d.findingId??""),policyId:typeof d.policyId==="string"?d.policyId:void 0,reason:String(d.reason??""),referenceUrl:typeof d.referenceUrl==="string"?d.referenceUrl:void 0,expiresAt:String(d.expiresAt??""),actorId:p.actor.id})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Security waiver could not be created."},422)}}if(L.pathname==="/api/security/waivers"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue);if(!p.actor)return b({ok:!1,error:"An organization actor is required."},403);try{return b({ok:!0,waiver:rt.revokeWaiver(String(d.id??""),p.actor.id)})}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Security waiver could not be revoked."},404)}}if(L.pathname==="/api/security/findings"&&C.method==="PATCH"){let d=await oe(C),p=Be(ue),R=rt.getFinding(String(d.id??""));if(!p.actor||!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Security finding was not found."},404);try{let M=d.action==="acknowledge"?rt.acknowledgeFinding(R.id,p.actor.id):rt.assignFinding(R.id,typeof d.ownerActorId==="string"&&d.ownerActorId?d.ownerActorId:void 0,p.actor.id);return b({ok:!0,finding:M})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Security finding could not be updated."},422)}}if(L.pathname==="/api/security/comments"&&C.method==="POST"){let d=await oe(C),p=Be(ue);if(!p.actor)return b({ok:!1,error:"An organization actor is required."},403);try{return b({ok:!0,comment:rt.addComment({findingId:String(d.findingId??""),actorId:p.actor.id,body:String(d.body??""),referenceUrl:typeof d.referenceUrl==="string"?d.referenceUrl:void 0})},201)}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Comment could not be saved."},422)}}if(L.pathname==="/api/auth/sessions"&&C.method==="GET"){let d=Ft.resolveSession(C);return b({currentSessionId:d?.id,sessions:d?Ie.listSessions(d.identityId,{includeInactive:!0}):[]})}if(L.pathname==="/api/auth/sessions"&&C.method==="DELETE"){let d=await oe(C),p=Ft.resolveSession(C);if(!p)return b({ok:!1,error:"Sign in again to manage sessions."},401);let R=String(d.id??""),M=Ie.revokeSession(p.identityId,R),j=R===p.id&&M?{"set-cookie":bd({secure:ho})}:void 0;return b({ok:M,signedOut:R===p.id&&M},M?200:404,j)}if(L.pathname==="/api/auth/sessions/revoke-others"&&C.method==="POST"){let d=Ft.resolveSession(C);if(!d)return b({ok:!1,error:"Sign in again to manage sessions."},401);return b({ok:!0,revoked:Ie.revokeOtherSessions(d.identityId,d.id)})}if(L.pathname==="/api/auth/password/change"&&C.method==="POST"){let d=await oe(C),p=String(d.currentPassword??""),R=String(d.password??""),M=Be(ue),j=M.actor?Ie.getIdentityByActor(M.actor.id):void 0;if(!j||!Ei(p,j.passwordHash))return b({ok:!1,error:"Current password is incorrect."},401);if(R.length<12)return b({ok:!1,error:"New password must be at least 12 characters."},422);if(Ei(R,j.passwordHash))return b({ok:!1,error:"Choose a different password."},409);let X=$o(R),F=Ie.updatePassword(j.id,X);wd(t,F.username,X);let Z=qa(F.id,C,Ze.requestIP(C)?.address??"unknown");return a.store.appendEvent({organizationId:a.organization.id,actorId:F.actorId,type:"auth.password.changed"}),b({ok:!0,message:"Password changed and other sessions were signed out."},200,{"set-cookie":ia(Z.token,{secure:ho,maxAgeMs:Co})})}if(L.pathname==="/api/auth/mfa/enroll"&&C.method==="POST"){let d=await oe(C),p=Ft.resolveSession(C),R=Be(ue),M=R.actor?Ie.getIdentityByActor(R.actor.id):void 0;if(!p||!M)return b({ok:!1,error:"Sign in again before enabling MFA."},401);if(!Ei(String(d.password??""),M.passwordHash))return b({ok:!1,error:"Current password is incorrect."},401);try{let j=Ie.beginTotpEnrollment(M.id,{issuer:a.organization.name});return a.store.appendEvent({organizationId:a.organization.id,actorId:M.actorId,type:"auth.mfa.enrollment.started"}),b({factor:j.factor,secret:j.secret,uri:j.uri})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"MFA enrollment failed."},409)}}if(L.pathname==="/api/auth/mfa/verify"&&C.method==="POST"){let d=await oe(C),p=Ft.resolveSession(C),R=Be(ue),M=R.actor?Ie.getIdentityByActor(R.actor.id):void 0;if(!p||!M)return b({ok:!1,error:"Sign in again before enabling MFA."},401);try{let j=Ie.verifyTotpEnrollment(M.id,String(d.code??""));return Ie.markSessionStepUp(p.id,!0),a.store.appendEvent({organizationId:a.organization.id,actorId:M.actorId,type:"auth.mfa.enabled",payload:{recoveryCodeCount:j.recoveryCodes.length}}),b(j)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:"MFA enrollment failed."},422)}}if(L.pathname==="/api/auth/mfa"&&C.method==="DELETE"){let d=await oe(C),p=Ft.resolveSession(C),R=Be(ue),M=R.actor?Ie.getIdentityByActor(R.actor.id):void 0;if(!p||!M||!Ei(String(d.password??""),M.passwordHash))return b({ok:!1,error:"Current password is incorrect."},401);let j=Ie.verifyMfaCode(M.id,String(d.code??""));if(!j.valid||!j.method)return b({ok:!1,error:"Authenticator or recovery code is incorrect."},401);return Ie.disableMfa(M.id),Ie.revokeOtherSessions(M.id,p.id),Ie.markSessionStepUp(p.id),a.store.appendEvent({organizationId:a.organization.id,actorId:M.actorId,type:"auth.mfa.disabled",payload:{method:j.method}}),b({ok:!0})}if(L.pathname==="/api/auth/step-up"&&C.method==="POST"){let d=await oe(C),p=Ft.resolveSession(C),R=Be(ue),M=R.actor?Ie.getIdentityByActor(R.actor.id):void 0;if(!p||!M||!Ei(String(d.password??""),M.passwordHash))return b({ok:!1,error:"Current password is incorrect."},401);let j=Ie.getMfaFactor(M.id);if(j?.state==="active"){if(!Ie.verifyMfaCode(M.id,String(d.code??"")).valid)return b({ok:!1,error:"Authenticator or recovery code is incorrect."},401)}let X=Ie.markSessionStepUp(p.id,j?.state==="active");return a.store.appendEvent({organizationId:a.organization.id,actorId:M.actorId,type:"auth.step_up.succeeded",payload:{mfa:j?.state==="active"}}),b({ok:!0,recentAuthAt:X.recentAuthAt})}if(L.pathname==="/api/terminal"){if(!ge)return b({ok:!1,error:"The web terminal is disabled."},403);if(Ze.upgrade(C))return;return Rd("WebSocket upgrade failed",400)}if(L.pathname==="/api/health"){let d=a.store.health();return b({ok:!0,cwd:t,environment:Se,environments:f,uiRoot:await ki(ue,Se),liveData:Re.size>0,terminal:ge,localPackage:import.meta.url.includes("/Code/Libraries/ts-cloud/"),controlPlane:{schemaVersion:d.schemaVersion,supportedSchemaVersion:d.supportedSchemaVersion,integrity:d.integrity,pendingRetryableOperations:d.pendingRetryableOperations}})}if(L.pathname==="/api/control-plane/operations"){let d=L.searchParams.get("state"),p=d&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(d)?d:void 0;return b({operations:a.store.listOperations({projectId:a.project.id,state:p,kind:L.searchParams.get("kind")??void 0,limit:Number(L.searchParams.get("limit"))||100})})}if(L.pathname==="/api/queue"&&C.method==="GET"){let d=L.searchParams.get("state"),p=d&&["queued","running","succeeded","failed","cancelled","timed_out"].includes(d)?d:void 0,R=At.list({projectId:a.project.id,state:p,limit:Number(L.searchParams.get("limit"))||250}).filter((M)=>Cs(ue,M.operation.id,"deployments:read")).map((M)=>{let j=M.operation.resourceId?a.store.getResource(M.operation.resourceId):void 0,X=M.operation.environmentId?a.store.listEnvironments(a.project.id).find((fe)=>fe.id===M.operation.environmentId):void 0,F=M.operation.actorId?a.store.getActor(M.operation.actorId):void 0,Z=M.operation.input;return{...M,target:j?{id:j.id,name:j.name,slug:j.slug,kind:j.kind}:X?{id:X.id,name:X.name,slug:X.slug,kind:"environment"}:{id:a.project.id,name:a.project.name,slug:a.project.slug,kind:"project"},actor:F?{id:F.id,name:F.displayName,kind:F.kind}:void 0,commit:Z.revision??Z.source?.commitSha??null}});return b({operations:R,concurrency:At.limits})}if(L.pathname==="/api/queue/logs"&&C.method==="GET"){let d=String(L.searchParams.get("id")??"");if(!Cs(ue,d,"deployments:read"))return b({ok:!1,error:"Operation was not found in this scope."},404);let p=At.logs(d,{after:Number(L.searchParams.get("after"))||0,limit:Number(L.searchParams.get("limit"))||500});return b({entries:p,cursor:p.at(-1)?.sequence??(Number(L.searchParams.get("after"))||0),operation:a.store.getOperation(d)})}if(L.pathname==="/api/queue/stream"&&C.method==="GET"){let d=String(L.searchParams.get("id")??"");if(!Cs(ue,d,"deployments:read"))return b({ok:!1,error:"Operation was not found in this scope."},404);let p=C.headers.get("last-event-id")?.trim(),R=Number(p||L.searchParams.get("after")||0),M=new TextEncoder,j,X=!1,F=new ReadableStream({start(Z){let fe=()=>{if(X)return;let pe=Ft.resolveUser(C);if(!pe||!Cs(pe,d,"deployments:read")){if(X=!0,j)clearInterval(j);Z.close();return}let Ge=At.logs(d,{after:R,limit:500});for(let je of Ge)R=je.sequence,Z.enqueue(M.encode(`id: ${je.sequence}
 event: log
 data: ${JSON.stringify(je)}
 
@@ -496,7 +496,7 @@ This link expires ${j.invitation.expiresAt} and can be used once.`});return b({i
 
 This replacement link expires ${R.invitation.expiresAt} and can be used once.`});return b({invitation:R.invitation,token:R.token,acceptUrl:M,delivered:j})}catch(R){return b({ok:!1,error:R instanceof Error?R.message:"Invitation could not be resent."},409)}}if(L.pathname==="/api/organization/memberships"&&C.method==="PATCH"){let d=await oe(C),p=a.store.getMembership(String(d.id??"")),R=Td(d.roleTemplate),M=Ba(d);if(!p||p.organizationId!==a.organization.id)return b({ok:!1,error:"Membership was not found."},404);if(!R||!M)return b({ok:!1,error:"Choose a valid role template and resource scope."},422);let j=Be(ue);if((p.roleTemplate==="owner"||R==="owner")&&(!Ei(String(d.password??""),ue.passwordHash)||j.membership?.roleTemplate!=="owner"))return b({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let F=a.store.resolveAuthorizationTarget(a.organization.id,M)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),Z=a.store.listGrants(p.id),fe=mn({membership:p,grants:Z,target:F}),pe={...p,roleTemplate:R,scope:M},Ge=mn({membership:pe,grants:Z,target:F}),ve={gained:Ge.filter((je)=>!fe.includes(je)),lost:fe.filter((je)=>!Ge.includes(je))};if(d.preview===!0)return b({membership:p,proposed:{roleTemplate:R,scope:M},accessDiff:ve});if(String(d.confirm??"")!==p.id)return b({ok:!1,error:`Confirm this change with membership ID ${p.id}.`,accessDiff:ve},409);try{return b({membership:a.store.updateMembership({id:p.id,roleTemplate:R,scope:M,actorId:j.actor?.id}),accessDiff:ve})}catch(je){return b({ok:!1,error:je instanceof Error?je.message:"Membership could not be updated."},409)}}if(L.pathname==="/api/organization/memberships"&&C.method==="DELETE"){let d=await oe(C),p=a.store.getMembership(String(d.id??""));if(!p||p.organizationId!==a.organization.id)return b({ok:!1,error:"Membership was not found."},404);if(String(d.confirm??"")!==p.id)return b({ok:!1,error:`Confirm removal with membership ID ${p.id}.`},409);let R=Be(ue);if(p.roleTemplate==="owner"&&(R.membership?.roleTemplate!=="owner"||!Ei(String(d.password??""),ue.passwordHash)))return b({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return b({membership:a.store.revokeMembership(p.id,R.actor?.id)})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Membership could not be removed."},409)}}if(L.pathname==="/api/organization/grants"&&C.method==="POST"){let d=await oe(C),p=String(d.capability??""),R=d.effect==="deny"?"deny":d.effect==="allow"?"allow":void 0,M=Ba(d),j=Be(ue);if(!R||!M||!ae.includes(p))return b({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return b({grant:a.store.upsertGrant({organizationId:a.organization.id,membershipId:String(d.membershipId??""),effect:R,capability:p,scope:M,actorId:j.actor?.id})},201)}catch(X){return b({ok:!1,error:X instanceof Error?X.message:"Grant could not be created."},422)}}if(L.pathname==="/api/organization/grants"&&C.method==="DELETE"){let d=await oe(C),p=Be(ue),R=a.store.getGrant(String(d.id??""));if(!R||R.organizationId!==a.organization.id)return b({ok:!1,error:"Grant was not found."},404);return b({ok:a.store.removeGrant(R.id,p.actor?.id)})}if(L.pathname==="/api/tags"&&C.method==="GET")return b({tags:a.store.listTags(a.project.id),assignments:a.store.listResourceTags(a.project.id)});if(L.pathname==="/api/tags"&&C.method==="POST"){let d=await oe(C),p=a.store.upsertTag(a.project.id,String(d.name??""),String(d.color??"#5a8be0"));if(d.resourceId)a.store.assignTag(String(d.resourceId),p.id);return b({tag:p},201)}if(L.pathname==="/api/tags"&&C.method==="DELETE"){let d=await oe(C);return a.store.removeTag(String(d.resourceId??""),String(d.tagId??"")),b({ok:!0})}if(L.pathname==="/"&&!fb(L.pathname,Fn))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(Se)}`}});if(L.pathname==="/"&&Lt?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(Se)}`}});let Ga=by(L.pathname);if(Ga)return new Response(null,{status:308,headers:{location:`${Ga}?env=${encodeURIComponent(Se)}`}});if(L.pathname==="/api/env"&&C.method==="POST"){let d=await oe(C),p=String(d.env??"");if(!f.includes(p))return b({ok:!1,error:`Unknown environment '${p}'.`,environments:f},404);return b({ok:!0,environment:p,environments:f,href:`?env=${encodeURIComponent(p)}`})}if(L.pathname==="/api/config"){let d={...fA(o),environment:Se,environments:f};return b(vy(d,Fn))}if(L.pathname==="/api/ssh-keys"&&C.method==="GET")return b({configPath:D,keys:_t(da(o))});if(L.pathname==="/api/ssh-keys"&&C.method==="POST"){if(!D)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await oe(C),p=await Li(D,"utf8"),R=da(o),M=lc({configText:p,name:String(d.name??""),publicKey:String(d.publicKey??""),existingKeys:R});return await ys(D,M),lb(o,[...R,{name:String(d.name??"").trim(),publicKey:String(d.publicKey??"").trim().replace(/\s+/g," ")}]),b({ok:!0,configPath:D,keys:_t(da(o))})}if(L.pathname==="/api/ssh-keys"&&C.method==="DELETE"){if(!D)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await oe(C),p=String(d.name??L.searchParams.get("name")??""),R=await Li(D,"utf8"),M=da(o),j=dc({configText:R,name:p,existingKeys:M});return await ys(D,j),lb(o,M.filter((X)=>X.name!==p.trim())),b({ok:!0,configPath:D,keys:_t(da(o))})}if(L.pathname==="/api/firewall"&&C.method==="GET")return b({configPath:D,alwaysOpen:[22,80,443],ports:sp(o)});if(L.pathname==="/api/firewall"&&C.method==="POST"){if(!D)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await oe(C),p=Number(d.port);if(!Ma(p))return b({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let R=sp(o),M=await Li(D,"utf8");try{await ys(D,ky(M,p,R))}catch(F){return b({ok:!1,error:F?.message??String(F)},422)}let j=hs([...R,p]);pb(o,j);let X=d.apply===!1?null:await sr(o,Se,`ufw allow ${p}/tcp`).catch((F)=>({ok:!1,error:String(F?.message??F)}));return b({ok:!0,configPath:D,ports:j,apply:X})}if(L.pathname==="/api/firewall"&&C.method==="DELETE"){if(!D)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await oe(C),p=Number(d.port??L.searchParams.get("port"));if(!Ma(p))return b({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let R=sp(o),M=await Li(D,"utf8");await ys(D,Ry(M,p,R));let j=hs(R.filter((F)=>F!==p));pb(o,j);let X=d.apply===!1?null:await sr(o,Se,`ufw delete allow ${p}/tcp`).catch((F)=>({ok:!1,error:String(F?.message??F)}));return b({ok:!0,configPath:D,ports:j,apply:X})}if(L.pathname==="/api/sites"&&C.method==="POST"){if(!D)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await oe(C),p=String(d.name??"").trim(),R=String(d.root??"").trim();if(!p||!R)return b({ok:!1,error:"Site name and root are required."},422);let M={deploy:d.deploy==="bucket"?"bucket":"server",root:R,path:String(d.path??"").trim()||void 0,domain:String(d.domain??"").trim()||void 0,build:String(d.build??"").trim()||void 0,start:String(d.start??"").trim()||void 0,port:d.port?Number(d.port):void 0,type:String(d.type??"").trim()||void 0};if(M.port!==void 0&&(!Number.isInteger(M.port)||M.port<1||M.port>65535))return b({ok:!1,error:"Port must be a number between 1 and 65535."},422);let j=await Li(D,"utf8"),X=In({configText:j,name:p,root:M.root,domain:M.domain,path:M.path,deploy:M.deploy,build:M.build,start:M.start,port:M.port,type:M.type});return await ys(D,X),aA(o,p,Object.fromEntries(Object.entries(M).filter(([,F])=>F!==void 0))),Lt=await bs(o,Se),W.set(Se,Lt),b({ok:!0,configPath:D,site:p,data:Lt})}if(L.pathname==="/api/sites"&&C.method==="DELETE"){if(!D)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await oe(C),p=String(d.name??L.searchParams.get("name")??"").trim();if(!p||!o.sites?.[p])return b({ok:!1,error:`Site '${p}' was not found.`},404);let R=await Li(D,"utf8");return await ys(D,qy({configText:R,name:p})),delete o.sites[p],Lt=await bs(o,Se),W.set(Se,Lt),b({ok:!0,configPath:D,site:p,data:Lt})}if(L.pathname==="/api/sites"&&C.method==="PATCH"){if(!D)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await oe(C),p=String(d.name??"").trim(),R=o.sites?.[p];if(!p||!R)return b({ok:!1,error:`Site '${p}' was not found.`},404);if(Fn.role==="member"){let X=Cy(d);if(!X.ok)return b({ok:!1,error:X.error},403);let F=Ey({siteName:p,body:d,sites:o.sites??{},ownSites:Object.keys(Fn.sites)});if(!F.ok)return b({ok:!1,error:F.error},409)}if(d.port!==void 0&&d.port!==null&&d.port!==""&&(!Number.isInteger(Number(d.port))||Number(d.port)<1||Number(d.port)>65535))return b({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof d.domain==="string"&&d.domain.trim()&&!np(d.domain.trim()))return b({ok:!1,error:`Domain '${d.domain.trim()}' is not a valid hostname.`},422);let M=await Li(D,"utf8"),j=(X,F)=>{M=Jy({configText:M,siteName:p,key:X,valueText:F})};if(d.ssl!==void 0)j("ssl",Gy(d.ssl)),R.ssl=d.ssl;if(d.env!==void 0&&d.env&&typeof d.env==="object")j("env",Hy(d.env)),R.env=d.env;if(d.aliases!==void 0&&Array.isArray(d.aliases)){let X=d.aliases.map((F)=>String(F));j("aliases",Ky(X)),R.aliases=X.map((F)=>F.trim().toLowerCase()).filter(Boolean)}if(d.redirects!==void 0&&d.redirects&&typeof d.redirects==="object")j("redirects",Qy(d.redirects)),R.redirects=d.redirects;for(let X of["domain","path","build","start","type","root","php"])if(typeof d[X]==="string"&&d[X].trim())j(X,Wy(String(d[X]).trim())),R[X]=String(d[X]).trim();if(d.port!==void 0&&d.port!==null&&d.port!=="")j("port",String(Number(d.port))),R.port=Number(d.port);return await ys(D,M),Lt=await bs(o,Se),W.set(Se,Lt),b({ok:!0,configPath:D,site:p,data:Lt})}if(L.pathname==="/api/sites/deploy"&&C.method==="POST"){let d=await oe(C),p=String(d.name??"").trim();if(!p||!o.sites?.[p])return b({ok:!1,error:`Site '${p}' was not found.`},404);if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to deploy this site.`},409);let R=le(a,String(Se));await new ps(rt).run(new Da,{...R,artifactRoot:t}),dd(rt,R,Lt??{});let M=ar(rt,{scope:R,desiredConfigHash:a.project.desiredConfigHash});if(M.decision.outcome==="block")return b({ok:!1,error:`Deployment blocked by security policy: ${M.decision.explanation}`,securityReview:M},409);let j={id:`deploy:${p}`,label:`Deploy ${p}`,description:`Deploy the ${p} site for ${Se}.`,command:["deploy","--env",Se,"--site",p,"--yes"],mutates:!0},X=await oo({controlPlane:a,environment:Se,actor:ue,kind:"dashboard.site.deploy",resourceSlug:p,input:{site:p},execute:()=>ap(j,{cwd:t,cliEntry:i})});return b({...X.result,controlPlaneOperation:X.operation,securityReview:M})}if(L.pathname==="/api/actions")return b(wb(Se));if(L.pathname==="/api/server/operations")return b(jr(o,Lt));if(L.pathname==="/api/runtime/workloads"&&C.method==="GET"){let d=await Ii(o,Se);return b(d)}if(L.pathname==="/api/runtime/logs"&&C.method==="GET"){let d=String(L.searchParams.get("workload")??"");if(!d)return b({ok:!1,error:"A workload query parameter is required."},422);let p=Math.min(1000,Math.max(1,Number(L.searchParams.get("limit"))||200));try{return b(await new be(o,Se).logs(d,{limit:p}))}catch(R){return b({ok:!1,error:String(R?.message??R)},404)}}if(L.pathname==="/api/runtime/log-sessions"&&C.method==="POST"){let d=await oe(C),p=String(d.workloadId??"");if(!p)return b({ok:!1,error:"A workloadId is required."},422);let R=await Ii(o,Se),M=R.workloads.find((F)=>F.id===p);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!M.capabilities.logs.supported)return b({ok:!1,error:M.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let j=new be(o,Se,{inventory:async()=>R}),X=Yt.create("logs",p);return(async()=>{let F=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(d.sinceMs)||60000)));try{for(let Z=0;Z<200&&!Yt.signal(X.id)?.aborted;Z++){let fe=await j.logs(p,{limit:Math.min(500,Math.max(1,Number(d.limit)||200)),since:F});for(let pe of fe.lines)if(Yt.append(X.id,`${pe.timestamp?`${pe.timestamp} `:""}${pe.message}
 `),pe.timestamp)F=new Date(Math.max(F.getTime(),new Date(pe.timestamp).getTime()+1));await Bun.sleep(3000)}if(!Yt.signal(X.id)?.aborted)Yt.close(X.id,"complete")}catch(Z){Yt.append(X.id,Z instanceof Error?Z.message:String(Z),"stderr"),Yt.close(X.id,"failed",Z instanceof Error?Z.message:String(Z))}})(),b({ok:!0,session:X,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(X.id)}&workload=${encodeURIComponent(p)}`},201)}if((L.pathname==="/api/runtime/log-stream"||L.pathname==="/api/runtime/exec-stream")&&C.method==="GET"){let d=String(L.searchParams.get("id")??""),p=String(L.searchParams.get("workload")??""),R=Number(C.headers.get("last-event-id")??L.searchParams.get("after")??0)||0,M=Yt.read(d,p,R),j=L.pathname.includes("exec")?"exec":"logs";if(!M||M.kind!==j)return b({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return XT(Yt,M,R,C.signal)}if((L.pathname==="/api/runtime/log-sessions"||L.pathname==="/api/runtime/exec-sessions")&&C.method==="DELETE"){let d=await oe(C),p=Yt.cancel(String(d.id??""),String(d.workloadId??""));if(!p)return b({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return b({ok:!0,session:p})}if(L.pathname==="/api/runtime/exec-sessions"&&C.method==="POST"){let d=await oe(C),p=String(d.workloadId??""),R=await Ii(o,Se),M=R.workloads.find((Z)=>Z.id===p);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let j=Ft.resolveSession(C),X=new be(o,Se,{inventory:async()=>R}),F=Yt.create("exec",p);return oo({controlPlane:a,environment:Se,actor:ue,kind:"runtime.exec",resourceSlug:M.links.service,input:{workloadId:p,provider:M.provider,preset:d.preset?String(d.preset):null,freeForm:!!String(d.command??"").trim()},execute:()=>X.exec({workloadId:p,preset:["process","sockets","filesystem"].includes(String(d.preset))?String(d.preset):void 0,command:typeof d.command==="string"?d.command:void 0,confirm:String(d.confirm??""),recentAuth:!Pe||!!j&&Ie.isRecentlyAuthenticated(j)})}).then(({result:Z,operation:fe})=>{if(Yt.append(F.id,`operation ${fe.id}
-`,"system"),Z.stdout)Yt.append(F.id,Z.stdout,"stdout");if(Z.stderr)Yt.append(F.id,Z.stderr,"stderr");Yt.close(F.id,Z.ok?"complete":"failed",Z.error)}).catch((Z)=>{let fe=Z instanceof Error?Z.message:String(Z);Yt.append(F.id,fe,"stderr"),Yt.close(F.id,"failed",fe)}),b({ok:!0,session:F,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(F.id)}&workload=${encodeURIComponent(p)}`},202)}if(L.pathname==="/api/runtime/files/read"&&C.method==="POST"){let d=await oe(C),p=await Ii(o,Se),R=Ft.resolveSession(C),M=await new be(o,Se,{inventory:async()=>p}).readFile({workloadId:String(d.workloadId??""),path:String(d.path??""),confirm:String(d.confirm??""),recentAuth:!Pe||!!R&&Ie.isRecentlyAuthenticated(R)});return b(M,M.ok?200:409)}if(L.pathname==="/api/runtime/files/write"&&C.method==="POST"){let d=await oe(C),p=await Ii(o,Se),R=String(d.workloadId??""),M=p.workloads.find((Z)=>Z.id===R);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let j=Ft.resolveSession(C),X=new be(o,Se,{inventory:async()=>p}),F=await oo({controlPlane:a,environment:Se,actor:ue,kind:"runtime.file.write",resourceSlug:M.links.service,input:{workloadId:R,provider:M.provider,path:String(d.path??""),bytes:Buffer.from(String(d.contentBase64??""),"base64").byteLength},execute:()=>X.writeFile({workloadId:R,path:String(d.path??""),contentBase64:String(d.contentBase64??""),confirm:String(d.confirm??""),recentAuth:!Pe||!!j&&Ie.isRecentlyAuthenticated(j)})});return b({...F.result,controlPlaneOperation:F.operation},F.result.ok?200:409)}if(L.pathname==="/api/runtime/operations"&&C.method==="POST"){let d=await oe(C),p=String(d.workloadId??""),R=String(d.action??"");if(!p||!["start","stop","restart","redeploy","scale","inspect"].includes(R))return b({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let M=await Ii(o,Se),j=M.workloads.find((fe)=>fe.id===p);if(!j)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let X=Ft.resolveSession(C),F=new be(o,Se,{inventory:async()=>M}),Z=await oo({controlPlane:a,environment:Se,actor:ue,kind:`runtime.${R}`,resourceSlug:j.links.service,input:{workloadId:p,provider:j.provider,action:R,replicas:d.replicas==null?null:Number(d.replicas)},execute:()=>F.run({workloadId:p,action:R,replicas:d.replicas==null?void 0:Number(d.replicas),confirm:String(d.confirm??""),recentAuth:!Pe||!!X&&Ie.isRecentlyAuthenticated(X)})});return b({...Z.result,controlPlaneOperation:Z.operation},Z.result.ok?200:409)}if(L.pathname.startsWith("/api/protection")){let d=ue.role==="admin"||Ja(ue,"security:read"),p=ue.role==="admin"||Ja(ue,"security:manage");if(!d)return b({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:R,describePosture:M}=await import("./chunk-e9mkg5dn.js"),j=new R(a.store),X=()=>{if(!p)throw Error("Changing protection controls requires security:manage.")};if(L.pathname==="/api/protection"&&C.method==="GET"){let F=j.current();return b({ok:!0,posture:M(F),controls:F,raw:j.raw()})}if(L.pathname==="/api/protection/attack-mode"&&C.method==="POST"){X();let F=await oe(C);if(F.enabled===!1)return b({ok:!0,disabled:j.disableAttackMode()});return b({ok:!0,control:j.enableAttackMode({hours:F.hours==null?void 0:Number(F.hours),reason:String(F.reason??"Enabled from the dashboard."),actorId:Be(ue).actor?.id})})}if(L.pathname==="/api/protection/pause"&&C.method==="POST"){X();let F=await oe(C);if(F.enabled===!1)return b({ok:!0,resumed:j.resumeMitigations()});return b({ok:!0,control:j.pauseMitigations({hours:F.hours==null?void 0:Number(F.hours),reason:String(F.reason??""),actorId:Be(ue).actor?.id})})}if(L.pathname==="/api/protection/ip-rules"&&C.method==="GET")return b({ok:!0,ipRules:j.current().ipRules});if(L.pathname==="/api/protection/ip-rules"&&(C.method==="POST"||C.method==="DELETE")){X();let F=await oe(C),Z=F.list==="allow"?"allow":"block",fe=C.method==="POST"?j.addIpRule(Z,String(F.cidr??"")):j.removeIpRule(Z,String(F.cidr??""));return b({ok:!0,ipRules:fe})}return b({ok:!1,error:"Protection endpoint was not found."},404)}if(L.pathname.startsWith("/api/spend/")||L.pathname==="/api/usage"){let d=await Ab(),{store:p,service:R,gate:M}=d,j=ue.role==="admin"||Ja(ue,"billing:read"),X=ue.role==="admin"||Ja(ue,"billing:manage");if(!j)return b({ok:!1,error:"Spend data requires the billing:read capability."},403);let F=a.environments.get(Se),Z={organizationId:a.organization.id,projectId:a.project.id,environmentId:F?.id},fe=()=>{if(!X)throw Error("Changing a budget requires the billing:manage capability.")};if(L.pathname==="/api/usage"&&C.method==="GET")return b({ok:!0,...R.usageReport({organizationId:Z.organizationId,projectId:Z.projectId,period:L.searchParams.get("period")??"monthly",timezone:L.searchParams.get("timezone")??void 0})});if(L.pathname==="/api/spend/budgets"&&C.method==="GET")return b({ok:!0,budgets:p.listBudgets({organizationId:Z.organizationId,projectId:Z.projectId}).map((pe)=>({...pe,status:R.status(pe)}))});if(L.pathname==="/api/spend/budgets"&&C.method==="POST"){fe();let pe=await oe(C),Ge=String(pe.scope??"project"),ve=p.createBudget({organizationId:Z.organizationId,projectId:Ge==="organization"?void 0:Z.projectId,environmentId:Ge==="environment"?Z.environmentId:void 0,name:String(pe.name??"").trim(),period:pe.period??"monthly",timezone:pe.timezone?String(pe.timezone):void 0,softLimitCents:pe.softLimitCents==null?void 0:Math.round(Number(pe.softLimitCents)),hardLimitCents:pe.hardLimitCents==null?void 0:Math.round(Number(pe.hardLimitCents)),graceSeconds:pe.graceSeconds==null?void 0:Number(pe.graceSeconds),dryRun:pe.dryRun!==!1});return b({ok:!0,budget:ve})}if(L.pathname==="/api/spend/budgets"&&C.method==="PATCH"){fe();let pe=await oe(C),Ge=String(pe.id??""),ve=p.getBudget(Ge);if(!ve||ve.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);return b({ok:!0,budget:p.updateBudget(Ge,{softLimitCents:pe.softLimitCents==null?ve.softLimitCents:Math.round(Number(pe.softLimitCents)),hardLimitCents:pe.hardLimitCents==null?ve.hardLimitCents:Math.round(Number(pe.hardLimitCents)),enabled:pe.enabled==null?ve.enabled:pe.enabled===!0,dryRun:pe.dryRun==null?ve.dryRun:pe.dryRun===!0},pe.expectedVersion==null?void 0:Number(pe.expectedVersion))})}if(L.pathname==="/api/spend/budgets"&&C.method==="DELETE"){fe();let pe=await oe(C),Ge=String(pe.id??""),ve=p.getBudget(Ge);if(!ve||ve.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);let je=M.closeBudget(Ge);return p.deleteBudget(Ge),b({ok:!0,deleted:!0,lifted:je})}if(L.pathname==="/api/spend/check"&&C.method==="POST"){fe();let pe=await oe(C),{SpendRunner:Ge}=await import("./chunk-hfswzdzj.js"),ve=new Ge({controlPlane:a.store,store:p,alerts:We});if(pe.apply!==!0){let we=p.budgetsForScope(Z.organizationId,Z.projectId,Z.environmentId);return b({ok:!0,applied:!1,preview:we.map((Ae)=>R.status(Ae))})}let je=await ve.run({...Z,environmentKind:F?.kind});return b({ok:!0,applied:!0,result:je})}if(L.pathname==="/api/spend/enforcement"&&C.method==="GET")return b({ok:!0,enforcement:M.listUnder({organizationId:Z.organizationId})});if(L.pathname==="/api/spend/release"&&C.method==="POST"){fe();let pe=await oe(C),Ge=M.close(String(pe.budgetId??""),pe.action);return b({ok:Ge,released:Ge,note:Ge?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(L.pathname==="/api/spend/anomalies"&&C.method==="GET")return b({ok:!0,anomalies:p.listAnomalies({organizationId:Z.organizationId,projectId:Z.projectId,unacknowledgedOnly:L.searchParams.get("unacknowledged")==="true"})});if(L.pathname==="/api/spend/anomalies/acknowledge"&&C.method==="POST"){fe();let pe=await oe(C);return b({ok:!0,acknowledged:p.acknowledgeAnomaly(String(pe.id??""))})}return b({ok:!1,error:"Spend endpoint was not found."},404)}if(L.pathname.startsWith("/api/health/")||L.pathname.startsWith("/api/alerts")||L.pathname.startsWith("/api/notifications/")){let d=a.environments.get(Se),p=a.store.listResources(a.project.id,d?.id),R=ue.role==="admin"||!!d&&la(ue,d.id,"runtime:read")?p:p.filter((F)=>Sr(ue,F.id,"runtime:read")),M=(F)=>!F||R.some((Z)=>Z.id===F),j=(F)=>{if(!F)return;let Z=p.find((fe)=>fe.id===F||fe.slug===F);if(!Z)throw Error("Alert resource was not found.");if(!M(Z.id))throw Error("Alert resource is outside your authorized scope.");return Z.id},X=Be(ue).actor;if(L.pathname==="/api/health/checks"&&C.method==="GET")return b({ok:!0,checks:We.listHealthChecks(a.project.id,d?.id).filter((F)=>M(F.resourceId)).map((F)=>({...F,results:We.listHealthResults(F.id,20)}))});if(L.pathname==="/api/health/checks"&&C.method==="POST"){let F=await oe(C),Z=String(F.kind??"http");if(Z==="command"&&ue.role!=="admin")return b({ok:!1,error:"Command health checks require an administrator."},403);let fe={method:String(F.config?.method??"GET").toUpperCase().slice(0,10),path:F.config?.path?String(F.config.path).slice(0,500):void 0,port:F.config?.port==null?void 0:Number(F.config.port),command:Array.isArray(F.config?.command)?F.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(F.config?.expectedStatuses)?F.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:F.config?.expectedBody?String(F.config.expectedBody).slice(0,500):void 0};return b({ok:!0,check:We.createHealthCheck({projectId:a.project.id,environmentId:d?.id,resourceId:j(F.resourceId??F.resource),name:String(F.name??""),kind:Z,target:String(F.target??""),config:fe,intervalSeconds:Number(F.intervalSeconds)||60,timeoutSeconds:Number(F.timeoutSeconds)||10,failureThreshold:Number(F.failureThreshold)||3,recoveryThreshold:Number(F.recoveryThreshold)||2,regions:Array.isArray(F.regions)?F.regions.map(String):["local"],enabled:F.enabled!==!1})},201)}if(L.pathname==="/api/health/checks"&&C.method==="PATCH"){let F=await oe(C),Z=We.getHealthCheck(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,check:We.setHealthCheckEnabled(Z.id,F.enabled!==!1)})}if(L.pathname==="/api/health/checks/test"&&C.method==="POST"){let F=await oe(C),Z=We.getHealthCheck(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,productionIncidentCreated:!1,result:await new Me(We).probe(Z)})}if(L.pathname==="/api/health/checks/run"&&C.method==="POST"){let F=await oe(C),Z=We.getHealthCheck(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);let fe=await new Me(We).runAndEvaluate(Z),pe=[];for(let Ge of fe.evaluations.filter((ve)=>ve.notify&&ve.alert)){let ve=Tn.enqueue(a.organization.id,Ge.alert,Ge.transition);pe.push(...await Tn.deliverAll(ve))}return b({ok:!0,...fe,deliveries:pe})}if(L.pathname==="/api/alerts/rules"&&C.method==="GET")return b({ok:!0,rules:We.listRules(a.project.id,d?.id).filter((F)=>M(F.resourceId))});if(L.pathname==="/api/alerts/rules"&&C.method==="POST"){let F=await oe(C),Z=F.healthCheckId?We.getHealthCheck(String(F.healthCheckId)):void 0;if(F.healthCheckId&&(!Z||!M(Z.resourceId)))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,rule:We.createRule({projectId:a.project.id,environmentId:d?.id,resourceId:j(F.resourceId??F.resource)??Z?.resourceId,healthCheckId:Z?.id,name:String(F.name??""),signal:String(F.signal??(Z?"health":"")),operator:String(F.operator??(Z?"unhealthy":"gt")),threshold:F.threshold==null?void 0:Number(F.threshold),recoveryThreshold:F.recoveryThreshold==null?void 0:Number(F.recoveryThreshold),windowMs:Number(F.windowMs)||300000,consecutive:Number(F.consecutive)||Z?.failureThreshold||3,recoveryConsecutive:Number(F.recoveryConsecutive)||Z?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(F.noDataPolicy))?F.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(F.severity))?F.severity:"warning",groupBy:Array.isArray(F.groupBy)?F.groupBy.map(String):[],labels:F.labels&&typeof F.labels==="object"?F.labels:{},enabled:F.enabled!==!1})},201)}if(L.pathname==="/api/alerts/rules"&&C.method==="PATCH"){let F=await oe(C),Z=We.getRule(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert rule was not found."},404);return b({ok:!0,rule:We.setRuleEnabled(Z.id,F.enabled!==!1)})}if(L.pathname==="/api/alerts/evaluate"&&C.method==="POST")return b({ok:!0,...await hp(d?.id)});if(L.pathname==="/api/alerts"&&C.method==="GET")return b({ok:!0,alerts:We.listAlerts(a.project.id,{environmentId:d?.id,states:L.searchParams.getAll("state").length?L.searchParams.getAll("state"):void 0,limit:Number(L.searchParams.get("limit"))||200}).filter((F)=>M(F.resourceId)).map((F)=>({...F,deliveries:We.listDeliveries({alertId:F.id,limit:50})}))});if(L.pathname==="/api/alerts/action"&&C.method==="POST"){let F=await oe(C),Z=We.getAlert(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert was not found."},404);let fe=String(F.action??"");if(fe==="acknowledge")return b({ok:!0,alert:We.acknowledge(Z.id,X?.id??"")});if(fe==="assign")return b({ok:!0,alert:We.assign(Z.id,F.ownerActorId==="me"?X?.id:F.ownerActorId?String(F.ownerActorId):void 0,X?.id)});if(fe==="silence"){if(ue.role!=="admin")return b({ok:!1,error:"Silencing production alerts requires an administrator."},403);let pe=Ft.resolveSession(C);if(Pe&&(!pe||!Ie.isRecentlyAuthenticated(pe)))return b({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return b({ok:!0,alert:We.silenceAlert(Z.id,String(F.until??""),X?.id)})}return b({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(L.pathname==="/api/alerts/silences"&&C.method==="POST"){let F=await oe(C);return b({ok:!0,id:We.createSilence({projectId:a.project.id,environmentId:d?.id,resourceId:j(F.resourceId??F.resource),matcher:F.matcher,reason:String(F.reason??""),startsAt:String(F.startsAt??new Date().toISOString()),endsAt:String(F.endsAt??""),timezone:String(F.timezone??"UTC"),actorId:X?.id})},201)}if(L.pathname==="/api/notifications/channels"&&C.method==="GET")return b({ok:!0,channels:We.listChannels(a.organization.id)});if(L.pathname==="/api/notifications/channels"&&C.method==="POST"){let F=await oe(C),Z=String(F.kind??""),fe=Z==="email"?{to:F.config?.to,from:F.config?.from}:Z==="telegram"?{chatId:String(F.config?.chatId??"")}:{};return b({ok:!0,channel:We.createChannel({organizationId:a.organization.id,name:String(F.name??""),kind:Z,config:fe,credential:F.credential?String(F.credential):void 0,actorId:X?.id})},201)}if(L.pathname==="/api/notifications/channels"&&C.method==="PATCH"){let F=await oe(C),Z=String(F.id??"");if(F.credential)return b({ok:!0,channel:We.rotateChannel(Z,String(F.credential))});let fe=String(F.status??"paused");if(!["active","paused","disabled"].includes(fe))return b({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return b({ok:!0,channel:We.setChannelStatus(Z,fe)})}if(L.pathname==="/api/notifications/channels/test"&&C.method==="POST"){let F=await oe(C);return b({ok:!0,productionIncidentCreated:!1,result:await Tn.testChannel(String(F.id??""))})}if(L.pathname==="/api/notifications/routes"&&C.method==="GET")return b({ok:!0,routes:We.listRoutes(a.organization.id)});if(L.pathname==="/api/notifications/routes"&&C.method==="POST"){let F=await oe(C),Z=Array.isArray(F.channelIds)?F.channelIds.map(String):[];if(Z.some((fe)=>We.getChannel(fe)?.organizationId!==a.organization.id))return b({ok:!1,error:"Route contains an unavailable channel."},422);return b({ok:!0,route:We.createRoute({organizationId:a.organization.id,name:String(F.name??""),priority:Number(F.priority)||0,matcher:F.matcher&&typeof F.matcher==="object"?F.matcher:{},channelIds:Z,quietHours:F.quietHours,groupWaitSeconds:Number(F.groupWaitSeconds)||30,reminderSeconds:F.reminderSeconds==null?void 0:Number(F.reminderSeconds),escalation:Array.isArray(F.escalation)?F.escalation:[],template:F.template?String(F.template):void 0,rateLimitPerMinute:Number(F.rateLimitPerMinute)||60,enabled:F.enabled!==!1})},201)}if(L.pathname==="/api/notifications/routes"&&C.method==="PATCH"){let F=await oe(C),Z=We.getRoute(String(F.id??""));if(!Z||Z.organizationId!==a.organization.id)return b({ok:!1,error:"Notification route was not found."},404);return b({ok:!0,route:We.setRouteEnabled(Z.id,F.enabled!==!1)})}if(L.pathname==="/api/notifications/routes/preview"&&C.method==="POST"){let F=await oe(C),fe=(F.alertId?We.getAlert(String(F.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:a.project.id,environmentId:d?.id,resourceId:j(F.resourceId??F.resource),dedupKey:"preview",groupKey:String(F.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(F.severity))?F.severity:"warning",title:String(F.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return b({ok:!0,productionIncidentCreated:!1,matches:Tn.preview(a.organization.id,fe,String(F.eventType??"firing")).map((pe)=>({route:pe.route,channels:pe.channels,quiet:pe.quiet}))})}if(L.pathname==="/api/notifications/deliveries"&&C.method==="GET")return b({ok:!0,deliveries:We.listDeliveries({alertId:L.searchParams.get("alertId")??void 0,states:L.searchParams.getAll("state"),limit:Number(L.searchParams.get("limit"))||200})});if(L.pathname==="/api/notifications/deliveries/retry"&&C.method==="POST"){let F=await oe(C),Z=We.getDelivery(String(F.id??""));if(!Z)return b({ok:!1,error:"Delivery was not found."},404);return We.updateDelivery(Z.id,{state:"retrying",attempt:Math.max(0,Z.attempt-1),nextAttemptAt:new Date().toISOString()}),b({ok:!0,delivery:await Tn.deliver(Z.id)})}}if(L.pathname.startsWith("/api/jobs")||L.pathname.startsWith("/api/workers")){let d=a.environments.get(Se),p=a.store.listResources(a.project.id,d?.id),M=ue.role==="admin"||!!d&&la(ue,d.id,"automation:read")?p:p.filter((we)=>Sr(ue,we.id,"automation:read")),j=(we)=>!we||M.some((Ae)=>Ae.id===we),X=Be(ue).actor,F=W.get(Se)??N,Z=jr(o,F),fe=Z.filter((we)=>!we.danger&&["scheduler","backup","worker"].includes(we.group)),pe=H(o),Ge=()=>{let we=Ft.resolveSession(C);return!Pe||!!we&&Ie.isRecentlyAuthenticated(we)},ve=(we)=>{if(!we||typeof we!=="object"||Array.isArray(we))return{};let Ae=Object.entries(we).slice(0,50);if(Ae.some(([,et])=>typeof et!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(et)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(Ae)},je=(we,Ae,et)=>a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,resourceId:et,actorId:X?.id,type:`job.${we}`,payload:Ae});if(L.pathname==="/api/jobs/preview"&&C.method==="POST"){let we=await oe(C);try{return b({ok:!0,productionExecutionCreated:!1,preview:ct(String(we.expression??""),String(we.timezone??"UTC"),new Date(we.from?String(we.from):Date.now()),Number(we.count)||5)})}catch(Ae){return b({ok:!1,error:Ae instanceof Error?Ae.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(L.pathname==="/api/jobs"&&C.method==="GET")return b({ok:!0,jobs:br.list(a.project.id,{environmentId:d?.id}).filter((we)=>j(we.resourceId)).map((we)=>({...we,preview:ct(we.normalizedExpression,we.timezone,new Date,5),capability:Yn(we),lastExecution:br.listExecutions(we.id,1)[0]}))});if(L.pathname==="/api/jobs"&&C.method==="POST"){let we=await oe(C),Ae=String(we.provider??(pe==="serverless"?"eventbridge":"server")),et=pe==="serverless"?"eventbridge":"server";if(Ae!==et)return b({ok:!1,error:`${pe} environments accept ${et} schedules through this adapter.`},422);let ut=we.operationId?String(we.operationId):void 0;if(Ae==="server"&&(!ut||!fe.some((Xt)=>Xt.id===ut)))return b({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let St=Yn({provider:Ae,expression:String(we.expression??""),flexibleMinutes:Number(we.flexibleMinutes)||0,missedRunPolicy:we.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(we.overlapPolicy))?we.overlapPolicy:"forbid"});if(!St.supported)return b({ok:!1,error:St.notes.join(" ")},422);let bn=we.resourceId?p.find((Xt)=>Xt.id===we.resourceId||Xt.slug===we.resourceId):void 0;if(we.resourceId&&(!bn||!j(bn.id)))return b({ok:!1,error:"Job resource was not found."},404);try{let Xt=Ae==="server"?{kind:"dashboard_operation",operationId:ut}:{kind:"serverless_scheduler",action:"run"},yo=br.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:bn?.id,name:String(we.name??""),provider:Ae,expression:String(we.expression??""),timezone:String(we.timezone??"UTC"),startsAt:we.startsAt?String(we.startsAt):void 0,endsAt:we.endsAt?String(we.endsAt):void 0,flexibleMinutes:Number(we.flexibleMinutes)||0,target:Xt,payloadRefs:ve(we.payloadRefs),missedRunPolicy:we.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(we.overlapPolicy))?we.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(we.maxAttempts)||3,backoffSeconds:Number(we.backoffSeconds)||30,deadLetterRef:we.deadLetterRef?String(we.deadLetterRef):void 0},timeoutSeconds:Number(we.timeoutSeconds)||900,enabled:we.enabled!==!1,origin:"managed",ownerActorId:X?.id,observedState:{},reconciliationStatus:"pending"});return je("created",{jobId:yo.id,provider:yo.provider,expression:yo.normalizedExpression},yo.resourceId),b({ok:!0,job:yo,capability:St},201)}catch(Xt){return b({ok:!1,error:Xt instanceof Error?Xt.message:"Scheduled job could not be created."},422)}}if(L.pathname==="/api/jobs"&&C.method==="PATCH"){let we=await oe(C),Ae=br.get(String(we.id??""));if(!Ae||!j(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);if(Ae.origin==="config")return b({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let et=we.missedRunPolicy==null?void 0:String(we.missedRunPolicy),ut=we.overlapPolicy==null?void 0:String(we.overlapPolicy);if(et&&!["skip","catch_up"].includes(et))return b({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ut&&!["allow","forbid","replace"].includes(ut))return b({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let St=br.updateSchedule(Ae.id,{expression:we.expression?String(we.expression):void 0,timezone:we.timezone?String(we.timezone):void 0,missedRunPolicy:et,overlapPolicy:ut,timeoutSeconds:we.timeoutSeconds==null?void 0:Number(we.timeoutSeconds)});return je("updated",{jobId:St.id,expression:St.normalizedExpression,version:St.version},St.resourceId),b({ok:!0,job:St})}catch(St){return b({ok:!1,error:St instanceof Error?St.message:"Scheduled job could not be updated."},422)}}if(L.pathname==="/api/jobs/action"&&C.method==="POST"){let we=await oe(C),Ae=br.get(String(we.id??""));if(!Ae||!j(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);let et=String(we.action??"");if(et==="run"){let ut=fp.enqueue(Ae,{trigger:"manual",actorId:X?.id});return je("run_queued",{jobId:Ae.id,executionId:ut.id},Ae.resourceId),b({ok:!0,execution:ut},202)}if(["disable","delete"].includes(et)&&d?.kind==="production"){if(String(we.confirm??"")!==et)return b({ok:!1,error:`Type "${et}" to confirm this production change.`},409);if(!Ge())return b({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(et==="enable"||et==="disable"){let ut=br.setEnabled(Ae.id,et==="enable");return je(et==="enable"?"enabled":"disabled",{jobId:Ae.id},Ae.resourceId),b({ok:!0,job:ut})}if(et==="delete")try{return br.remove(Ae.id),je("deleted",{jobId:Ae.id,name:Ae.name},Ae.resourceId),b({ok:!0,deleted:Ae.id})}catch(ut){return b({ok:!1,error:ut instanceof Error?ut.message:"Scheduled job could not be deleted."},409)}return b({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(L.pathname==="/api/jobs/history"&&C.method==="GET"){let we=br.get(String(L.searchParams.get("jobId")??""));if(!we||!j(we.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);return b({ok:!0,executions:br.listExecutions(we.id,Number(L.searchParams.get("limit"))||100).map((Ae)=>({...Ae,logs:Ae.operationId?At.logs(Ae.operationId,{limit:500}):[]}))})}if(L.pathname==="/api/jobs/reconcile"&&C.method==="POST"){if(!d)return b({ok:!1,error:"Environment was not found."},404);let we=Gr(br,o,{organization:a.organization,project:a.project,environment:d,resources:p});return je("reconciled",we),b({ok:!0,reconciliation:we})}if(L.pathname==="/api/workers"&&C.method==="GET"){let we=Array.isArray(F.workersDetail??F.workers)?F.workersDetail??F.workers:[];return b({ok:!0,workers:br.listWorkers(a.project.id,d?.id).filter((Ae)=>j(Ae.resourceId)).map((Ae)=>{let et=we.find((ut)=>ut.name===Ae.name||ut.site===Ae.target.site);return et?{...Ae,observedState:{...Ae.observedState,status:et.status??"configured",currentJob:et.currentJob??null,failures:Number(et.failed??et.failures)||0,processed:Number(et.processed)||0}}:Ae})})}if(L.pathname==="/api/workers/action"&&C.method==="POST"){let we=await oe(C),Ae=br.getWorker(String(we.id??""));if(!Ae||!j(Ae.resourceId))return b({ok:!1,error:"Worker was not found."},404);let et=String(we.action??"");if(et==="restart"){if(String(we.confirm??"")!==Ae.name)return b({ok:!1,error:`Type "${Ae.name}" to restart this worker.`},409);let ut=Z.find((Xt)=>Xt.id===Ae.target.operationId);if(!ut)return b({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let St=await Vr(o,Se,ut),bn=br.reconcileWorker(Ae.id,St.ok?"in_sync":"unavailable",{...Ae.observedState,lastRestartAt:new Date().toISOString(),command:St.command??null,error:St.error??St.stderr??null});return je("worker_restarted",{workerId:Ae.id,ok:St.ok},Ae.resourceId),b({...St,worker:bn},St.ok?200:409)}if(et==="scale")return b({ok:!1,error:Ae.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return b({ok:!1,error:"Action must be restart or scale."},422)}}if(L.pathname.startsWith("/api/telemetry/")){let d=a.environments.get(Se),p=new Qe(a.store),R=a.store.listResources(a.project.id,d?.id),M=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(L.pathname)?"runtime:logs":"runtime:read",j=ue.role==="admin"||!!d&&la(ue,d.id,M),X=j?R:R.filter((ve)=>Sr(ue,ve.id,M)),F=(ve)=>Zy(X,j,ve),Z=(ve)=>{let je=new Date,we={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},Ae=String(ve.to??je.toISOString()),et=String(ve.from??new Date(new Date(Ae).getTime()-(we[String(ve.range??"1h")]??we["1h"])).toISOString()),ut=(bn)=>{let Xt=(Array.isArray(bn)?bn:String(bn??"").split(",")).map(String).filter(Boolean);return Xt.length?Xt:void 0},St=ut(ve.kinds)?.filter((bn)=>["metric","log","trace","request","event"].includes(bn));return{projectId:a.project.id,environmentId:d?.id,resourceIds:F(ve.resources),kinds:St,names:ut(ve.names),sources:ut(ve.sources),levels:ut(ve.levels),from:et,to:Ae,text:String(ve.text??"")||void 0,traceId:String(ve.traceId??"")||void 0,requestId:String(ve.requestId??"")||void 0,deploymentId:String(ve.deploymentId??"")||void 0,releaseId:String(ve.releaseId??"")||void 0,workloadId:String(ve.workloadId??"")||void 0,cursor:String(ve.cursor??"")||void 0,limit:Number(ve.limit)||void 0}},fe=Object.fromEntries(L.searchParams.entries()),pe=(ve=!1)=>ri({controlPlane:a.store,projectId:a.project.id,environmentId:d?.id,config:o,environment:Se,force:ve,lightweight:!ve}),Ge=()=>{let ve=a.store.getSetting(`telemetry.collection:${a.project.id}:${d?.id??"all"}`)??{};return{generatedAt:String(ve.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(ve.statuses)?ve.statuses:[],errors:Array.isArray(ve.errors)?ve.errors:[],policy:ve.policy??Xe(a.store,a.project.id)}};if(L.pathname==="/api/telemetry/status"&&C.method==="GET"){pe(!1);let ve=Ge(),je=j?ve.statuses:p.status(a.project.id,d?.id,ve.policy.rawDays,ve.policy.samplingRate,X.map((Ae)=>Ae.id)),we=je.reduce((Ae,et)=>Ae+et.estimatedDailyBytes*30,0);return b({ok:!0,generatedAt:ve.generatedAt,cached:ve.cached,sources:je,errors:j?ve.errors:[],policy:ve.policy,retention:{rawDays:ve.policy.rawDays,downsampleAfterDays:ve.policy.downsampleAfterDays,downsampleBucketMs:ve.policy.downsampleBucketMs,maxRecords:ve.policy.maxRecords},estimatedMonthlyBytes:we,estimatedMonthlyCostUsd:mi(we,ve.policy),costEstimateConfigured:ve.policy.estimatedStorageUsdPerGbMonth>0})}if(L.pathname==="/api/telemetry/settings"&&C.method==="GET")return b({ok:!0,policy:Xe(a.store,a.project.id)});if(L.pathname==="/api/telemetry/settings"&&C.method==="PATCH"){let ve=pi(a.store,a.project.id,await oe(C));return sb(a.project.id),b({ok:!0,policy:ve})}if(L.pathname==="/api/telemetry/query"&&C.method==="GET"){pe(!1);let ve=Ge();return b({ok:!0,collection:{generatedAt:ve.generatedAt,cached:ve.cached},...p.query(Z(fe))})}if(L.pathname==="/api/telemetry/tail"&&C.method==="GET"){pe(!1);let ve=new TextEncoder,je=new Date,we=Z({...fe,kinds:fe.kinds||"log,request,event,trace",from:fe.from||new Date(je.getTime()-120000).toISOString(),to:je.toISOString(),limit:Math.min(1000,Number(fe.limit)||200),cursor:void 0}),Ae=C.headers.get("last-event-id")||String(fe.cursor??"")||void 0,et,ut=!1,St=!1,bn=new ReadableStream({start(Xt){let yo=()=>{if(ut)return;if(ut=!0,et)clearInterval(et);C.signal.removeEventListener("abort",yo);try{Xt.close()}catch{}},Rp=async()=>{if(ut||St)return;St=!0;try{let qo=p.tail({...we,to:new Date(Date.now()+1000).toISOString()},Ae);for(let Pp of qo.records)Ae=ts(Pp)??Ae,Xt.enqueue(ve.encode(`id: ${Ae??""}
+`,"system"),Z.stdout)Yt.append(F.id,Z.stdout,"stdout");if(Z.stderr)Yt.append(F.id,Z.stderr,"stderr");Yt.close(F.id,Z.ok?"complete":"failed",Z.error)}).catch((Z)=>{let fe=Z instanceof Error?Z.message:String(Z);Yt.append(F.id,fe,"stderr"),Yt.close(F.id,"failed",fe)}),b({ok:!0,session:F,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(F.id)}&workload=${encodeURIComponent(p)}`},202)}if(L.pathname==="/api/runtime/files/read"&&C.method==="POST"){let d=await oe(C),p=await Ii(o,Se),R=Ft.resolveSession(C),M=await new be(o,Se,{inventory:async()=>p}).readFile({workloadId:String(d.workloadId??""),path:String(d.path??""),confirm:String(d.confirm??""),recentAuth:!Pe||!!R&&Ie.isRecentlyAuthenticated(R)});return b(M,M.ok?200:409)}if(L.pathname==="/api/runtime/files/write"&&C.method==="POST"){let d=await oe(C),p=await Ii(o,Se),R=String(d.workloadId??""),M=p.workloads.find((Z)=>Z.id===R);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let j=Ft.resolveSession(C),X=new be(o,Se,{inventory:async()=>p}),F=await oo({controlPlane:a,environment:Se,actor:ue,kind:"runtime.file.write",resourceSlug:M.links.service,input:{workloadId:R,provider:M.provider,path:String(d.path??""),bytes:Buffer.from(String(d.contentBase64??""),"base64").byteLength},execute:()=>X.writeFile({workloadId:R,path:String(d.path??""),contentBase64:String(d.contentBase64??""),confirm:String(d.confirm??""),recentAuth:!Pe||!!j&&Ie.isRecentlyAuthenticated(j)})});return b({...F.result,controlPlaneOperation:F.operation},F.result.ok?200:409)}if(L.pathname==="/api/runtime/operations"&&C.method==="POST"){let d=await oe(C),p=String(d.workloadId??""),R=String(d.action??"");if(!p||!["start","stop","restart","redeploy","scale","inspect"].includes(R))return b({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let M=await Ii(o,Se),j=M.workloads.find((fe)=>fe.id===p);if(!j)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let X=Ft.resolveSession(C),F=new be(o,Se,{inventory:async()=>M}),Z=await oo({controlPlane:a,environment:Se,actor:ue,kind:`runtime.${R}`,resourceSlug:j.links.service,input:{workloadId:p,provider:j.provider,action:R,replicas:d.replicas==null?null:Number(d.replicas)},execute:()=>F.run({workloadId:p,action:R,replicas:d.replicas==null?void 0:Number(d.replicas),confirm:String(d.confirm??""),recentAuth:!Pe||!!X&&Ie.isRecentlyAuthenticated(X)})});return b({...Z.result,controlPlaneOperation:Z.operation},Z.result.ok?200:409)}if(L.pathname.startsWith("/api/protection")){let d=ue.role==="admin"||Ja(ue,"security:read"),p=ue.role==="admin"||Ja(ue,"security:manage");if(!d)return b({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:R,describePosture:M}=await import("./chunk-gjadvs6y.js"),j=new R(a.store),X=()=>{if(!p)throw Error("Changing protection controls requires security:manage.")};if(L.pathname==="/api/protection"&&C.method==="GET"){let F=j.current();return b({ok:!0,posture:M(F),controls:F,raw:j.raw()})}if(L.pathname==="/api/protection/attack-mode"&&C.method==="POST"){X();let F=await oe(C);if(F.enabled===!1)return b({ok:!0,disabled:j.disableAttackMode()});return b({ok:!0,control:j.enableAttackMode({hours:F.hours==null?void 0:Number(F.hours),reason:String(F.reason??"Enabled from the dashboard."),actorId:Be(ue).actor?.id})})}if(L.pathname==="/api/protection/pause"&&C.method==="POST"){X();let F=await oe(C);if(F.enabled===!1)return b({ok:!0,resumed:j.resumeMitigations()});return b({ok:!0,control:j.pauseMitigations({hours:F.hours==null?void 0:Number(F.hours),reason:String(F.reason??""),actorId:Be(ue).actor?.id})})}if(L.pathname==="/api/protection/ip-rules"&&C.method==="GET")return b({ok:!0,ipRules:j.current().ipRules});if(L.pathname==="/api/protection/ip-rules"&&(C.method==="POST"||C.method==="DELETE")){X();let F=await oe(C),Z=F.list==="allow"?"allow":"block",fe=C.method==="POST"?j.addIpRule(Z,String(F.cidr??"")):j.removeIpRule(Z,String(F.cidr??""));return b({ok:!0,ipRules:fe})}return b({ok:!1,error:"Protection endpoint was not found."},404)}if(L.pathname.startsWith("/api/spend/")||L.pathname==="/api/usage"){let d=await Ab(),{store:p,service:R,gate:M}=d,j=ue.role==="admin"||Ja(ue,"billing:read"),X=ue.role==="admin"||Ja(ue,"billing:manage");if(!j)return b({ok:!1,error:"Spend data requires the billing:read capability."},403);let F=a.environments.get(Se),Z={organizationId:a.organization.id,projectId:a.project.id,environmentId:F?.id},fe=()=>{if(!X)throw Error("Changing a budget requires the billing:manage capability.")};if(L.pathname==="/api/usage"&&C.method==="GET")return b({ok:!0,...R.usageReport({organizationId:Z.organizationId,projectId:Z.projectId,period:L.searchParams.get("period")??"monthly",timezone:L.searchParams.get("timezone")??void 0})});if(L.pathname==="/api/spend/budgets"&&C.method==="GET")return b({ok:!0,budgets:p.listBudgets({organizationId:Z.organizationId,projectId:Z.projectId}).map((pe)=>({...pe,status:R.status(pe)}))});if(L.pathname==="/api/spend/budgets"&&C.method==="POST"){fe();let pe=await oe(C),Ge=String(pe.scope??"project"),ve=p.createBudget({organizationId:Z.organizationId,projectId:Ge==="organization"?void 0:Z.projectId,environmentId:Ge==="environment"?Z.environmentId:void 0,name:String(pe.name??"").trim(),period:pe.period??"monthly",timezone:pe.timezone?String(pe.timezone):void 0,softLimitCents:pe.softLimitCents==null?void 0:Math.round(Number(pe.softLimitCents)),hardLimitCents:pe.hardLimitCents==null?void 0:Math.round(Number(pe.hardLimitCents)),graceSeconds:pe.graceSeconds==null?void 0:Number(pe.graceSeconds),dryRun:pe.dryRun!==!1});return b({ok:!0,budget:ve})}if(L.pathname==="/api/spend/budgets"&&C.method==="PATCH"){fe();let pe=await oe(C),Ge=String(pe.id??""),ve=p.getBudget(Ge);if(!ve||ve.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);return b({ok:!0,budget:p.updateBudget(Ge,{softLimitCents:pe.softLimitCents==null?ve.softLimitCents:Math.round(Number(pe.softLimitCents)),hardLimitCents:pe.hardLimitCents==null?ve.hardLimitCents:Math.round(Number(pe.hardLimitCents)),enabled:pe.enabled==null?ve.enabled:pe.enabled===!0,dryRun:pe.dryRun==null?ve.dryRun:pe.dryRun===!0},pe.expectedVersion==null?void 0:Number(pe.expectedVersion))})}if(L.pathname==="/api/spend/budgets"&&C.method==="DELETE"){fe();let pe=await oe(C),Ge=String(pe.id??""),ve=p.getBudget(Ge);if(!ve||ve.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);let je=M.closeBudget(Ge);return p.deleteBudget(Ge),b({ok:!0,deleted:!0,lifted:je})}if(L.pathname==="/api/spend/check"&&C.method==="POST"){fe();let pe=await oe(C),{SpendRunner:Ge}=await import("./chunk-xpzkwgb4.js"),ve=new Ge({controlPlane:a.store,store:p,alerts:We});if(pe.apply!==!0){let we=p.budgetsForScope(Z.organizationId,Z.projectId,Z.environmentId);return b({ok:!0,applied:!1,preview:we.map((Ae)=>R.status(Ae))})}let je=await ve.run({...Z,environmentKind:F?.kind});return b({ok:!0,applied:!0,result:je})}if(L.pathname==="/api/spend/enforcement"&&C.method==="GET")return b({ok:!0,enforcement:M.listUnder({organizationId:Z.organizationId})});if(L.pathname==="/api/spend/release"&&C.method==="POST"){fe();let pe=await oe(C),Ge=M.close(String(pe.budgetId??""),pe.action);return b({ok:Ge,released:Ge,note:Ge?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(L.pathname==="/api/spend/anomalies"&&C.method==="GET")return b({ok:!0,anomalies:p.listAnomalies({organizationId:Z.organizationId,projectId:Z.projectId,unacknowledgedOnly:L.searchParams.get("unacknowledged")==="true"})});if(L.pathname==="/api/spend/anomalies/acknowledge"&&C.method==="POST"){fe();let pe=await oe(C);return b({ok:!0,acknowledged:p.acknowledgeAnomaly(String(pe.id??""))})}return b({ok:!1,error:"Spend endpoint was not found."},404)}if(L.pathname.startsWith("/api/health/")||L.pathname.startsWith("/api/alerts")||L.pathname.startsWith("/api/notifications/")){let d=a.environments.get(Se),p=a.store.listResources(a.project.id,d?.id),R=ue.role==="admin"||!!d&&la(ue,d.id,"runtime:read")?p:p.filter((F)=>Sr(ue,F.id,"runtime:read")),M=(F)=>!F||R.some((Z)=>Z.id===F),j=(F)=>{if(!F)return;let Z=p.find((fe)=>fe.id===F||fe.slug===F);if(!Z)throw Error("Alert resource was not found.");if(!M(Z.id))throw Error("Alert resource is outside your authorized scope.");return Z.id},X=Be(ue).actor;if(L.pathname==="/api/health/checks"&&C.method==="GET")return b({ok:!0,checks:We.listHealthChecks(a.project.id,d?.id).filter((F)=>M(F.resourceId)).map((F)=>({...F,results:We.listHealthResults(F.id,20)}))});if(L.pathname==="/api/health/checks"&&C.method==="POST"){let F=await oe(C),Z=String(F.kind??"http");if(Z==="command"&&ue.role!=="admin")return b({ok:!1,error:"Command health checks require an administrator."},403);let fe={method:String(F.config?.method??"GET").toUpperCase().slice(0,10),path:F.config?.path?String(F.config.path).slice(0,500):void 0,port:F.config?.port==null?void 0:Number(F.config.port),command:Array.isArray(F.config?.command)?F.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(F.config?.expectedStatuses)?F.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:F.config?.expectedBody?String(F.config.expectedBody).slice(0,500):void 0};return b({ok:!0,check:We.createHealthCheck({projectId:a.project.id,environmentId:d?.id,resourceId:j(F.resourceId??F.resource),name:String(F.name??""),kind:Z,target:String(F.target??""),config:fe,intervalSeconds:Number(F.intervalSeconds)||60,timeoutSeconds:Number(F.timeoutSeconds)||10,failureThreshold:Number(F.failureThreshold)||3,recoveryThreshold:Number(F.recoveryThreshold)||2,regions:Array.isArray(F.regions)?F.regions.map(String):["local"],enabled:F.enabled!==!1})},201)}if(L.pathname==="/api/health/checks"&&C.method==="PATCH"){let F=await oe(C),Z=We.getHealthCheck(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,check:We.setHealthCheckEnabled(Z.id,F.enabled!==!1)})}if(L.pathname==="/api/health/checks/test"&&C.method==="POST"){let F=await oe(C),Z=We.getHealthCheck(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,productionIncidentCreated:!1,result:await new Me(We).probe(Z)})}if(L.pathname==="/api/health/checks/run"&&C.method==="POST"){let F=await oe(C),Z=We.getHealthCheck(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);let fe=await new Me(We).runAndEvaluate(Z),pe=[];for(let Ge of fe.evaluations.filter((ve)=>ve.notify&&ve.alert)){let ve=Tn.enqueue(a.organization.id,Ge.alert,Ge.transition);pe.push(...await Tn.deliverAll(ve))}return b({ok:!0,...fe,deliveries:pe})}if(L.pathname==="/api/alerts/rules"&&C.method==="GET")return b({ok:!0,rules:We.listRules(a.project.id,d?.id).filter((F)=>M(F.resourceId))});if(L.pathname==="/api/alerts/rules"&&C.method==="POST"){let F=await oe(C),Z=F.healthCheckId?We.getHealthCheck(String(F.healthCheckId)):void 0;if(F.healthCheckId&&(!Z||!M(Z.resourceId)))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,rule:We.createRule({projectId:a.project.id,environmentId:d?.id,resourceId:j(F.resourceId??F.resource)??Z?.resourceId,healthCheckId:Z?.id,name:String(F.name??""),signal:String(F.signal??(Z?"health":"")),operator:String(F.operator??(Z?"unhealthy":"gt")),threshold:F.threshold==null?void 0:Number(F.threshold),recoveryThreshold:F.recoveryThreshold==null?void 0:Number(F.recoveryThreshold),windowMs:Number(F.windowMs)||300000,consecutive:Number(F.consecutive)||Z?.failureThreshold||3,recoveryConsecutive:Number(F.recoveryConsecutive)||Z?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(F.noDataPolicy))?F.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(F.severity))?F.severity:"warning",groupBy:Array.isArray(F.groupBy)?F.groupBy.map(String):[],labels:F.labels&&typeof F.labels==="object"?F.labels:{},enabled:F.enabled!==!1})},201)}if(L.pathname==="/api/alerts/rules"&&C.method==="PATCH"){let F=await oe(C),Z=We.getRule(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert rule was not found."},404);return b({ok:!0,rule:We.setRuleEnabled(Z.id,F.enabled!==!1)})}if(L.pathname==="/api/alerts/evaluate"&&C.method==="POST")return b({ok:!0,...await hp(d?.id)});if(L.pathname==="/api/alerts"&&C.method==="GET")return b({ok:!0,alerts:We.listAlerts(a.project.id,{environmentId:d?.id,states:L.searchParams.getAll("state").length?L.searchParams.getAll("state"):void 0,limit:Number(L.searchParams.get("limit"))||200}).filter((F)=>M(F.resourceId)).map((F)=>({...F,deliveries:We.listDeliveries({alertId:F.id,limit:50})}))});if(L.pathname==="/api/alerts/action"&&C.method==="POST"){let F=await oe(C),Z=We.getAlert(String(F.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert was not found."},404);let fe=String(F.action??"");if(fe==="acknowledge")return b({ok:!0,alert:We.acknowledge(Z.id,X?.id??"")});if(fe==="assign")return b({ok:!0,alert:We.assign(Z.id,F.ownerActorId==="me"?X?.id:F.ownerActorId?String(F.ownerActorId):void 0,X?.id)});if(fe==="silence"){if(ue.role!=="admin")return b({ok:!1,error:"Silencing production alerts requires an administrator."},403);let pe=Ft.resolveSession(C);if(Pe&&(!pe||!Ie.isRecentlyAuthenticated(pe)))return b({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return b({ok:!0,alert:We.silenceAlert(Z.id,String(F.until??""),X?.id)})}return b({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(L.pathname==="/api/alerts/silences"&&C.method==="POST"){let F=await oe(C);return b({ok:!0,id:We.createSilence({projectId:a.project.id,environmentId:d?.id,resourceId:j(F.resourceId??F.resource),matcher:F.matcher,reason:String(F.reason??""),startsAt:String(F.startsAt??new Date().toISOString()),endsAt:String(F.endsAt??""),timezone:String(F.timezone??"UTC"),actorId:X?.id})},201)}if(L.pathname==="/api/notifications/channels"&&C.method==="GET")return b({ok:!0,channels:We.listChannels(a.organization.id)});if(L.pathname==="/api/notifications/channels"&&C.method==="POST"){let F=await oe(C),Z=String(F.kind??""),fe=Z==="email"?{to:F.config?.to,from:F.config?.from}:Z==="telegram"?{chatId:String(F.config?.chatId??"")}:{};return b({ok:!0,channel:We.createChannel({organizationId:a.organization.id,name:String(F.name??""),kind:Z,config:fe,credential:F.credential?String(F.credential):void 0,actorId:X?.id})},201)}if(L.pathname==="/api/notifications/channels"&&C.method==="PATCH"){let F=await oe(C),Z=String(F.id??"");if(F.credential)return b({ok:!0,channel:We.rotateChannel(Z,String(F.credential))});let fe=String(F.status??"paused");if(!["active","paused","disabled"].includes(fe))return b({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return b({ok:!0,channel:We.setChannelStatus(Z,fe)})}if(L.pathname==="/api/notifications/channels/test"&&C.method==="POST"){let F=await oe(C);return b({ok:!0,productionIncidentCreated:!1,result:await Tn.testChannel(String(F.id??""))})}if(L.pathname==="/api/notifications/routes"&&C.method==="GET")return b({ok:!0,routes:We.listRoutes(a.organization.id)});if(L.pathname==="/api/notifications/routes"&&C.method==="POST"){let F=await oe(C),Z=Array.isArray(F.channelIds)?F.channelIds.map(String):[];if(Z.some((fe)=>We.getChannel(fe)?.organizationId!==a.organization.id))return b({ok:!1,error:"Route contains an unavailable channel."},422);return b({ok:!0,route:We.createRoute({organizationId:a.organization.id,name:String(F.name??""),priority:Number(F.priority)||0,matcher:F.matcher&&typeof F.matcher==="object"?F.matcher:{},channelIds:Z,quietHours:F.quietHours,groupWaitSeconds:Number(F.groupWaitSeconds)||30,reminderSeconds:F.reminderSeconds==null?void 0:Number(F.reminderSeconds),escalation:Array.isArray(F.escalation)?F.escalation:[],template:F.template?String(F.template):void 0,rateLimitPerMinute:Number(F.rateLimitPerMinute)||60,enabled:F.enabled!==!1})},201)}if(L.pathname==="/api/notifications/routes"&&C.method==="PATCH"){let F=await oe(C),Z=We.getRoute(String(F.id??""));if(!Z||Z.organizationId!==a.organization.id)return b({ok:!1,error:"Notification route was not found."},404);return b({ok:!0,route:We.setRouteEnabled(Z.id,F.enabled!==!1)})}if(L.pathname==="/api/notifications/routes/preview"&&C.method==="POST"){let F=await oe(C),fe=(F.alertId?We.getAlert(String(F.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:a.project.id,environmentId:d?.id,resourceId:j(F.resourceId??F.resource),dedupKey:"preview",groupKey:String(F.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(F.severity))?F.severity:"warning",title:String(F.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return b({ok:!0,productionIncidentCreated:!1,matches:Tn.preview(a.organization.id,fe,String(F.eventType??"firing")).map((pe)=>({route:pe.route,channels:pe.channels,quiet:pe.quiet}))})}if(L.pathname==="/api/notifications/deliveries"&&C.method==="GET")return b({ok:!0,deliveries:We.listDeliveries({alertId:L.searchParams.get("alertId")??void 0,states:L.searchParams.getAll("state"),limit:Number(L.searchParams.get("limit"))||200})});if(L.pathname==="/api/notifications/deliveries/retry"&&C.method==="POST"){let F=await oe(C),Z=We.getDelivery(String(F.id??""));if(!Z)return b({ok:!1,error:"Delivery was not found."},404);return We.updateDelivery(Z.id,{state:"retrying",attempt:Math.max(0,Z.attempt-1),nextAttemptAt:new Date().toISOString()}),b({ok:!0,delivery:await Tn.deliver(Z.id)})}}if(L.pathname.startsWith("/api/jobs")||L.pathname.startsWith("/api/workers")){let d=a.environments.get(Se),p=a.store.listResources(a.project.id,d?.id),M=ue.role==="admin"||!!d&&la(ue,d.id,"automation:read")?p:p.filter((we)=>Sr(ue,we.id,"automation:read")),j=(we)=>!we||M.some((Ae)=>Ae.id===we),X=Be(ue).actor,F=W.get(Se)??N,Z=jr(o,F),fe=Z.filter((we)=>!we.danger&&["scheduler","backup","worker"].includes(we.group)),pe=H(o),Ge=()=>{let we=Ft.resolveSession(C);return!Pe||!!we&&Ie.isRecentlyAuthenticated(we)},ve=(we)=>{if(!we||typeof we!=="object"||Array.isArray(we))return{};let Ae=Object.entries(we).slice(0,50);if(Ae.some(([,et])=>typeof et!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(et)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(Ae)},je=(we,Ae,et)=>a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,resourceId:et,actorId:X?.id,type:`job.${we}`,payload:Ae});if(L.pathname==="/api/jobs/preview"&&C.method==="POST"){let we=await oe(C);try{return b({ok:!0,productionExecutionCreated:!1,preview:ct(String(we.expression??""),String(we.timezone??"UTC"),new Date(we.from?String(we.from):Date.now()),Number(we.count)||5)})}catch(Ae){return b({ok:!1,error:Ae instanceof Error?Ae.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(L.pathname==="/api/jobs"&&C.method==="GET")return b({ok:!0,jobs:br.list(a.project.id,{environmentId:d?.id}).filter((we)=>j(we.resourceId)).map((we)=>({...we,preview:ct(we.normalizedExpression,we.timezone,new Date,5),capability:Yn(we),lastExecution:br.listExecutions(we.id,1)[0]}))});if(L.pathname==="/api/jobs"&&C.method==="POST"){let we=await oe(C),Ae=String(we.provider??(pe==="serverless"?"eventbridge":"server")),et=pe==="serverless"?"eventbridge":"server";if(Ae!==et)return b({ok:!1,error:`${pe} environments accept ${et} schedules through this adapter.`},422);let ut=we.operationId?String(we.operationId):void 0;if(Ae==="server"&&(!ut||!fe.some((Xt)=>Xt.id===ut)))return b({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let St=Yn({provider:Ae,expression:String(we.expression??""),flexibleMinutes:Number(we.flexibleMinutes)||0,missedRunPolicy:we.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(we.overlapPolicy))?we.overlapPolicy:"forbid"});if(!St.supported)return b({ok:!1,error:St.notes.join(" ")},422);let bn=we.resourceId?p.find((Xt)=>Xt.id===we.resourceId||Xt.slug===we.resourceId):void 0;if(we.resourceId&&(!bn||!j(bn.id)))return b({ok:!1,error:"Job resource was not found."},404);try{let Xt=Ae==="server"?{kind:"dashboard_operation",operationId:ut}:{kind:"serverless_scheduler",action:"run"},yo=br.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:bn?.id,name:String(we.name??""),provider:Ae,expression:String(we.expression??""),timezone:String(we.timezone??"UTC"),startsAt:we.startsAt?String(we.startsAt):void 0,endsAt:we.endsAt?String(we.endsAt):void 0,flexibleMinutes:Number(we.flexibleMinutes)||0,target:Xt,payloadRefs:ve(we.payloadRefs),missedRunPolicy:we.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(we.overlapPolicy))?we.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(we.maxAttempts)||3,backoffSeconds:Number(we.backoffSeconds)||30,deadLetterRef:we.deadLetterRef?String(we.deadLetterRef):void 0},timeoutSeconds:Number(we.timeoutSeconds)||900,enabled:we.enabled!==!1,origin:"managed",ownerActorId:X?.id,observedState:{},reconciliationStatus:"pending"});return je("created",{jobId:yo.id,provider:yo.provider,expression:yo.normalizedExpression},yo.resourceId),b({ok:!0,job:yo,capability:St},201)}catch(Xt){return b({ok:!1,error:Xt instanceof Error?Xt.message:"Scheduled job could not be created."},422)}}if(L.pathname==="/api/jobs"&&C.method==="PATCH"){let we=await oe(C),Ae=br.get(String(we.id??""));if(!Ae||!j(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);if(Ae.origin==="config")return b({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let et=we.missedRunPolicy==null?void 0:String(we.missedRunPolicy),ut=we.overlapPolicy==null?void 0:String(we.overlapPolicy);if(et&&!["skip","catch_up"].includes(et))return b({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ut&&!["allow","forbid","replace"].includes(ut))return b({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let St=br.updateSchedule(Ae.id,{expression:we.expression?String(we.expression):void 0,timezone:we.timezone?String(we.timezone):void 0,missedRunPolicy:et,overlapPolicy:ut,timeoutSeconds:we.timeoutSeconds==null?void 0:Number(we.timeoutSeconds)});return je("updated",{jobId:St.id,expression:St.normalizedExpression,version:St.version},St.resourceId),b({ok:!0,job:St})}catch(St){return b({ok:!1,error:St instanceof Error?St.message:"Scheduled job could not be updated."},422)}}if(L.pathname==="/api/jobs/action"&&C.method==="POST"){let we=await oe(C),Ae=br.get(String(we.id??""));if(!Ae||!j(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);let et=String(we.action??"");if(et==="run"){let ut=fp.enqueue(Ae,{trigger:"manual",actorId:X?.id});return je("run_queued",{jobId:Ae.id,executionId:ut.id},Ae.resourceId),b({ok:!0,execution:ut},202)}if(["disable","delete"].includes(et)&&d?.kind==="production"){if(String(we.confirm??"")!==et)return b({ok:!1,error:`Type "${et}" to confirm this production change.`},409);if(!Ge())return b({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(et==="enable"||et==="disable"){let ut=br.setEnabled(Ae.id,et==="enable");return je(et==="enable"?"enabled":"disabled",{jobId:Ae.id},Ae.resourceId),b({ok:!0,job:ut})}if(et==="delete")try{return br.remove(Ae.id),je("deleted",{jobId:Ae.id,name:Ae.name},Ae.resourceId),b({ok:!0,deleted:Ae.id})}catch(ut){return b({ok:!1,error:ut instanceof Error?ut.message:"Scheduled job could not be deleted."},409)}return b({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(L.pathname==="/api/jobs/history"&&C.method==="GET"){let we=br.get(String(L.searchParams.get("jobId")??""));if(!we||!j(we.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);return b({ok:!0,executions:br.listExecutions(we.id,Number(L.searchParams.get("limit"))||100).map((Ae)=>({...Ae,logs:Ae.operationId?At.logs(Ae.operationId,{limit:500}):[]}))})}if(L.pathname==="/api/jobs/reconcile"&&C.method==="POST"){if(!d)return b({ok:!1,error:"Environment was not found."},404);let we=qr(br,o,{organization:a.organization,project:a.project,environment:d,resources:p});return je("reconciled",we),b({ok:!0,reconciliation:we})}if(L.pathname==="/api/workers"&&C.method==="GET"){let we=Array.isArray(F.workersDetail??F.workers)?F.workersDetail??F.workers:[];return b({ok:!0,workers:br.listWorkers(a.project.id,d?.id).filter((Ae)=>j(Ae.resourceId)).map((Ae)=>{let et=we.find((ut)=>ut.name===Ae.name||ut.site===Ae.target.site);return et?{...Ae,observedState:{...Ae.observedState,status:et.status??"configured",currentJob:et.currentJob??null,failures:Number(et.failed??et.failures)||0,processed:Number(et.processed)||0}}:Ae})})}if(L.pathname==="/api/workers/action"&&C.method==="POST"){let we=await oe(C),Ae=br.getWorker(String(we.id??""));if(!Ae||!j(Ae.resourceId))return b({ok:!1,error:"Worker was not found."},404);let et=String(we.action??"");if(et==="restart"){if(String(we.confirm??"")!==Ae.name)return b({ok:!1,error:`Type "${Ae.name}" to restart this worker.`},409);let ut=Z.find((Xt)=>Xt.id===Ae.target.operationId);if(!ut)return b({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let St=await Vr(o,Se,ut),bn=br.reconcileWorker(Ae.id,St.ok?"in_sync":"unavailable",{...Ae.observedState,lastRestartAt:new Date().toISOString(),command:St.command??null,error:St.error??St.stderr??null});return je("worker_restarted",{workerId:Ae.id,ok:St.ok},Ae.resourceId),b({...St,worker:bn},St.ok?200:409)}if(et==="scale")return b({ok:!1,error:Ae.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return b({ok:!1,error:"Action must be restart or scale."},422)}}if(L.pathname.startsWith("/api/telemetry/")){let d=a.environments.get(Se),p=new Qe(a.store),R=a.store.listResources(a.project.id,d?.id),M=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(L.pathname)?"runtime:logs":"runtime:read",j=ue.role==="admin"||!!d&&la(ue,d.id,M),X=j?R:R.filter((ve)=>Sr(ue,ve.id,M)),F=(ve)=>Zy(X,j,ve),Z=(ve)=>{let je=new Date,we={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},Ae=String(ve.to??je.toISOString()),et=String(ve.from??new Date(new Date(Ae).getTime()-(we[String(ve.range??"1h")]??we["1h"])).toISOString()),ut=(bn)=>{let Xt=(Array.isArray(bn)?bn:String(bn??"").split(",")).map(String).filter(Boolean);return Xt.length?Xt:void 0},St=ut(ve.kinds)?.filter((bn)=>["metric","log","trace","request","event"].includes(bn));return{projectId:a.project.id,environmentId:d?.id,resourceIds:F(ve.resources),kinds:St,names:ut(ve.names),sources:ut(ve.sources),levels:ut(ve.levels),from:et,to:Ae,text:String(ve.text??"")||void 0,traceId:String(ve.traceId??"")||void 0,requestId:String(ve.requestId??"")||void 0,deploymentId:String(ve.deploymentId??"")||void 0,releaseId:String(ve.releaseId??"")||void 0,workloadId:String(ve.workloadId??"")||void 0,cursor:String(ve.cursor??"")||void 0,limit:Number(ve.limit)||void 0}},fe=Object.fromEntries(L.searchParams.entries()),pe=(ve=!1)=>ri({controlPlane:a.store,projectId:a.project.id,environmentId:d?.id,config:o,environment:Se,force:ve,lightweight:!ve}),Ge=()=>{let ve=a.store.getSetting(`telemetry.collection:${a.project.id}:${d?.id??"all"}`)??{};return{generatedAt:String(ve.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(ve.statuses)?ve.statuses:[],errors:Array.isArray(ve.errors)?ve.errors:[],policy:ve.policy??Xe(a.store,a.project.id)}};if(L.pathname==="/api/telemetry/status"&&C.method==="GET"){pe(!1);let ve=Ge(),je=j?ve.statuses:p.status(a.project.id,d?.id,ve.policy.rawDays,ve.policy.samplingRate,X.map((Ae)=>Ae.id)),we=je.reduce((Ae,et)=>Ae+et.estimatedDailyBytes*30,0);return b({ok:!0,generatedAt:ve.generatedAt,cached:ve.cached,sources:je,errors:j?ve.errors:[],policy:ve.policy,retention:{rawDays:ve.policy.rawDays,downsampleAfterDays:ve.policy.downsampleAfterDays,downsampleBucketMs:ve.policy.downsampleBucketMs,maxRecords:ve.policy.maxRecords},estimatedMonthlyBytes:we,estimatedMonthlyCostUsd:mi(we,ve.policy),costEstimateConfigured:ve.policy.estimatedStorageUsdPerGbMonth>0})}if(L.pathname==="/api/telemetry/settings"&&C.method==="GET")return b({ok:!0,policy:Xe(a.store,a.project.id)});if(L.pathname==="/api/telemetry/settings"&&C.method==="PATCH"){let ve=pi(a.store,a.project.id,await oe(C));return sb(a.project.id),b({ok:!0,policy:ve})}if(L.pathname==="/api/telemetry/query"&&C.method==="GET"){pe(!1);let ve=Ge();return b({ok:!0,collection:{generatedAt:ve.generatedAt,cached:ve.cached},...p.query(Z(fe))})}if(L.pathname==="/api/telemetry/tail"&&C.method==="GET"){pe(!1);let ve=new TextEncoder,je=new Date,we=Z({...fe,kinds:fe.kinds||"log,request,event,trace",from:fe.from||new Date(je.getTime()-120000).toISOString(),to:je.toISOString(),limit:Math.min(1000,Number(fe.limit)||200),cursor:void 0}),Ae=C.headers.get("last-event-id")||String(fe.cursor??"")||void 0,et,ut=!1,St=!1,bn=new ReadableStream({start(Xt){let yo=()=>{if(ut)return;if(ut=!0,et)clearInterval(et);C.signal.removeEventListener("abort",yo);try{Xt.close()}catch{}},Rp=async()=>{if(ut||St)return;St=!0;try{let qo=p.tail({...we,to:new Date(Date.now()+1000).toISOString()},Ae);for(let Pp of qo.records)Ae=ts(Pp)??Ae,Xt.enqueue(ve.encode(`id: ${Ae??""}
 event: record
 data: ${JSON.stringify(Pp)}
 
@@ -507,5 +507,5 @@ data: ${JSON.stringify({message:qo instanceof Error?qo.message:String(qo)})}
 data: ${JSON.stringify({cursor:Ae,at:new Date().toISOString()})}
 
 `))},5000),et.unref?.(),C.signal.addEventListener("abort",yo,{once:!0})},cancel(){if(ut=!0,et)clearInterval(et)}});return new Response(bn,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(L.pathname==="/api/telemetry/series"&&C.method==="GET"){pe(!1);let ve=Ge(),je=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(fe.aggregation))?fe.aggregation:"avg",we=Z({...fe,kinds:"metric",limit:5000}),Ae=p.series({...we,bucketMs:Number(fe.bucketMs)||60000,aggregation:je,timezone:String(fe.timezone??"UTC"),compareFrom:fe.compareFrom,compareTo:fe.compareTo});return b({ok:!0,collection:{generatedAt:ve.generatedAt,cached:ve.cached},query:{aggregation:je,bucketMs:Number(fe.bucketMs)||60000,timezone:String(fe.timezone??"UTC")},series:Ae})}if(L.pathname==="/api/telemetry/refresh"&&C.method==="POST")return b({ok:!0,...await pe(!0)});if(L.pathname==="/api/telemetry/export"&&C.method==="POST"){let ve=await oe(C);await pe(!1);let je=p.query({...Z(ve),limit:Math.min(5000,Number(ve.limit)||5000),cursor:void 0});if((ve.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:Z(ve),...je},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let Ae=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],et=[Ae.join(","),...je.records.map((ut)=>Ae.map((St)=>`"${String(ut[St]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(et,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="GET"){let ve=Be(ue);return b({ok:!0,queries:p.listSavedQueries(a.project.id,ve.actor?.id)})}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="POST"){let ve=await oe(C),je=Be(ue);return b({ok:!0,query:p.saveQuery(a.project.id,je.actor?.id,String(ve.name??""),Z(ve.query??ve))},201)}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="DELETE"){let ve=await oe(C),je=Be(ue),we=p.deleteSavedQuery(a.project.id,je.actor?.id,String(ve.id??""));return b({ok:we},we?200:404)}}if(L.pathname.startsWith("/api/configuration")){let d=a.environments.get(Se),p=ue.role==="admin"||!!Fn.capabilities?.includes("secrets:read"),R=ue.role==="admin"||!!Fn.capabilities?.includes("secrets:write"),M={projectId:a.project.id,environmentId:d?.id},j={"cache-control":"no-store"};if(L.pathname==="/api/configuration"&&C.method==="GET"){let X=Object.fromEntries(L.searchParams),F=X.scopeType||X.scopeId?aa(X,M):void 0,Z=["variable","secret"].includes(String(X.kind))?X.kind:void 0,fe=F?.type==="preview"?Ht.previews.getInstance(F.id):void 0,pe=fe?Ht.previews.getDefinition(fe.definitionId):void 0,Ge=F?await gn.resolve({projectId:a.project.id,environmentId:F.environmentId,resourceId:F.resourceId,functionId:F.type==="function"?F.id:void 0,previewId:F.previewId,trustedPreview:!!fe&&!fe.fork,allowedPreviewSecrets:pe?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:p}):void 0,ve=a.store.listResources(a.project.id);return b({ok:!0,entries:gn.list({projectId:a.project.id,scope:F,kind:Z,search:X.search,canReadSecretMetadata:p}),effectiveEntries:Ge?Object.values(Ge.entries).filter((je)=>!Z||je.kind===Z).filter((je)=>!X.search||je.key.toLowerCase().includes(String(X.search).toLowerCase())):[],configurationHash:Ge?.configurationHash,warnings:Ge?.warnings??[],scopes:{project:a.project,environments:a.store.listEnvironments(a.project.id),resources:ve.filter((je)=>je.kind!=="function"),functions:ve.filter((je)=>je.kind==="function"),previews:Ht.previews.listInstances({projectId:a.project.id}).filter((je)=>je.status!=="destroyed").map((je)=>({id:je.id,name:je.name,environmentId:je.baseEnvironmentId,resourceId:je.resourceId,fork:je.fork,status:je.status}))}},200,j)}if(L.pathname==="/api/configuration/export"&&C.method==="GET"){let X=aa(Object.fromEntries(L.searchParams),M);return new Response(gn.exportVariables({projectId:a.project.id,scope:X}),{headers:{...j,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(L.pathname==="/api/configuration/plan"&&C.method==="POST"){let X=await oe(C),F=aa(X,M),Z=X.values&&typeof X.values==="object"&&!Array.isArray(X.values)?Object.fromEntries(Object.entries(X.values).map(([fe,pe])=>[fe,String(pe)])):{};return b({ok:!0,plan:gn.plan({projectId:a.project.id,scope:F,values:Z,removeMissing:X.removeMissing===!0})},200,j)}if(L.pathname==="/api/configuration"&&C.method==="POST"){let X=await oe(C),F=aa(X,M),Z=X.kind==="secret"?"secret":"variable",fe=String(X.key??"");if(Z==="secret"&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);try{let pe=await gn.set({organizationId:a.organization.id,projectId:a.project.id,scope:F,key:fe,kind:Z,value:X.value==null?void 0:String(X.value),reference:X.reference==null?void 0:String(X.reference),backend:X.backend,required:X.required===!0,expectedVersion:X.expectedVersion==null?void 0:Number(X.expectedVersion),confirmed:String(X.confirm??"")===fe,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:Be(ue).actor?.id});return b({ok:!0,entry:gn.list({projectId:a.project.id,scope:F,canReadSecretMetadata:p}).find((Ge)=>Ge.id===pe.entry.id),mutation:pe.mutation,warnings:pe.warnings},pe.mutation.added.length?201:200,j)}catch(pe){return b({ok:!1,error:pe instanceof Error?pe.message:String(pe)},409,j)}}if(L.pathname==="/api/configuration/import"&&C.method==="POST"){let X=await oe(C),F=aa(X,M),Z=Array.isArray(X.secretKeys)?X.secretKeys.map(String):[];if(Z.length&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);try{let fe=await gn.importDotenv({organizationId:a.organization.id,projectId:a.project.id,scope:F,source:String(X.source??""),secretKeys:Z,backend:X.backend,confirmed:X.confirm==="import",idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:Be(ue).actor?.id});return b({ok:fe.document.valid,diagnostics:fe.document.diagnostics,mutation:fe.mutation,warnings:fe.warnings},fe.document.valid?200:422,j)}catch(fe){return b({ok:!1,error:fe instanceof Error?fe.message:String(fe)},409,j)}}if(L.pathname==="/api/configuration/dependencies"&&C.method==="POST"){let X=await oe(C),F=po.get(String(X.entryId??"")),Z=a.store.getResource(String(X.resourceId??""));if(!F||F.projectId!==a.project.id||!Z||Z.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry or dependent resource was not found."},404,j);return b({ok:!0,dependency:po.setDependency({entryId:F.id,resourceId:Z.id,injectionTarget:["native_reference","file"].includes(String(X.injectionTarget))?X.injectionTarget:"environment",required:X.required!==!1,requiresRedeploy:X.requiresRedeploy!==!1,lastDeployedVersion:X.lastDeployedVersion==null?void 0:Number(X.lastDeployedVersion)})},200,j)}if(L.pathname==="/api/configuration/transfer"&&C.method==="POST"){let X=await oe(C),F=po.get(String(X.id??"")),Z=aa({...X,scopeType:X.targetScopeType,scopeId:X.targetScopeId},M);if(!F||F.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,j);if(F.kind==="secret"&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);try{let fe=await gn.transfer({entryId:F.id,targetScope:Z,mode:X.mode==="move"?"move":"copy",confirmed:X.confirm===F.key,actorId:Be(ue).actor?.id,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey});return b({ok:!0,entry:gn.list({projectId:a.project.id,scope:Z,canReadSecretMetadata:p}).find((pe)=>pe.id===fe.entry.id),mutation:fe.mutation},200,j)}catch(fe){return b({ok:!1,error:fe instanceof Error?fe.message:String(fe)},409,j)}}if(L.pathname==="/api/configuration/bulk"&&C.method==="POST"){let X=await oe(C),F=Array.isArray(X.ids)?X.ids.map(String).slice(0,500):[],Z=F.map((pe)=>po.get(pe)).filter((pe)=>!!pe&&pe.projectId===a.project.id);if(Z.length!==F.length)return b({ok:!1,error:"One or more configuration entries were not found."},404,j);if(Z.some((pe)=>pe.kind==="secret")&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);if(X.action!=="delete"||X.confirm!=="bulk")return b({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,j);let fe=[];try{for(let pe of Z)fe.push(await gn.remove({entryId:pe.id,expectedVersion:pe.version,confirmed:!0,actorId:Be(ue).actor?.id}));return b({ok:!0,removed:fe.flatMap((pe)=>pe.removed),affectedResourceIds:[...new Set(fe.flatMap((pe)=>pe.affectedResourceIds))].sort()},200,j)}catch(pe){return b({ok:!1,error:pe instanceof Error?pe.message:String(pe),partial:fe.flatMap((Ge)=>Ge.removed)},409,j)}}if(L.pathname==="/api/configuration/reveal"&&C.method==="POST"){let X=await oe(C),F=Ft.resolveSession(C);try{return b({ok:!0,value:await gn.reveal({entryId:String(X.id??""),canRevealSecrets:p,recentlyAuthenticated:!Pe||!!F&&Ie.isRecentlyAuthenticated(F),actorId:Be(ue).actor?.id})},200,j)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},403,j)}}if(L.pathname==="/api/configuration"&&C.method==="DELETE"){let X=await oe(C),F=po.get(String(X.id??""));if(F?.kind==="secret"&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);if(!F||F.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,j);try{return b({ok:!0,mutation:await gn.remove({entryId:F.id,expectedVersion:Number(X.expectedVersion),confirmed:String(X.confirm??"")===F.key,actorId:Be(ue).actor?.id})},200,j)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},409,j)}}}if(L.pathname.startsWith("/api/fleet")){let d=Be(ue).actor?.id,p=(R,M=409)=>b({ok:!1,error:R instanceof Error?R.message:String(R)},M,{"cache-control":"no-store"});if(L.pathname==="/api/fleet"&&C.method==="GET")return b({ok:!0,servers:ua.list(a.project.id),resources:a.store.listResources(a.project.id),operations:At.list({projectId:a.project.id,limit:200}).filter((R)=>R.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(L.pathname==="/api/fleet"&&C.method==="POST"){let R=await oe(C);try{return b({ok:!0,server:xi.enroll({organizationId:a.organization.id,projectId:a.project.id,name:String(R.name??""),provider:["aws","hetzner"].includes(String(R.provider))?R.provider:"ssh",providerId:R.providerId?String(R.providerId):void 0,region:R.region?String(R.region):void 0,zone:R.zone?String(R.zone):void 0,endpoint:String(R.endpoint??""),sshUser:String(R.sshUser??"deploy"),sshPort:R.sshPort?Number(R.sshPort):22,credentialRef:String(R.credentialRef??""),roles:Array.isArray(R.roles)?R.roles:[],labels:R.labels&&typeof R.labels==="object"?R.labels:{}})},201)}catch(M){return p(M,422)}}if(L.pathname==="/api/fleet/action"&&C.method==="POST"){let R=await oe(C),M=String(R.id??""),j=String(R.action??"");try{if(j==="test")return b({ok:!0,server:await xi.test(M)});if(j==="validate")return b({ok:!0,server:await xi.validate(M)});if(j==="review_host_key")return b({ok:!0,server:xi.reviewHostKey(M,String(R.fingerprint??""))});if(j==="bootstrap")return b({ok:!0,...xi.bootstrap(M,R.confirmed===!0)},R.confirmed===!0?202:200);if(j==="heartbeat")return b({ok:!0,server:xi.heartbeat(M,{usage:R.usage&&typeof R.usage==="object"?R.usage:{}})});if(j==="drain")return b({ok:!0,server:xi.drain(M,R.completed===!0)});if(j==="uncordon")return b({ok:!0,server:xi.uncordon(M)});if(j==="archive")return b({ok:!0,server:xi.archive(M,String(R.confirmation??""))});return p("Unsupported fleet action.",422)}catch(X){return p(X)}}}if(L.pathname.startsWith("/api/capacity")){let d=(p,R=409)=>b({ok:!1,error:p instanceof Error?p.message:String(p)},R,{"cache-control":"no-store"});if(L.pathname==="/api/capacity"&&C.method==="GET")return b({ok:!0,pools:mo.listPools(a.project.id),placements:mo.listPlacements(a.project.id),servers:ua.list(a.project.id)},200,{"cache-control":"no-store"});if(L.pathname==="/api/capacity"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,pool:mo.createPool({organizationId:a.organization.id,projectId:a.project.id,name:String(p.name??""),purpose:String(p.purpose??"application"),backend:String(p.backend??"server"),region:p.region?String(p.region):void 0,architecture:p.architecture?String(p.architecture):void 0,labels:p.labels&&typeof p.labels==="object"?p.labels:{},requiredServerLabels:p.requiredServerLabels&&typeof p.requiredServerLabels==="object"?p.requiredServerLabels:{},toleratedTaints:Array.isArray(p.toleratedTaints)?p.toleratedTaints.map(String):[],capacity:p.capacity&&typeof p.capacity==="object"?p.capacity:{},maxWorkloads:Number(p.maxWorkloads??10),costWeight:Number(p.costWeight??1),spreadKey:p.spreadKey?String(p.spreadKey):void 0,concurrency:Number(p.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(R){return d(R,422)}}if(L.pathname==="/api/capacity/member"&&C.method==="POST"){let p=await oe(C);try{return mo.addMember(String(p.poolId??""),String(p.serverId??"")),b({ok:!0,pool:mo.getPool(String(p.poolId??""))})}catch(R){return d(R,422)}}if(L.pathname==="/api/capacity/explain"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,decisions:pp.explain(a.project.id,{purpose:String(p.purpose??"application"),resources:p.resources&&typeof p.resources==="object"?p.resources:{},region:p.region?String(p.region):void 0,architecture:p.architecture?String(p.architecture):void 0,labels:p.labels&&typeof p.labels==="object"?p.labels:{}})})}catch(R){return d(R,422)}}if(L.pathname==="/api/capacity/action"&&C.method==="POST"){let p=await oe(C);try{if(p.action==="drain")return b({ok:!0,...pp.drainPool(String(p.poolId??""))});if(p.action==="enable")return b({ok:!0,pool:mo.updatePool(String(p.poolId??""),{status:"active"})});if(p.action==="disable")return b({ok:!0,pool:mo.updatePool(String(p.poolId??""),{status:"disabled"})});return d("Unsupported capacity action.",422)}catch(R){return d(R,422)}}}if(L.pathname.startsWith("/api/regions")){let d=(p,R=409)=>b({ok:!1,error:p instanceof Error?p.message:String(p)},R,{"cache-control":"no-store"});if(L.pathname==="/api/regions"&&C.method==="GET")return b({ok:!0,topologies:zo.list(a.project.id).map((p)=>({topology:p,targets:zo.targets(p.id),channels:zo.channels(p.id),route:zo.route(p.id),executions:zo.executions(p.id)}))},200,{"cache-control":"no-store"});if(L.pathname==="/api/regions"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,topology:gp.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:a.environments.get(Se)?.id,name:String(p.name??""),hostname:String(p.hostname??""),regions:Array.isArray(p.regions)?p.regions:[],trafficPolicy:p.trafficPolicy==="weighted"||p.trafficPolicy==="latency"?p.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(p.replicate)?p.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(p.maxLagSeconds??30),retainOnDestroy:p.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:p.cdnEnabled===!0,wafEnabled:p.wafEnabled===!0})},201)}catch(R){return d(R,422)}}if(L.pathname==="/api/regions/action"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,...gp.enqueue({topologyId:String(p.topologyId??""),kind:String(p.action??""),targetRegion:p.targetRegion?String(p.targetRegion):void 0,revision:p.revision?String(p.revision):void 0,manifest:p.manifest&&typeof p.manifest==="object"?p.manifest:{},confirmation:p.confirmation?String(p.confirmation):void 0,deleteData:p.deleteData===!0})},202)}catch(R){return d(R,422)}}}if(L.pathname.startsWith("/api/maintenance")){let d=(p,R=409)=>b({ok:!1,error:p instanceof Error?p.message:String(p)},R,{"cache-control":"no-store"});if(L.pathname==="/api/maintenance"&&C.method==="GET")return b({ok:!0,manifests:zi.manifests(a.organization.id),windows:zi.windows(a.project.id),campaigns:zi.campaigns(a.project.id).map((p)=>({campaign:p,targets:zi.targets(p.id)})),cleanups:zi.cleanups(a.project.id),drills:zi.drills(a.project.id)},200,{"cache-control":"no-store"});if(L.pathname==="/api/maintenance/cleanup-preview"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,plan:await Od.previewCleanup({projectId:a.project.id,kind:String(p.kind??"operations"),criteria:{olderThanDays:Number(p.olderThanDays??30)}},mp)},201)}catch(R){return d(R,422)}}if(L.pathname==="/api/maintenance/cleanup-apply"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,...Od.enqueueCleanup(String(p.planId??""),String(p.confirmation??""))},202)}catch(R){return d(R,422)}}if(L.pathname==="/api/maintenance/drill"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,drill:zi.createDrill({projectId:a.project.id,scenario:String(p.scenario??"control_plane"),isolatedTarget:String(p.isolatedTarget??""),expectedRpoMinutes:Number(p.expectedRpoMinutes??60),expectedRtoMinutes:Number(p.expectedRtoMinutes??30),recoveryPointId:p.recoveryPointId?String(p.recoveryPointId):void 0,topologyId:p.topologyId?String(p.topologyId):void 0})},201)}catch(R){return d(R,422)}}if(L.pathname==="/api/maintenance/drill-run"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,...Od.enqueueDrill(String(p.drillId??""))},202)}catch(R){return d(R,422)}}}if(L.pathname.startsWith("/api/volumes")){let d=a.environments.get(Se),p=Be(ue).actor?.id,R=(M,j=409)=>b({ok:!1,error:M instanceof Error?M.message:String(M)},j,{"cache-control":"no-store"});if(L.pathname==="/api/volumes"&&C.method==="GET"){let M=xd.inventory(a.project.id,d?.id),j=a.store.listResources(a.project.id,d?.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind,provider:X.provider,providerId:X.providerId}));return b({ok:!0,volumes:M,resources:j,operations:At.list({projectId:a.project.id,limit:100}).filter((X)=>X.operation.kind.startsWith("volume.")),recoveryPoints:Qt.listRecoveryPoints(a.project.id).filter((X)=>X.kind==="volume"),providers:Dd.map((X)=>({provider:X.provider,type:X.type,capabilities:X.capabilities()}))},200,{"cache-control":"no-store"})}if(L.pathname==="/api/volumes"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:M.resourceId?String(M.resourceId):void 0,name:String(M.name??""),provider:String(M.provider??"docker"),type:M.type==="docker"?"docker":M.type,capacityBytes:M.capacityBytes==null?void 0:Number(M.capacityBytes),filesystem:M.filesystem?String(M.filesystem):void 0,encrypted:M.encrypted===!0,desiredState:M.desiredState&&typeof M.desiredState==="object"?M.desiredState:{},actorId:p})},202,{"cache-control":"no-store"})}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/attach"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.attach(String(M.volumeId??""),{resourceId:String(M.resourceId??""),targetPath:String(M.targetPath??""),readOnly:M.readOnly===!0,uid:M.uid==null?void 0:Number(M.uid),gid:M.gid==null?void 0:Number(M.gid),mode:M.mode?String(M.mode):void 0,propagation:M.propagation,driverOptions:M.driverOptions&&typeof M.driverOptions==="object"?M.driverOptions:{},actorId:p})},202)}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/detach"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.detach(String(M.volumeId??""),String(M.attachmentId??""),{force:M.force===!0,drained:M.drained===!0,unmounted:M.unmounted===!0,confirmation:M.confirmation?String(M.confirmation):void 0,actorId:p})},202)}catch(j){return R(j)}}if(L.pathname==="/api/volumes/resize"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.resize(String(M.volumeId??""),Number(M.capacityBytes),{drained:M.drained===!0,actorId:p})},202)}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/snapshot"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.snapshot(String(M.volumeId??""),{name:M.name?String(M.name):void 0,actorId:p})},202)}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/restore"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.restore(String(M.snapshotId??""),{name:String(M.name??""),actorId:p})},202)}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/discover"&&C.method==="POST")try{return b({ok:!0,volumes:await Ui.discover({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,actorId:p})})}catch(M){return R(M,502)}if(L.pathname==="/api/volumes/adopt"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,volume:Ui.adopt(String(M.volumeId??""),{name:String(M.name??""),actorId:p})})}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes"&&C.method==="DELETE"){let M=await oe(C),j=Ft.resolveSession(C);try{return b({ok:!0,...Ui.delete(String(M.volumeId??""),{recentAuthAt:!Pe||j&&Ie.isRecentlyAuthenticated(j)?new Date().toISOString():void 0,confirmation:M.confirmation?String(M.confirmation):void 0,backupOverride:M.backupOverride===!0,backupOverrideConfirmation:M.backupOverrideConfirmation?String(M.backupOverrideConfirmation):void 0,actorId:p})},202)}catch(X){return R(X)}}}if(L.pathname==="/api/backups"&&C.method==="GET"){let d=a.environments.get(Se),p=Qt.listPolicies(a.project.id,d?.id),R=new Set(p.map((Z)=>Z.id)),M=Qt.listRecoveryPoints(a.project.id).filter((Z)=>!Z.policyId||R.has(Z.policyId)),j=Qt.listJobs(a.project.id).filter((Z)=>!Z.policyId||R.has(Z.policyId)),X=(Z)=>({...Z,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Z.credentialRef,clientEncryptionConfigured:!!Z.encryptionKeyRef}),F=await Promise.all(Qt.listDestinations(a.project.id).map(async(Z)=>({...X(Z),credentialStatus:await Qg(Z,Fi)})));return b({ok:!0,destinations:F,policies:p,recoveryPoints:M,jobs:j,coverage:Qt.coverage(a.project.id).filter((Z)=>R.has(Z.policy.id)),resources:d?a.store.listResources(a.project.id,d.id).map((Z)=>({id:Z.id,name:Z.name,slug:Z.slug,kind:Z.kind})):[]})}if(L.pathname==="/api/backups/destinations"&&C.method==="POST"){let d=await oe(C),p=String(d.name??"").trim(),R=String(d.provider??""),M=String(d.encryption??"provider"),j=`secret://data-services/backups/${a.project.id}/${p}`,X=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(R))return b({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(M))return b({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let F,Z;if(d.credentials&&typeof d.credentials==="object"&&!Array.isArray(d.credentials))F=`${j}/credentials`,await Fi.put(F,JSON.stringify(d.credentials)),X.push(F);if(M!=="provider"){let pe=String(d.encryptionKey??"");if(pe.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");Z=`${j}/encryption-key`,await Fi.put(Z,pe),X.push(Z)}let fe=Qt.createDestination({organizationId:a.organization.id,projectId:a.project.id,name:p,provider:R,endpoint:d.endpoint?String(d.endpoint):void 0,endpointPolicy:d.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:d.bucket?String(d.bucket):void 0,prefix:String(d.prefix??""),region:d.region?String(d.region):go,forcePathStyle:d.forcePathStyle===!0,credentialRef:F,encryption:M,encryptionKeyRef:Z,immutability:d.immutability&&typeof d.immutability==="object"&&!Array.isArray(d.immutability)?d.immutability:{},status:"untested"});return b({ok:!0,destination:{...fe,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!F,clientEncryptionConfigured:!!Z}},201)}catch(F){for(let Z of X)await Fi.remove(Z).catch(()=>{});return b({ok:!1,error:F instanceof Error?F.message:String(F)},422)}}if(L.pathname==="/api/backups/destinations/test"&&C.method==="POST"){let d=await oe(C),p=Qt.getDestination(String(d.id??""));if(!p||p.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(p.provider==="aws_backup")return b({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await lp.test(p),b({ok:!0,destination:Qt.recordDestinationTest(p.id,{ok:!0})})}catch(R){let M=R instanceof Error?R.message:String(R);return Qt.recordDestinationTest(p.id,{ok:!1,error:M}),b({ok:!1,error:M},502)}}if(L.pathname==="/api/backups/policies"&&C.method==="POST"){let d=await oe(C),p=a.environments.get(Se),R=Qt.getDestination(String(d.destinationId??"")),M=String(d.resourceKind??""),j=d.dataServiceId?String(d.dataServiceId):void 0,X=j?Mt.get(j):void 0,F=d.resourceId?String(d.resourceId):void 0,Z=F?a.store.getResource(F):void 0;if(!p)return b({ok:!1,error:"Environment was not found."},404);if(!R||R.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(M))return b({ok:!1,error:"A supported backup resource kind is required."},422);if(j&&(!X||X.projectId!==a.project.id||X.environmentId!==p.id))return b({ok:!1,error:"Data service was not found in this environment."},404);if(F&&(!Z||Z.projectId!==a.project.id||Z.environmentId!==p.id))return b({ok:!1,error:"Resource was not found in this environment."},404);if(M==="managed_database"&&!X)return b({ok:!1,error:"Managed database policies require a data service."},422);if(M==="logical_database"&&(!X||!["container","server"].includes(X.provider)))return b({ok:!1,error:"Logical database policies require an on-box data service."},422);if(M==="volume"&&(!Z||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(d.volumeName??""))))return b({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let fe=Array.isArray(d.includePatterns)?d.includePatterns.map(String).filter(Boolean):[];if(M==="files"&&(!Z||!fe.length))return b({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(M==="control_plane"&&R.encryption==="provider")return b({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(M==="infrastructure"&&(R.provider!=="aws_backup"||!fe.some((pe)=>pe.startsWith("resource:arn:"))||!fe.some((pe)=>pe.startsWith("role:arn:"))))return b({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let pe=Qt.createPolicy({organizationId:a.organization.id,projectId:a.project.id,environmentId:p.id,resourceId:F,dataServiceId:j,destinationId:R.id,name:String(d.name??"").trim(),resourceKind:M,schedule:String(d.schedule??"daily"),timezone:String(d.timezone??"UTC"),retention:d.retention&&typeof d.retention==="object"&&!Array.isArray(d.retention)?d.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(d.compression))?d.compression:"gzip",encryption:["destination","client_side","both"].includes(String(d.encryption))?d.encryption:"destination",includePatterns:M==="volume"?[String(d.volumeName),...fe]:fe,excludePatterns:Array.isArray(d.excludePatterns)?d.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(d.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(d.expectedRtoMinutes)||120),healthCheckId:d.healthCheckId?String(d.healthCheckId):void 0,enabled:d.enabled!==!1});return b({ok:!0,policy:pe},201)}catch(pe){return b({ok:!1,error:pe instanceof Error?pe.message:String(pe)},422)}}if(L.pathname==="/api/backups/run"&&C.method==="POST"){let d=await oe(C),p=Qt.getPolicy(String(d.policyId??"")),R=a.environments.get(Se);if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Backup policy was not found in this environment."},404);try{let M=Fo.enqueueBackup(p,new Date().toISOString(),Be(ue).actor?.id);return b({ok:!0,job:M},202)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:String(M)},409)}}if(L.pathname==="/api/backups/verify"&&C.method==="POST"){let d=await oe(C),p=Qt.getRecoveryPoint(String(d.recoveryPointId??""));if(!p||p.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);return b({ok:!0,job:Fo.enqueueVerification(p)},202)}if(L.pathname==="/api/backups/restore"&&C.method==="POST"){let d=await oe(C),p=Qt.getRecoveryPoint(String(d.recoveryPointId??"")),R=d.mode==="in_place"?"in_place":"isolated",M=d.target&&typeof d.target==="object"&&!Array.isArray(d.target)?{...d.target,inPlace:R==="in_place"}:{inPlace:R==="in_place"},j=Ft.resolveSession(C),X={mode:R,target:M,targetName:String(d.targetName??""),confirm:d.confirm?String(d.confirm):void 0,recentAuth:!Pe||!!j&&Ie.isRecentlyAuthenticated(j),downtimeAcknowledged:d.downtimeAcknowledged===!0,safetyBackupId:d.safetyBackupId?String(d.safetyBackupId):void 0};if(!p||p.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.drill===!0&&R!=="isolated")return b({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let F=Fo.planRestore(p,X);if(d.execute!==!0)return b({ok:!0,plan:F,executionCreated:!1});let Z=Fo.enqueueRestore(p,{...X,drill:d.drill===!0,actorId:Be(ue).actor?.id});return b({ok:!0,plan:F,job:Z},202)}catch(F){return b({ok:!1,error:F instanceof Error?F.message:String(F)},409)}}if(L.pathname==="/api/backups/recovery-points"&&C.method==="POST"){let d=await oe(C),p=Qt.getRecoveryPoint(String(d.id??""));if(!p||p.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.held==null&&d.pinned==null)return b({ok:!1,error:"held or pinned must be provided."},422);return b({ok:!0,recoveryPoint:Qt.updateRecoveryPoint(p.id,{held:d.held==null?p.held:d.held===!0,pinned:d.pinned==null?p.pinned:d.pinned===!0})})}if(L.pathname==="/api/backups/retention"&&C.method==="POST")return b({ok:!0,jobs:Fo.enqueueRetention()},202);if(L.pathname==="/api/data-services/capabilities"&&C.method==="GET"){let d=String(L.searchParams.get("engine")??""),p=String(L.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(d)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(p))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,engine:d,provider:p,capabilities:Zt(d,p)})}if(L.pathname==="/api/data-services"&&C.method==="GET"){let d=a.environments.get(Se),p=Mt.list(a.project.id,d?.id).map((R)=>{let M=Mt.credential(R.id);return{...R,credentialRef:void 0,credential:M?{configured:!0,username:M.username,version:M.version,rotatedAt:M.rotatedAt}:void 0,dependencies:Mt.dependencies(R.id).map((j)=>({resourceId:j.resourceId,requiresRedeploy:j.requiresRedeploy}))}});return b({ok:!0,services:p})}if(L.pathname==="/api/data-services/preview"&&C.method==="POST"){let d=await oe(C);if(d.id){let M=Mt.get(String(d.id)),j=a.environments.get(Se),X=String(d.action??"");if(!M||M.projectId!==a.project.id||M.environmentId!==j?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Ad.includes(X))return b({ok:!1,error:`Action must be one of: ${Ad.join(", ")}.`},422);try{return b({ok:!0,plan:Fa.plan(M,X,d.changes??{})})}catch(F){return b({ok:!1,error:F instanceof Error?F.message:String(F)},422)}}let p=String(d.engine??""),R=String(d.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(p)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(R))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,capabilities:Zt(p,R),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(L.pathname==="/api/data-services"&&C.method==="POST"){let d=await oe(C),p=String(d.engine??""),R=String(d.provider??""),M=a.environments.get(Se),j=Be(ue);if(!M)return b({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(p)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(R))return b({ok:!1,error:"A supported engine and provider are required."},422);let X={organizationId:a.organization.id,projectId:a.project.id,environmentId:M.id,resourceId:d.resourceId?String(d.resourceId):void 0,name:String(d.name??"").trim(),engine:p,provider:R,placement:String(d.placement??d.name??"").trim(),engineVersion:d.engineVersion?String(d.engineVersion):void 0,plan:String(d.plan??(R==="aws_elasticache"?"cache.t4g.micro":R==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:d.storageGb==null?void 0:Number(d.storageGb),highAvailability:d.highAvailability===!0,publicExposure:d.publicExposure===!0,allowedCidrs:Array.isArray(d.allowedCidrs)?d.allowedCidrs.map(String):[],desiredState:d.desiredState&&typeof d.desiredState==="object"&&!Array.isArray(d.desiredState)?d.desiredState:{},observedState:{},origin:d.adopt===!0?"adopted":"managed",managementEnabled:d.adopt!==!0,ownerActorId:j.actor?.id,username:d.username?String(d.username):void 0};try{if(d.adopt===!0){let Z=Mt.create({...X,status:"adopted",credentialRef:void 0});return b({ok:!0,service:Z,readOnly:!0},201)}if(!up({provider:R,engine:p}))return b({ok:!1,error:`No ${R}/${p} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let F=await Fa.create(X);return b({ok:!0,service:F.service,operationId:F.operationId,oneTimeCredential:F.credential},201)}catch(F){return b({ok:!1,error:F instanceof Error?F.message:String(F)},422)}}if(L.pathname==="/api/data-services/connections"&&C.method==="GET"){let d=Mt.get(String(L.searchParams.get("id")??"")),p=a.environments.get(Se);if(!d||d.projectId!==a.project.id||d.environmentId!==p?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);let R=typeof d.observedState.endpoint==="string"?d.observedState.endpoint:void 0,M=typeof d.observedState.readerEndpoint==="string"?d.observedState.readerEndpoint:void 0,j=Number(d.observedState.port)||(d.engine==="postgres"?5432:d.engine==="redis"?6379:d.engine==="mongodb"?27017:d.engine==="libsql"?8080:3306),X=typeof d.observedState.database==="string"?d.observedState.database:void 0,F=typeof d.observedState.tls==="boolean"?d.observedState.tls:d.provider.startsWith("aws_"),Z=[...R?[{type:d.publicExposure?"external":"internal",host:R,port:j,database:X,tls:F}]:[],...M?[{type:"internal",host:M,port:j,database:X,tls:F}]:[],{type:"tunnel",host:R??d.placement,port:j,database:X,tls:F}];return b({ok:!0,serviceId:d.id,guidance:Ln(d,Z)})}if(L.pathname==="/api/data-services/action"&&C.method==="POST"){let d=await oe(C),p=Mt.get(String(d.id??"")),R=a.environments.get(Se),M=String(d.action??"");if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Ad.includes(M))return b({ok:!1,error:`Action must be one of: ${Ad.join(", ")}.`},422);let j=d.changes&&typeof d.changes==="object"&&!Array.isArray(d.changes)?d.changes:{};try{let X=Fa.plan(p,M,j);if(d.execute!==!0)return b({ok:!0,plan:X,productionExecutionCreated:!1});let F=Fa.enqueue(p,M,j,Be(ue).actor?.id);return b({ok:!0,plan:X,operationId:F},202)}catch(X){return b({ok:!1,error:X instanceof Error?X.message:String(X)},409)}}if(L.pathname==="/api/data-services/dependencies"&&C.method==="POST"){let d=await oe(C),p=Mt.get(String(d.id??"")),R=a.environments.get(Se),M=a.store.getResource(String(d.resourceId??""));if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M||M.projectId!==a.project.id||M.environmentId!==R?.id)return b({ok:!1,error:"Dependent resource was not found in this environment."},404);if(d.remove===!0)return b({ok:Mt.removeDependency(p.id,M.id)});return Mt.addDependency({serviceId:p.id,resourceId:M.id,secretRef:p.credentialRef??`secret://data-services/${p.projectId}/${p.name}`,requiresRedeploy:d.requiresRedeploy!==!1}),b({ok:!0,dependencies:Mt.dependencies(p.id).map((j)=>({resourceId:j.resourceId,requiresRedeploy:j.requiresRedeploy}))})}if(L.pathname==="/api/data-services/management"&&C.method==="POST"){let d=await oe(C),p=Mt.get(String(d.id??"")),R=a.environments.get(Se);if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(p.origin!=="adopted"||d.reviewed!==!0||d.confirm!==p.name)return b({ok:!1,error:`Enabling management requires reviewed=true and typing ${p.name}.`},409);return b({ok:!0,service:Mt.update(p.id,p.version,{managementEnabled:!0})})}if(L.pathname==="/api/data-services/reveal"&&C.method==="POST"){let d=await oe(C),p=Mt.get(String(d.id??"")),R=a.environments.get(Se),M=p?Mt.credential(p.id):void 0;if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M)return b({ok:!1,error:"No managed credential is configured."},404);return b({ok:!0,credential:{username:M.username,password:await Fi.resolve(M.secretRef),version:M.version}},200,{"cache-control":"no-store"})}if(L.pathname==="/api/databases"&&C.method==="GET")return b(await Fh(o,Se));if(L.pathname==="/api/databases"&&C.method==="POST"){let d=await oe(C),p=String(d.name??"").trim();if(!so(p))return b({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return b({...await Uh(o,Se,p),name:p})}if(L.pathname==="/api/databases/vitess"&&C.method==="GET"){let d=await Jh(o,Se);return b({...d,unhealthy:Gh(d.tablets),missingPrimary:Wh(d)})}if(L.pathname==="/api/databases/vitess/provision"&&C.method==="POST"){let d=await oe(C);try{return b(await ry(o,Se,{keyspace:String(d.keyspace??""),username:String(d.username??""),password:String(d.password??""),sharded:d.sharded===!0,confirm:String(d.confirm??"")}))}catch(p){return b({ok:!1,error:p instanceof Error?p.message:String(p)},422)}}if(L.pathname==="/api/databases/vitess/migrations"&&C.method==="GET"){let d=L.searchParams.get("keyspace")??void 0;return b(await ey(o,Se,d))}if(L.pathname==="/api/databases/vitess/migrations/action"&&C.method==="POST"){let d=await oe(C),p=String(d.uuid??"").trim(),R=String(d.action??"");if(!["retry","cancel","cleanup","complete"].includes(R))return b({ok:!1,error:"Unknown migration action."},422);return b(await ty(o,Se,p,R))}if(L.pathname==="/api/databases/vitess/keyspaces"&&C.method==="POST"){let d=await oe(C),p=String(d.name??"").trim(),R=d.sharded===!0;return b(await Yh(o,Se,p,{sharded:R}))}if(L.pathname==="/api/databases/vitess/vschema"&&C.method==="POST"){let d=await oe(C),p=String(d.keyspace??"").trim(),R=typeof d.vschema==="string"?d.vschema:JSON.stringify(d.vschema??null);return b(await Xh(o,Se,p,R))}if(L.pathname==="/api/databases/vitess/schema"&&C.method==="POST"){let d=await oe(C),p=String(d.sql??"");return b(await Zh(o,Se,p))}if(L.pathname==="/api/databases/vitess/install-client"&&C.method==="POST")return b(await Qh(o,Se));if(L.pathname==="/api/databases/backups"&&C.method==="GET")return b(await qh(o,Se));if(L.pathname==="/api/databases/backup"&&C.method==="POST"){let d=await oe(C),p=String(d.database??"").trim();if(!so(p))return b({ok:!1,error:"Database name must be a valid identifier."},422);if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to back up this database.`},409);return b(await Vh(o,Se,p))}if(L.pathname==="/api/databases/users"&&C.method==="POST"){let d=await oe(C),p=String(d.username??"").trim(),R=String(d.password??""),M=String(d.database??"").trim()||void 0,j=d.access==="readonly"?"readonly":"all";if(!so(p))return b({ok:!1,error:"Username must be a valid identifier."},422);if(!R)return b({ok:!1,error:"Password is required."},422);if(M&&!so(M))return b({ok:!1,error:"Database must be a valid identifier."},422);return b({...await zh(o,Se,{username:p,password:R,database:M,access:j}),username:p})}if(L.pathname==="/api/dashboard-data")return Lt=W.get(Se)??await tt(Se),tt(Se),b(Hl(Lt,{user:Fn,slug:o.project.slug}));if(L.pathname==="/api/users"&&C.method==="GET")return b({ok:!0,users:ln(t).map(oa)});if(L.pathname==="/api/users"&&C.method==="POST"){let d=await oe(C),p=String(d.username??"").trim();if(!Sd(p))return b({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let R=d.sites&&typeof d.sites==="object"?d.sites:{},M=new Set(Object.keys(o.sites??{})),j={};for(let[Z,fe]of Object.entries(R)){if(!M.has(Z))return b({ok:!1,error:`Site '${Z}' was not found.`},404);if(fe!=="owner"&&fe!=="collaborator")return b({ok:!1,error:`Unknown site role '${fe}'. Use 'owner' or 'collaborator'.`},422);j[Z]=fe}let X=typeof d.password==="string"&&d.password.trim()?d.password.trim():void 0;if(X&&X.length<12)return b({ok:!1,error:"Password must be at least 12 characters."},422);let F=Na(t,{username:p,password:X,name:typeof d.name==="string"?d.name:void 0,sites:j});return ud(a,ln(t)),hi(),b({ok:!0,user:oa(F.user),password:F.password})}if(L.pathname==="/api/users"&&C.method==="DELETE"){let d=await oe(C),p=String(d.username??"").trim();if(p.toLowerCase()===ue.username.toLowerCase())return b({ok:!1,error:"You cannot remove your own account."},409);let R=fi(ln(t),p),M=R?a.store.getActorByExternalId("user",`dashboard:${R.username.toLowerCase()}`):void 0,j=M?a.store.getMembershipForActor(a.organization.id,M.id):void 0;if(j&&j.source!=="legacy")return b({ok:!1,error:"Organization members must be removed from Organization access."},409);let X=Gl(t,p);if(!X.ok)return b(X,409);return ud(a,ln(t)),Re.clear(),b({ok:!0,username:p})}if(L.pathname==="/api/actions/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=d.action?hA(d.action,Se):void 0;if(!p)return b({ok:!1,error:"Unknown dashboard action."},404);if(p.mutates&&d.confirm!==p.confirm)return b({ok:!1,error:`Type "${p.confirm}" to run this action.`},409);let R=await oo({controlPlane:a,environment:Se,actor:ue,kind:`dashboard.action.${p.id}`,input:{action:p.id},execute:()=>ap(p,{cwd:t,cliEntry:i})});return b({...R.result,controlPlaneOperation:R.operation})}if(L.pathname==="/api/server/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=d.operation?Xn(d.operation,o,Lt):void 0;if(!p)return b({ok:!1,error:"Unknown or unavailable server operation."},404);if(p.mutates&&d.confirm!==p.confirm)return b({ok:!1,error:`Type "${p.confirm}" to run this operation.`},409);let R=le(a,String(Se));await new ps(rt).run(new Da,{...R,artifactRoot:t});let M=ar(rt,{scope:R,desiredConfigHash:a.project.desiredConfigHash});if(M.decision.outcome==="block")return b({ok:!1,error:`Operation blocked by security policy: ${M.decision.explanation}`,securityReview:M},409);let j=await oo({controlPlane:a,environment:Se,actor:ue,kind:`dashboard.server.${p.id}`,resourceSlug:p.target,input:{operation:p.id,target:p.target,to:d.to??null},execute:()=>Vr(o,Se,p,{to:d.to})});return b({...j.result,controlPlaneOperation:j.operation,securityReview:M})}if(L.pathname==="/api/server/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command on the server.'},409);let p=await oo({controlPlane:a,environment:Se,actor:ue,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>sr(o,Se,String(d.command??""))});return b({...p.result,controlPlaneOperation:p.operation})}if(L.pathname==="/api/serverless/operations")return b(Zl(o,Se,Lt));if(L.pathname==="/api/serverless/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=d.operation?Dy(d.operation,o,Se,Lt):void 0;if(!p)return b({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(p.mutates&&d.confirm!==p.confirm)return b({ok:!1,error:`Type "${p.confirm}" to run this operation.`},409);let R=await oo({controlPlane:a,environment:Se,actor:ue,kind:`dashboard.serverless.${p.id}`,input:{operation:p.id,min:d.min??null,max:d.max??null},execute:()=>Oy(o,Se,p,{min:d.min,max:d.max})});return Lt=await bs(o,Se),W.set(Se,Lt),b({...R.result,controlPlaneOperation:R.operation})}if(L.pathname==="/api/serverless/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command.'},409);return b(await _y(o,Se,String(d.command??"")))}if(L.pathname==="/api/serverless/dlq"&&C.method==="GET"){let d=Number(L.searchParams.get("max"))||10;return b(await Ny(o,Se,d))}if(L.pathname==="/api/serverless/dlq/redrive"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="redrive")return b({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return b(await $y(o,Se,{max:d.max,targetQueue:d.targetQueue}))}if(L.pathname==="/api/serverless/dlq/purge"&&C.method==="POST"){if((await C.json().catch(()=>({}))).confirm!=="purge")return b({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return b(await My(o,Se))}if(L.pathname==="/api/serverless/secrets"&&C.method==="GET")return b({secrets:Ly(o,Se)});if(L.pathname==="/api/serverless/secrets"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=String(d.secretId??"").trim();if(!p)return b({ok:!1,error:"A secret id is required."},422);if(typeof d.value!=="string"||d.value==="")return b({ok:!1,error:"A non-empty value is required."},422);return b(await By(o,Se,p,d.value))}if(L.pathname==="/api/serverless/secrets"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),p=String(d.secretId??"").trim();if(!p)return b({ok:!1,error:"A secret id is required."},422);if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to delete this secret.`},409);return b(await jy(o,Se,p))}if(L.pathname==="/api/serverless/functions/config"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=String(d.mode??"").trim();if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to update this function.`},409);return b(await Fy(o,Se,p,{memory:d.memory,timeout:d.timeout}))}if(L.pathname==="/api/serverless/alarms"&&C.method==="GET")return b(await Uy(o,Se));if(L.pathname==="/api/serverless/alarms"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=String(d.preset??"").trim(),R=Number(d.threshold);if(!p)return b({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(R))return b({ok:!1,error:"A numeric threshold is required."},422);return b(await zy(o,Se,p,R))}if(L.pathname==="/api/serverless/alarms"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),p=String(d.name??"").trim();if(!p)return b({ok:!1,error:"An alarm name is required."},422);if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to delete this alarm.`},409);return b(await Vy(o,Se,p))}if(L.pathname==="/api/serverless/traces"&&C.method==="GET"){let d=Number(L.searchParams.get("minutes"))||30;return b(await Cd(o,Se,d))}if(L.pathname==="/api/serverless/scheduler"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=String(d.action??"").trim();if(p!=="enable"&&p!=="disable"&&p!=="run")return b({ok:!1,error:"Unknown scheduler action."},422);if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to ${p} the scheduler.`},409);return b(await rp(o,Se,p))}if(!fb(L.pathname,Fn))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(Se)}`}});let ks=await ki(ue,Se);if(!ks)return Rd("ts-cloud dashboard UI is unavailable.",503);return hb(ks,L.pathname)}catch(Vo){if(e.verbose)console.error(Vo);return b({ok:!1,error:Vo?.message??String(Vo)},500)}})();if(!Kt)return Kt;if(gt&&(L.pathname.startsWith("/api/")||L.pathname.startsWith("/auth/"))){let Ze;if((Ce.headers.get("content-type")||"").includes("application/json"))Ze=await Ce.json().catch(()=>{return});let Cr=Ft.resolveUser(C),mr=Cr?Be(Cr).actor:void 0;a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,actorId:mr?.id,correlationId:qe,type:Kt.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:Kt.status<400?"info":"warning",payload:eA(C.method,L.pathname,Ze,Kt.status,Date.now()-Ne)})}return Kt.headers.set("x-request-id",qe),Kt}});Ua?.start();let Ob=e.spendLoop??!0,kp;if(Ob)(async()=>{let{SpendRunner:C,SpendLoopLease:Te,startSpendLoop:Ne}=await import("./chunk-hfswzdzj.js"),{store:Ce}=await bb(a.store),qe=new C({controlPlane:a.store,store:Ce,alerts:We});kp=Ne(qe,{lease:new Te(a.store,{owner:`dashboard:${process.pid}`}),onError:(gt)=>console.error(`[ts-cloud] spend cycle failed: ${gt instanceof Error?gt.message:String(gt)}`)})})();let _b=Ts.stop.bind(Ts);return Ts.stop=(C)=>{clearInterval(Cp),clearInterval(Ep),clearInterval(Tp),clearInterval(Ip),clearInterval(wp),clearInterval(yp),clearInterval(bp),clearInterval(Sp),clearInterval(vp),hi(),Yt.clear(),Ua?.stop(),kp?.();let Te=_b(C);if(Ua)Ua.settled().finally(()=>a.store.close());else a.store.close();return Te},{server:Ts,url:`http://${r}:${Ts.port}/`}}
-export{_e,x,An,y,Rn,Bi,In,Js,Mr,it,De,Pn,Dn,Nn,kn,xn,_n,On,$n,ie,Zt,er,Ln,Ur,Mn,Un,Bn,jn,Vn,zn,Hn,Gn,st,tr,rr,Dt,Fr,nr,ir,ji,Nt,qn,ce,Wn,Kn,Jn,Br,jr,Xn,Vr,sr,or,ot,kt,xt,zr,le,Qn,nc,ic,ar,sc,G,Vi,Ve,at,ct,Yn,Hr,Gr,Zn,ei,ti,qr,Xs,de,ye,Oe,be,ri,cr};
+`);return new Response(et,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="GET"){let ve=Be(ue);return b({ok:!0,queries:p.listSavedQueries(a.project.id,ve.actor?.id)})}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="POST"){let ve=await oe(C),je=Be(ue);return b({ok:!0,query:p.saveQuery(a.project.id,je.actor?.id,String(ve.name??""),Z(ve.query??ve))},201)}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="DELETE"){let ve=await oe(C),je=Be(ue),we=p.deleteSavedQuery(a.project.id,je.actor?.id,String(ve.id??""));return b({ok:we},we?200:404)}}if(L.pathname.startsWith("/api/configuration")){let d=a.environments.get(Se),p=ue.role==="admin"||!!Fn.capabilities?.includes("secrets:read"),R=ue.role==="admin"||!!Fn.capabilities?.includes("secrets:write"),M={projectId:a.project.id,environmentId:d?.id},j={"cache-control":"no-store"};if(L.pathname==="/api/configuration"&&C.method==="GET"){let X=Object.fromEntries(L.searchParams),F=X.scopeType||X.scopeId?aa(X,M):void 0,Z=["variable","secret"].includes(String(X.kind))?X.kind:void 0,fe=F?.type==="preview"?Ht.previews.getInstance(F.id):void 0,pe=fe?Ht.previews.getDefinition(fe.definitionId):void 0,Ge=F?await gn.resolve({projectId:a.project.id,environmentId:F.environmentId,resourceId:F.resourceId,functionId:F.type==="function"?F.id:void 0,previewId:F.previewId,trustedPreview:!!fe&&!fe.fork,allowedPreviewSecrets:pe?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:p}):void 0,ve=a.store.listResources(a.project.id);return b({ok:!0,entries:gn.list({projectId:a.project.id,scope:F,kind:Z,search:X.search,canReadSecretMetadata:p}),effectiveEntries:Ge?Object.values(Ge.entries).filter((je)=>!Z||je.kind===Z).filter((je)=>!X.search||je.key.toLowerCase().includes(String(X.search).toLowerCase())):[],configurationHash:Ge?.configurationHash,warnings:Ge?.warnings??[],scopes:{project:a.project,environments:a.store.listEnvironments(a.project.id),resources:ve.filter((je)=>je.kind!=="function"),functions:ve.filter((je)=>je.kind==="function"),previews:Ht.previews.listInstances({projectId:a.project.id}).filter((je)=>je.status!=="destroyed").map((je)=>({id:je.id,name:je.name,environmentId:je.baseEnvironmentId,resourceId:je.resourceId,fork:je.fork,status:je.status}))}},200,j)}if(L.pathname==="/api/configuration/export"&&C.method==="GET"){let X=aa(Object.fromEntries(L.searchParams),M);return new Response(gn.exportVariables({projectId:a.project.id,scope:X}),{headers:{...j,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(L.pathname==="/api/configuration/plan"&&C.method==="POST"){let X=await oe(C),F=aa(X,M),Z=X.values&&typeof X.values==="object"&&!Array.isArray(X.values)?Object.fromEntries(Object.entries(X.values).map(([fe,pe])=>[fe,String(pe)])):{};return b({ok:!0,plan:gn.plan({projectId:a.project.id,scope:F,values:Z,removeMissing:X.removeMissing===!0})},200,j)}if(L.pathname==="/api/configuration"&&C.method==="POST"){let X=await oe(C),F=aa(X,M),Z=X.kind==="secret"?"secret":"variable",fe=String(X.key??"");if(Z==="secret"&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);try{let pe=await gn.set({organizationId:a.organization.id,projectId:a.project.id,scope:F,key:fe,kind:Z,value:X.value==null?void 0:String(X.value),reference:X.reference==null?void 0:String(X.reference),backend:X.backend,required:X.required===!0,expectedVersion:X.expectedVersion==null?void 0:Number(X.expectedVersion),confirmed:String(X.confirm??"")===fe,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:Be(ue).actor?.id});return b({ok:!0,entry:gn.list({projectId:a.project.id,scope:F,canReadSecretMetadata:p}).find((Ge)=>Ge.id===pe.entry.id),mutation:pe.mutation,warnings:pe.warnings},pe.mutation.added.length?201:200,j)}catch(pe){return b({ok:!1,error:pe instanceof Error?pe.message:String(pe)},409,j)}}if(L.pathname==="/api/configuration/import"&&C.method==="POST"){let X=await oe(C),F=aa(X,M),Z=Array.isArray(X.secretKeys)?X.secretKeys.map(String):[];if(Z.length&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);try{let fe=await gn.importDotenv({organizationId:a.organization.id,projectId:a.project.id,scope:F,source:String(X.source??""),secretKeys:Z,backend:X.backend,confirmed:X.confirm==="import",idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:Be(ue).actor?.id});return b({ok:fe.document.valid,diagnostics:fe.document.diagnostics,mutation:fe.mutation,warnings:fe.warnings},fe.document.valid?200:422,j)}catch(fe){return b({ok:!1,error:fe instanceof Error?fe.message:String(fe)},409,j)}}if(L.pathname==="/api/configuration/dependencies"&&C.method==="POST"){let X=await oe(C),F=po.get(String(X.entryId??"")),Z=a.store.getResource(String(X.resourceId??""));if(!F||F.projectId!==a.project.id||!Z||Z.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry or dependent resource was not found."},404,j);return b({ok:!0,dependency:po.setDependency({entryId:F.id,resourceId:Z.id,injectionTarget:["native_reference","file"].includes(String(X.injectionTarget))?X.injectionTarget:"environment",required:X.required!==!1,requiresRedeploy:X.requiresRedeploy!==!1,lastDeployedVersion:X.lastDeployedVersion==null?void 0:Number(X.lastDeployedVersion)})},200,j)}if(L.pathname==="/api/configuration/transfer"&&C.method==="POST"){let X=await oe(C),F=po.get(String(X.id??"")),Z=aa({...X,scopeType:X.targetScopeType,scopeId:X.targetScopeId},M);if(!F||F.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,j);if(F.kind==="secret"&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);try{let fe=await gn.transfer({entryId:F.id,targetScope:Z,mode:X.mode==="move"?"move":"copy",confirmed:X.confirm===F.key,actorId:Be(ue).actor?.id,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey});return b({ok:!0,entry:gn.list({projectId:a.project.id,scope:Z,canReadSecretMetadata:p}).find((pe)=>pe.id===fe.entry.id),mutation:fe.mutation},200,j)}catch(fe){return b({ok:!1,error:fe instanceof Error?fe.message:String(fe)},409,j)}}if(L.pathname==="/api/configuration/bulk"&&C.method==="POST"){let X=await oe(C),F=Array.isArray(X.ids)?X.ids.map(String).slice(0,500):[],Z=F.map((pe)=>po.get(pe)).filter((pe)=>!!pe&&pe.projectId===a.project.id);if(Z.length!==F.length)return b({ok:!1,error:"One or more configuration entries were not found."},404,j);if(Z.some((pe)=>pe.kind==="secret")&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);if(X.action!=="delete"||X.confirm!=="bulk")return b({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,j);let fe=[];try{for(let pe of Z)fe.push(await gn.remove({entryId:pe.id,expectedVersion:pe.version,confirmed:!0,actorId:Be(ue).actor?.id}));return b({ok:!0,removed:fe.flatMap((pe)=>pe.removed),affectedResourceIds:[...new Set(fe.flatMap((pe)=>pe.affectedResourceIds))].sort()},200,j)}catch(pe){return b({ok:!1,error:pe instanceof Error?pe.message:String(pe),partial:fe.flatMap((Ge)=>Ge.removed)},409,j)}}if(L.pathname==="/api/configuration/reveal"&&C.method==="POST"){let X=await oe(C),F=Ft.resolveSession(C);try{return b({ok:!0,value:await gn.reveal({entryId:String(X.id??""),canRevealSecrets:p,recentlyAuthenticated:!Pe||!!F&&Ie.isRecentlyAuthenticated(F),actorId:Be(ue).actor?.id})},200,j)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},403,j)}}if(L.pathname==="/api/configuration"&&C.method==="DELETE"){let X=await oe(C),F=po.get(String(X.id??""));if(F?.kind==="secret"&&!R)return b({ok:!1,error:"Secret write permission is required."},403,j);if(!F||F.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,j);try{return b({ok:!0,mutation:await gn.remove({entryId:F.id,expectedVersion:Number(X.expectedVersion),confirmed:String(X.confirm??"")===F.key,actorId:Be(ue).actor?.id})},200,j)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},409,j)}}}if(L.pathname.startsWith("/api/fleet")){let d=Be(ue).actor?.id,p=(R,M=409)=>b({ok:!1,error:R instanceof Error?R.message:String(R)},M,{"cache-control":"no-store"});if(L.pathname==="/api/fleet"&&C.method==="GET")return b({ok:!0,servers:ua.list(a.project.id),resources:a.store.listResources(a.project.id),operations:At.list({projectId:a.project.id,limit:200}).filter((R)=>R.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(L.pathname==="/api/fleet"&&C.method==="POST"){let R=await oe(C);try{return b({ok:!0,server:xi.enroll({organizationId:a.organization.id,projectId:a.project.id,name:String(R.name??""),provider:["aws","hetzner"].includes(String(R.provider))?R.provider:"ssh",providerId:R.providerId?String(R.providerId):void 0,region:R.region?String(R.region):void 0,zone:R.zone?String(R.zone):void 0,endpoint:String(R.endpoint??""),sshUser:String(R.sshUser??"deploy"),sshPort:R.sshPort?Number(R.sshPort):22,credentialRef:String(R.credentialRef??""),roles:Array.isArray(R.roles)?R.roles:[],labels:R.labels&&typeof R.labels==="object"?R.labels:{}})},201)}catch(M){return p(M,422)}}if(L.pathname==="/api/fleet/action"&&C.method==="POST"){let R=await oe(C),M=String(R.id??""),j=String(R.action??"");try{if(j==="test")return b({ok:!0,server:await xi.test(M)});if(j==="validate")return b({ok:!0,server:await xi.validate(M)});if(j==="review_host_key")return b({ok:!0,server:xi.reviewHostKey(M,String(R.fingerprint??""))});if(j==="bootstrap")return b({ok:!0,...xi.bootstrap(M,R.confirmed===!0)},R.confirmed===!0?202:200);if(j==="heartbeat")return b({ok:!0,server:xi.heartbeat(M,{usage:R.usage&&typeof R.usage==="object"?R.usage:{}})});if(j==="drain")return b({ok:!0,server:xi.drain(M,R.completed===!0)});if(j==="uncordon")return b({ok:!0,server:xi.uncordon(M)});if(j==="archive")return b({ok:!0,server:xi.archive(M,String(R.confirmation??""))});return p("Unsupported fleet action.",422)}catch(X){return p(X)}}}if(L.pathname.startsWith("/api/capacity")){let d=(p,R=409)=>b({ok:!1,error:p instanceof Error?p.message:String(p)},R,{"cache-control":"no-store"});if(L.pathname==="/api/capacity"&&C.method==="GET")return b({ok:!0,pools:mo.listPools(a.project.id),placements:mo.listPlacements(a.project.id),servers:ua.list(a.project.id)},200,{"cache-control":"no-store"});if(L.pathname==="/api/capacity"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,pool:mo.createPool({organizationId:a.organization.id,projectId:a.project.id,name:String(p.name??""),purpose:String(p.purpose??"application"),backend:String(p.backend??"server"),region:p.region?String(p.region):void 0,architecture:p.architecture?String(p.architecture):void 0,labels:p.labels&&typeof p.labels==="object"?p.labels:{},requiredServerLabels:p.requiredServerLabels&&typeof p.requiredServerLabels==="object"?p.requiredServerLabels:{},toleratedTaints:Array.isArray(p.toleratedTaints)?p.toleratedTaints.map(String):[],capacity:p.capacity&&typeof p.capacity==="object"?p.capacity:{},maxWorkloads:Number(p.maxWorkloads??10),costWeight:Number(p.costWeight??1),spreadKey:p.spreadKey?String(p.spreadKey):void 0,concurrency:Number(p.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(R){return d(R,422)}}if(L.pathname==="/api/capacity/member"&&C.method==="POST"){let p=await oe(C);try{return mo.addMember(String(p.poolId??""),String(p.serverId??"")),b({ok:!0,pool:mo.getPool(String(p.poolId??""))})}catch(R){return d(R,422)}}if(L.pathname==="/api/capacity/explain"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,decisions:pp.explain(a.project.id,{purpose:String(p.purpose??"application"),resources:p.resources&&typeof p.resources==="object"?p.resources:{},region:p.region?String(p.region):void 0,architecture:p.architecture?String(p.architecture):void 0,labels:p.labels&&typeof p.labels==="object"?p.labels:{}})})}catch(R){return d(R,422)}}if(L.pathname==="/api/capacity/action"&&C.method==="POST"){let p=await oe(C);try{if(p.action==="drain")return b({ok:!0,...pp.drainPool(String(p.poolId??""))});if(p.action==="enable")return b({ok:!0,pool:mo.updatePool(String(p.poolId??""),{status:"active"})});if(p.action==="disable")return b({ok:!0,pool:mo.updatePool(String(p.poolId??""),{status:"disabled"})});return d("Unsupported capacity action.",422)}catch(R){return d(R,422)}}}if(L.pathname.startsWith("/api/regions")){let d=(p,R=409)=>b({ok:!1,error:p instanceof Error?p.message:String(p)},R,{"cache-control":"no-store"});if(L.pathname==="/api/regions"&&C.method==="GET")return b({ok:!0,topologies:zo.list(a.project.id).map((p)=>({topology:p,targets:zo.targets(p.id),channels:zo.channels(p.id),route:zo.route(p.id),executions:zo.executions(p.id)}))},200,{"cache-control":"no-store"});if(L.pathname==="/api/regions"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,topology:gp.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:a.environments.get(Se)?.id,name:String(p.name??""),hostname:String(p.hostname??""),regions:Array.isArray(p.regions)?p.regions:[],trafficPolicy:p.trafficPolicy==="weighted"||p.trafficPolicy==="latency"?p.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(p.replicate)?p.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(p.maxLagSeconds??30),retainOnDestroy:p.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:p.cdnEnabled===!0,wafEnabled:p.wafEnabled===!0})},201)}catch(R){return d(R,422)}}if(L.pathname==="/api/regions/action"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,...gp.enqueue({topologyId:String(p.topologyId??""),kind:String(p.action??""),targetRegion:p.targetRegion?String(p.targetRegion):void 0,revision:p.revision?String(p.revision):void 0,manifest:p.manifest&&typeof p.manifest==="object"?p.manifest:{},confirmation:p.confirmation?String(p.confirmation):void 0,deleteData:p.deleteData===!0})},202)}catch(R){return d(R,422)}}}if(L.pathname.startsWith("/api/maintenance")){let d=(p,R=409)=>b({ok:!1,error:p instanceof Error?p.message:String(p)},R,{"cache-control":"no-store"});if(L.pathname==="/api/maintenance"&&C.method==="GET")return b({ok:!0,manifests:zi.manifests(a.organization.id),windows:zi.windows(a.project.id),campaigns:zi.campaigns(a.project.id).map((p)=>({campaign:p,targets:zi.targets(p.id)})),cleanups:zi.cleanups(a.project.id),drills:zi.drills(a.project.id)},200,{"cache-control":"no-store"});if(L.pathname==="/api/maintenance/cleanup-preview"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,plan:await Od.previewCleanup({projectId:a.project.id,kind:String(p.kind??"operations"),criteria:{olderThanDays:Number(p.olderThanDays??30)}},mp)},201)}catch(R){return d(R,422)}}if(L.pathname==="/api/maintenance/cleanup-apply"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,...Od.enqueueCleanup(String(p.planId??""),String(p.confirmation??""))},202)}catch(R){return d(R,422)}}if(L.pathname==="/api/maintenance/drill"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,drill:zi.createDrill({projectId:a.project.id,scenario:String(p.scenario??"control_plane"),isolatedTarget:String(p.isolatedTarget??""),expectedRpoMinutes:Number(p.expectedRpoMinutes??60),expectedRtoMinutes:Number(p.expectedRtoMinutes??30),recoveryPointId:p.recoveryPointId?String(p.recoveryPointId):void 0,topologyId:p.topologyId?String(p.topologyId):void 0})},201)}catch(R){return d(R,422)}}if(L.pathname==="/api/maintenance/drill-run"&&C.method==="POST"){let p=await oe(C);try{return b({ok:!0,...Od.enqueueDrill(String(p.drillId??""))},202)}catch(R){return d(R,422)}}}if(L.pathname.startsWith("/api/volumes")){let d=a.environments.get(Se),p=Be(ue).actor?.id,R=(M,j=409)=>b({ok:!1,error:M instanceof Error?M.message:String(M)},j,{"cache-control":"no-store"});if(L.pathname==="/api/volumes"&&C.method==="GET"){let M=xd.inventory(a.project.id,d?.id),j=a.store.listResources(a.project.id,d?.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind,provider:X.provider,providerId:X.providerId}));return b({ok:!0,volumes:M,resources:j,operations:At.list({projectId:a.project.id,limit:100}).filter((X)=>X.operation.kind.startsWith("volume.")),recoveryPoints:Qt.listRecoveryPoints(a.project.id).filter((X)=>X.kind==="volume"),providers:Dd.map((X)=>({provider:X.provider,type:X.type,capabilities:X.capabilities()}))},200,{"cache-control":"no-store"})}if(L.pathname==="/api/volumes"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:M.resourceId?String(M.resourceId):void 0,name:String(M.name??""),provider:String(M.provider??"docker"),type:M.type==="docker"?"docker":M.type,capacityBytes:M.capacityBytes==null?void 0:Number(M.capacityBytes),filesystem:M.filesystem?String(M.filesystem):void 0,encrypted:M.encrypted===!0,desiredState:M.desiredState&&typeof M.desiredState==="object"?M.desiredState:{},actorId:p})},202,{"cache-control":"no-store"})}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/attach"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.attach(String(M.volumeId??""),{resourceId:String(M.resourceId??""),targetPath:String(M.targetPath??""),readOnly:M.readOnly===!0,uid:M.uid==null?void 0:Number(M.uid),gid:M.gid==null?void 0:Number(M.gid),mode:M.mode?String(M.mode):void 0,propagation:M.propagation,driverOptions:M.driverOptions&&typeof M.driverOptions==="object"?M.driverOptions:{},actorId:p})},202)}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/detach"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.detach(String(M.volumeId??""),String(M.attachmentId??""),{force:M.force===!0,drained:M.drained===!0,unmounted:M.unmounted===!0,confirmation:M.confirmation?String(M.confirmation):void 0,actorId:p})},202)}catch(j){return R(j)}}if(L.pathname==="/api/volumes/resize"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.resize(String(M.volumeId??""),Number(M.capacityBytes),{drained:M.drained===!0,actorId:p})},202)}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/snapshot"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.snapshot(String(M.volumeId??""),{name:M.name?String(M.name):void 0,actorId:p})},202)}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/restore"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,...Ui.restore(String(M.snapshotId??""),{name:String(M.name??""),actorId:p})},202)}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes/discover"&&C.method==="POST")try{return b({ok:!0,volumes:await Ui.discover({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,actorId:p})})}catch(M){return R(M,502)}if(L.pathname==="/api/volumes/adopt"&&C.method==="POST"){let M=await oe(C);try{return b({ok:!0,volume:Ui.adopt(String(M.volumeId??""),{name:String(M.name??""),actorId:p})})}catch(j){return R(j,422)}}if(L.pathname==="/api/volumes"&&C.method==="DELETE"){let M=await oe(C),j=Ft.resolveSession(C);try{return b({ok:!0,...Ui.delete(String(M.volumeId??""),{recentAuthAt:!Pe||j&&Ie.isRecentlyAuthenticated(j)?new Date().toISOString():void 0,confirmation:M.confirmation?String(M.confirmation):void 0,backupOverride:M.backupOverride===!0,backupOverrideConfirmation:M.backupOverrideConfirmation?String(M.backupOverrideConfirmation):void 0,actorId:p})},202)}catch(X){return R(X)}}}if(L.pathname==="/api/backups"&&C.method==="GET"){let d=a.environments.get(Se),p=Qt.listPolicies(a.project.id,d?.id),R=new Set(p.map((Z)=>Z.id)),M=Qt.listRecoveryPoints(a.project.id).filter((Z)=>!Z.policyId||R.has(Z.policyId)),j=Qt.listJobs(a.project.id).filter((Z)=>!Z.policyId||R.has(Z.policyId)),X=(Z)=>({...Z,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Z.credentialRef,clientEncryptionConfigured:!!Z.encryptionKeyRef}),F=await Promise.all(Qt.listDestinations(a.project.id).map(async(Z)=>({...X(Z),credentialStatus:await Qg(Z,Fi)})));return b({ok:!0,destinations:F,policies:p,recoveryPoints:M,jobs:j,coverage:Qt.coverage(a.project.id).filter((Z)=>R.has(Z.policy.id)),resources:d?a.store.listResources(a.project.id,d.id).map((Z)=>({id:Z.id,name:Z.name,slug:Z.slug,kind:Z.kind})):[]})}if(L.pathname==="/api/backups/destinations"&&C.method==="POST"){let d=await oe(C),p=String(d.name??"").trim(),R=String(d.provider??""),M=String(d.encryption??"provider"),j=`secret://data-services/backups/${a.project.id}/${p}`,X=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(R))return b({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(M))return b({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let F,Z;if(d.credentials&&typeof d.credentials==="object"&&!Array.isArray(d.credentials))F=`${j}/credentials`,await Fi.put(F,JSON.stringify(d.credentials)),X.push(F);if(M!=="provider"){let pe=String(d.encryptionKey??"");if(pe.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");Z=`${j}/encryption-key`,await Fi.put(Z,pe),X.push(Z)}let fe=Qt.createDestination({organizationId:a.organization.id,projectId:a.project.id,name:p,provider:R,endpoint:d.endpoint?String(d.endpoint):void 0,endpointPolicy:d.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:d.bucket?String(d.bucket):void 0,prefix:String(d.prefix??""),region:d.region?String(d.region):go,forcePathStyle:d.forcePathStyle===!0,credentialRef:F,encryption:M,encryptionKeyRef:Z,immutability:d.immutability&&typeof d.immutability==="object"&&!Array.isArray(d.immutability)?d.immutability:{},status:"untested"});return b({ok:!0,destination:{...fe,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!F,clientEncryptionConfigured:!!Z}},201)}catch(F){for(let Z of X)await Fi.remove(Z).catch(()=>{});return b({ok:!1,error:F instanceof Error?F.message:String(F)},422)}}if(L.pathname==="/api/backups/destinations/test"&&C.method==="POST"){let d=await oe(C),p=Qt.getDestination(String(d.id??""));if(!p||p.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(p.provider==="aws_backup")return b({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await lp.test(p),b({ok:!0,destination:Qt.recordDestinationTest(p.id,{ok:!0})})}catch(R){let M=R instanceof Error?R.message:String(R);return Qt.recordDestinationTest(p.id,{ok:!1,error:M}),b({ok:!1,error:M},502)}}if(L.pathname==="/api/backups/policies"&&C.method==="POST"){let d=await oe(C),p=a.environments.get(Se),R=Qt.getDestination(String(d.destinationId??"")),M=String(d.resourceKind??""),j=d.dataServiceId?String(d.dataServiceId):void 0,X=j?Mt.get(j):void 0,F=d.resourceId?String(d.resourceId):void 0,Z=F?a.store.getResource(F):void 0;if(!p)return b({ok:!1,error:"Environment was not found."},404);if(!R||R.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(M))return b({ok:!1,error:"A supported backup resource kind is required."},422);if(j&&(!X||X.projectId!==a.project.id||X.environmentId!==p.id))return b({ok:!1,error:"Data service was not found in this environment."},404);if(F&&(!Z||Z.projectId!==a.project.id||Z.environmentId!==p.id))return b({ok:!1,error:"Resource was not found in this environment."},404);if(M==="managed_database"&&!X)return b({ok:!1,error:"Managed database policies require a data service."},422);if(M==="logical_database"&&(!X||!["container","server"].includes(X.provider)))return b({ok:!1,error:"Logical database policies require an on-box data service."},422);if(M==="volume"&&(!Z||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(d.volumeName??""))))return b({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let fe=Array.isArray(d.includePatterns)?d.includePatterns.map(String).filter(Boolean):[];if(M==="files"&&(!Z||!fe.length))return b({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(M==="control_plane"&&R.encryption==="provider")return b({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(M==="infrastructure"&&(R.provider!=="aws_backup"||!fe.some((pe)=>pe.startsWith("resource:arn:"))||!fe.some((pe)=>pe.startsWith("role:arn:"))))return b({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let pe=Qt.createPolicy({organizationId:a.organization.id,projectId:a.project.id,environmentId:p.id,resourceId:F,dataServiceId:j,destinationId:R.id,name:String(d.name??"").trim(),resourceKind:M,schedule:String(d.schedule??"daily"),timezone:String(d.timezone??"UTC"),retention:d.retention&&typeof d.retention==="object"&&!Array.isArray(d.retention)?d.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(d.compression))?d.compression:"gzip",encryption:["destination","client_side","both"].includes(String(d.encryption))?d.encryption:"destination",includePatterns:M==="volume"?[String(d.volumeName),...fe]:fe,excludePatterns:Array.isArray(d.excludePatterns)?d.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(d.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(d.expectedRtoMinutes)||120),healthCheckId:d.healthCheckId?String(d.healthCheckId):void 0,enabled:d.enabled!==!1});return b({ok:!0,policy:pe},201)}catch(pe){return b({ok:!1,error:pe instanceof Error?pe.message:String(pe)},422)}}if(L.pathname==="/api/backups/run"&&C.method==="POST"){let d=await oe(C),p=Qt.getPolicy(String(d.policyId??"")),R=a.environments.get(Se);if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Backup policy was not found in this environment."},404);try{let M=Fo.enqueueBackup(p,new Date().toISOString(),Be(ue).actor?.id);return b({ok:!0,job:M},202)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:String(M)},409)}}if(L.pathname==="/api/backups/verify"&&C.method==="POST"){let d=await oe(C),p=Qt.getRecoveryPoint(String(d.recoveryPointId??""));if(!p||p.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);return b({ok:!0,job:Fo.enqueueVerification(p)},202)}if(L.pathname==="/api/backups/restore"&&C.method==="POST"){let d=await oe(C),p=Qt.getRecoveryPoint(String(d.recoveryPointId??"")),R=d.mode==="in_place"?"in_place":"isolated",M=d.target&&typeof d.target==="object"&&!Array.isArray(d.target)?{...d.target,inPlace:R==="in_place"}:{inPlace:R==="in_place"},j=Ft.resolveSession(C),X={mode:R,target:M,targetName:String(d.targetName??""),confirm:d.confirm?String(d.confirm):void 0,recentAuth:!Pe||!!j&&Ie.isRecentlyAuthenticated(j),downtimeAcknowledged:d.downtimeAcknowledged===!0,safetyBackupId:d.safetyBackupId?String(d.safetyBackupId):void 0};if(!p||p.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.drill===!0&&R!=="isolated")return b({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let F=Fo.planRestore(p,X);if(d.execute!==!0)return b({ok:!0,plan:F,executionCreated:!1});let Z=Fo.enqueueRestore(p,{...X,drill:d.drill===!0,actorId:Be(ue).actor?.id});return b({ok:!0,plan:F,job:Z},202)}catch(F){return b({ok:!1,error:F instanceof Error?F.message:String(F)},409)}}if(L.pathname==="/api/backups/recovery-points"&&C.method==="POST"){let d=await oe(C),p=Qt.getRecoveryPoint(String(d.id??""));if(!p||p.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.held==null&&d.pinned==null)return b({ok:!1,error:"held or pinned must be provided."},422);return b({ok:!0,recoveryPoint:Qt.updateRecoveryPoint(p.id,{held:d.held==null?p.held:d.held===!0,pinned:d.pinned==null?p.pinned:d.pinned===!0})})}if(L.pathname==="/api/backups/retention"&&C.method==="POST")return b({ok:!0,jobs:Fo.enqueueRetention()},202);if(L.pathname==="/api/data-services/capabilities"&&C.method==="GET"){let d=String(L.searchParams.get("engine")??""),p=String(L.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(d)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(p))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,engine:d,provider:p,capabilities:Zt(d,p)})}if(L.pathname==="/api/data-services"&&C.method==="GET"){let d=a.environments.get(Se),p=Mt.list(a.project.id,d?.id).map((R)=>{let M=Mt.credential(R.id);return{...R,credentialRef:void 0,credential:M?{configured:!0,username:M.username,version:M.version,rotatedAt:M.rotatedAt}:void 0,dependencies:Mt.dependencies(R.id).map((j)=>({resourceId:j.resourceId,requiresRedeploy:j.requiresRedeploy}))}});return b({ok:!0,services:p})}if(L.pathname==="/api/data-services/preview"&&C.method==="POST"){let d=await oe(C);if(d.id){let M=Mt.get(String(d.id)),j=a.environments.get(Se),X=String(d.action??"");if(!M||M.projectId!==a.project.id||M.environmentId!==j?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Ad.includes(X))return b({ok:!1,error:`Action must be one of: ${Ad.join(", ")}.`},422);try{return b({ok:!0,plan:Fa.plan(M,X,d.changes??{})})}catch(F){return b({ok:!1,error:F instanceof Error?F.message:String(F)},422)}}let p=String(d.engine??""),R=String(d.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(p)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(R))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,capabilities:Zt(p,R),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(L.pathname==="/api/data-services"&&C.method==="POST"){let d=await oe(C),p=String(d.engine??""),R=String(d.provider??""),M=a.environments.get(Se),j=Be(ue);if(!M)return b({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(p)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(R))return b({ok:!1,error:"A supported engine and provider are required."},422);let X={organizationId:a.organization.id,projectId:a.project.id,environmentId:M.id,resourceId:d.resourceId?String(d.resourceId):void 0,name:String(d.name??"").trim(),engine:p,provider:R,placement:String(d.placement??d.name??"").trim(),engineVersion:d.engineVersion?String(d.engineVersion):void 0,plan:String(d.plan??(R==="aws_elasticache"?"cache.t4g.micro":R==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:d.storageGb==null?void 0:Number(d.storageGb),highAvailability:d.highAvailability===!0,publicExposure:d.publicExposure===!0,allowedCidrs:Array.isArray(d.allowedCidrs)?d.allowedCidrs.map(String):[],desiredState:d.desiredState&&typeof d.desiredState==="object"&&!Array.isArray(d.desiredState)?d.desiredState:{},observedState:{},origin:d.adopt===!0?"adopted":"managed",managementEnabled:d.adopt!==!0,ownerActorId:j.actor?.id,username:d.username?String(d.username):void 0};try{if(d.adopt===!0){let Z=Mt.create({...X,status:"adopted",credentialRef:void 0});return b({ok:!0,service:Z,readOnly:!0},201)}if(!up({provider:R,engine:p}))return b({ok:!1,error:`No ${R}/${p} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let F=await Fa.create(X);return b({ok:!0,service:F.service,operationId:F.operationId,oneTimeCredential:F.credential},201)}catch(F){return b({ok:!1,error:F instanceof Error?F.message:String(F)},422)}}if(L.pathname==="/api/data-services/connections"&&C.method==="GET"){let d=Mt.get(String(L.searchParams.get("id")??"")),p=a.environments.get(Se);if(!d||d.projectId!==a.project.id||d.environmentId!==p?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);let R=typeof d.observedState.endpoint==="string"?d.observedState.endpoint:void 0,M=typeof d.observedState.readerEndpoint==="string"?d.observedState.readerEndpoint:void 0,j=Number(d.observedState.port)||(d.engine==="postgres"?5432:d.engine==="redis"?6379:d.engine==="mongodb"?27017:d.engine==="libsql"?8080:3306),X=typeof d.observedState.database==="string"?d.observedState.database:void 0,F=typeof d.observedState.tls==="boolean"?d.observedState.tls:d.provider.startsWith("aws_"),Z=[...R?[{type:d.publicExposure?"external":"internal",host:R,port:j,database:X,tls:F}]:[],...M?[{type:"internal",host:M,port:j,database:X,tls:F}]:[],{type:"tunnel",host:R??d.placement,port:j,database:X,tls:F}];return b({ok:!0,serviceId:d.id,guidance:Ln(d,Z)})}if(L.pathname==="/api/data-services/action"&&C.method==="POST"){let d=await oe(C),p=Mt.get(String(d.id??"")),R=a.environments.get(Se),M=String(d.action??"");if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Ad.includes(M))return b({ok:!1,error:`Action must be one of: ${Ad.join(", ")}.`},422);let j=d.changes&&typeof d.changes==="object"&&!Array.isArray(d.changes)?d.changes:{};try{let X=Fa.plan(p,M,j);if(d.execute!==!0)return b({ok:!0,plan:X,productionExecutionCreated:!1});let F=Fa.enqueue(p,M,j,Be(ue).actor?.id);return b({ok:!0,plan:X,operationId:F},202)}catch(X){return b({ok:!1,error:X instanceof Error?X.message:String(X)},409)}}if(L.pathname==="/api/data-services/dependencies"&&C.method==="POST"){let d=await oe(C),p=Mt.get(String(d.id??"")),R=a.environments.get(Se),M=a.store.getResource(String(d.resourceId??""));if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M||M.projectId!==a.project.id||M.environmentId!==R?.id)return b({ok:!1,error:"Dependent resource was not found in this environment."},404);if(d.remove===!0)return b({ok:Mt.removeDependency(p.id,M.id)});return Mt.addDependency({serviceId:p.id,resourceId:M.id,secretRef:p.credentialRef??`secret://data-services/${p.projectId}/${p.name}`,requiresRedeploy:d.requiresRedeploy!==!1}),b({ok:!0,dependencies:Mt.dependencies(p.id).map((j)=>({resourceId:j.resourceId,requiresRedeploy:j.requiresRedeploy}))})}if(L.pathname==="/api/data-services/management"&&C.method==="POST"){let d=await oe(C),p=Mt.get(String(d.id??"")),R=a.environments.get(Se);if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(p.origin!=="adopted"||d.reviewed!==!0||d.confirm!==p.name)return b({ok:!1,error:`Enabling management requires reviewed=true and typing ${p.name}.`},409);return b({ok:!0,service:Mt.update(p.id,p.version,{managementEnabled:!0})})}if(L.pathname==="/api/data-services/reveal"&&C.method==="POST"){let d=await oe(C),p=Mt.get(String(d.id??"")),R=a.environments.get(Se),M=p?Mt.credential(p.id):void 0;if(!p||p.projectId!==a.project.id||p.environmentId!==R?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M)return b({ok:!1,error:"No managed credential is configured."},404);return b({ok:!0,credential:{username:M.username,password:await Fi.resolve(M.secretRef),version:M.version}},200,{"cache-control":"no-store"})}if(L.pathname==="/api/databases"&&C.method==="GET")return b(await Fh(o,Se));if(L.pathname==="/api/databases"&&C.method==="POST"){let d=await oe(C),p=String(d.name??"").trim();if(!so(p))return b({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return b({...await Uh(o,Se,p),name:p})}if(L.pathname==="/api/databases/vitess"&&C.method==="GET"){let d=await Jh(o,Se);return b({...d,unhealthy:Gh(d.tablets),missingPrimary:Wh(d)})}if(L.pathname==="/api/databases/vitess/provision"&&C.method==="POST"){let d=await oe(C);try{return b(await ry(o,Se,{keyspace:String(d.keyspace??""),username:String(d.username??""),password:String(d.password??""),sharded:d.sharded===!0,confirm:String(d.confirm??"")}))}catch(p){return b({ok:!1,error:p instanceof Error?p.message:String(p)},422)}}if(L.pathname==="/api/databases/vitess/migrations"&&C.method==="GET"){let d=L.searchParams.get("keyspace")??void 0;return b(await ey(o,Se,d))}if(L.pathname==="/api/databases/vitess/migrations/action"&&C.method==="POST"){let d=await oe(C),p=String(d.uuid??"").trim(),R=String(d.action??"");if(!["retry","cancel","cleanup","complete"].includes(R))return b({ok:!1,error:"Unknown migration action."},422);return b(await ty(o,Se,p,R))}if(L.pathname==="/api/databases/vitess/keyspaces"&&C.method==="POST"){let d=await oe(C),p=String(d.name??"").trim(),R=d.sharded===!0;return b(await Yh(o,Se,p,{sharded:R}))}if(L.pathname==="/api/databases/vitess/vschema"&&C.method==="POST"){let d=await oe(C),p=String(d.keyspace??"").trim(),R=typeof d.vschema==="string"?d.vschema:JSON.stringify(d.vschema??null);return b(await Xh(o,Se,p,R))}if(L.pathname==="/api/databases/vitess/schema"&&C.method==="POST"){let d=await oe(C),p=String(d.sql??"");return b(await Zh(o,Se,p))}if(L.pathname==="/api/databases/vitess/install-client"&&C.method==="POST")return b(await Qh(o,Se));if(L.pathname==="/api/databases/backups"&&C.method==="GET")return b(await qh(o,Se));if(L.pathname==="/api/databases/backup"&&C.method==="POST"){let d=await oe(C),p=String(d.database??"").trim();if(!so(p))return b({ok:!1,error:"Database name must be a valid identifier."},422);if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to back up this database.`},409);return b(await Vh(o,Se,p))}if(L.pathname==="/api/databases/users"&&C.method==="POST"){let d=await oe(C),p=String(d.username??"").trim(),R=String(d.password??""),M=String(d.database??"").trim()||void 0,j=d.access==="readonly"?"readonly":"all";if(!so(p))return b({ok:!1,error:"Username must be a valid identifier."},422);if(!R)return b({ok:!1,error:"Password is required."},422);if(M&&!so(M))return b({ok:!1,error:"Database must be a valid identifier."},422);return b({...await zh(o,Se,{username:p,password:R,database:M,access:j}),username:p})}if(L.pathname==="/api/dashboard-data")return Lt=W.get(Se)??await tt(Se),tt(Se),b(Hl(Lt,{user:Fn,slug:o.project.slug}));if(L.pathname==="/api/users"&&C.method==="GET")return b({ok:!0,users:ln(t).map(oa)});if(L.pathname==="/api/users"&&C.method==="POST"){let d=await oe(C),p=String(d.username??"").trim();if(!Sd(p))return b({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let R=d.sites&&typeof d.sites==="object"?d.sites:{},M=new Set(Object.keys(o.sites??{})),j={};for(let[Z,fe]of Object.entries(R)){if(!M.has(Z))return b({ok:!1,error:`Site '${Z}' was not found.`},404);if(fe!=="owner"&&fe!=="collaborator")return b({ok:!1,error:`Unknown site role '${fe}'. Use 'owner' or 'collaborator'.`},422);j[Z]=fe}let X=typeof d.password==="string"&&d.password.trim()?d.password.trim():void 0;if(X&&X.length<12)return b({ok:!1,error:"Password must be at least 12 characters."},422);let F=Na(t,{username:p,password:X,name:typeof d.name==="string"?d.name:void 0,sites:j});return ud(a,ln(t)),hi(),b({ok:!0,user:oa(F.user),password:F.password})}if(L.pathname==="/api/users"&&C.method==="DELETE"){let d=await oe(C),p=String(d.username??"").trim();if(p.toLowerCase()===ue.username.toLowerCase())return b({ok:!1,error:"You cannot remove your own account."},409);let R=fi(ln(t),p),M=R?a.store.getActorByExternalId("user",`dashboard:${R.username.toLowerCase()}`):void 0,j=M?a.store.getMembershipForActor(a.organization.id,M.id):void 0;if(j&&j.source!=="legacy")return b({ok:!1,error:"Organization members must be removed from Organization access."},409);let X=Gl(t,p);if(!X.ok)return b(X,409);return ud(a,ln(t)),Re.clear(),b({ok:!0,username:p})}if(L.pathname==="/api/actions/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=d.action?hA(d.action,Se):void 0;if(!p)return b({ok:!1,error:"Unknown dashboard action."},404);if(p.mutates&&d.confirm!==p.confirm)return b({ok:!1,error:`Type "${p.confirm}" to run this action.`},409);let R=await oo({controlPlane:a,environment:Se,actor:ue,kind:`dashboard.action.${p.id}`,input:{action:p.id},execute:()=>ap(p,{cwd:t,cliEntry:i})});return b({...R.result,controlPlaneOperation:R.operation})}if(L.pathname==="/api/server/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=d.operation?Xn(d.operation,o,Lt):void 0;if(!p)return b({ok:!1,error:"Unknown or unavailable server operation."},404);if(p.mutates&&d.confirm!==p.confirm)return b({ok:!1,error:`Type "${p.confirm}" to run this operation.`},409);let R=le(a,String(Se));await new ps(rt).run(new Da,{...R,artifactRoot:t});let M=ar(rt,{scope:R,desiredConfigHash:a.project.desiredConfigHash});if(M.decision.outcome==="block")return b({ok:!1,error:`Operation blocked by security policy: ${M.decision.explanation}`,securityReview:M},409);let j=await oo({controlPlane:a,environment:Se,actor:ue,kind:`dashboard.server.${p.id}`,resourceSlug:p.target,input:{operation:p.id,target:p.target,to:d.to??null},execute:()=>Vr(o,Se,p,{to:d.to})});return b({...j.result,controlPlaneOperation:j.operation,securityReview:M})}if(L.pathname==="/api/server/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command on the server.'},409);let p=await oo({controlPlane:a,environment:Se,actor:ue,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>sr(o,Se,String(d.command??""))});return b({...p.result,controlPlaneOperation:p.operation})}if(L.pathname==="/api/serverless/operations")return b(Zl(o,Se,Lt));if(L.pathname==="/api/serverless/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=d.operation?Dy(d.operation,o,Se,Lt):void 0;if(!p)return b({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(p.mutates&&d.confirm!==p.confirm)return b({ok:!1,error:`Type "${p.confirm}" to run this operation.`},409);let R=await oo({controlPlane:a,environment:Se,actor:ue,kind:`dashboard.serverless.${p.id}`,input:{operation:p.id,min:d.min??null,max:d.max??null},execute:()=>Oy(o,Se,p,{min:d.min,max:d.max})});return Lt=await bs(o,Se),W.set(Se,Lt),b({...R.result,controlPlaneOperation:R.operation})}if(L.pathname==="/api/serverless/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command.'},409);return b(await _y(o,Se,String(d.command??"")))}if(L.pathname==="/api/serverless/dlq"&&C.method==="GET"){let d=Number(L.searchParams.get("max"))||10;return b(await Ny(o,Se,d))}if(L.pathname==="/api/serverless/dlq/redrive"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="redrive")return b({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return b(await $y(o,Se,{max:d.max,targetQueue:d.targetQueue}))}if(L.pathname==="/api/serverless/dlq/purge"&&C.method==="POST"){if((await C.json().catch(()=>({}))).confirm!=="purge")return b({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return b(await My(o,Se))}if(L.pathname==="/api/serverless/secrets"&&C.method==="GET")return b({secrets:Ly(o,Se)});if(L.pathname==="/api/serverless/secrets"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=String(d.secretId??"").trim();if(!p)return b({ok:!1,error:"A secret id is required."},422);if(typeof d.value!=="string"||d.value==="")return b({ok:!1,error:"A non-empty value is required."},422);return b(await By(o,Se,p,d.value))}if(L.pathname==="/api/serverless/secrets"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),p=String(d.secretId??"").trim();if(!p)return b({ok:!1,error:"A secret id is required."},422);if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to delete this secret.`},409);return b(await jy(o,Se,p))}if(L.pathname==="/api/serverless/functions/config"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=String(d.mode??"").trim();if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to update this function.`},409);return b(await Fy(o,Se,p,{memory:d.memory,timeout:d.timeout}))}if(L.pathname==="/api/serverless/alarms"&&C.method==="GET")return b(await Uy(o,Se));if(L.pathname==="/api/serverless/alarms"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=String(d.preset??"").trim(),R=Number(d.threshold);if(!p)return b({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(R))return b({ok:!1,error:"A numeric threshold is required."},422);return b(await zy(o,Se,p,R))}if(L.pathname==="/api/serverless/alarms"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),p=String(d.name??"").trim();if(!p)return b({ok:!1,error:"An alarm name is required."},422);if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to delete this alarm.`},409);return b(await Vy(o,Se,p))}if(L.pathname==="/api/serverless/traces"&&C.method==="GET"){let d=Number(L.searchParams.get("minutes"))||30;return b(await Cd(o,Se,d))}if(L.pathname==="/api/serverless/scheduler"&&C.method==="POST"){let d=await C.json().catch(()=>({})),p=String(d.action??"").trim();if(p!=="enable"&&p!=="disable"&&p!=="run")return b({ok:!1,error:"Unknown scheduler action."},422);if(d.confirm!==p)return b({ok:!1,error:`Type "${p}" to ${p} the scheduler.`},409);return b(await rp(o,Se,p))}if(!fb(L.pathname,Fn))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(Se)}`}});let ks=await ki(ue,Se);if(!ks)return Rd("ts-cloud dashboard UI is unavailable.",503);return hb(ks,L.pathname)}catch(Vo){if(e.verbose)console.error(Vo);return b({ok:!1,error:Vo?.message??String(Vo)},500)}})();if(!Kt)return Kt;if(gt&&(L.pathname.startsWith("/api/")||L.pathname.startsWith("/auth/"))){let Ze;if((Ce.headers.get("content-type")||"").includes("application/json"))Ze=await Ce.json().catch(()=>{return});let Cr=Ft.resolveUser(C),mr=Cr?Be(Cr).actor:void 0;a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,actorId:mr?.id,correlationId:qe,type:Kt.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:Kt.status<400?"info":"warning",payload:eA(C.method,L.pathname,Ze,Kt.status,Date.now()-Ne)})}return Kt.headers.set("x-request-id",qe),Kt}});Ua?.start();let Ob=e.spendLoop??!0,kp;if(Ob)(async()=>{let{SpendRunner:C,SpendLoopLease:Te,startSpendLoop:Ne}=await import("./chunk-xpzkwgb4.js"),{store:Ce}=await bb(a.store),qe=new C({controlPlane:a.store,store:Ce,alerts:We});kp=Ne(qe,{lease:new Te(a.store,{owner:`dashboard:${process.pid}`}),onError:(gt)=>console.error(`[ts-cloud] spend cycle failed: ${gt instanceof Error?gt.message:String(gt)}`)})})();let _b=Ts.stop.bind(Ts);return Ts.stop=(C)=>{clearInterval(Cp),clearInterval(Ep),clearInterval(Tp),clearInterval(Ip),clearInterval(wp),clearInterval(yp),clearInterval(bp),clearInterval(Sp),clearInterval(vp),hi(),Yt.clear(),Ua?.stop(),kp?.();let Te=_b(C);if(Ua)Ua.settled().finally(()=>a.store.close());else a.store.close();return Te},{server:Ts,url:`http://${r}:${Ts.port}/`}}
+export{_e,x,An,y,Rn,Bi,In,Js,Mr,it,De,Pn,Dn,Nn,kn,xn,_n,On,$n,ie,Zt,er,Ln,Ur,Mn,Un,Bn,jn,Vn,zn,Hn,qn,st,tr,rr,Dt,Fr,nr,ir,ji,Nt,Gn,ce,Wn,Kn,Jn,Br,jr,Xn,Vr,sr,or,ot,kt,xt,zr,le,Qn,nc,ic,ar,sc,q,Vi,Ve,at,ct,Yn,Hr,qr,Zn,ei,ti,Gr,Xs,de,ye,Oe,be,ri,cr};