@stacksjs/ts-cloud 0.16.45 → 0.16.46

package/dist/{chunk-294kdscm.js → chunk-j2jex596.js}

@@ -1,4 +1,4 @@
-import{_d,L,d,$d,Q,g,fe,p,Xt,Hd,Fi,To,jd,Wd,Jd,Al,tn,qi,nr,yl,Sl,Tl,wl}from"./chunk-c5jyzyqw.js";import{_,u}from"./chunk-hm6pwhne.js";import{me,Vt,P,qt,s,vi,Zs,Mr,nd,id,te,c,ro,Ve,Fr,sd,jt,io,od,Ur,so,Qr,Ri,Wt,ki,Bi,qe,Jt,Rd,Dd,Oi,_i,At,So,i,Li,bo,Co}from"./chunk-v3w791ze.js";import{n}from"./chunk-cgcthvq9.js";import{o}from"./chunk-bwtxb2hf.js";import{Tn}from"./chunk-j5x0qn7z.js";import{be}from"./chunk-w78e5n94.js";import{wn,eg,Is,B,w,bs,tg}from"./chunk-96vc5w8w.js";import{Se,lr,Ts,nt,W,ae,E,Ie,pr,ce,st,fr}from"./chunk-8jsf214f.js";import{J}from"./chunk-ct72f70x.js";import{v,br,Qs,Qt,Cr,mg,Ht,hg,Ag,Tc,Qe,lt,ri,O,Gt,kr}from"./chunk-vv5fmmhr.js";import{S}from"./chunk-3s8dtcz8.js";import{$e}from"./chunk-varjr6np.js";import{Re}from"./chunk-fwcf0n8f.js";import{h}from"./chunk-9e4afej1.js";function An(e){let t=Dc(e.name),r=xl(e.configText);if(kw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=Gf({...e,name:t}),l=e.configText.slice(0,r.end).trimEnd(),m=e.configText.slice(r.end),f=l.endsWith("{")?`
+import{_d,L,d,$d,Q,g,fe,p,Xt,Hd,Fi,To,jd,Wd,Jd,Al,tn,qi,nr,yl,Sl,Tl,wl}from"./chunk-j73ntebp.js";import{_,u}from"./chunk-tj852ns1.js";import{me,Vt,P,qt,s,vi,Zs,Mr,nd,id,te,c,ro,Ve,Fr,sd,jt,io,od,Ur,so,Qr,Ri,Wt,ki,Bi,qe,Jt,Rd,Dd,Oi,_i,At,So,i,Li,bo,Co}from"./chunk-jzpwfgg1.js";import{n}from"./chunk-2sc0s7pc.js";import{o}from"./chunk-jpdpr7k6.js";import{Tn}from"./chunk-wmxw3pe4.js";import{be}from"./chunk-nryh43p1.js";import{wn,eg,Is,B,w,bs,tg}from"./chunk-yxzdwe7j.js";import{Se,lr,Ts,nt,W,ae,E,Ie,pr,ce,st,fr}from"./chunk-1dbe68z7.js";import{J}from"./chunk-fh7apa5n.js";import{v,br,Qs,Qt,Cr,fg,Ht,Ag,yg,Tc,Qe,lt,ri,O,Gt,kr}from"./chunk-46bazfbh.js";import{S}from"./chunk-r86dh7h7.js";import{$e}from"./chunk-xzcpzxtj.js";import{Re}from"./chunk-xxq1ygp9.js";import{h}from"./chunk-vjph4eh0.js";function An(e){let t=Dc(e.name),r=xl(e.configText);if(kw(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let a=Vf({...e,name:t}),l=e.configText.slice(0,r.end).trimEnd(),m=e.configText.slice(r.end),f=l.endsWith("{")?`
 `:l.endsWith(",")?`
 
 `:`,
@@ -15,7 +15,7 @@ ${t.map(([r,a])=>`        ${r}: '${Di(String(a))}',`).join(`
       }`}function Ba(e){return/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.trim())}function Ou(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];for(let r of t)if(!Ba(r))throw Error(`Alias '${r}' is not a valid hostname.`);if(t.length===0)return"[]";return`[${t.map((r)=>`'${Di(r)}'`).join(", ")}]`}function _u(e){let t=Object.entries(e).map(([r,a])=>[r.trim(),String(a).trim()]).filter(([r,a])=>r&&a);if(t.length===0)return"{}";return`{
 ${t.map(([r,a])=>`        '${Di(r)}': '${Di(a)}',`).join(`
 `)}
-      }`}function ww(e,t,r){let a=t;while(a<r&&/\s/.test(e[a]))a++;let l=0,m,f=!1;for(;a<r;a++){let b=e[a];if(m){if(f){f=!1;continue}if(b==="\\"){f=!0;continue}if(b===m)m=void 0;continue}if(b==='"'||b==="'"||b==="`"){m=b;continue}if(b==="{"||b==="["||b==="("){l++;continue}if(b==="}"||b==="]"||b===")"){if(l===0)return a;l--;continue}if(b===","&&l===0)return a}return r}function Vm(e,t,r,a){let l=e.slice(t+1,r),m=new RegExp(`(^|[\\s,{])(${Dl(a)})\\s*:\\s*\\{`,"m").exec(l);if(!m)return null;let f=t+1+m.index+m[1].length,b=e.indexOf("{",f);return{nameStart:f,end:Wm(e,b)}}function Gf(e){let r=[`    ${Dc(e.name)}: {`];if(xi(r,"deploy",e.deploy),xi(r,"root",e.root),xi(r,"path",e.path),xi(r,"domain",e.domain),xi(r,"type",e.type),xi(r,"build",e.build),xi(r,"start",e.start),e.port!==void 0)r.push(`      port: ${e.port},`);if(xi(r,"pathRewriteStyle",e.pathRewriteStyle),e.ssl!==void 0)if(e.ssl===!1)r.push("      ssl: false,");else if(e.ssl===!0)r.push("      ssl: true,");else r.push(`      ssl: { provider: '${Di(e.ssl.provider||"letsencrypt")}' },`);if(e.env&&Object.keys(e.env).length>0){r.push("      env: {");for(let[a,l]of Object.entries(e.env)){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(a))continue;r.push(`        ${a}: '${Di(String(l))}',`)}r.push("      },")}return r.push("    },"),r.join(`
+      }`}function ww(e,t,r){let a=t;while(a<r&&/\s/.test(e[a]))a++;let l=0,m,f=!1;for(;a<r;a++){let b=e[a];if(m){if(f){f=!1;continue}if(b==="\\"){f=!0;continue}if(b===m)m=void 0;continue}if(b==='"'||b==="'"||b==="`"){m=b;continue}if(b==="{"||b==="["||b==="("){l++;continue}if(b==="}"||b==="]"||b===")"){if(l===0)return a;l--;continue}if(b===","&&l===0)return a}return r}function Vm(e,t,r,a){let l=e.slice(t+1,r),m=new RegExp(`(^|[\\s,{])(${Dl(a)})\\s*:\\s*\\{`,"m").exec(l);if(!m)return null;let f=t+1+m.index+m[1].length,b=e.indexOf("{",f);return{nameStart:f,end:Wm(e,b)}}function Vf(e){let r=[`    ${Dc(e.name)}: {`];if(xi(r,"deploy",e.deploy),xi(r,"root",e.root),xi(r,"path",e.path),xi(r,"domain",e.domain),xi(r,"type",e.type),xi(r,"build",e.build),xi(r,"start",e.start),e.port!==void 0)r.push(`      port: ${e.port},`);if(xi(r,"pathRewriteStyle",e.pathRewriteStyle),e.ssl!==void 0)if(e.ssl===!1)r.push("      ssl: false,");else if(e.ssl===!0)r.push("      ssl: true,");else r.push(`      ssl: { provider: '${Di(e.ssl.provider||"letsencrypt")}' },`);if(e.env&&Object.keys(e.env).length>0){r.push("      env: {");for(let[a,l]of Object.entries(e.env)){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(a))continue;r.push(`        ${a}: '${Di(String(l))}',`)}r.push("      },")}return r.push("    },"),r.join(`
 `)}function Di(e){return e.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'").replace(/\r/g,"\\r").replace(/\n/g,"\\n")}function Dc(e){let t=e.trim();if(!/^[A-Za-z_$][\w$]*$/.test(t))throw Error(`Invalid site name '${e}'. Use a valid JavaScript object key, e.g. docs or marketingSite.`);return t}function xi(e,t,r){if(r===void 0||r==="")return;let a=r.replace(/\\/g,"\\\\").replaceAll(String.fromCharCode(39),"\\'");e.push(`      ${t}: '${a}',`)}function xl(e){let t=/\bsites\s*:\s*{/g.exec(e);if(!t)throw Error("Could not find a top-level sites: { ... } block in cloud.config.ts");let r=e.indexOf("{",t.index),a=Wm(e,r);return{start:r,end:a}}function kw(e,t,r,a){let l=e.slice(t+1,r);return new RegExp(`(^|[\\s,{])${Dl(a)}\\s*:`,"m").test(l)}function Dl(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Wm(e,t){let r=0,a,l=!1,m=!1,f=!1;for(let b=t;b<e.length;b++){let k=e[b],y=e[b+1];if(m){if(k===`
 `)m=!1;continue}if(f){if(k==="*"&&y==="/")f=!1,b++;continue}if(a){if(l){l=!1;continue}if(k==="\\"){l=!0;continue}if(k===a)a=void 0;continue}if(k==="/"&&y==="/"){m=!0,b++;continue}if(k==="/"&&y==="*"){f=!0,b++;continue}if(k==='"'||k==="'"||k==="`"){a=k;continue}if(k==="{")r++;if(k==="}"){if(r--,r===0)return b}}throw Error("Could not find the closing brace for sites: { ... } in cloud.config.ts")}function Lu(e){let{configText:t,owner:r}=e,a=[...t.matchAll(/\n( {2})cloud: \{\n([\s\S]*?)\n\1\},\n/g)],[l]=a;if(!l)throw Error("No `cloud: { ... }` block found in the cloud config");if(a.length>1)throw Error(`Found ${a.length} \`cloud: { ... }\` blocks in the cloud config, so which one to edit is ambiguous`);let[m,f,b]=l;if(f===void 0||b===void 0)throw Error("The `cloud: { ... }` block did not parse into an indent and a body");if(b.includes("{"))throw Error("The `cloud: { ... }` block holds a nested object, which this edit does not attempt to rewrite");let k=b.match(/^\s*attachTo:\s*(['"])([^'"]*)\1\s*,?\s*$/m);if(k){let[R,T="'",N=""]=k;if(N===r)return t;return t.replace(m,m.replace(R,R.replace(`${T}${N}${T}`,`'${r}'`)))}let y=`${f}  `;return t.replace(m,m.replace(`
 ${f}},
@@ -23,7 +23,7 @@ ${f}},
 ${y}// Deploy onto the box '${r}' owns rather than provisioning one.
 ${y}attachTo: '${r}',
 ${f}},
-`))}import{createHash as Iw}from"node:crypto";function Ew(e){return Iw("sha256").update(uo(e)).digest("hex")}function uo(e){if(Array.isArray(e))return`[${e.map((t)=>uo(t)).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0&&typeof t!=="function").sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${uo(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function C(e,t){let r=`dashboard:${t.username.toLowerCase()}`;return e.getActorByExternalId("user",r)??e.createActor({kind:"user",externalId:r,displayName:t.name??t.username,metadata:{source:"dashboard",role:t.role}})}function $u(e,t){let r=new vi({cwd:e}),a=Ew(t),l=r.getProjectBySlug(t.project.slug),m=t.project.slug.length>=3?t.project.slug:`${t.project.slug}-org`,f=(l?.organizationId?r.getOrganization(l.organizationId):void 0)??r.getOrganizationBySlug(m)??r.createOrganization({id:l?.organizationId,slug:m,name:t.project.name}),b=l?l.name!==t.project.name||l.desiredConfigHash!==a||l.organizationId!==f.id?r.updateProject(l.id,l.version,{name:t.project.name,organizationId:f.id,desiredConfigHash:a}):l:r.createProject({organizationId:f.id,slug:t.project.slug,name:t.project.name,desiredConfigHash:a}),k=new Map;for(let[N,j]of Object.entries(t.environments??{})){let q=r.getEnvironmentBySlug(b.id,N)??r.createEnvironment({projectId:b.id,slug:N,name:N.replace(/(^|[-_])(\w)/g,(ie,we,Ee)=>Ee.toUpperCase()),kind:String(j?.type??N),region:j?.region??t.project.region,desiredState:s(j)});k.set(N,q);let Y=new Map(r.listResources(b.id,q.id).map((ie)=>[`${ie.kind}:${ie.slug}`,ie])),ee=(ie,we,Ee,de)=>{let je=`${ie}:${we}`,ne=Y.get(je),Me=s(de);if(ne){if(ne.name!==Ee||uo(ne.desiredState)!==uo(Me))Y.set(je,r.updateResource(ne.id,ne.version,{name:Ee,desiredState:Me}));return}let Je=r.createResource({projectId:b.id,environmentId:q.id,kind:ie,slug:we,name:Ee,provider:t.cloud?.provider,desiredState:Me,metadata:{source:"cloud-config"}});Y.set(je,Je)};for(let[ie,we]of Object.entries(t.sites??{}))ee("application",ie,ie,we);let le=j?.app;if(le)for(let ie of["http","queue","cli"])ee("function",ie,`${ie.toUpperCase()} function`,{...s(le),function:ie});let Z=t.infrastructure;for(let[ie,we]of Object.entries(Z?.functions??{}))ee("function",ie,ie,we);if(Z?.compute)ee("server",`${b.slug}-server`,b.name,{...s(Z.compute),label:b.name});for(let[ie,we]of Object.entries(Z?.databases??{}))ee("database",ie,ie,we);if(Z?.appDatabase)ee("database","application-database","Application database",Z.appDatabase);else if(Z?.database)ee("database","application-database","Application database",{engine:Z.database})}let y=new c(r).recoverExpired(),R=r.reconcileOrphanedOperations({policy:"fail"}),T={requeued:y.requeued+R.requeued,failed:y.failed+y.cancelled+R.failed};return{store:r,organization:f,project:b,environments:k,reconciliation:T}}var Rw=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function ls(e,t){let{store:r,organization:a,project:l}=e,m=new Set;for(let f of t){let b=C(r,f);m.add(b.id);let k=r.getMembershipForActor(a.id,b.id);if(k&&k.source!=="legacy")continue;let y=r.listResources(l.id).filter((U)=>U.kind==="application"&&Object.hasOwn(f.sites,U.slug)),R=f.role==="admin"?"owner":"viewer",T=f.role==="admin"||y.length===0?{type:"organization"}:{type:"resource",id:y[0].id},N=k?k.roleTemplate!==R||uo(k.scope)!==uo(T)?r.updateMembership({id:k.id,roleTemplate:R,scope:T,actorId:b.id}):k:r.createMembership({organizationId:a.id,actorId:b.id,roleTemplate:R,scope:T,source:"legacy"}),j=new Set;if(f.role==="member"&&y.length===0)for(let U of Vt("viewer"))j.add(`deny|${U}|organization|`);for(let U of y){let q=f.sites[U.slug];for(let Y of Rw)j.add(`allow|${Y}|resource|${U.id}`);if(q==="owner")j.add(`allow|config:write|resource|${U.id}`)}for(let U of r.listGrants(N.id).filter((q)=>q.source==="legacy")){let q=`${U.effect}|${U.capability}|${U.scope.type}|${U.scope.id??""}`;if(!j.has(q))r.removeGrant(U.id,b.id)}for(let U of j){let[q,Y,ee,le]=U.split("|");r.upsertGrant({organizationId:a.id,membershipId:N.id,effect:q,capability:Y,scope:ee==="organization"?{type:"organization"}:{type:ee,id:le},source:"legacy"})}}for(let f of r.listMemberships(a.id))if(f.source==="legacy"&&!m.has(f.actorId))r.revokeMembership(f.id)}async function xe(e){let{controlPlane:t,environment:r,actor:a}=e,l=C(t.store,a),m=t.environments.get(r),f=e.resourceSlug&&m?t.store.listResources(t.project.id,m.id).find((R)=>R.slug===e.resourceSlug):void 0,b=new c(t.store,{workerId:`dashboard:${process.pid}`}),k=b.enqueue({projectId:t.project.id,environmentId:m?.id,resourceId:f?.id,actorId:l.id,kind:e.kind,input:e.input??{},lockKey:f?`resource:${f.id}`:m?`environment:${m.id}`:`project:${t.project.id}`,providerKey:f?.provider??"dashboard",buildSlot:e.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!b.claim(k.id)?.operation)throw Error(`Could not claim control-plane operation ${k.id}`);try{let R=await e.execute(),T=typeof R.stdout==="string"?String(R.stdout):"",N=typeof R.stderr==="string"?String(R.stderr):"";if(T)b.appendLog(k.id,T,{stream:"stdout"});if(N)b.appendLog(k.id,N,{stream:"stderr"});let j=R.ok?b.complete(k.id,Hm(R)):b.fail(k.id,Aw(R),Hm(R));return{result:R,operation:j}}catch(R){throw b.fail(k.id,R instanceof Error?R.message:String(R),{ok:!1,threw:!0}),R}}function Aw(e){let t=e;return String(t.error??t.stderr??"Operation failed")}function Hm(e){let t=e,r=typeof t.stdout==="string"?t.stdout:"",a=typeof t.stderr==="string"?t.stderr:"",l={ok:e.ok,stdoutBytes:Buffer.byteLength(r),stderrBytes:Buffer.byteLength(a)};if(typeof t.operation==="string")l.operation=t.operation;if(typeof t.error==="string")l.error=t.error;return s(l)}var Mu=[{id:"server.overview",path:"/",label:"Dashboard",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/server"]},{id:"server.activity",path:"/server/activity",label:"Activity",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/activity"]},{id:"services.list",path:"/server/sites",label:"Services",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/sites","/services"]},{id:"deployments.list",path:"/server/deployments",label:"Deployments",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/deployments"]},{id:"logs.list",path:"/server/logs",label:"Logs",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/logs"]},{id:"sources.integrations",path:"/integrations",label:"Git integrations",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.create",path:"/applications/new",label:"Create application",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.compose",path:"/applications/compose",label:"Compose applications",group:"applications",modes:["server"],adminOnly:!1},{id:"operations.queue",path:"/operations/queue",label:"Deployment queue",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.previews",path:"/operations/previews",label:"Preview environments",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.releases",path:"/operations/releases",label:"Releases & promotion",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"runtime.workloads",path:"/operations/workloads",label:"Workloads",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"observability.overview",path:"/operations/observability",label:"Observability",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"alerts.overview",path:"/operations/alerts",label:"Alerts & health",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"spend.overview",path:"/operations/spend",label:"Spend & budgets",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"automation.jobs",path:"/operations/jobs",label:"Workers & schedules",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/workers","/serverless/scheduler"]},{id:"configuration.entries",path:"/operations/configuration",label:"Environment & secrets",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/serverless/secrets"]},{id:"metrics.overview",path:"/server/metrics",label:"Metrics",group:"operations",modes:["server"],adminOnly:!0},{id:"runtime.services",path:"/server/services",label:"Runtime services",group:"operations",modes:["server"],adminOnly:!0},{id:"backups.list",path:"/data/backups",label:"Backups & recovery",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/backups"]},{id:"volumes.list",path:"/data/volumes",label:"Persistent volumes",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:[]},{id:"fleet.list",path:"/server/fleet",label:"Fleet inventory",group:"operations",modes:["server"],adminOnly:!1,legacyPaths:[]},{id:"operations.run",path:"/server/actions",label:"Run operations",group:"operations",modes:["server"],adminOnly:!0},{id:"infrastructure.topology",path:"/infrastructure/topology",label:"Infrastructure map",group:"infrastructure",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/topology"]},{id:"data.services",path:"/data/services",label:"Data services",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/database","/databases","/server/database","/serverless/data"]},{id:"network.firewall",path:"/server/firewall",label:"Network & firewall",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"security.posture",path:"/security",label:"Security posture",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/security"]},{id:"access.ssh",path:"/server/ssh-keys",label:"SSH keys",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"runtime.terminal",path:"/server/terminal",label:"Terminal",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"organization.people",path:"/server/team",label:"People & access",group:"organization",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/team"]},{id:"organization.automation",path:"/account/automation",label:"API & automation",group:"organization",modes:["server","serverless"],adminOnly:!0},{id:"serverless.overview",path:"/serverless",label:"Dashboard",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.deployments",path:"/serverless/deployments",label:"Deployments",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.logs",path:"/serverless/logs",label:"Logs",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.metrics",path:"/serverless/metrics",label:"Metrics",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.traces",path:"/serverless/traces",label:"Traces",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.functions",path:"/serverless/functions",label:"Functions",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.queues",path:"/serverless/queues",label:"Queues",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.assets",path:"/serverless/assets",label:"Assets",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.network",path:"/serverless/firewall",label:"Network",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.alerts",path:"/serverless/alarms",label:"Alerts",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.cost",path:"/serverless/cost",label:"Costs",group:"settings",modes:["serverless"],adminOnly:!0}],Cw=new Map(Mu.flatMap((e)=>(e.legacyPaths??[]).map((t)=>[t,e.path])));function Fu(e){return Cw.get(e)}function IS(e,t){return Mu.filter((r)=>r.modes.includes(e)&&(!t||!r.adminOnly))}var Oc=()=>{};async function Uu(e,t=Oc){for(let r of e){let a=new o(r.replicaRegion),l;try{l=await a.headBucket(r.replicaBucket)}catch(m){if(m?.statusCode===301)throw Error(`Failover replica bucket ${r.replicaBucket} already exists outside ${r.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${r.name}.`);if(m?.statusCode===403)throw Error(`Failover replica bucket ${r.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${r.name}.failover.bucket to a name you own.`);throw m}if(l.exists&&l.region&&l.region!==r.replicaRegion)throw Error(`Failover replica bucket ${r.replicaBucket} is in ${l.region}, not ${r.replicaRegion}.`);if(!l.exists)t(`Creating failover replica bucket ${r.replicaBucket} in ${r.replicaRegion}`),await a.createBucket(r.replicaBucket);if(await a.putPublicAccessBlock(r.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await a.putBucketEncryption(r.replicaBucket,"AES256"),r.replicate){if((await a.getBucketVersioning(r.replicaBucket)).Status!=="Enabled")t(`Enabling versioning on ${r.replicaBucket} (S3 replication requires it)`),await a.putBucketVersioning(r.replicaBucket,"Enabled")}}}async function Qu(e,t,r=Oc){for(let a of e){let l=t[a.distributionArnOutput];if(!l)throw Error(`Stack output ${a.distributionArnOutput} is missing, so the failover replica ${a.replicaBucket} cannot be scoped to its distribution.`);let m=new o(a.replicaRegion),k={Version:"2012-10-17",Statement:[...((await m.getBucketPolicy(a.replicaBucket))?.Statement??[]).filter((y)=>y?.Sid!==To),jd({replicaBucket:a.replicaBucket,distributionArn:l})]};r(`Granting ${l} read access to ${a.replicaBucket}`),await m.putBucketPolicy(a.replicaBucket,k)}}async function Hu(e,t=Oc){let r={};for(let a of e){let l=new o(a.primaryRegion),m=new o(a.replicaRegion),[f,b]=await Promise.all([l.listAllObjects({bucket:a.primaryBucket}),m.listAllObjects({bucket:a.replicaBucket})]),k=new Map(b.map((R)=>[R.Key,R.Size])),y=f.filter((R)=>k.get(R.Key)!==R.Size);for(let R of y)await m.copyObject({sourceBucket:a.primaryBucket,sourceKey:R.Key,destinationBucket:a.replicaBucket,destinationKey:R.Key});if(y.length>0)t(`Copied ${y.length} object(s) from ${a.primaryBucket} to ${a.replicaBucket}`);r[a.replicaBucket]=y.length}return r}async function Gu(e,t=Oc){for(let r of e){let a=new o(r.replicaRegion);if(!(await a.headBucket(r.replicaBucket)).exists)continue;await a.emptyBucket(r.replicaBucket),await a.deleteBucket(r.replicaBucket),t(`Deleted failover replica bucket ${r.replicaBucket}`)}}import $i from"node:process";import{existsSync as Pw}from"node:fs";import{join as _w}from"node:path";async function Vu(e){let t=Date.now(),r=e.sourceDir??"dist";if(!Pw(_w(r,"index.html")))return Ol(t,`${r}/ has no index.html — build first.`);if(!$i.env.AWS_ACCESS_KEY_ID||!$i.env.AWS_SECRET_ACCESS_KEY)return Ol(t,"Missing AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in env.");let a=Tw(e.dnsProvider);if("error"in a)return Ol(t,a.error);let l=await Tn({siteName:e.siteName,region:e.region??"us-east-1",domain:e.domain,bucket:e.bucket,stackName:e.stackName,certificateArn:e.certificateArn,defaultRootObject:e.defaultRootObject??"index.html",errorDocument:e.errorDocument??"404.html",cacheControl:e.cacheControl??"max-age=3600, public",sourceDir:r,cleanBucket:e.cleanBucket??!1,singlePageApp:e.singlePageApp??!1,dnsProvider:a,tags:{ManagedBy:"ts-cloud",Application:e.siteName,...e.tags},onProgress:e.onProgress});return{success:!!l.success,domain:l.domain,url:l.domain?`https://${l.domain}`:l.distributionDomain?`https://${l.distributionDomain}`:void 0,bucket:l.bucket,distributionId:l.distributionId,distributionDomain:l.distributionDomain,certificateArn:l.certificateArn,filesUploaded:l.filesUploaded,filesSkipped:l.filesSkipped,message:l.message,durationMs:Date.now()-t}}function Tw(e){let t=typeof e==="string"?{provider:e}:e??{provider:"porkbun"};if(t.provider==="porkbun"){let r=t,a=r?.apiKey??$i.env.PORKBUN_API_KEY,l=r?.secretKey??$i.env.PORKBUN_SECRET_KEY??$i.env.PORKBUN_SECRET_API_KEY;if(!a||!l)return{error:"Missing PORKBUN_API_KEY / PORKBUN_SECRET_KEY in env."};return{provider:"porkbun",apiKey:a,secretKey:l}}if(t.provider==="godaddy"){let r=t,a=r?.apiKey??$i.env.GODADDY_API_KEY,l=r?.secretKey??$i.env.GODADDY_API_SECRET,m=r?.environment??$i.env.GODADDY_ENVIRONMENT;if(!a||!l)return{error:"Missing GODADDY_API_KEY / GODADDY_API_SECRET in env."};return{provider:"godaddy",apiKey:a,apiSecret:l,environment:m}}return{error:`Unsupported DNS provider: ${t.provider}`}}function Ol(e,t){return{success:!1,message:t,durationMs:Date.now()-e}}import{createHash as xw}from"node:crypto";var Dw=`let coldStart = true
+`))}import{createHash as Iw}from"node:crypto";function Ew(e){return Iw("sha256").update(uo(e)).digest("hex")}function uo(e){if(Array.isArray(e))return`[${e.map((t)=>uo(t)).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0&&typeof t!=="function").sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${uo(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function C(e,t){let r=`dashboard:${t.username.toLowerCase()}`;return e.getActorByExternalId("user",r)??e.createActor({kind:"user",externalId:r,displayName:t.name??t.username,metadata:{source:"dashboard",role:t.role}})}function $u(e,t){let r=new vi({cwd:e}),a=Ew(t),l=r.getProjectBySlug(t.project.slug),m=t.project.slug.length>=3?t.project.slug:`${t.project.slug}-org`,f=(l?.organizationId?r.getOrganization(l.organizationId):void 0)??r.getOrganizationBySlug(m)??r.createOrganization({id:l?.organizationId,slug:m,name:t.project.name}),b=l?l.name!==t.project.name||l.desiredConfigHash!==a||l.organizationId!==f.id?r.updateProject(l.id,l.version,{name:t.project.name,organizationId:f.id,desiredConfigHash:a}):l:r.createProject({organizationId:f.id,slug:t.project.slug,name:t.project.name,desiredConfigHash:a}),k=new Map;for(let[N,j]of Object.entries(t.environments??{})){let q=r.getEnvironmentBySlug(b.id,N)??r.createEnvironment({projectId:b.id,slug:N,name:N.replace(/(^|[-_])(\w)/g,(ie,we,Ee)=>Ee.toUpperCase()),kind:String(j?.type??N),region:j?.region??t.project.region,desiredState:s(j)});k.set(N,q);let Y=new Map(r.listResources(b.id,q.id).map((ie)=>[`${ie.kind}:${ie.slug}`,ie])),ee=(ie,we,Ee,de)=>{let je=`${ie}:${we}`,ne=Y.get(je),Me=s(de);if(ne){if(ne.name!==Ee||uo(ne.desiredState)!==uo(Me))Y.set(je,r.updateResource(ne.id,ne.version,{name:Ee,desiredState:Me}));return}let Je=r.createResource({projectId:b.id,environmentId:q.id,kind:ie,slug:we,name:Ee,provider:t.cloud?.provider,desiredState:Me,metadata:{source:"cloud-config"}});Y.set(je,Je)};for(let[ie,we]of Object.entries(t.sites??{}))ee("application",ie,ie,we);let le=j?.app;if(le)for(let ie of["http","queue","cli"])ee("function",ie,`${ie.toUpperCase()} function`,{...s(le),function:ie});let Z=t.infrastructure;for(let[ie,we]of Object.entries(Z?.functions??{}))ee("function",ie,ie,we);if(Z?.compute)ee("server",`${b.slug}-server`,b.name,{...s(Z.compute),label:b.name});for(let[ie,we]of Object.entries(Z?.databases??{}))ee("database",ie,ie,we);if(Z?.appDatabase)ee("database","application-database","Application database",Z.appDatabase);else if(Z?.database)ee("database","application-database","Application database",{engine:Z.database})}let y=new c(r).recoverExpired(),R=r.reconcileOrphanedOperations({policy:"fail"}),T={requeued:y.requeued+R.requeued,failed:y.failed+y.cancelled+R.failed};return{store:r,organization:f,project:b,environments:k,reconciliation:T}}var Rw=["project:read","config:read","deployments:read","deployments:create","runtime:read","runtime:logs"];function ls(e,t){let{store:r,organization:a,project:l}=e,m=new Set;for(let f of t){let b=C(r,f);m.add(b.id);let k=r.getMembershipForActor(a.id,b.id);if(k&&k.source!=="legacy")continue;let y=r.listResources(l.id).filter((U)=>U.kind==="application"&&Object.hasOwn(f.sites,U.slug)),R=f.role==="admin"?"owner":"viewer",T=f.role==="admin"||y.length===0?{type:"organization"}:{type:"resource",id:y[0].id},N=k?k.roleTemplate!==R||uo(k.scope)!==uo(T)?r.updateMembership({id:k.id,roleTemplate:R,scope:T,actorId:b.id}):k:r.createMembership({organizationId:a.id,actorId:b.id,roleTemplate:R,scope:T,source:"legacy"}),j=new Set;if(f.role==="member"&&y.length===0)for(let U of Vt("viewer"))j.add(`deny|${U}|organization|`);for(let U of y){let q=f.sites[U.slug];for(let Y of Rw)j.add(`allow|${Y}|resource|${U.id}`);if(q==="owner")j.add(`allow|config:write|resource|${U.id}`)}for(let U of r.listGrants(N.id).filter((q)=>q.source==="legacy")){let q=`${U.effect}|${U.capability}|${U.scope.type}|${U.scope.id??""}`;if(!j.has(q))r.removeGrant(U.id,b.id)}for(let U of j){let[q,Y,ee,le]=U.split("|");r.upsertGrant({organizationId:a.id,membershipId:N.id,effect:q,capability:Y,scope:ee==="organization"?{type:"organization"}:{type:ee,id:le},source:"legacy"})}}for(let f of r.listMemberships(a.id))if(f.source==="legacy"&&!m.has(f.actorId))r.revokeMembership(f.id)}async function xe(e){let{controlPlane:t,environment:r,actor:a}=e,l=C(t.store,a),m=t.environments.get(r),f=e.resourceSlug&&m?t.store.listResources(t.project.id,m.id).find((R)=>R.slug===e.resourceSlug):void 0,b=new c(t.store,{workerId:`dashboard:${process.pid}`}),k=b.enqueue({projectId:t.project.id,environmentId:m?.id,resourceId:f?.id,actorId:l.id,kind:e.kind,input:e.input??{},lockKey:f?`resource:${f.id}`:m?`environment:${m.id}`:`project:${t.project.id}`,providerKey:f?.provider??"dashboard",buildSlot:e.kind.includes("deploy"),maxAttempts:1,timeoutSeconds:3600,resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;if(!b.claim(k.id)?.operation)throw Error(`Could not claim control-plane operation ${k.id}`);try{let R=await e.execute(),T=typeof R.stdout==="string"?String(R.stdout):"",N=typeof R.stderr==="string"?String(R.stderr):"";if(T)b.appendLog(k.id,T,{stream:"stdout"});if(N)b.appendLog(k.id,N,{stream:"stderr"});let j=R.ok?b.complete(k.id,Hm(R)):b.fail(k.id,Aw(R),Hm(R));return{result:R,operation:j}}catch(R){throw b.fail(k.id,R instanceof Error?R.message:String(R),{ok:!1,threw:!0}),R}}function Aw(e){let t=e;return String(t.error??t.stderr??"Operation failed")}function Hm(e){let t=e,r=typeof t.stdout==="string"?t.stdout:"",a=typeof t.stderr==="string"?t.stderr:"",l={ok:e.ok,stdoutBytes:Buffer.byteLength(r),stderrBytes:Buffer.byteLength(a)};if(typeof t.operation==="string")l.operation=t.operation;if(typeof t.error==="string")l.error=t.error;return s(l)}var Mu=[{id:"server.overview",path:"/",label:"Dashboard",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/server"]},{id:"server.activity",path:"/server/activity",label:"Activity",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/activity"]},{id:"services.list",path:"/server/sites",label:"Services",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/sites","/services"]},{id:"deployments.list",path:"/server/deployments",label:"Deployments",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/deployments"]},{id:"logs.list",path:"/server/logs",label:"Logs",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/logs"]},{id:"sources.integrations",path:"/integrations",label:"Git integrations",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.create",path:"/applications/new",label:"Create application",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.compose",path:"/applications/compose",label:"Compose applications",group:"applications",modes:["server"],adminOnly:!1},{id:"operations.queue",path:"/operations/queue",label:"Deployment queue",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.previews",path:"/operations/previews",label:"Preview environments",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.releases",path:"/operations/releases",label:"Releases & promotion",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"runtime.workloads",path:"/operations/workloads",label:"Workloads",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"observability.overview",path:"/operations/observability",label:"Observability",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"alerts.overview",path:"/operations/alerts",label:"Alerts & health",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"spend.overview",path:"/operations/spend",label:"Spend & budgets",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"automation.jobs",path:"/operations/jobs",label:"Workers & schedules",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/workers","/serverless/scheduler"]},{id:"configuration.entries",path:"/operations/configuration",label:"Environment & secrets",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/serverless/secrets"]},{id:"metrics.overview",path:"/server/metrics",label:"Metrics",group:"operations",modes:["server"],adminOnly:!0},{id:"runtime.services",path:"/server/services",label:"Runtime services",group:"operations",modes:["server"],adminOnly:!0},{id:"backups.list",path:"/data/backups",label:"Backups & recovery",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/backups"]},{id:"volumes.list",path:"/data/volumes",label:"Persistent volumes",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:[]},{id:"fleet.list",path:"/server/fleet",label:"Fleet inventory",group:"operations",modes:["server"],adminOnly:!1,legacyPaths:[]},{id:"operations.run",path:"/server/actions",label:"Run operations",group:"operations",modes:["server"],adminOnly:!0},{id:"infrastructure.topology",path:"/infrastructure/topology",label:"Infrastructure map",group:"infrastructure",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/topology"]},{id:"data.services",path:"/data/services",label:"Data services",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/database","/databases","/server/database","/serverless/data"]},{id:"network.firewall",path:"/server/firewall",label:"Network & firewall",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"security.posture",path:"/security",label:"Security posture",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/security"]},{id:"access.ssh",path:"/server/ssh-keys",label:"SSH keys",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"runtime.terminal",path:"/server/terminal",label:"Terminal",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"organization.people",path:"/server/team",label:"People & access",group:"organization",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/team"]},{id:"organization.automation",path:"/account/automation",label:"API & automation",group:"organization",modes:["server","serverless"],adminOnly:!0},{id:"serverless.overview",path:"/serverless",label:"Dashboard",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.deployments",path:"/serverless/deployments",label:"Deployments",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.logs",path:"/serverless/logs",label:"Logs",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.metrics",path:"/serverless/metrics",label:"Metrics",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.traces",path:"/serverless/traces",label:"Traces",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.functions",path:"/serverless/functions",label:"Functions",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.queues",path:"/serverless/queues",label:"Queues",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.assets",path:"/serverless/assets",label:"Assets",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.network",path:"/serverless/firewall",label:"Network",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.alerts",path:"/serverless/alarms",label:"Alerts",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.cost",path:"/serverless/cost",label:"Costs",group:"settings",modes:["serverless"],adminOnly:!0}],Cw=new Map(Mu.flatMap((e)=>(e.legacyPaths??[]).map((t)=>[t,e.path])));function Fu(e){return Cw.get(e)}function bS(e,t){return Mu.filter((r)=>r.modes.includes(e)&&(!t||!r.adminOnly))}var Oc=()=>{};async function Uu(e,t=Oc){for(let r of e){let a=new o(r.replicaRegion),l;try{l=await a.headBucket(r.replicaBucket)}catch(m){if(m?.statusCode===301)throw Error(`Failover replica bucket ${r.replicaBucket} already exists outside ${r.replicaRegion}. Pick another failover.bucket or region for infrastructure.storage.${r.name}.`);if(m?.statusCode===403)throw Error(`Failover replica bucket ${r.replicaBucket} exists but this account cannot reach it (S3 names are global, so another account may own it). Set infrastructure.storage.${r.name}.failover.bucket to a name you own.`);throw m}if(l.exists&&l.region&&l.region!==r.replicaRegion)throw Error(`Failover replica bucket ${r.replicaBucket} is in ${l.region}, not ${r.replicaRegion}.`);if(!l.exists)t(`Creating failover replica bucket ${r.replicaBucket} in ${r.replicaRegion}`),await a.createBucket(r.replicaBucket);if(await a.putPublicAccessBlock(r.replicaBucket,{BlockPublicAcls:!0,IgnorePublicAcls:!0,BlockPublicPolicy:!0,RestrictPublicBuckets:!0}),await a.putBucketEncryption(r.replicaBucket,"AES256"),r.replicate){if((await a.getBucketVersioning(r.replicaBucket)).Status!=="Enabled")t(`Enabling versioning on ${r.replicaBucket} (S3 replication requires it)`),await a.putBucketVersioning(r.replicaBucket,"Enabled")}}}async function Qu(e,t,r=Oc){for(let a of e){let l=t[a.distributionArnOutput];if(!l)throw Error(`Stack output ${a.distributionArnOutput} is missing, so the failover replica ${a.replicaBucket} cannot be scoped to its distribution.`);let m=new o(a.replicaRegion),k={Version:"2012-10-17",Statement:[...((await m.getBucketPolicy(a.replicaBucket))?.Statement??[]).filter((y)=>y?.Sid!==To),jd({replicaBucket:a.replicaBucket,distributionArn:l})]};r(`Granting ${l} read access to ${a.replicaBucket}`),await m.putBucketPolicy(a.replicaBucket,k)}}async function Hu(e,t=Oc){let r={};for(let a of e){let l=new o(a.primaryRegion),m=new o(a.replicaRegion),[f,b]=await Promise.all([l.listAllObjects({bucket:a.primaryBucket}),m.listAllObjects({bucket:a.replicaBucket})]),k=new Map(b.map((R)=>[R.Key,R.Size])),y=f.filter((R)=>k.get(R.Key)!==R.Size);for(let R of y)await m.copyObject({sourceBucket:a.primaryBucket,sourceKey:R.Key,destinationBucket:a.replicaBucket,destinationKey:R.Key});if(y.length>0)t(`Copied ${y.length} object(s) from ${a.primaryBucket} to ${a.replicaBucket}`);r[a.replicaBucket]=y.length}return r}async function Gu(e,t=Oc){for(let r of e){let a=new o(r.replicaRegion);if(!(await a.headBucket(r.replicaBucket)).exists)continue;await a.emptyBucket(r.replicaBucket),await a.deleteBucket(r.replicaBucket),t(`Deleted failover replica bucket ${r.replicaBucket}`)}}import $i from"node:process";import{existsSync as Pw}from"node:fs";import{join as _w}from"node:path";async function Vu(e){let t=Date.now(),r=e.sourceDir??"dist";if(!Pw(_w(r,"index.html")))return Ol(t,`${r}/ has no index.html — build first.`);if(!$i.env.AWS_ACCESS_KEY_ID||!$i.env.AWS_SECRET_ACCESS_KEY)return Ol(t,"Missing AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in env.");let a=Tw(e.dnsProvider);if("error"in a)return Ol(t,a.error);let l=await Tn({siteName:e.siteName,region:e.region??"us-east-1",domain:e.domain,bucket:e.bucket,stackName:e.stackName,certificateArn:e.certificateArn,defaultRootObject:e.defaultRootObject??"index.html",errorDocument:e.errorDocument??"404.html",cacheControl:e.cacheControl??"max-age=3600, public",sourceDir:r,cleanBucket:e.cleanBucket??!1,singlePageApp:e.singlePageApp??!1,dnsProvider:a,tags:{ManagedBy:"ts-cloud",Application:e.siteName,...e.tags},onProgress:e.onProgress});return{success:!!l.success,domain:l.domain,url:l.domain?`https://${l.domain}`:l.distributionDomain?`https://${l.distributionDomain}`:void 0,bucket:l.bucket,distributionId:l.distributionId,distributionDomain:l.distributionDomain,certificateArn:l.certificateArn,filesUploaded:l.filesUploaded,filesSkipped:l.filesSkipped,message:l.message,durationMs:Date.now()-t}}function Tw(e){let t=typeof e==="string"?{provider:e}:e??{provider:"porkbun"};if(t.provider==="porkbun"){let r=t,a=r?.apiKey??$i.env.PORKBUN_API_KEY,l=r?.secretKey??$i.env.PORKBUN_SECRET_KEY??$i.env.PORKBUN_SECRET_API_KEY;if(!a||!l)return{error:"Missing PORKBUN_API_KEY / PORKBUN_SECRET_KEY in env."};return{provider:"porkbun",apiKey:a,secretKey:l}}if(t.provider==="godaddy"){let r=t,a=r?.apiKey??$i.env.GODADDY_API_KEY,l=r?.secretKey??$i.env.GODADDY_API_SECRET,m=r?.environment??$i.env.GODADDY_ENVIRONMENT;if(!a||!l)return{error:"Missing GODADDY_API_KEY / GODADDY_API_SECRET in env."};return{provider:"godaddy",apiKey:a,apiSecret:l,environment:m}}return{error:`Unsupported DNS provider: ${t.provider}`}}function Ol(e,t){return{success:!1,message:t,durationMs:Date.now()-e}}import{createHash as xw}from"node:crypto";var Dw=`let coldStart = true
 const initializedAt = new Date().toISOString()
 export const handler = async (event) => {
   const currentColdStart = coldStart
@@ -36,13 +36,13 @@ export const handler = async (event) => {
     body: JSON.stringify({ ok: statusCode === 200, service: 'ts-cloud-static-api', path, coldStart: currentColdStart, initializedAt })
   }
 }
-`;function Gm(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function Ow(e){return["NoSuchEntity","ResourceNotFoundException","404"].includes(Gm(e))}function Km(e){return["EntityAlreadyExists","ResourceAlreadyExistsException","ResourceConflictException","409"].includes(Gm(e))}function Jm(e,t){let r=e?.Items;if(!r)return[];if(Array.isArray(r))return r;let a=r[t];if(a===void 0)return[];return Array.isArray(a)?a:[a]}function Nl(e){let t=e?.Aliases?.Items,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function $w(e){if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected CloudFront alias is invalid");if(!/^[A-Za-z0-9-_]{1,64}$/.test(e.functionName))throw Error("Lambda function name is invalid");let t=e.pathPattern?.startsWith("/")?e.pathPattern:`/${e.pathPattern||"api/*"}`;if(t==="/"||t==="/*"||!t.endsWith("*"))throw Error("API path must be a non-default wildcard pattern such as /api/*");let r=e.originId||`${e.functionName}-url`,a=e.roleName||`${e.functionName}-execution`;if(!/^[A-Za-z0-9_.-]{1,64}$/.test(a))throw Error("IAM role name is invalid");let l=e.memorySize??256,m=e.timeout??10,f=e.logRetentionDays??14;if(l<128||l>10240)throw Error("Lambda memory must be between 128 and 10240 MB");if(m<1||m>900)throw Error("Lambda timeout must be between 1 and 900 seconds");return{region:e.region||"us-east-1",pathPattern:t,originId:r,roleName:a,memorySize:l,timeout:m,logRetentionDays:f}}function Vf(e){let t=e.region||"us-east-1";return{cloudfront:new S(e.profile),iam:new be(t,e.profile),lambda:new E(t,e.profile),logs:new Ie(t,e.profile),sts:new Se(t,e.profile),sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}async function bS(e,t){let r=$w(e),a=t||Vf({profile:e.profile,region:r.region}),[l,m,f]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId),a.cloudfront.getDistributionConfig(e.distributionId)]);if(!l.Account)throw Error("AWS identity did not return an account ID");if(!m.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!(Nl(m).length?Nl(m):Nl(f.DistributionConfig)).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let k,y=!0;try{k=await a.iam.getRole({RoleName:r.roleName})}catch(it){if(!Ow(it))throw it;y=!1}let R=k?.Arn||`arn:aws:iam::${l.Account}:role/${r.roleName}`,T=await a.lambda.functionExists(e.functionName),N=T?await a.lambda.getFunctionUrl(e.functionName):null,j=await a.cloudfront.listOriginAccessControls(),U=`${e.functionName}-lambda-url`,q=j.some((it)=>it.Name===U&&it.OriginAccessControlOriginType==="lambda"),Y=Jm(f.DistributionConfig.Origins,"Origin"),ee=Jm(f.DistributionConfig.CacheBehaviors,"CacheBehavior"),le=Y.some((it)=>String(it.Id)===r.originId),Z=ee.some((it)=>String(it.PathPattern)===r.pathPattern),ie=[...!y?[`create IAM execution role ${r.roleName}`]:[`reconcile IAM execution policy ${r.roleName}`],...T?[`update Lambda ${e.functionName} code and configuration`]:[`create Lambda ${e.functionName}`],...!N?["create private AWS_IAM function URL"]:[],...!q?[`create Lambda origin access control ${U}`]:[],"grant CloudFront function-URL and invocation permissions",`${Z?"reconcile":"add"} ${r.pathPattern} behavior without changing the default behavior`],we={command:`cloud cdn:origin:remove ${e.distributionId} FUNCTION_URL_HOST --id ${r.originId} --path '${r.pathPattern}' --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,removeFunction:!T,removeRole:!y},Ee={mode:e.apply?"apply":"plan",accountId:l.Account,identityArn:l.Arn,distribution:{id:m.Id,arn:m.ARN,alias:e.expectedAlias,domainName:m.DomainName,status:m.Status},function:{name:e.functionName,existed:T,runtime:"nodejs22.x",urlExisted:!!N,url:N?.FunctionUrl},role:{name:r.roleName,existed:y,arn:R},origin:{id:r.originId,pathPattern:r.pathPattern,existed:le,behaviorExisted:Z,accessControlExisted:q},changes:ie,rollback:we,applied:!1};if(!e.apply)return Ee;let de=`${e.distributionId}:${r.pathPattern}`;if(e.confirm!==de)throw Error(`Pass exact confirmation token ${de} to mutate the live distribution`);if(!k)k=await a.iam.createRole({RoleName:r.roleName,Description:`Execution role for ${e.functionName}`,AssumeRolePolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]}),Tags:[{Key:"ManagedBy",Value:"ts-cloud"}]});await a.iam.putRolePolicy({RoleName:r.roleName,PolicyName:"lambda-logs",PolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:${r.region}:${l.Account}:log-group:/aws/lambda/${e.functionName}:*`}]})});try{await a.logs.createLogGroup(`/aws/lambda/${e.functionName}`,{ManagedBy:"ts-cloud"})}catch(it){if(!Km(it))throw it}await a.logs.putRetentionPolicy(`/aws/lambda/${e.functionName}`,r.logRetentionDays);let je=e.code||Dw;if(T)await a.lambda.updateFunctionCodeInline(e.functionName,je,"index.mjs"),await a.lambda.waitForFunctionActive(e.functionName),await a.lambda.updateFunctionConfiguration({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:k.Arn,Handler:"index.handler",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize});else{let it;for(let kt=0;kt<8;kt++)try{await a.lambda.createFunctionWithCode({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:k.Arn,Handler:"index.handler",Code:je,Filename:"index.mjs",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize}),it=void 0;break}catch(Ut){if(it=Ut,!String(Ut.message).toLowerCase().includes("role"))throw Ut;await a.sleep(1000)}if(it)throw it}await a.lambda.waitForFunctionActive(e.functionName);let ne=N||await a.lambda.createFunctionUrl({FunctionName:e.functionName,AuthType:"AWS_IAM",InvokeMode:"BUFFERED"});if(!ne.FunctionUrl)throw Error("Lambda did not return a function URL");let Me=new URL(ne.FunctionUrl).hostname,Je=await a.cloudfront.findOrCreateOriginAccessControl(U,"lambda"),gt=m.ARN||`arn:aws:cloudfront::${l.Account}:distribution/${e.distributionId}`,zt=[{FunctionName:e.functionName,StatementId:"AllowCloudFrontFunctionUrl",Action:"lambda:InvokeFunctionUrl",Principal:"cloudfront.amazonaws.com",SourceArn:gt,FunctionUrlAuthType:"AWS_IAM"},{FunctionName:e.functionName,StatementId:"AllowCloudFrontInvoke",Action:"lambda:InvokeFunction",Principal:"cloudfront.amazonaws.com",SourceArn:gt,InvokedViaFunctionUrl:!0}];for(let it of zt)try{await a.lambda.addPermission(it)}catch(kt){if(!Km(kt))throw kt}return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:Me,pathPattern:r.pathPattern,originAccessControlId:Je.Id}),{...Ee,function:{...Ee.function,url:ne.FunctionUrl},applied:!0}}async function CS(e){let t=`https://${e.alias}/`,r=`https://${e.alias}/api/health`,a=await fetch(t,{redirect:"follow",headers:{"cache-control":"no-cache"}}),l=new Uint8Array(await a.arrayBuffer()),m=xw("sha256").update(l).digest("hex"),f=Date.now(),b=await fetch(r,{redirect:"follow",headers:{"cache-control":"no-cache"}}),k=Date.now()-f,y=await b.text(),R=y;try{R=JSON.parse(y)}catch{}let T;if(e.logs&&e.functionName){let N=await e.logs.filterLogEvents({logGroupName:`/aws/lambda/${e.functionName}`,startTime:f-60000,filterPattern:'"Init Duration"',limit:25});for(let j of N.events||[]){let U=j.message?.match(/Init Duration:\s*([0-9.]+)\s*ms/i);if(U)T=Number(U[1])}}return{frontend:{url:t,status:a.status,sha256:m,unchanged:e.expectedFrontendSha256?m===e.expectedFrontendSha256:void 0,bytes:l.byteLength},api:{url:r,status:b.status,latencyMs:k,healthy:b.ok&&!!R?.ok,body:R},coldStart:{observed:T!==void 0,initDurationMs:T},verifiedAt:(e.now?.()||new Date).toISOString()}}function ES(e){let t=(e.memoryMb||256)/1024,r=Math.max(0,e.requests-(e.includeFreeTier===!1?0:1e6)),a=Math.max(0,e.requests*(e.averageDurationMs/1000)*t-(e.includeFreeTier===!1?0:400000)),l=r/1e6*0.2+a*0.0000166667,m=9.010025,f=16.425;return{lambdaUsd:Number(l.toFixed(2)),alwaysOnFargateAndAlbUsd:Number(25.435025000000003 .toFixed(2)),assumptions:["us-east-1 public list rates snapshot, July 2026","Lambda x86 request and duration pricing with optional monthly free tier","Fargate comparison uses one always-on 0.25 vCPU/0.5 GB task plus one ALB before LCU charges","excludes CloudFront, data transfer, logs, taxes, and application data services"]}}import{createHash as Nw}from"node:crypto";function jw(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function Bw(e){return jw(e)==="ValidationError"&&String(e.message).includes("does not exist")}function Mw(e){return Object.fromEntries((e||[]).map((t)=>[t.OutputKey,t.OutputValue]))}function Lw(e){let t=e?.Aliases?.Items??e?.Aliases,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function Qm(e){if(!/^[a-z][a-z0-9-]{1,62}$/.test(e.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected distribution alias is invalid");let t=e.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!t)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let r=e.stackName||`${e.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(r))throw Error("CloudFormation stack name is invalid");let a=e.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(a)||a==="/*")throw Error("Backend path must be a non-default wildcard pattern");let l=e.originId||`${e.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(l))throw Error("CloudFront origin ID is invalid");if(e.originVerifySecret&&e.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!e.originDomain!==!!e.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:r,region:e.region||"us-east-1",pathPattern:a,originId:l,digest:t}}function qf(e){let t=e.region||"us-east-1";return{cloudformation:new h(t,e.profile),cloudfront:new S(e.profile),sts:new Se(t,e.profile),fetch,sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}function jf(e){let t=Qm(e),r=Jd({name:e.name,slug:e.slug,domain:e.originDomain||e.expectedAlias,imageUri:e.imageUri,certificateArn:e.certificateArn,originVerifySecret:e.originVerifySecret,desiredCount:e.desiredCount,database:e.database,cache:e.cache,queue:e.queue}),a=Wd(r);return a.Description=`Managed backend for existing static frontend ${e.expectedAlias}`,a.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:e.distributionId,ExistingDistributionAlias:e.expectedAlias,BackendPathPattern:t.pathPattern,ContainerDigest:t.digest},a}async function Fw(e,t,r){let a;for(let l=0;l<30;l++){let m=Date.now();try{let f=await e.fetch(t,{redirect:"manual",headers:r?{"x-origin-verify":r}:void 0}),b=Date.now()-m,k=await f.text(),y=k;try{y=JSON.parse(k)}catch{}if(f.ok)return{url:t,status:f.status,latencyMs:b,body:y};a=Error(`origin returned ${f.status}`)}catch(f){a=f}if(l<29)await e.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${a instanceof Error?a.message:String(a)}`)}async function vS(e,t){let r=Qm(e),a=t||qf({region:r.region,profile:e.profile}),[l,m]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId)]);if(!l.Account)throw Error("AWS identity did not return an account ID");if(!m.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!Lw(m).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let f;try{f=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0]}catch(ie){if(!Bw(ie))throw ie}let b=jf(e),k=JSON.stringify(b);if(Buffer.byteLength(k)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let y=Object.values(b.Resources||{}).reduce((ie,we)=>(ie[we.Type]=(ie[we.Type]||0)+1,ie),{}),R=[`cloud cdn:origin:remove ${e.distributionId} ${e.originDomain||"ALB_HOST"} --id ${r.originId} --path '${r.pathPattern}' --profile ${e.profile||"default"} --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${r.stackName} only with an approved data-retention decision.`],T={mode:e.apply?"apply":"plan",accountId:l.Account,stack:{name:r.stackName,existed:!!f,status:f?.StackStatus,templateSha256:Nw("sha256").update(k).digest("hex"),resourceCount:Object.keys(b.Resources||{}).length,resourceTypes:y},distribution:{id:m.Id,alias:e.expectedAlias,domainName:m.DomainName,status:m.Status,pathPattern:r.pathPattern,originId:r.originId},artifact:{imageUri:e.imageUri,digest:r.digest},services:{database:e.database!==!1,cache:e.cache!==!1,queue:e.queue!==!1,mail:"ses",desiredCount:e.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:R};if(!e.apply)return T;let N=`${e.distributionId}:${r.pathPattern}:${r.stackName}`;if(e.confirm!==N)throw Error(`Pass exact confirmation token ${N} to provision the backend and change live routing`);if(f)try{await a.cloudformation.updateStack({stackName:r.stackName,templateBody:k,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-update-complete")}catch(ie){if(!String(ie.message).includes("No updates are to be performed"))throw ie}else await a.cloudformation.createStack({stackName:r.stackName,templateBody:k,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-create-complete");let j=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0],U=Mw(j?.Outputs),q=U.AppLoadBalancerDnsName;if(!q)throw Error("Backend stack did not return AppLoadBalancerDnsName");let Y=!1;if(e.originDomain&&e.originDomain!==q){if(!a.dns)throw Error(`External DNS provider is required to map ${e.originDomain} to ${q}`);let ie=await a.dns.upsertRecord(e.originDomain,{name:e.originDomain,type:"CNAME",content:q,ttl:300});if(!ie.success)throw Error(ie.message||"External DNS update failed");Y=!0}let ee=e.originDomain||q,le=e.certificateArn?"https-only":"http-only",Z=e.skipHealthCheck?void 0:await Fw(a,`${le==="https-only"?"https":"http"}://${ee}/api/health`,e.originVerifySecret);return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:ee,pathPattern:r.pathPattern,protocolPolicy:le,customHeaders:e.originVerifySecret?{"X-Origin-Verify":e.originVerifySecret}:void 0}),{...T,outputs:U,health:Z,cloudFrontApplied:!0,dnsApplied:Y,applied:!0}}function TS(e={}){let r={fargate:730*(e.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(e.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(r).reduce((a,l)=>a+l,0).toFixed(2)),components:Object.fromEntries(Object.entries(r).map(([a,l])=>[a,Number(l.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}import{execFileSync as zw}from"node:child_process";import{createHash as Uw}from"node:crypto";import{existsSync as Ym,mkdirSync as qw,mkdtempSync as Vw,readdirSync as Ww,readFileSync as Hw,rmSync as Kw,statSync as Zm,writeFileSync as Jw}from"node:fs";import{tmpdir as Gw}from"node:os";import{basename as Qw,join as Go,relative as Yw,resolve as Bl}from"node:path";var Zw=new Set([".git","node_modules","dist","coverage"]);function Xm(e,t=e){let r=[];for(let a of Ww(e).sort()){if(Zw.has(a))continue;let l=Go(e,a);if($d(l,t))continue;let m=Zm(l);if(m.isDirectory())r.push(...Xm(l,t));else if(m.isFile())r.push(Yw(t,l))}return r}function zf(e){let t=Bl(e);if(!Ym(t)||!Zm(t).isDirectory())throw Error(`Container context does not exist: ${t}`);let r=Uw("sha256");for(let a of Xm(t))r.update(a),r.update("\x00"),r.update(Hw(Go(t,a))),r.update("\x00");return r.digest("hex")}function Kf(e){return{ecr:new $e(e.region||"us-east-1",e.profile),run:(t,r,a)=>{zw(t,r,{cwd:a?.cwd,env:a?.env,stdio:a?.stdio||"inherit"})}}}async function wS(e,t){let r=Bl(e.context),a=Bl(e.dockerfile||Go(r,"Dockerfile"));if(!Ym(a))throw Error(`Dockerfile does not exist: ${a}`);if(!e.repository.split("/").every((U)=>/^[a-z0-9][a-z0-9._-]*$/.test(U)&&!/[._-]$/.test(U)&&!/[._-]{2}/.test(U)))throw Error("ECR repository name is invalid");let f=t||Kf(e),b=zf(r),k=`sha-${b.slice(0,20)}`,y="";try{y=(await f.ecr.describeRepositories({repositoryNames:[e.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!y)y=(await f.ecr.createRepository({repositoryName:e.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!y)throw Error(`Could not resolve ECR repository URI for ${e.repository}`);await f.ecr.putLifecyclePolicy({repositoryName:e.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let R=`${y}:${k}`,T=Vw(Go(Gw(),"ts-cloud-container-"));try{f.run("docker",["version"],{stdio:"ignore"}),f.run("docker",["build","--platform",e.platform||"linux/amd64","--provenance=false","--sbom=false","--file",a,"--tag",R,r],{cwd:r});let U=(await f.ecr.getAuthorizationToken()).authorizationData?.[0];if(!U?.authorizationToken||!U.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let q=U.proxyEndpoint.replace(/^https?:\/\//,""),Y=Go(T,"docker");qw(Y,{recursive:!0}),Jw(Go(Y,"config.json"),JSON.stringify({auths:{[q]:{auth:U.authorizationToken}}}),{mode:384}),f.run("docker",["push",R],{env:{...process.env,DOCKER_CONFIG:Y}})}finally{Kw(T,{recursive:!0,force:!0})}let j=(await f.ecr.describeImages({repositoryName:e.repository,imageIds:[{imageTag:k}]})).imageDetails?.[0]?.imageDigest;if(!j||!/^sha256:[a-f0-9]{64}$/i.test(j))throw Error(`ECR did not return an immutable digest for ${Qw(R)}`);return{repository:e.repository,tag:k,imageUri:R,digest:j,digestUri:`${y}@${j}`,contextSha256:b}}import{existsSync as Xw,readdirSync as ek,readFileSync as tk,statSync as rk}from"node:fs";import{join as ef,relative as nk}from"node:path";function go(e,t){let r=e.environments?.[t]?.app;if(!r)throw Error(`No serverless app configured for environment '${t}'. Add environments.${t}.app to your config.`);let a=e.project.slug,l=e.environments?.[t]?.region||e.project.region||"us-east-1";return{app:r,slug:a,region:l,stackName:Xt(e,t),artifactBucket:Hd(a,t),assetsBucket:Fi(a,t)}}async function po(e,t=8){let r;for(let a=0;a<t;a++)try{return await e()}catch(l){let m=l?.code||l?.name||"",f=String(l?.message||"");if(m==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(f)){r=l,await new Promise((b)=>setTimeout(b,3000));continue}throw l}throw r}var tf=(e,t)=>`releases/${e}/${t}/current.json`;async function Nc(e,t,r,a){try{return await e.getObjectJson(t,tf(r,a))}catch{return null}}async function rf(e,t,r,a,l){await e.putObjectJson(t,tf(r,a),l)}async function ik(e,t){if(!e.secrets)return{};let r=new W(t),a={},l=Array.isArray(e.secrets)?e.secrets.map((m)=>({envName:m.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:m})):Object.entries(e.secrets).map(([m,f])=>({envName:m,secretId:f}));if(Array.isArray(e.secrets)){let m=new Map;for(let{envName:b,secretId:k}of l)m.set(b,[...m.get(b)??[],k]);let f=[...m.entries()].filter(([,b])=>b.length>1);if(f.length){let b=f.map(([k,y])=>`${k} ← ${y.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${b}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:m,secretId:f}of l){let k=(await r.getSecretValue({SecretId:f})).SecretString??"";try{let y=JSON.parse(k);if(y&&typeof y==="object"&&!Array.isArray(y)){for(let[R,T]of Object.entries(y))a[R]=String(T);continue}}catch{}a[m]=k}return a}function us(e,t){let r={},a=t.DbProxyEndpoint||t.DbEndpoint;if(a)r.DB_CONNECTION="mysql",r.DB_HOST=a,r.DB_PORT="3306",r.DB_DATABASE=r.DB_DATABASE||"app";if(t.CacheEndpoint){if(r.REDIS_HOST=t.CacheEndpoint,r.REDIS_PORT="6379",e.cache?.driver==="elasticache")r.CACHE_STORE="redis",r.CACHE_DRIVER="redis",r.SESSION_DRIVER="redis"}return r}function cr(e,t,r,a,l,m,f,b={}){let k=e.kind==="php"?Tl({cacheDriver:e.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:a,TSCLOUD_ENV:r,MAINTENANCE_MODE:"0",...e.octane?{TSCLOUD_OCTANE:"1"}:{},...e.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...e.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...k,...b,...t.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${t.slug}-${r}-cache`}:{},...f?{TSCLOUD_QUEUE:f,SQS_QUEUE:f}:{},...m?{ASSET_URL:m}:{},...e.env??{},...l}}function ok(e){let t=e.slice(e.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[t]??"application/octet-stream"}function*nf(e){for(let t of ek(e)){let r=ef(e,t);if(rk(r).isDirectory())yield*nf(r);else yield r}}async function sk(e,t,r,a,l=!1){let m=0;for(let f of nf(r)){let b=nk(r,f).replace(/\\/g,"/");if(!l&&b.split("/").some((k)=>k.startsWith(".")))continue;await e.putObject({bucket:t,key:`${a}/${b}`,body:tk(f),contentType:ok(f),cacheControl:"public, max-age=31536000, immutable"}),m++}return m}function ak(e,t){let r=Object.entries(t).reduce((a,[l,m])=>a+Buffer.byteLength(`${l}=${m}`,"utf8"),0);if(r>4096){let a=Object.entries(t).map(([l,m])=>[l,Buffer.byteLength(`${l}=${m}`,"utf8")]).sort((l,m)=>m[1]-l[1]).slice(0,5).map(([l,m])=>`${l} (${m}B)`).join(", ");throw Error(`${e}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${a}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function Ja(e,t,r,a){ak(t,r),await po(()=>e.updateFunctionConfiguration({FunctionName:t,Environment:{Variables:r}})),await e.waitForFunctionActive(t,120);let l=a.kind==="image"?{FunctionName:t,ImageUri:a.imageUri}:{FunctionName:t,S3Bucket:a.bucket,S3Key:a.key};await po(()=>e.updateFunctionCode(l)),await e.waitForFunctionActive(t,120)}async function $c(e,t){let a=(await po(()=>e.publishVersion({FunctionName:t}))).Version;if(!a)throw Error(`publishVersion returned no version for ${t}`);return await po(()=>e.updateAlias({FunctionName:t,Name:"live",FunctionVersion:a})),a}async function xa(e,t,r={}){let a=go(e,t),{app:l,slug:m,region:f,stackName:b,artifactBucket:k}=a,y=r.projectRoot??process.cwd();bs(`Deploying serverless app: ${m} (${t})`),B(`Stack: ${b}`),B(`Region: ${f}`);let R=new o(f),T=new h(f),N=new E(f),j=l.kind==="php",U=l.packaging==="image",q=qi(l),Y,ee,le,Z,ie=[];if(U&&q.usesLayer&&q.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${q.kind}${q.kind==="node"?` ${q.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(U){w("Building + pushing container image");let{buildAndPushServerlessImage:he}=await import("./chunk-mqwdq7w1.js"),Te=await he({app:l,projectRoot:y,region:f,repository:`${m}-${t}`,skipBuild:r.skipBuild,onStep:(mt)=>B(`  ${mt}`)});Y=Te.handlers,ee={kind:"image",imageUri:Te.imageUri},le=Te.tag,ie.push({ParameterKey:"ImageUri",ParameterValue:Te.imageUri})}else{w("Packaging application");let he=j?wl({projectRoot:y,app:l,skipBuild:r.skipBuild,onStep:(It)=>B(`  ${It}`)}):await tn({projectRoot:y,app:l,skipBuild:r.skipBuild,onStep:(It)=>B(`  ${It}`)}),Te=Al(m,t,he.sha256);if(B(`Artifact: ${he.sha256.slice(0,12)} (${(he.zip.length/1024).toFixed(0)} KB)`),Y=he.handlers,le=he.sha256,q.usesLayer){let It=q.layerEnvVar?process.env[q.layerEnvVar]:void 0;if(Z=l.layers??(It?[It]:void 0),!Z?.length){let Ne=q.layerKind==="php"?"serverless:build-php-layer":q.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${q.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${q.layerEnvVar} env var (build one with \`cloud ${Ne}\`)${q.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await R.bucketExists(k))w(`Creating artifact bucket ${k}`),await R.createBucket(k);if(await R.headObject(k,Te).then((It)=>It!==null).catch(()=>!1))B("Artifact already uploaded — reusing");else w("Uploading artifact"),await R.putObject({bucket:k,key:Te,body:he.zip,contentType:"application/zip"});ee={kind:"zip",bucket:k,key:Te},ie.push({ParameterKey:"ArtifactBucket",ParameterValue:k},{ParameterKey:"ArtifactKey",ParameterValue:Te})}let we=Sl({config:e,environment:t,app:l,handlers:Y,runtimeLayers:Z}),Ee=JSON.stringify(we.template),de=["CAPABILITY_NAMED_IAM"],je=await T.describeStacks({stackName:b}).then((he)=>he.Stacks[0]?.StackStatus).catch(()=>{return}),ne=je!==void 0;if(je&&/DELETE_IN_PROGRESS/.test(je))w("Waiting for an in-progress stack delete to finish"),await T.waitForStack(b,"stack-delete-complete").catch(()=>{}),ne=!1;else if(je&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(je))w(`Deleting unusable stack (status ${je}) before recreate`),await T.deleteStack(b),await T.waitForStack(b,"stack-delete-complete").catch(()=>{}),ne=!1;w(ne?"Updating infrastructure stack":"Creating infrastructure stack");try{if(ne)await T.updateStack({stackName:b,templateBody:Ee,parameters:ie,capabilities:de}),await T.waitForStack(b,"stack-update-complete");else await T.createStack({stackName:b,templateBody:Ee,parameters:ie,capabilities:de,onFailure:"DELETE"}),await T.waitForStack(b,"stack-create-complete")}catch(he){if(/No updates are to be performed/i.test(String(he?.message)))B("No infrastructure changes");else throw he}let Me=await T.getStackOutputs(b).catch(()=>({})),Je;if(l.assets){let he=ef(y,l.assets);if(Xw(he)){let Te=l.assetDomain||Me.AssetsCdnDomain;Je=Te?`https://${Te}/${le}`:void 0,w(`Syncing assets from ${l.assets}`);let mt=await sk(R,a.assetsBucket,he,le,l.dotFilesAsAssets);B(`Uploaded ${mt} asset(s)${Je?` → ${Je}`:""}`)}else Is(`Assets directory not found: ${he}`)}w("Resolving secrets");let gt=await ik(l,f);if(l.database?.connection==="aurora-serverless")try{let Te=await new W(f).getSecretValue({SecretId:`${m}/${t}/db`}),mt=JSON.parse(Te.SecretString??"{}");if(mt.username)gt.DB_USERNAME=mt.username;if(mt.password)gt.DB_PASSWORD=mt.password}catch(he){Is(`Could not resolve Aurora DB credentials: ${he.message}`)}if(!await R.bucketExists(k))await R.createBucket(k);let zt=await Nc(R,k,m,t),it={},kt=we.queueNames[0],Ut=us(l,Me);if(w("Activating functions"),it.http=cr(l,a,t,"http",gt,Je,kt,Ut),await Ja(N,we.functionNames.http,it.http,ee),it.cli=cr(l,a,t,"cli",gt,Je,kt,Ut),await Ja(N,we.functionNames.cli,it.cli,ee),we.queueNames.length)it.queue=cr(l,a,t,"queue",gt,Je,kt,Ut),await Ja(N,we.functionNames.queue,it.queue,ee);let dt=(l.provisionedConcurrency??0)>0,K={};if(dt){if(w("Publishing versions + flipping live alias"),K.http=await $c(N,we.functionNames.http),K.cli=await $c(N,we.functionNames.cli),we.queueNames.length)K.queue=await $c(N,we.functionNames.queue)}if(await rf(R,k,m,t,{sha:le,code:ee,previousSha:zt?.sha,previousCode:zt?.code,previousFunctionEnv:zt?.functionEnv,...dt?{functionVersions:K,previousFunctionVersions:zt?.functionVersions}:{},functionEnv:it,functionNames:{http:we.functionNames.http,cli:we.functionNames.cli,...we.queueNames.length?{queue:we.functionNames.queue}:{}},assetUrl:Je,timestamp:new Date().toISOString()}),!r.skipDeployHooks&&l.deploy?.length){w("Running deploy hooks");for(let he of l.deploy){B(`  deploy: ${he}`);let Te=await N.invoke({FunctionName:we.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:he},LogType:"Tail"});if(Te.FunctionError)throw eg("Deploy hook failed — the new build is ALREADY LIVE."),B(`  Roll back with: cloud serverless:rollback --env ${t}`),Error(`Deploy hook failed (${he}): ${Te.Payload}`)}}let ue=Me.HttpApiEndpoint;if(!r.skipHealthCheck&&ue){w("Health check");try{let he=await fetch(ue,{method:"GET"});B(`GET ${ue} → ${he.status}`)}catch(he){Is(`Health check could not reach ${ue}: ${he.message}`)}}tg(["Serverless deploy complete","",ue?`URL:   ${ue}`:"",`Stack: ${b}`,`Build: ${le.slice(0,12)}`].filter(Boolean).join(`
-`),"green")}async function Sn(e,t){let r=go(e,t),a=new o(r.region),l=new E(r.region),m=await Nc(a,r.artifactBucket,r.slug,t);if(!m)throw Error("No previous release to redeploy. Run a full deploy first.");bs(`Redeploying ${r.slug} (${t}) — build ${m.sha.slice(0,12)}`);for(let[f,b]of Object.entries(m.functionNames)){if(!b)continue;w(`Re-activating ${f} (${b})`),await Ja(l,b,m.functionEnv[f]??{},m.code);let k=m.functionVersions?.[f];if(k)await po(()=>l.updateAlias({FunctionName:b,Name:"live",FunctionVersion:k}))}wn("Redeploy complete")}async function In(e,t){let r=go(e,t),a=new o(r.region),l=new E(r.region),m=await Nc(a,r.artifactBucket,r.slug,t);if(!m?.previousCode)throw Error("No previous release to roll back to.");bs(`Rolling back ${r.slug} (${t}) → ${m.previousSha?.slice(0,12)}`);for(let[f,b]of Object.entries(m.functionNames)){if(!b)continue;w(`Restoring ${f} (${b})`);let k=m.previousFunctionEnv?.[f]??m.functionEnv[f]??{};await Ja(l,b,k,m.previousCode);let y=m.previousFunctionVersions?.[f];if(y)await po(()=>l.updateAlias({FunctionName:b,Name:"live",FunctionVersion:y}))}await rf(a,r.artifactBucket,r.slug,t,{...m,sha:m.previousSha??m.sha,code:m.previousCode,functionEnv:m.previousFunctionEnv??m.functionEnv,functionVersions:m.previousFunctionVersions??m.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),wn("Rollback complete")}async function dr(e,t,r,a){let l=go(e,t),m=new E(l.region),f=`${l.slug}-${t}-http`,k={...(await m.getFunction(f)).Configuration?.Environment?.Variables??{}};if(k.MAINTENANCE_MODE=r?"1":"0",r&&a)k.MAINTENANCE_BYPASS_SECRET=a;if(!r)delete k.MAINTENANCE_BYPASS_SECRET;if(await po(()=>m.updateFunctionConfiguration({FunctionName:f,Environment:{Variables:k}})),(l.app.provisionedConcurrency??0)>0)await m.waitForFunctionActive(f,120),await $c(m,f);wn(r?"Application is now in maintenance mode (503)":"Application is live")}async function rt(e,t,r){let a=go(e,t),l=new E(a.region),m=`${a.slug}-${t}-cli`,f=await l.invoke({FunctionName:m,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(f.FunctionError)throw Error(`Command failed: ${f.Payload}`);return f.Payload??""}async function Ar(e,t){let r=go(e,t),a=new h(r.region),l=new E(r.region),m=new o(r.region),f="not deployed",b={};try{let{Stacks:U}=await a.describeStacks({stackName:r.stackName});f=U?.[0]?.StackStatus??f;for(let q of U?.[0]?.Outputs??[])if(q.OutputKey)b[q.OutputKey]=q.OutputValue??""}catch{}let k=yl(r.app,r.slug,t),y=r.app.provisionedConcurrency??0,R=["http","cli",...k.length?["queue"]:[]],T=`${r.slug}-${t}`,N=[];for(let U of R){let q=`${T}-${U}`,Y={mode:U,name:q,version:"$LATEST"};if(y>0){let ee=await l.getAlias(q,"live").catch(()=>null);if(ee?.FunctionVersion){Y.version=ee.FunctionVersion;let le=await l.getProvisionedConcurrencyConfig(q,"live").catch(()=>null);if(le)Y.provisioned={status:le.Status??"-",allocated:le.AllocatedProvisionedConcurrentExecutions??0,requested:le.RequestedProvisionedConcurrentExecutions??0}}}N.push(Y)}let j=await Nc(m,r.artifactBucket,r.slug,t).catch(()=>null);return{slug:r.slug,environment:t,region:r.region,stackStatus:f,endpoint:b.HttpApiEndpoint,assetUrl:j?.assetUrl,scheduler:r.app.scheduler??"on",queues:k,provisionedConcurrency:y,functions:N,lastRelease:j?{sha:j.sha,timestamp:j.timestamp}:void 0}}function ck(e,t){return`${e}-${t}-db`}async function of(e,t,r,a){let l=go(e,t);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:m}=await import("./chunk-c9zjh5bx.js"),f=new m(l.region),b=ck(l.slug,t);w(`Scaling ${b} → ${r}–${a} ACUs`),await f.modifyDBCluster({DBClusterIdentifier:b,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:a},ApplyImmediately:!0}),wn(`Scaling applied to ${b} (takes effect shortly).`)}class ep{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async call(e,t){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${e}`},body:JSON.stringify(t)})}async listWebACLs(e="REGIONAL"){return(await this.call("ListWebACLs",{Scope:e,Limit:100}))?.WebACLs??[]}async getWebACLRules(e,t,r="REGIONAL"){return((await this.call("GetWebACL",{Name:e,Id:t,Scope:r}))?.WebACL?.Rules??[]).map((m)=>({Name:m.Name,Priority:m.Priority,Action:m.Action?Object.keys(m.Action)[0]:m.OverrideAction?Object.keys(m.OverrideAction)[0]:"count"}))}}var dk=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"routing",label:"Routing"},{index:4,id:"apps",label:"Applications"},{index:5,id:"runtime",label:"Background runtime"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],lk=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"entry",label:"Entry points"},{index:4,id:"compute",label:"Compute"},{index:5,id:"messaging",label:"Messaging & pooling"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],uk=[{match:/^redis/,kind:"cache",label:"Redis"},{match:/^(?:mysql|mariadb)/,kind:"database",label:"MySQL"},{match:/^postgres/,kind:"database",label:"PostgreSQL"},{match:/^meilisearch/,kind:"database",label:"Meilisearch"},{match:/^vitess|^vtgate/,kind:"database",label:"Vitess"},{match:/^memcached/,kind:"cache",label:"Memcached"}],pk=/^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;function De(e,t=""){let r=e==null?"":String(e).trim();return r&&r!=="-"&&r!=="—"?r:t}function gk(e){return Array.isArray(e)?e.length:0}function zn(e){let t=De(e).toLowerCase();if(!t)return"unknown";if(["running","live","active","available","success","ok","healthy","enabled"].includes(t))return"ok";if(["failed","stopped","unreachable","error","critical","disabled"].includes(t))return"bad";if(["configured","creating","pending","degraded","shadowed","warn","unknown"].includes(t))return"warn";return"warn"}function tr(e,t,r){if(r.has(t.source)&&r.has(t.target))e.push(t)}function Pt(e,t={}){let r=[],a=[],l=[],m=e.server??{},f=Array.isArray(e.sites)?e.sites:[],b=Array.isArray(e.services)?e.services:[],k=Array.isArray(e.workers)?e.workers:[],y=e.security??{},R=!!e._serverReachable&&!e.metricsUnavailable,T="box";if(!R)l.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let N=[...new Set(f.map((de)=>De(de.domain)||De(de.route).split("/")[0]).filter((de)=>de&&de!=="internal"&&de!=="loopback"))],j=Array.isArray(y.tlsCertificates)?y.tlsCertificates:[],U=j.filter((de)=>Number(de?.daysRemaining??999)<21).length;r.push({id:"dns",label:N.length===1?N[0]:"Public domains",kind:"dns",layer:1,status:U?"warn":N.length?"ok":"unknown",sub:N.length>1?`${N.length} domains`:"DNS & certificates",facts:[{label:"Domains",value:N.length?N.slice(0,6).join(", "):"none resolved"},{label:"Certificates",value:j.length?`${j.length} issued`:"none reported"},...U?[{label:"Expiring",value:`${U} within 21 days`}]:[]],href:"/server/security",external:!0});let q=y.firewall??{},Y=Array.isArray(y.ports)?y.ports:[];r.push({id:"firewall",label:"Host firewall",kind:"firewall",layer:2,status:zn(q.status),sub:De(q.summary,"Inbound filtering"),facts:[{label:"State",value:De(q.status,"unknown")},{label:"Open ports",value:Y.length?Y.map((de)=>De(de.listen)).join(", "):"not reported"}],href:"/server/firewall",group:"box"});let ee=b.find((de)=>pk.test(De(de.name)));r.push({id:"proxy",label:De(ee?.name,"Reverse proxy"),kind:"proxy",layer:3,status:ee?zn(ee.status):"unknown",sub:"TLS termination & routing",facts:[{label:"Service",value:De(ee?.name,"not detected")},{label:"State",value:De(ee?.status,R?"not running":"not probed")},{label:"Routes",value:`${f.length} site${f.length===1?"":"s"}`}],href:"/server/services",group:"box"});for(let de of f){let je=`site:${De(de.name)}`;if(!De(de.name))continue;r.push({id:je,label:De(de.name),kind:"site",layer:4,status:zn(de.status),sub:De(de.runtime,"runtime"),facts:[{label:"Route",value:De(de.route,"internal")},{label:"Runtime",value:De(de.runtime,"unknown")},{label:"Delivery",value:De(de.deploy,"unknown")},{label:"TLS",value:De(de.tls,"unknown")},...de.responseMs!=null?[{label:"Response",value:`${Math.round(Number(de.responseMs))} ms`}]:[],...de.httpStatus!=null?[{label:"HTTP",value:String(de.httpStatus)}]:[]],href:"/server/sites",group:"box"})}for(let de of k){let je=`worker:${De(de.name)}`;if(!De(de.name))continue;r.push({id:je,label:De(de.name),kind:"worker",layer:5,status:zn(de.status),sub:`${Number(de.processes??1)} process${Number(de.processes??1)===1?"":"es"}`,facts:[{label:"Processes",value:String(de.processes??1)},{label:"State",value:De(de.status,"unknown")},...De(de.site)?[{label:"Site",value:De(de.site)}]:[]],href:"/operations/jobs",group:"box"})}let le=e.serverScheduler??{};if(le.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:5,status:"ok",sub:"Cron dispatch",facts:[{label:"Last run",value:De(le.lastRun,"unknown")}],href:"/operations/jobs",group:"box"});let Z=b.map((de)=>{let je=De(de.name),ne=uk.find((Me)=>Me.match.test(je));return ne?{service:de,name:je,...ne}:null}).filter((de)=>!!de);for(let de of Z)r.push({id:`data:${de.name}`,label:de.label,kind:de.kind,layer:6,status:zn(de.service.status),sub:de.name,facts:[{label:"Unit",value:de.name},{label:"State",value:De(de.service.status,"unknown")}],href:"/data/services",group:"box"});let ie=e.backup??{};if(ie.enabled)r.push({id:"backup",label:"Backups",kind:"backup",layer:7,status:"ok",sub:De(ie.destination,"destination"),facts:[{label:"Destination",value:De(ie.destination,"unknown")},{label:"Schedule",value:De(ie.schedule,"unknown")},{label:"Retention",value:`${ie.retention??0} copies`},{label:"Last run",value:De(ie.last,"unknown")}],href:"/data/backups"});let we=new Set(r.map((de)=>de.id));tr(a,{source:"internet",target:"dns",flow:"request",label:"https"},we),tr(a,{source:"dns",target:"firewall",flow:"request",label:"443/80"},we),tr(a,{source:"firewall",target:"proxy",flow:"request"},we);for(let de of f){let je=`site:${De(de.name)}`;tr(a,{source:"proxy",target:je,flow:"request",label:De(de.path)||void 0,status:zn(de.status)},we)}for(let de of k){let je=`worker:${De(de.name)}`,ne=`site:${De(de.site)}`;if(we.has(ne))tr(a,{source:ne,target:je,flow:"async",label:"queue"},we);else tr(a,{source:"proxy",target:je,flow:"async",label:"queue"},we)}for(let de of k)tr(a,{source:"scheduler",target:`worker:${De(de.name)}`,flow:"async",label:"dispatch"},we);let Ee=[...f.map((de)=>`site:${De(de.name)}`),...k.map((de)=>`worker:${De(de.name)}`)];for(let de of Z)for(let je of Ee)tr(a,{source:je,target:`data:${de.name}`,flow:"data",label:"localhost"},we);if(Z.length&&Ee.length)l.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");for(let de of Z)tr(a,{source:`data:${de.name}`,target:"backup",flow:"backup",label:"snapshot"},we);for(let de of f)tr(a,{source:`site:${De(de.name)}`,target:"backup",flow:"backup"},we);return{mode:"server",project:De(t.project)||De(e.project?.name)||De(m.name,"project"),environment:De(t.environment)||De(e.environment,"production"),provider:De(m.provider,"unknown"),region:De(m.region,"unknown"),generatedAt:new Date().toISOString(),layers:dk,groups:[{id:"box",label:De(m.name,"App server"),sub:[De(m.provider),De(m.region),De(m.ip)].filter(Boolean).join(" · ")}],nodes:r,links:a,notes:l}}function gs(e,t={}){let r=[],a=[],l=[],m=e.app??{},f=Array.isArray(e.functions)?e.functions:[],b=Array.isArray(e.queues)?e.queues:[],k=e.metrics??{};if(!f.length)l.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let y=De(m.url),R=y.replace(/^https?:\/\//,"").split("/")[0];r.push({id:"dns",label:R||"Application domain",kind:"dns",layer:1,status:R?"ok":"unknown",sub:"DNS & certificates",facts:[{label:"Endpoint",value:y||"not resolved"}],external:!0});let T=e.waf;if(T)r.push({id:"waf",label:"WAF",kind:"waf",layer:2,status:zn(T.status??"active"),sub:De(T.scope,"Managed rules"),facts:[{label:"Web ACL",value:De(T.name,"unnamed")},...T.blocked!=null?[{label:"Blocked (24h)",value:String(T.blocked)}]:[],{label:"Rules",value:String(gk(e.wafRules))}],href:"/serverless/firewall"});let N=e.assetsInfo;if(N)r.push({id:"cdn",label:"Asset CDN",kind:"cdn",layer:2,status:"ok",sub:De(N.cdn,"CloudFront"),facts:[{label:"Distribution",value:De(N.cdn,"unknown")},{label:"Custom domain",value:De(N.customDomain,"none")}],href:"/serverless/assets"}),r.push({id:"assets",label:"Asset bucket",kind:"storage",layer:6,status:"ok",sub:De(N.bucket,"S3"),facts:[{label:"Bucket",value:De(N.bucket,"unknown")},...N.files?[{label:"Objects",value:String(N.files)}]:[],...N.sizeMb?[{label:"Size",value:`${N.sizeMb} MB`}]:[]],href:"/serverless/assets"});let j=f.find((ne)=>De(ne.key).startsWith("http"));r.push({id:"gateway",label:"HTTP entry point",kind:"gateway",layer:3,status:j?"ok":"unknown",sub:"Function URL / API Gateway",facts:[{label:"Endpoint",value:y||"not resolved"},{label:"Invocations (24h)",value:String(k.invocations??0)},...k.errorRatePct!=null?[{label:"Error rate",value:`${k.errorRatePct}%`}]:[]],href:"/serverless/metrics"});for(let ne of f){let Me=`fn:${De(ne.name)}`;if(!De(ne.name))continue;let Je=Number(ne.errors??0),gt=Number(ne.invocations??0);r.push({id:Me,label:De(ne.key,De(ne.name)),kind:"function",layer:4,status:Je>0?gt&&Je/gt>0.02?"bad":"warn":gt?"ok":"idle",sub:De(ne.runtime,"lambda"),facts:[{label:"Function",value:De(ne.name)},{label:"Memory",value:`${ne.memory??0} MB`},{label:"Timeout",value:`${ne.timeout??0}s`},{label:"Invocations (24h)",value:String(gt)},{label:"Errors (24h)",value:String(Je)},{label:"p95",value:`${ne.p95??0} ms`},...ne.provisioned?[{label:"Provisioned",value:De(ne.provisioned)}]:[]],href:"/serverless/functions"})}for(let ne of b){let Me=`queue:${De(ne.name)}`;if(!De(ne.name))continue;let Je=Number(ne.dlq??0);r.push({id:Me,label:De(ne.name),kind:"queue",layer:5,status:Je>0?"bad":Number(ne.visible??0)>0?"warn":"ok",sub:"SQS",facts:[{label:"Visible",value:String(ne.visible??0)},{label:"In flight",value:String(ne.inFlight??0)},{label:"Processed (24h)",value:String(ne.processed??0)},{label:"Dead letter",value:String(Je)}],href:"/serverless/queues"})}let U=e.aurora;if(U)r.push({id:"database",label:"Aurora Serverless",kind:"database",layer:6,status:zn(U.status),sub:De(U.engine,"aurora"),facts:[{label:"Cluster",value:De(U.id,"unknown")},{label:"Capacity",value:`${U.currentAcu??0} ACU (${U.minAcu??0}–${U.maxAcu??0})`},{label:"Connections",value:String(U.connections??0)}],href:"/serverless/data"});let q=e.proxy;if(q)r.push({id:"rds-proxy",label:"RDS Proxy",kind:"database",layer:5,status:zn(q.status),sub:"Connection pooling",facts:[{label:"Proxy",value:De(q.name,"unknown")},{label:"Endpoint",value:De(q.endpoint,"unknown")},{label:"Pooled",value:String(q.pooledConns??0)}],href:"/serverless/data"});let Y=e.redis;if(Y)r.push({id:"cache",label:"ElastiCache",kind:"cache",layer:6,status:zn(Y.status),sub:De(Y.node,"redis"),facts:[{label:"Group",value:De(Y.id,"unknown")},{label:"Hit rate",value:`${Y.hitRate??0}%`}],href:"/serverless/data"});let ee=e.efs;if(ee)r.push({id:"efs",label:"EFS",kind:"filesystem",layer:6,status:zn(ee.status),sub:De(ee.mount,"/mnt/local"),facts:[{label:"File system",value:De(ee.id,"unknown")},{label:"Mount",value:De(ee.mount,"unknown")},{label:"Size",value:`${ee.sizeMb??0} MB`}],href:"/data/volumes"});let le=e.scheduler??{};if(le.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:3,status:"ok",sub:De(le.expression,"rate(1 minute)"),facts:[{label:"Expression",value:De(le.expression,"unknown")},{label:"Last run",value:De(le.lastRun,"unknown")}],href:"/operations/jobs"});let Z=new Set(r.map((ne)=>ne.id)),ie=Z.has("waf")?"waf":"gateway";tr(a,{source:"internet",target:"dns",flow:"request",label:"https"},Z),tr(a,{source:"dns",target:ie,flow:"request"},Z),tr(a,{source:"dns",target:"cdn",flow:"request",label:"assets"},Z),tr(a,{source:"waf",target:"gateway",flow:"request",label:"allowed"},Z),tr(a,{source:"cdn",target:"assets",flow:"data",label:"origin"},Z);let we=f.filter((ne)=>De(ne.key).startsWith("http")),Ee=f.filter((ne)=>De(ne.key).startsWith("queue")),de=f.filter((ne)=>De(ne.key).startsWith("cli"));for(let ne of we)tr(a,{source:"gateway",target:`fn:${De(ne.name)}`,flow:"request",label:"invoke"},Z);for(let ne of de)tr(a,{source:"scheduler",target:`fn:${De(ne.name)}`,flow:"async",label:"schedule"},Z);for(let ne of b){for(let Me of we)tr(a,{source:`fn:${De(Me.name)}`,target:`queue:${De(ne.name)}`,flow:"async",label:"publish"},Z);for(let Me of Ee)tr(a,{source:`queue:${De(ne.name)}`,target:`fn:${De(Me.name)}`,flow:"async",label:"consume"},Z)}let je=["rds-proxy","database","cache","efs","assets"];for(let ne of f){let Me=`fn:${De(ne.name)}`;if(Z.has("rds-proxy"))tr(a,{source:Me,target:"rds-proxy",flow:"data",label:"pooled"},Z);else tr(a,{source:Me,target:"database",flow:"data",label:"sql"},Z);for(let Je of je.filter((gt)=>gt!=="rds-proxy"&&gt!=="database"))tr(a,{source:Me,target:Je,flow:"data"},Z)}return tr(a,{source:"rds-proxy",target:"database",flow:"data",label:"sql"},Z),{mode:"serverless",project:De(t.project)||De(m.name,"application"),environment:De(t.environment)||De(m.env,"production"),provider:"aws",region:De(m.region,"unknown"),generatedAt:new Date().toISOString(),layers:lk,groups:[],nodes:r,links:a,notes:l}}function Wf(e,t,r={}){return e==="serverless"?gs(t,r):Pt(t,r)}function sf(e){return String(e).padStart(2,"0")}function Qo(e){return`${e.getUTCFullYear()}-${sf(e.getUTCMonth()+1)}-${sf(e.getUTCDate())}`}function mk(e){let t=Math.max(0,Math.round((Date.now()-e)/1000));if(t<60)return`${t}s ago`;let r=Math.round(t/60);if(r<60)return`${r}m ago`;let a=Math.round(r/60);if(a<48)return`${a}h ago`;return`${Math.round(a/24)}d ago`}async function Ya(e,t,r,a,l,m){let f=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:t}],StartTime:l,EndTime:m,Period:86400,Statistics:[a]}).catch(()=>[]);if(!f.length)return 0;if(a==="Sum")return f.reduce((b,k)=>b+(k.Sum??0),0);if(a==="Maximum")return Math.max(...f.map((b)=>b.Maximum??0));return f.reduce((b,k)=>b+(k.Average??0),0)/f.length}async function Za(e,t,r,a,l,m,f){let b=await e.getMetricStatistics({Namespace:t,MetricName:r,Dimensions:a,StartTime:m,EndTime:f,Period:86400,Statistics:[l]}).catch(()=>[]);if(!b.length)return 0;if(l==="Sum")return b.reduce((k,y)=>k+(y.Sum??0),0);if(l==="Maximum")return Math.max(...b.map((k)=>k.Maximum??0));return b.reduce((k,y)=>k+(y.Average??0),0)/b.length}async function tp(e,t,r,a,l){let m=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:t}],StartTime:a,EndTime:l,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(m.reduce((f,b)=>f+(b.Percentiles?.[r]??0),0))}async function bn(e,t){let r=await Ar(e,t),a=r.region,l=new ce(a),m=new E(a),f=new Ie(a),b=new Date,k=new Date(b.getTime()-86400000),y=e.environments?.[t]?.app,R={};R.app={name:r.slug,env:t,region:a,runtime:y?.kind==="php"?`php-${y?.phpVersion??"8.3"} (fpm)`:y?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},R.maintenance={enabled:!1},R.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let T=0,N=0,j=0,U=[],q=[],Y=[];for(let ie of r.functions){let[we,Ee,de,je,ne,Me,Je,gt,zt]=await Promise.all([Ya(l,ie.name,"Invocations","Sum",k,b),Ya(l,ie.name,"Errors","Sum",k,b),Ya(l,ie.name,"Throttles","Sum",k,b),Ya(l,ie.name,"Duration","Average",k,b),m.getFunction(ie.name).catch(()=>null),tp(l,ie.name,"p50",k,b),tp(l,ie.name,"p95",k,b),tp(l,ie.name,"p99",k,b),l.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:ie.name}],StartTime:new Date(b.getTime()-43200000),EndTime:b,Period:3600,Stat:"Sum"}).catch(()=>[])]);T+=we,N+=Ee,j=Math.max(j,je);let it=ne?.Configuration?.MemorySize??0,kt=Object.keys(ne?.Configuration?.Environment?.Variables??{}),Ut=[],dt=0;try{let{events:ue=[]}=await f.filterLogEvents({logGroupName:`/aws/lambda/${ie.name}`,startTime:k.getTime(),limit:120});for(let he of ue){let Te=(he.message??"").trim(),mt=/Max Memory Used:\s*(\d+)\s*MB/.exec(Te);if(mt)dt=Math.max(dt,Number(mt[1]));if(Te&&!/^(?:START|END|REPORT|INIT_START)/.test(Te))Y.push({source:ie.mode||ie.name,timestamp:new Date(he.timestamp??0).toISOString(),when:mk(he.timestamp??0),message:Te.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(Te)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(Te)?"warn":"info"})}Ut=ue.filter((he)=>!/^(?:START|END|REPORT|INIT_START)/.test((he.message??"").trim())).slice(-6).map((he)=>({ts:new Date(he.timestamp??0).toISOString().slice(11,19),msg:(he.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(he.message??"")}))}catch{}let K=Math.max(1,...zt);U.push({key:ie.mode,name:ie.name,version:ie.version,memory:it,timeout:ne?.Configuration?.Timeout??0,runtime:ne?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(we),errors:Math.round(Ee),p95:Je||Math.round(je),status:"active",provisioned:ie.provisioned?`${ie.provisioned.allocated}/${ie.provisioned.requested}`:void 0}),q.push({key:ie.mode,name:ie.name,runtime:ne?.Configuration?.Runtime??"provided.al2023",arch:ne?.Configuration?.Architectures?.[0]??"x86_64",memory:it,timeout:ne?.Configuration?.Timeout??0,ephemeral:ne?.Configuration?.EphemeralStorage?.Size??512,version:ie.version,concurrency:y?.concurrency??"—",invocations:Math.round(we),errors:Math.round(Ee),throttles:Math.round(de),p50:Me||Math.round(je),p95:Je||Math.round(je),p99:gt||Math.round(je),maxMem:dt,spark:zt.length?zt.map((ue)=>Math.round(ue/K*100)):[0],env:kt.length?kt:["(none)"],recent:Ut.length?Ut:[{ts:"—",msg:"no recent events",err:!1}]})}R.functions=U,R.functionsDetail=q,R.serverlessLogs=Y.sort((ie,we)=>String(we.timestamp).localeCompare(String(ie.timestamp))).slice(0,600),R.serverlessLogsEmptyReason=Y.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let ee=T?Number((N/T*100).toFixed(2)):0,le=Math.round(await Ya(l,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",k,b));R.metrics={invocations:Math.round(T),errorRatePct:ee,p95Ms:Math.round(j),coldStartPct:void 0,concurrency:le,estCostUsd:void 0};try{let ie=new ae(a),we=[],Ee=[],de=0;try{let{QueueUrl:ne}=await ie.getQueueUrl(`${r.slug}-${t}-dlq`),{Attributes:Me}=await ie.getQueueAttributes(ne);de=Number(Me.ApproximateNumberOfMessages??0)}catch{}let je=y?nr(y,r.slug,t):[];for(let ne of je){let Me=ne.name.replace(`${r.slug}-${t}-`,""),Je=0,gt=0;try{let{QueueUrl:it}=await ie.getQueueUrl(ne.name),{Attributes:kt}=await ie.getQueueAttributes(it);Je=Number(kt.ApproximateNumberOfMessages??0),gt=Number(kt.ApproximateNumberOfMessagesNotVisible??0)}catch{}let zt=Math.round(await Za(l,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:ne.name}],"Sum",k,b));we.push({name:Me,visible:Je,inFlight:gt,processed:zt,dlq:de}),Ee.push({name:ne.name,short:Me,visible:Je,inFlight:gt,delayed:0,processed:zt,oldestSec:0,concurrency:ne.concurrency??y?.queueConcurrency??"—",tries:y?.queueTries??3,visTimeout:(y?.queueTimeout??120)*6,dlq:de})}if(we.length)R.queues=we;if(Ee.length)R.queuesDetail=Ee;R.dlqItems=[]}catch{}try{let ie=new h(a),{Stacks:we}=await ie.describeStacks({stackName:Xt(e,t)}),Ee={};for(let de of we?.[0]?.Outputs??[])if(de.OutputKey)Ee[de.OutputKey]=de.OutputValue??"";if(y?.database?.connection==="aurora-serverless"){let de=`${r.slug}-${t}-db`,je=[{Name:"DBClusterIdentifier",Value:de}],[ne,Me]=await Promise.all([Za(l,"AWS/RDS","ServerlessDatabaseCapacity",je,"Average",k,b),Za(l,"AWS/RDS","DatabaseConnections",je,"Maximum",k,b)]);if(R.aurora={id:de,engine:"aurora-mysql",minAcu:y?.database?.minCapacity??0.5,maxAcu:y?.database?.maxCapacity??4,currentAcu:ne?Number(ne.toFixed(1)):y?.database?.minCapacity??0.5,database:"app",connections:Math.round(Me),status:Ee.DbEndpoint?"available":"creating"},y?.rdsProxy)R.proxy={name:`${r.slug}-${t}-proxy`,endpoint:Ee.DbProxyEndpoint??"—",pooledConns:Math.round(Me),status:"available"}}if(y?.cache?.driver==="elasticache"){let de=`${r.slug}-${t}-cache`,je=[{Name:"CacheClusterId",Value:`${de}-001`}],[ne,Me]=await Promise.all([Za(l,"AWS/ElastiCache","CacheHits",je,"Sum",k,b),Za(l,"AWS/ElastiCache","CacheMisses",je,"Sum",k,b)]),Je=ne+Me>0?Number((ne/(ne+Me)*100).toFixed(1)):0;R.redis={id:de,node:"cache.t4g.micro",engine:"redis",hitRate:Je,status:Ee.CacheEndpoint?"available":"creating"}}if(y?.efs){let de=0;try{if(Ee.EfsFileSystemId){let je=new fr(a),{FileSystems:ne}=await je.describeFileSystems({FileSystemId:Ee.EfsFileSystemId});de=Number(((ne?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}R.efs={id:Ee.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:de,status:"available"}}R.assetsInfo=Ee.AssetsCdnDomain?{bucket:Ee.AssetsBucketName??`${r.slug}-${t}-assets`,cdn:Ee.AssetsCdnDomain,customDomain:y?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:R.app.build}:void 0}catch{}if(R.assetsInfo)try{let we=await new o(a).list({bucket:R.assetsInfo.bucket,maxKeys:1000});R.assetsInfo.files=we.length,R.assetsInfo.sizeMb=Number((we.reduce((Ee,de)=>Ee+(de.Size??0),0)/1048576).toFixed(1)),R.assetsRecent=we.slice(0,8).map((Ee)=>({path:`/${Ee.Key}`,size:`${Math.max(1,Math.round((Ee.Size??0)/1024))} KB`,type:Ee.Key.split(".").pop()??""}))}catch{}try{if(y?.secrets){let ie=Array.isArray(y.secrets)?y.secrets.map((we)=>({key:we.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:we})):Object.entries(y.secrets).map(([we,Ee])=>({key:we,source:String(Ee)}));R.secretsList=ie.map((we)=>({...we,updated:"—"}))}}catch{}try{let ie=new o(a),we=`${r.slug}-${t}-deployments`,Ee=await ie.getObjectJson(we,`deployments/${r.slug}/${t}/history.json`).catch(()=>null);if(Ee?.records?.length)R.deploymentsDetail=Ee.records.slice(-12).reverse().map((de)=>({sha:(de.sha??"").slice(0,7),status:de.status??"success",when:de.timestamp??"—",took:de.took??"—",by:de.by??"—",version:de.version??"—",hooks:de.hooks??[]}))}catch{}R.metricsTotals={invocations:R.metrics.invocations,errors:Math.round(N),errorRatePct:ee,p95Ms:R.metrics.p95Ms,throttles:q.reduce((ie,we)=>ie+we.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:le},R.metricsPerFn=q.map((ie)=>({key:ie.key,invocations:ie.invocations,errors:ie.errors,throttles:ie.throttles,avgMs:ie.p50,maxMs:ie.p99,costUsd:void 0}));try{R.invSpark=await l.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((ie)=>ie.mode==="http")?.name??""}],StartTime:new Date(b.getTime()-86400000),EndTime:b,Period:3600,Stat:"Sum"})}catch{}try{let ie=new Ts,we=b,Ee=new Date(Date.UTC(we.getUTCFullYear(),we.getUTCMonth(),1)),de=new Date(Date.UTC(we.getUTCFullYear(),we.getUTCMonth()-1,1)),[je,ne]=await Promise.all([ie.getCostByService({start:Qo(Ee),end:Qo(we),granularity:"MONTHLY"}).catch(()=>[]),ie.getCostByService({start:Qo(de),end:Qo(Ee),granularity:"MONTHLY"}).catch(()=>[])]);if(je.length){let Me=je.reduce((dt,K)=>dt+K.amount,0),Je=ne.reduce((dt,K)=>dt+K.amount,0),gt=we.getUTCDate(),zt=new Date(Date.UTC(we.getUTCFullYear(),we.getUTCMonth()+1,0)).getUTCDate();R.costSummary={monthToDateUsd:Number(Me.toFixed(2)),projectedUsd:Number((Me/gt*zt).toFixed(2)),lastMonthUsd:Number(Je.toFixed(2)),dailyAvgUsd:Number((Me/gt).toFixed(2))},R.costServices=je.filter((dt)=>dt.amount>0).sort((dt,K)=>K.amount-dt.amount).slice(0,12).map((dt)=>({name:dt.service,usd:Number(dt.amount.toFixed(2)),note:""})),R.metrics.estCostUsd=Number((Me/gt).toFixed(2)),R.metricsTotals.estCostUsd=R.metrics.estCostUsd,R.costTrend=await ie.getDailyTotals({start:Qo(Ee),end:Qo(we)}).catch(()=>[]);let it=je.find((dt)=>/lambda/i.test(dt.service))?.amount??0,kt=(dt)=>dt.invocations*(dt.p50/1000)*(dt.memory/1024),Ut=q.reduce((dt,K)=>dt+kt(K),0)||1;R.costPerFn=q.map((dt)=>({key:dt.key,requests:dt.invocations,gbSec:Math.round(kt(dt)),usd:Number((it*(kt(dt)/Ut)).toFixed(2))}))}}catch{}if(y?.firewall)try{let ie=await l.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:k,EndTime:b,Period:86400,Statistics:["Sum"]}).catch(()=>[]),we=await l.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:k,EndTime:b,Period:86400,Statistics:["Sum"]}).catch(()=>[]);R.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${t}-waf`,allowed24h:Math.round(we.reduce((Ee,de)=>Ee+(de.Sum??0),0)),blocked24h:Math.round(ie.reduce((Ee,de)=>Ee+(de.Sum??0),0))};try{let Ee=new ep(a),de=await Ee.listWebACLs("REGIONAL"),je=de.find((ne)=>ne.Name?.includes(`${r.slug}-${t}`))??de[0];if(je?.Name&&je.Id){R.waf.acl=je.Name;let ne=await Ee.getWebACLRules(je.Name,je.Id,"REGIONAL");if(ne.length)R.wafRules=ne.map((Me)=>({name:Me.Name??"—",detail:`priority ${Me.Priority??0}`,action:Me.Action??"count",blocked24h:0}))}}catch{}}catch{}let Z=[];if(R.aurora)Z.push({name:"Aurora Serverless v2",detail:`${R.aurora.id} · ${R.aurora.minAcu}-${R.aurora.maxAcu} ACU`,status:R.aurora.status});if(R.proxy)Z.push({name:"RDS Proxy",detail:R.proxy.name,status:R.proxy.status});if(R.redis)Z.push({name:`ElastiCache (${R.redis.engine})`,detail:`${R.redis.node} · ${R.redis.hitRate}% hit rate`,status:R.redis.status});if(R.efs)Z.push({name:"EFS",detail:`${R.efs.mount} · ${R.efs.sizeMb} MB`,status:R.efs.status});if(Z.length)R.dataServices=Z;if(r.scheduler!=="off"&&y?.kind==="php")try{let ie=await rt(e,t,"schedule:list"),we=[];for(let Ee of(ie||"").split(`
+`;function Gm(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function Ow(e){return["NoSuchEntity","ResourceNotFoundException","404"].includes(Gm(e))}function Km(e){return["EntityAlreadyExists","ResourceAlreadyExistsException","ResourceConflictException","409"].includes(Gm(e))}function Jm(e,t){let r=e?.Items;if(!r)return[];if(Array.isArray(r))return r;let a=r[t];if(a===void 0)return[];return Array.isArray(a)?a:[a]}function Nl(e){let t=e?.Aliases?.Items,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function $w(e){if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected CloudFront alias is invalid");if(!/^[A-Za-z0-9-_]{1,64}$/.test(e.functionName))throw Error("Lambda function name is invalid");let t=e.pathPattern?.startsWith("/")?e.pathPattern:`/${e.pathPattern||"api/*"}`;if(t==="/"||t==="/*"||!t.endsWith("*"))throw Error("API path must be a non-default wildcard pattern such as /api/*");let r=e.originId||`${e.functionName}-url`,a=e.roleName||`${e.functionName}-execution`;if(!/^[A-Za-z0-9_.-]{1,64}$/.test(a))throw Error("IAM role name is invalid");let l=e.memorySize??256,m=e.timeout??10,f=e.logRetentionDays??14;if(l<128||l>10240)throw Error("Lambda memory must be between 128 and 10240 MB");if(m<1||m>900)throw Error("Lambda timeout must be between 1 and 900 seconds");return{region:e.region||"us-east-1",pathPattern:t,originId:r,roleName:a,memorySize:l,timeout:m,logRetentionDays:f}}function qf(e){let t=e.region||"us-east-1";return{cloudfront:new S(e.profile),iam:new be(t,e.profile),lambda:new E(t,e.profile),logs:new Ie(t,e.profile),sts:new Se(t,e.profile),sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}async function CS(e,t){let r=$w(e),a=t||qf({profile:e.profile,region:r.region}),[l,m,f]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId),a.cloudfront.getDistributionConfig(e.distributionId)]);if(!l.Account)throw Error("AWS identity did not return an account ID");if(!m.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!(Nl(m).length?Nl(m):Nl(f.DistributionConfig)).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let k,y=!0;try{k=await a.iam.getRole({RoleName:r.roleName})}catch(it){if(!Ow(it))throw it;y=!1}let R=k?.Arn||`arn:aws:iam::${l.Account}:role/${r.roleName}`,T=await a.lambda.functionExists(e.functionName),N=T?await a.lambda.getFunctionUrl(e.functionName):null,j=await a.cloudfront.listOriginAccessControls(),U=`${e.functionName}-lambda-url`,q=j.some((it)=>it.Name===U&&it.OriginAccessControlOriginType==="lambda"),Y=Jm(f.DistributionConfig.Origins,"Origin"),ee=Jm(f.DistributionConfig.CacheBehaviors,"CacheBehavior"),le=Y.some((it)=>String(it.Id)===r.originId),Z=ee.some((it)=>String(it.PathPattern)===r.pathPattern),ie=[...!y?[`create IAM execution role ${r.roleName}`]:[`reconcile IAM execution policy ${r.roleName}`],...T?[`update Lambda ${e.functionName} code and configuration`]:[`create Lambda ${e.functionName}`],...!N?["create private AWS_IAM function URL"]:[],...!q?[`create Lambda origin access control ${U}`]:[],"grant CloudFront function-URL and invocation permissions",`${Z?"reconcile":"add"} ${r.pathPattern} behavior without changing the default behavior`],we={command:`cloud cdn:origin:remove ${e.distributionId} FUNCTION_URL_HOST --id ${r.originId} --path '${r.pathPattern}' --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,removeFunction:!T,removeRole:!y},Ee={mode:e.apply?"apply":"plan",accountId:l.Account,identityArn:l.Arn,distribution:{id:m.Id,arn:m.ARN,alias:e.expectedAlias,domainName:m.DomainName,status:m.Status},function:{name:e.functionName,existed:T,runtime:"nodejs22.x",urlExisted:!!N,url:N?.FunctionUrl},role:{name:r.roleName,existed:y,arn:R},origin:{id:r.originId,pathPattern:r.pathPattern,existed:le,behaviorExisted:Z,accessControlExisted:q},changes:ie,rollback:we,applied:!1};if(!e.apply)return Ee;let de=`${e.distributionId}:${r.pathPattern}`;if(e.confirm!==de)throw Error(`Pass exact confirmation token ${de} to mutate the live distribution`);if(!k)k=await a.iam.createRole({RoleName:r.roleName,Description:`Execution role for ${e.functionName}`,AssumeRolePolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Principal:{Service:"lambda.amazonaws.com"},Action:"sts:AssumeRole"}]}),Tags:[{Key:"ManagedBy",Value:"ts-cloud"}]});await a.iam.putRolePolicy({RoleName:r.roleName,PolicyName:"lambda-logs",PolicyDocument:JSON.stringify({Version:"2012-10-17",Statement:[{Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:${r.region}:${l.Account}:log-group:/aws/lambda/${e.functionName}:*`}]})});try{await a.logs.createLogGroup(`/aws/lambda/${e.functionName}`,{ManagedBy:"ts-cloud"})}catch(it){if(!Km(it))throw it}await a.logs.putRetentionPolicy(`/aws/lambda/${e.functionName}`,r.logRetentionDays);let je=e.code||Dw;if(T)await a.lambda.updateFunctionCodeInline(e.functionName,je,"index.mjs"),await a.lambda.waitForFunctionActive(e.functionName),await a.lambda.updateFunctionConfiguration({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:k.Arn,Handler:"index.handler",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize});else{let it;for(let kt=0;kt<8;kt++)try{await a.lambda.createFunctionWithCode({FunctionName:e.functionName,Runtime:"nodejs22.x",Role:k.Arn,Handler:"index.handler",Code:je,Filename:"index.mjs",Description:`Private API origin for ${e.expectedAlias}`,Timeout:r.timeout,MemorySize:r.memorySize}),it=void 0;break}catch(Ut){if(it=Ut,!String(Ut.message).toLowerCase().includes("role"))throw Ut;await a.sleep(1000)}if(it)throw it}await a.lambda.waitForFunctionActive(e.functionName);let ne=N||await a.lambda.createFunctionUrl({FunctionName:e.functionName,AuthType:"AWS_IAM",InvokeMode:"BUFFERED"});if(!ne.FunctionUrl)throw Error("Lambda did not return a function URL");let Me=new URL(ne.FunctionUrl).hostname,Je=await a.cloudfront.findOrCreateOriginAccessControl(U,"lambda"),gt=m.ARN||`arn:aws:cloudfront::${l.Account}:distribution/${e.distributionId}`,zt=[{FunctionName:e.functionName,StatementId:"AllowCloudFrontFunctionUrl",Action:"lambda:InvokeFunctionUrl",Principal:"cloudfront.amazonaws.com",SourceArn:gt,FunctionUrlAuthType:"AWS_IAM"},{FunctionName:e.functionName,StatementId:"AllowCloudFrontInvoke",Action:"lambda:InvokeFunction",Principal:"cloudfront.amazonaws.com",SourceArn:gt,InvokedViaFunctionUrl:!0}];for(let it of zt)try{await a.lambda.addPermission(it)}catch(kt){if(!Km(kt))throw kt}return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:Me,pathPattern:r.pathPattern,originAccessControlId:Je.Id}),{...Ee,function:{...Ee.function,url:ne.FunctionUrl},applied:!0}}async function ES(e){let t=`https://${e.alias}/`,r=`https://${e.alias}/api/health`,a=await fetch(t,{redirect:"follow",headers:{"cache-control":"no-cache"}}),l=new Uint8Array(await a.arrayBuffer()),m=xw("sha256").update(l).digest("hex"),f=Date.now(),b=await fetch(r,{redirect:"follow",headers:{"cache-control":"no-cache"}}),k=Date.now()-f,y=await b.text(),R=y;try{R=JSON.parse(y)}catch{}let T;if(e.logs&&e.functionName){let N=await e.logs.filterLogEvents({logGroupName:`/aws/lambda/${e.functionName}`,startTime:f-60000,filterPattern:'"Init Duration"',limit:25});for(let j of N.events||[]){let U=j.message?.match(/Init Duration:\s*([0-9.]+)\s*ms/i);if(U)T=Number(U[1])}}return{frontend:{url:t,status:a.status,sha256:m,unchanged:e.expectedFrontendSha256?m===e.expectedFrontendSha256:void 0,bytes:l.byteLength},api:{url:r,status:b.status,latencyMs:k,healthy:b.ok&&!!R?.ok,body:R},coldStart:{observed:T!==void 0,initDurationMs:T},verifiedAt:(e.now?.()||new Date).toISOString()}}function vS(e){let t=(e.memoryMb||256)/1024,r=Math.max(0,e.requests-(e.includeFreeTier===!1?0:1e6)),a=Math.max(0,e.requests*(e.averageDurationMs/1000)*t-(e.includeFreeTier===!1?0:400000)),l=r/1e6*0.2+a*0.0000166667,m=9.010025,f=16.425;return{lambdaUsd:Number(l.toFixed(2)),alwaysOnFargateAndAlbUsd:Number(25.435025000000003 .toFixed(2)),assumptions:["us-east-1 public list rates snapshot, July 2026","Lambda x86 request and duration pricing with optional monthly free tier","Fargate comparison uses one always-on 0.25 vCPU/0.5 GB task plus one ALB before LCU charges","excludes CloudFront, data transfer, logs, taxes, and application data services"]}}import{createHash as Nw}from"node:crypto";function jw(e){let t=e;return String(t?.code||t?.name||t?.statusCode||"")}function Bw(e){return jw(e)==="ValidationError"&&String(e.message).includes("does not exist")}function Mw(e){return Object.fromEntries((e||[]).map((t)=>[t.OutputKey,t.OutputValue]))}function Lw(e){let t=e?.Aliases?.Items??e?.Aliases,r=t?.CNAME??t;if(Array.isArray(r))return r.map(String);if(typeof r==="string")return[r];return[]}function Qm(e){if(!/^[a-z][a-z0-9-]{1,62}$/.test(e.slug))throw Error("Slug must be a lowercase DNS-safe identifier");if(!/^[A-Z0-9]{8,32}$/.test(e.distributionId))throw Error("CloudFront distribution ID is invalid");if(!/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9-]{2,63}$/.test(e.expectedAlias))throw Error("Expected distribution alias is invalid");let t=e.imageUri.match(/@((?:sha256:)[a-f0-9]{64})$/i)?.[1];if(!t)throw Error("Container image must use an immutable ECR digest URI ending in @sha256:<64 hex>");let r=e.stackName||`${e.slug}-backend`;if(!/^[A-Za-z][A-Za-z0-9-]{0,127}$/.test(r))throw Error("CloudFormation stack name is invalid");let a=e.pathPattern||"/api/*";if(!/^\/[A-Za-z0-9_.*?~!$&'()+,;=:@%/-]+\*$/.test(a)||a==="/*")throw Error("Backend path must be a non-default wildcard pattern");let l=e.originId||`${e.slug}-backend`;if(!/^[A-Za-z0-9_.-]{1,128}$/.test(l))throw Error("CloudFront origin ID is invalid");if(e.originVerifySecret&&e.originVerifySecret.length<24)throw Error("Origin verification secret must contain at least 24 characters");if(!!e.originDomain!==!!e.certificateArn)throw Error("A custom origin domain and matching ACM certificate ARN must be provided together");return{stackName:r,region:e.region||"us-east-1",pathPattern:a,originId:l,digest:t}}function jf(e){let t=e.region||"us-east-1";return{cloudformation:new h(t,e.profile),cloudfront:new S(e.profile),sts:new Se(t,e.profile),fetch,sleep:(r)=>new Promise((a)=>setTimeout(a,r))}}function zf(e){let t=Qm(e),r=Jd({name:e.name,slug:e.slug,domain:e.originDomain||e.expectedAlias,imageUri:e.imageUri,certificateArn:e.certificateArn,originVerifySecret:e.originVerifySecret,desiredCount:e.desiredCount,database:e.database,cache:e.cache,queue:e.queue}),a=Wd(r);return a.Description=`Managed backend for existing static frontend ${e.expectedAlias}`,a.Metadata={ManagedBy:"ts-cloud",ExistingDistributionId:e.distributionId,ExistingDistributionAlias:e.expectedAlias,BackendPathPattern:t.pathPattern,ContainerDigest:t.digest},a}async function Fw(e,t,r){let a;for(let l=0;l<30;l++){let m=Date.now();try{let f=await e.fetch(t,{redirect:"manual",headers:r?{"x-origin-verify":r}:void 0}),b=Date.now()-m,k=await f.text(),y=k;try{y=JSON.parse(k)}catch{}if(f.ok)return{url:t,status:f.status,latencyMs:b,body:y};a=Error(`origin returned ${f.status}`)}catch(f){a=f}if(l<29)await e.sleep(1e4)}throw Error(`Backend origin did not become healthy: ${a instanceof Error?a.message:String(a)}`)}async function TS(e,t){let r=Qm(e),a=t||jf({region:r.region,profile:e.profile}),[l,m]=await Promise.all([a.sts.getCallerIdentity(),a.cloudfront.getDistribution(e.distributionId)]);if(!l.Account)throw Error("AWS identity did not return an account ID");if(!m.Enabled)throw Error(`CloudFront distribution ${e.distributionId} is disabled`);if(!Lw(m).includes(e.expectedAlias))throw Error(`Distribution ${e.distributionId} does not contain expected alias ${e.expectedAlias}`);let f;try{f=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0]}catch(ie){if(!Bw(ie))throw ie}let b=zf(e),k=JSON.stringify(b);if(Buffer.byteLength(k)>51200)throw Error("Generated template exceeds the direct CloudFormation template body limit");let y=Object.values(b.Resources||{}).reduce((ie,we)=>(ie[we.Type]=(ie[we.Type]||0)+1,ie),{}),R=[`cloud cdn:origin:remove ${e.distributionId} ${e.originDomain||"ALB_HOST"} --id ${r.originId} --path '${r.pathPattern}' --profile ${e.profile||"default"} --apply --confirm 'remove:${e.distributionId}:${r.pathPattern}'`,`After CloudFront is deployed, restore external DNS if changed and delete stack ${r.stackName} only with an approved data-retention decision.`],T={mode:e.apply?"apply":"plan",accountId:l.Account,stack:{name:r.stackName,existed:!!f,status:f?.StackStatus,templateSha256:Nw("sha256").update(k).digest("hex"),resourceCount:Object.keys(b.Resources||{}).length,resourceTypes:y},distribution:{id:m.Id,alias:e.expectedAlias,domainName:m.DomainName,status:m.Status,pathPattern:r.pathPattern,originId:r.originId},artifact:{imageUri:e.imageUri,digest:r.digest},services:{database:e.database!==!1,cache:e.cache!==!1,queue:e.queue!==!1,mail:"ses",desiredCount:e.desiredCount||1},cloudFrontApplied:!1,dnsApplied:!1,applied:!1,rollback:R};if(!e.apply)return T;let N=`${e.distributionId}:${r.pathPattern}:${r.stackName}`;if(e.confirm!==N)throw Error(`Pass exact confirmation token ${N} to provision the backend and change live routing`);if(f)try{await a.cloudformation.updateStack({stackName:r.stackName,templateBody:k,capabilities:["CAPABILITY_NAMED_IAM"],tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-update-complete")}catch(ie){if(!String(ie.message).includes("No updates are to be performed"))throw ie}else await a.cloudformation.createStack({stackName:r.stackName,templateBody:k,capabilities:["CAPABILITY_NAMED_IAM"],onFailure:"ROLLBACK",tags:[{Key:"ManagedBy",Value:"ts-cloud"},{Key:"Application",Value:e.slug}]}),await a.cloudformation.waitForStack(r.stackName,"stack-create-complete");let j=(await a.cloudformation.describeStacks({stackName:r.stackName})).Stacks[0],U=Mw(j?.Outputs),q=U.AppLoadBalancerDnsName;if(!q)throw Error("Backend stack did not return AppLoadBalancerDnsName");let Y=!1;if(e.originDomain&&e.originDomain!==q){if(!a.dns)throw Error(`External DNS provider is required to map ${e.originDomain} to ${q}`);let ie=await a.dns.upsertRecord(e.originDomain,{name:e.originDomain,type:"CNAME",content:q,ttl:300});if(!ie.success)throw Error(ie.message||"External DNS update failed");Y=!0}let ee=e.originDomain||q,le=e.certificateArn?"https-only":"http-only",Z=e.skipHealthCheck?void 0:await Fw(a,`${le==="https-only"?"https":"http"}://${ee}/api/health`,e.originVerifySecret);return await a.cloudfront.upsertExistingDistributionOrigin(e.distributionId,{id:r.originId,domainName:ee,pathPattern:r.pathPattern,protocolPolicy:le,customHeaders:e.originVerifySecret?{"X-Origin-Verify":e.originVerifySecret}:void 0}),{...T,outputs:U,health:Z,cloudFrontApplied:!0,dnsApplied:Y,applied:!0}}function wS(e={}){let r={fargate:730*(e.desiredCount||1)*0.012342500000000001,applicationLoadBalancer:16.425,natGateway:32.85,postgres:730*(e.multiAzDatabase?0.032:0.016),redis:23.36};return{monthlyUsd:Number(Object.values(r).reduce((a,l)=>a+l,0).toFixed(2)),components:Object.fromEntries(Object.entries(r).map(([a,l])=>[a,Number(l.toFixed(2))])),assumptions:["us-east-1 public on-demand rate snapshot, July 2026","one 0.25 vCPU/0.5 GB Linux Fargate task unless desiredCount is changed","one ALB before LCU charges and one NAT gateway before data processing","single-AZ db.t4g.micro PostgreSQL by default and two cache.t4g.micro Redis nodes","excludes storage, backups, CloudFront, data transfer, public IPv4, logs, email, queue requests, taxes, and free-tier credits"]}}import{execFileSync as zw}from"node:child_process";import{createHash as Uw}from"node:crypto";import{existsSync as Ym,mkdirSync as qw,mkdtempSync as Vw,readdirSync as Ww,readFileSync as Hw,rmSync as Kw,statSync as Zm,writeFileSync as Jw}from"node:fs";import{tmpdir as Gw}from"node:os";import{basename as Qw,join as Go,relative as Yw,resolve as Bl}from"node:path";var Zw=new Set([".git","node_modules","dist","coverage"]);function Xm(e,t=e){let r=[];for(let a of Ww(e).sort()){if(Zw.has(a))continue;let l=Go(e,a);if($d(l,t))continue;let m=Zm(l);if(m.isDirectory())r.push(...Xm(l,t));else if(m.isFile())r.push(Yw(t,l))}return r}function Kf(e){let t=Bl(e);if(!Ym(t)||!Zm(t).isDirectory())throw Error(`Container context does not exist: ${t}`);let r=Uw("sha256");for(let a of Xm(t))r.update(a),r.update("\x00"),r.update(Hw(Go(t,a))),r.update("\x00");return r.digest("hex")}function Wf(e){return{ecr:new $e(e.region||"us-east-1",e.profile),run:(t,r,a)=>{zw(t,r,{cwd:a?.cwd,env:a?.env,stdio:a?.stdio||"inherit"})}}}async function RS(e,t){let r=Bl(e.context),a=Bl(e.dockerfile||Go(r,"Dockerfile"));if(!Ym(a))throw Error(`Dockerfile does not exist: ${a}`);if(!e.repository.split("/").every((U)=>/^[a-z0-9][a-z0-9._-]*$/.test(U)&&!/[._-]$/.test(U)&&!/[._-]{2}/.test(U)))throw Error("ECR repository name is invalid");let f=t||Wf(e),b=Kf(r),k=`sha-${b.slice(0,20)}`,y="";try{y=(await f.ecr.describeRepositories({repositoryNames:[e.repository]})).repositories?.[0]?.repositoryUri||""}catch{}if(!y)y=(await f.ecr.createRepository({repositoryName:e.repository,imageTagMutability:"IMMUTABLE",imageScanningConfiguration:{scanOnPush:!0},tags:[{Key:"ManagedBy",Value:"ts-cloud"}]})).repository?.repositoryUri||"";if(!y)throw Error(`Could not resolve ECR repository URI for ${e.repository}`);await f.ecr.putLifecyclePolicy({repositoryName:e.repository,lifecyclePolicyText:JSON.stringify({rules:[{rulePriority:1,description:"Retain the newest 25 release images",selection:{tagStatus:"any",countType:"imageCountMoreThan",countNumber:25},action:{type:"expire"}}]})});let R=`${y}:${k}`,T=Vw(Go(Gw(),"ts-cloud-container-"));try{f.run("docker",["version"],{stdio:"ignore"}),f.run("docker",["build","--platform",e.platform||"linux/amd64","--provenance=false","--sbom=false","--file",a,"--tag",R,r],{cwd:r});let U=(await f.ecr.getAuthorizationToken()).authorizationData?.[0];if(!U?.authorizationToken||!U.proxyEndpoint)throw Error("ECR did not return Docker authorization data");let q=U.proxyEndpoint.replace(/^https?:\/\//,""),Y=Go(T,"docker");qw(Y,{recursive:!0}),Jw(Go(Y,"config.json"),JSON.stringify({auths:{[q]:{auth:U.authorizationToken}}}),{mode:384}),f.run("docker",["push",R],{env:{...process.env,DOCKER_CONFIG:Y}})}finally{Kw(T,{recursive:!0,force:!0})}let j=(await f.ecr.describeImages({repositoryName:e.repository,imageIds:[{imageTag:k}]})).imageDetails?.[0]?.imageDigest;if(!j||!/^sha256:[a-f0-9]{64}$/i.test(j))throw Error(`ECR did not return an immutable digest for ${Qw(R)}`);return{repository:e.repository,tag:k,imageUri:R,digest:j,digestUri:`${y}@${j}`,contextSha256:b}}import{existsSync as Xw,readdirSync as ek,readFileSync as tk,statSync as rk}from"node:fs";import{join as ef,relative as nk}from"node:path";function go(e,t){let r=e.environments?.[t]?.app;if(!r)throw Error(`No serverless app configured for environment '${t}'. Add environments.${t}.app to your config.`);let a=e.project.slug,l=e.environments?.[t]?.region||e.project.region||"us-east-1";return{app:r,slug:a,region:l,stackName:Xt(e,t),artifactBucket:Hd(a,t),assetsBucket:Fi(a,t)}}async function po(e,t=8){let r;for(let a=0;a<t;a++)try{return await e()}catch(l){let m=l?.code||l?.name||"",f=String(l?.message||"");if(m==="ResourceConflictException"||/update is in progress|currently in the following state/i.test(f)){r=l,await new Promise((b)=>setTimeout(b,3000));continue}throw l}throw r}var tf=(e,t)=>`releases/${e}/${t}/current.json`;async function Nc(e,t,r,a){try{return await e.getObjectJson(t,tf(r,a))}catch{return null}}async function rf(e,t,r,a,l){await e.putObjectJson(t,tf(r,a),l)}async function ik(e,t){if(!e.secrets)return{};let r=new W(t),a={},l=Array.isArray(e.secrets)?e.secrets.map((m)=>({envName:m.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:m})):Object.entries(e.secrets).map(([m,f])=>({envName:m,secretId:f}));if(Array.isArray(e.secrets)){let m=new Map;for(let{envName:b,secretId:k}of l)m.set(b,[...m.get(b)??[],k]);let f=[...m.entries()].filter(([,b])=>b.length>1);if(f.length){let b=f.map(([k,y])=>`${k} ← ${y.join(", ")}`).join("; ");throw Error(`serverless secrets: multiple secrets map to the same env var (${b}). Use the map form { ENV_NAME: 'secret/id' } to disambiguate.`)}}for(let{envName:m,secretId:f}of l){let k=(await r.getSecretValue({SecretId:f})).SecretString??"";try{let y=JSON.parse(k);if(y&&typeof y==="object"&&!Array.isArray(y)){for(let[R,T]of Object.entries(y))a[R]=String(T);continue}}catch{}a[m]=k}return a}function us(e,t){let r={},a=t.DbProxyEndpoint||t.DbEndpoint;if(a)r.DB_CONNECTION="mysql",r.DB_HOST=a,r.DB_PORT="3306",r.DB_DATABASE=r.DB_DATABASE||"app";if(t.CacheEndpoint){if(r.REDIS_HOST=t.CacheEndpoint,r.REDIS_PORT="6379",e.cache?.driver==="elasticache")r.CACHE_STORE="redis",r.CACHE_DRIVER="redis",r.SESSION_DRIVER="redis"}return r}function cr(e,t,r,a,l,m,f,b={}){let k=e.kind==="php"?Tl({cacheDriver:e.cache?.driver==="elasticache"?"redis":"dynamodb"}):{};return{TSCLOUD_LAMBDA_MODE:a,TSCLOUD_ENV:r,MAINTENANCE_MODE:"0",...e.octane?{TSCLOUD_OCTANE:"1"}:{},...e.serveAssets?{TSCLOUD_SERVE_ASSETS:"1"}:{},...e.redirectRobotsTxt===!1?{TSCLOUD_REDIRECT_ROBOTS_TXT:"0"}:{},...k,...b,...t.app.cache?.driver!=="elasticache"?{TSCLOUD_CACHE_TABLE:`${t.slug}-${r}-cache`}:{},...f?{TSCLOUD_QUEUE:f,SQS_QUEUE:f}:{},...m?{ASSET_URL:m}:{},...e.env??{},...l}}function ok(e){let t=e.slice(e.lastIndexOf(".")).toLowerCase();return{".html":"text/html",".css":"text/css",".js":"text/javascript",".mjs":"text/javascript",".json":"application/json",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".gif":"image/gif",".webp":"image/webp",".ico":"image/x-icon",".woff":"font/woff",".woff2":"font/woff2",".txt":"text/plain",".map":"application/json"}[t]??"application/octet-stream"}function*nf(e){for(let t of ek(e)){let r=ef(e,t);if(rk(r).isDirectory())yield*nf(r);else yield r}}async function sk(e,t,r,a,l=!1){let m=0;for(let f of nf(r)){let b=nk(r,f).replace(/\\/g,"/");if(!l&&b.split("/").some((k)=>k.startsWith(".")))continue;await e.putObject({bucket:t,key:`${a}/${b}`,body:tk(f),contentType:ok(f),cacheControl:"public, max-age=31536000, immutable"}),m++}return m}function ak(e,t){let r=Object.entries(t).reduce((a,[l,m])=>a+Buffer.byteLength(`${l}=${m}`,"utf8"),0);if(r>4096){let a=Object.entries(t).map(([l,m])=>[l,Buffer.byteLength(`${l}=${m}`,"utf8")]).sort((l,m)=>m[1]-l[1]).slice(0,5).map(([l,m])=>`${l} (${m}B)`).join(", ");throw Error(`${e}: environment variables total ${r}B, over AWS's 4096B limit (${r-4096}B too large). Largest: ${a}. Move large/secret values out of env — store them in Secrets Manager and fetch at cold start.`)}}async function Ja(e,t,r,a){ak(t,r),await po(()=>e.updateFunctionConfiguration({FunctionName:t,Environment:{Variables:r}})),await e.waitForFunctionActive(t,120);let l=a.kind==="image"?{FunctionName:t,ImageUri:a.imageUri}:{FunctionName:t,S3Bucket:a.bucket,S3Key:a.key};await po(()=>e.updateFunctionCode(l)),await e.waitForFunctionActive(t,120)}async function $c(e,t){let a=(await po(()=>e.publishVersion({FunctionName:t}))).Version;if(!a)throw Error(`publishVersion returned no version for ${t}`);return await po(()=>e.updateAlias({FunctionName:t,Name:"live",FunctionVersion:a})),a}async function xa(e,t,r={}){let a=go(e,t),{app:l,slug:m,region:f,stackName:b,artifactBucket:k}=a,y=r.projectRoot??process.cwd();bs(`Deploying serverless app: ${m} (${t})`),B(`Stack: ${b}`),B(`Region: ${f}`);let R=new o(f),T=new h(f),N=new E(f),j=l.kind==="php",U=l.packaging==="image",q=qi(l),Y,ee,le,Z,ie=[];if(U&&q.usesLayer&&q.layerKind!=="php")throw Error(`packaging: 'image' currently supports PHP and managed Node runtimes. ${q.kind}${q.kind==="node"?` ${q.version}`:""} uses a custom runtime — `+"use the default zip packaging (the runtime layer is built + attached automatically).");if(U){w("Building + pushing container image");let{buildAndPushServerlessImage:he}=await import("./chunk-4t0vj9a4.js"),Te=await he({app:l,projectRoot:y,region:f,repository:`${m}-${t}`,skipBuild:r.skipBuild,onStep:(mt)=>B(`  ${mt}`)});Y=Te.handlers,ee={kind:"image",imageUri:Te.imageUri},le=Te.tag,ie.push({ParameterKey:"ImageUri",ParameterValue:Te.imageUri})}else{w("Packaging application");let he=j?wl({projectRoot:y,app:l,skipBuild:r.skipBuild,onStep:(It)=>B(`  ${It}`)}):await tn({projectRoot:y,app:l,skipBuild:r.skipBuild,onStep:(It)=>B(`  ${It}`)}),Te=Al(m,t,he.sha256);if(B(`Artifact: ${he.sha256.slice(0,12)} (${(he.zip.length/1024).toFixed(0)} KB)`),Y=he.handlers,le=he.sha256,q.usesLayer){let It=q.layerEnvVar?process.env[q.layerEnvVar]:void 0;if(Z=l.layers??(It?[It]:void 0),!Z?.length){let Ne=q.layerKind==="php"?"serverless:build-php-layer":q.layerKind==="bun"?"serverless:build-bun-layer":"serverless:build-node-layer";throw Error(`${q.kind} apps on provided.al2023 need a runtime layer. Set environments.<env>.app.layers or the ${q.layerEnvVar} env var (build one with \`cloud ${Ne}\`)${q.kind==="node"?", or use a managed Node version (18/20/22)":""}.`)}}if(!await R.bucketExists(k))w(`Creating artifact bucket ${k}`),await R.createBucket(k);if(await R.headObject(k,Te).then((It)=>It!==null).catch(()=>!1))B("Artifact already uploaded — reusing");else w("Uploading artifact"),await R.putObject({bucket:k,key:Te,body:he.zip,contentType:"application/zip"});ee={kind:"zip",bucket:k,key:Te},ie.push({ParameterKey:"ArtifactBucket",ParameterValue:k},{ParameterKey:"ArtifactKey",ParameterValue:Te})}let we=Sl({config:e,environment:t,app:l,handlers:Y,runtimeLayers:Z}),Ee=JSON.stringify(we.template),de=["CAPABILITY_NAMED_IAM"],je=await T.describeStacks({stackName:b}).then((he)=>he.Stacks[0]?.StackStatus).catch(()=>{return}),ne=je!==void 0;if(je&&/DELETE_IN_PROGRESS/.test(je))w("Waiting for an in-progress stack delete to finish"),await T.waitForStack(b,"stack-delete-complete").catch(()=>{}),ne=!1;else if(je&&/(?:ROLLBACK_COMPLETE|REVIEW_IN_PROGRESS|CREATE_FAILED)/.test(je))w(`Deleting unusable stack (status ${je}) before recreate`),await T.deleteStack(b),await T.waitForStack(b,"stack-delete-complete").catch(()=>{}),ne=!1;w(ne?"Updating infrastructure stack":"Creating infrastructure stack");try{if(ne)await T.updateStack({stackName:b,templateBody:Ee,parameters:ie,capabilities:de}),await T.waitForStack(b,"stack-update-complete");else await T.createStack({stackName:b,templateBody:Ee,parameters:ie,capabilities:de,onFailure:"DELETE"}),await T.waitForStack(b,"stack-create-complete")}catch(he){if(/No updates are to be performed/i.test(String(he?.message)))B("No infrastructure changes");else throw he}let Me=await T.getStackOutputs(b).catch(()=>({})),Je;if(l.assets){let he=ef(y,l.assets);if(Xw(he)){let Te=l.assetDomain||Me.AssetsCdnDomain;Je=Te?`https://${Te}/${le}`:void 0,w(`Syncing assets from ${l.assets}`);let mt=await sk(R,a.assetsBucket,he,le,l.dotFilesAsAssets);B(`Uploaded ${mt} asset(s)${Je?` → ${Je}`:""}`)}else Is(`Assets directory not found: ${he}`)}w("Resolving secrets");let gt=await ik(l,f);if(l.database?.connection==="aurora-serverless")try{let Te=await new W(f).getSecretValue({SecretId:`${m}/${t}/db`}),mt=JSON.parse(Te.SecretString??"{}");if(mt.username)gt.DB_USERNAME=mt.username;if(mt.password)gt.DB_PASSWORD=mt.password}catch(he){Is(`Could not resolve Aurora DB credentials: ${he.message}`)}if(!await R.bucketExists(k))await R.createBucket(k);let zt=await Nc(R,k,m,t),it={},kt=we.queueNames[0],Ut=us(l,Me);if(w("Activating functions"),it.http=cr(l,a,t,"http",gt,Je,kt,Ut),await Ja(N,we.functionNames.http,it.http,ee),it.cli=cr(l,a,t,"cli",gt,Je,kt,Ut),await Ja(N,we.functionNames.cli,it.cli,ee),we.queueNames.length)it.queue=cr(l,a,t,"queue",gt,Je,kt,Ut),await Ja(N,we.functionNames.queue,it.queue,ee);let dt=(l.provisionedConcurrency??0)>0,K={};if(dt){if(w("Publishing versions + flipping live alias"),K.http=await $c(N,we.functionNames.http),K.cli=await $c(N,we.functionNames.cli),we.queueNames.length)K.queue=await $c(N,we.functionNames.queue)}if(await rf(R,k,m,t,{sha:le,code:ee,previousSha:zt?.sha,previousCode:zt?.code,previousFunctionEnv:zt?.functionEnv,...dt?{functionVersions:K,previousFunctionVersions:zt?.functionVersions}:{},functionEnv:it,functionNames:{http:we.functionNames.http,cli:we.functionNames.cli,...we.queueNames.length?{queue:we.functionNames.queue}:{}},assetUrl:Je,timestamp:new Date().toISOString()}),!r.skipDeployHooks&&l.deploy?.length){w("Running deploy hooks");for(let he of l.deploy){B(`  deploy: ${he}`);let Te=await N.invoke({FunctionName:we.functionNames.cli,InvocationType:"RequestResponse",Payload:{command:he},LogType:"Tail"});if(Te.FunctionError)throw eg("Deploy hook failed — the new build is ALREADY LIVE."),B(`  Roll back with: cloud serverless:rollback --env ${t}`),Error(`Deploy hook failed (${he}): ${Te.Payload}`)}}let ue=Me.HttpApiEndpoint;if(!r.skipHealthCheck&&ue){w("Health check");try{let he=await fetch(ue,{method:"GET"});B(`GET ${ue} → ${he.status}`)}catch(he){Is(`Health check could not reach ${ue}: ${he.message}`)}}tg(["Serverless deploy complete","",ue?`URL:   ${ue}`:"",`Stack: ${b}`,`Build: ${le.slice(0,12)}`].filter(Boolean).join(`
+`),"green")}async function Sn(e,t){let r=go(e,t),a=new o(r.region),l=new E(r.region),m=await Nc(a,r.artifactBucket,r.slug,t);if(!m)throw Error("No previous release to redeploy. Run a full deploy first.");bs(`Redeploying ${r.slug} (${t}) — build ${m.sha.slice(0,12)}`);for(let[f,b]of Object.entries(m.functionNames)){if(!b)continue;w(`Re-activating ${f} (${b})`),await Ja(l,b,m.functionEnv[f]??{},m.code);let k=m.functionVersions?.[f];if(k)await po(()=>l.updateAlias({FunctionName:b,Name:"live",FunctionVersion:k}))}wn("Redeploy complete")}async function In(e,t){let r=go(e,t),a=new o(r.region),l=new E(r.region),m=await Nc(a,r.artifactBucket,r.slug,t);if(!m?.previousCode)throw Error("No previous release to roll back to.");bs(`Rolling back ${r.slug} (${t}) → ${m.previousSha?.slice(0,12)}`);for(let[f,b]of Object.entries(m.functionNames)){if(!b)continue;w(`Restoring ${f} (${b})`);let k=m.previousFunctionEnv?.[f]??m.functionEnv[f]??{};await Ja(l,b,k,m.previousCode);let y=m.previousFunctionVersions?.[f];if(y)await po(()=>l.updateAlias({FunctionName:b,Name:"live",FunctionVersion:y}))}await rf(a,r.artifactBucket,r.slug,t,{...m,sha:m.previousSha??m.sha,code:m.previousCode,functionEnv:m.previousFunctionEnv??m.functionEnv,functionVersions:m.previousFunctionVersions??m.functionVersions,previousSha:void 0,previousCode:void 0,previousFunctionEnv:void 0,previousFunctionVersions:void 0,timestamp:new Date().toISOString()}),wn("Rollback complete")}async function dr(e,t,r,a){let l=go(e,t),m=new E(l.region),f=`${l.slug}-${t}-http`,k={...(await m.getFunction(f)).Configuration?.Environment?.Variables??{}};if(k.MAINTENANCE_MODE=r?"1":"0",r&&a)k.MAINTENANCE_BYPASS_SECRET=a;if(!r)delete k.MAINTENANCE_BYPASS_SECRET;if(await po(()=>m.updateFunctionConfiguration({FunctionName:f,Environment:{Variables:k}})),(l.app.provisionedConcurrency??0)>0)await m.waitForFunctionActive(f,120),await $c(m,f);wn(r?"Application is now in maintenance mode (503)":"Application is live")}async function rt(e,t,r){let a=go(e,t),l=new E(a.region),m=`${a.slug}-${t}-cli`,f=await l.invoke({FunctionName:m,InvocationType:"RequestResponse",Payload:{command:r},LogType:"Tail"});if(f.FunctionError)throw Error(`Command failed: ${f.Payload}`);return f.Payload??""}async function Ar(e,t){let r=go(e,t),a=new h(r.region),l=new E(r.region),m=new o(r.region),f="not deployed",b={};try{let{Stacks:U}=await a.describeStacks({stackName:r.stackName});f=U?.[0]?.StackStatus??f;for(let q of U?.[0]?.Outputs??[])if(q.OutputKey)b[q.OutputKey]=q.OutputValue??""}catch{}let k=yl(r.app,r.slug,t),y=r.app.provisionedConcurrency??0,R=["http","cli",...k.length?["queue"]:[]],T=`${r.slug}-${t}`,N=[];for(let U of R){let q=`${T}-${U}`,Y={mode:U,name:q,version:"$LATEST"};if(y>0){let ee=await l.getAlias(q,"live").catch(()=>null);if(ee?.FunctionVersion){Y.version=ee.FunctionVersion;let le=await l.getProvisionedConcurrencyConfig(q,"live").catch(()=>null);if(le)Y.provisioned={status:le.Status??"-",allocated:le.AllocatedProvisionedConcurrentExecutions??0,requested:le.RequestedProvisionedConcurrentExecutions??0}}}N.push(Y)}let j=await Nc(m,r.artifactBucket,r.slug,t).catch(()=>null);return{slug:r.slug,environment:t,region:r.region,stackStatus:f,endpoint:b.HttpApiEndpoint,assetUrl:j?.assetUrl,scheduler:r.app.scheduler??"on",queues:k,provisionedConcurrency:y,functions:N,lastRelease:j?{sha:j.sha,timestamp:j.timestamp}:void 0}}function ck(e,t){return`${e}-${t}-db`}async function of(e,t,r,a){let l=go(e,t);if(l.app.database?.connection!=="aurora-serverless")throw Error("No Aurora Serverless v2 database is configured for this environment.");let{RDSClient:m}=await import("./chunk-ksqhsz52.js"),f=new m(l.region),b=ck(l.slug,t);w(`Scaling ${b} → ${r}–${a} ACUs`),await f.modifyDBCluster({DBClusterIdentifier:b,ServerlessV2ScalingConfiguration:{MinCapacity:r,MaxCapacity:a},ApplyImmediately:!0}),wn(`Scaling applied to ${b} (takes effect shortly).`)}class ep{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async call(e,t){return this.client.request({service:"wafv2",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSWAF_20190729.${e}`},body:JSON.stringify(t)})}async listWebACLs(e="REGIONAL"){return(await this.call("ListWebACLs",{Scope:e,Limit:100}))?.WebACLs??[]}async getWebACLRules(e,t,r="REGIONAL"){return((await this.call("GetWebACL",{Name:e,Id:t,Scope:r}))?.WebACL?.Rules??[]).map((m)=>({Name:m.Name,Priority:m.Priority,Action:m.Action?Object.keys(m.Action)[0]:m.OverrideAction?Object.keys(m.OverrideAction)[0]:"count"}))}}var dk=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"routing",label:"Routing"},{index:4,id:"apps",label:"Applications"},{index:5,id:"runtime",label:"Background runtime"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],lk=[{index:0,id:"clients",label:"Clients"},{index:1,id:"dns",label:"DNS & TLS"},{index:2,id:"edge",label:"Edge"},{index:3,id:"entry",label:"Entry points"},{index:4,id:"compute",label:"Compute"},{index:5,id:"messaging",label:"Messaging & pooling"},{index:6,id:"data",label:"Data services"},{index:7,id:"durability",label:"Durability"}],uk=[{match:/^redis/,kind:"cache",label:"Redis"},{match:/^(?:mysql|mariadb)/,kind:"database",label:"MySQL"},{match:/^postgres/,kind:"database",label:"PostgreSQL"},{match:/^meilisearch/,kind:"database",label:"Meilisearch"},{match:/^vitess|^vtgate/,kind:"database",label:"Vitess"},{match:/^memcached/,kind:"cache",label:"Memcached"}],pk=/^(?:rpx-gateway|nginx|caddy|traefik|haproxy)$/;function De(e,t=""){let r=e==null?"":String(e).trim();return r&&r!=="-"&&r!=="—"?r:t}function gk(e){return Array.isArray(e)?e.length:0}function zn(e){let t=De(e).toLowerCase();if(!t)return"unknown";if(["running","live","active","available","success","ok","healthy","enabled"].includes(t))return"ok";if(["failed","stopped","unreachable","error","critical","disabled"].includes(t))return"bad";if(["configured","creating","pending","degraded","shadowed","warn","unknown"].includes(t))return"warn";return"warn"}function tr(e,t,r){if(r.has(t.source)&&r.has(t.target))e.push(t)}function Pt(e,t={}){let r=[],a=[],l=[],m=e.server??{},f=Array.isArray(e.sites)?e.sites:[],b=Array.isArray(e.services)?e.services:[],k=Array.isArray(e.workers)?e.workers:[],y=e.security??{},R=!!e._serverReachable&&!e.metricsUnavailable,T="box";if(!R)l.push("The compute box could not be probed, so live service state is missing; the shape comes from your cloud config.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let N=[...new Set(f.map((de)=>De(de.domain)||De(de.route).split("/")[0]).filter((de)=>de&&de!=="internal"&&de!=="loopback"))],j=Array.isArray(y.tlsCertificates)?y.tlsCertificates:[],U=j.filter((de)=>Number(de?.daysRemaining??999)<21).length;r.push({id:"dns",label:N.length===1?N[0]:"Public domains",kind:"dns",layer:1,status:U?"warn":N.length?"ok":"unknown",sub:N.length>1?`${N.length} domains`:"DNS & certificates",facts:[{label:"Domains",value:N.length?N.slice(0,6).join(", "):"none resolved"},{label:"Certificates",value:j.length?`${j.length} issued`:"none reported"},...U?[{label:"Expiring",value:`${U} within 21 days`}]:[]],href:"/server/security",external:!0});let q=y.firewall??{},Y=Array.isArray(y.ports)?y.ports:[];r.push({id:"firewall",label:"Host firewall",kind:"firewall",layer:2,status:zn(q.status),sub:De(q.summary,"Inbound filtering"),facts:[{label:"State",value:De(q.status,"unknown")},{label:"Open ports",value:Y.length?Y.map((de)=>De(de.listen)).join(", "):"not reported"}],href:"/server/firewall",group:"box"});let ee=b.find((de)=>pk.test(De(de.name)));r.push({id:"proxy",label:De(ee?.name,"Reverse proxy"),kind:"proxy",layer:3,status:ee?zn(ee.status):"unknown",sub:"TLS termination & routing",facts:[{label:"Service",value:De(ee?.name,"not detected")},{label:"State",value:De(ee?.status,R?"not running":"not probed")},{label:"Routes",value:`${f.length} site${f.length===1?"":"s"}`}],href:"/server/services",group:"box"});for(let de of f){let je=`site:${De(de.name)}`;if(!De(de.name))continue;r.push({id:je,label:De(de.name),kind:"site",layer:4,status:zn(de.status),sub:De(de.runtime,"runtime"),facts:[{label:"Route",value:De(de.route,"internal")},{label:"Runtime",value:De(de.runtime,"unknown")},{label:"Delivery",value:De(de.deploy,"unknown")},{label:"TLS",value:De(de.tls,"unknown")},...de.responseMs!=null?[{label:"Response",value:`${Math.round(Number(de.responseMs))} ms`}]:[],...de.httpStatus!=null?[{label:"HTTP",value:String(de.httpStatus)}]:[]],href:"/server/sites",group:"box"})}for(let de of k){let je=`worker:${De(de.name)}`;if(!De(de.name))continue;r.push({id:je,label:De(de.name),kind:"worker",layer:5,status:zn(de.status),sub:`${Number(de.processes??1)} process${Number(de.processes??1)===1?"":"es"}`,facts:[{label:"Processes",value:String(de.processes??1)},{label:"State",value:De(de.status,"unknown")},...De(de.site)?[{label:"Site",value:De(de.site)}]:[]],href:"/operations/jobs",group:"box"})}let le=e.serverScheduler??{};if(le.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:5,status:"ok",sub:"Cron dispatch",facts:[{label:"Last run",value:De(le.lastRun,"unknown")}],href:"/operations/jobs",group:"box"});let Z=b.map((de)=>{let je=De(de.name),ne=uk.find((Me)=>Me.match.test(je));return ne?{service:de,name:je,...ne}:null}).filter((de)=>!!de);for(let de of Z)r.push({id:`data:${de.name}`,label:de.label,kind:de.kind,layer:6,status:zn(de.service.status),sub:de.name,facts:[{label:"Unit",value:de.name},{label:"State",value:De(de.service.status,"unknown")}],href:"/data/services",group:"box"});let ie=e.backup??{};if(ie.enabled)r.push({id:"backup",label:"Backups",kind:"backup",layer:7,status:"ok",sub:De(ie.destination,"destination"),facts:[{label:"Destination",value:De(ie.destination,"unknown")},{label:"Schedule",value:De(ie.schedule,"unknown")},{label:"Retention",value:`${ie.retention??0} copies`},{label:"Last run",value:De(ie.last,"unknown")}],href:"/data/backups"});let we=new Set(r.map((de)=>de.id));tr(a,{source:"internet",target:"dns",flow:"request",label:"https"},we),tr(a,{source:"dns",target:"firewall",flow:"request",label:"443/80"},we),tr(a,{source:"firewall",target:"proxy",flow:"request"},we);for(let de of f){let je=`site:${De(de.name)}`;tr(a,{source:"proxy",target:je,flow:"request",label:De(de.path)||void 0,status:zn(de.status)},we)}for(let de of k){let je=`worker:${De(de.name)}`,ne=`site:${De(de.site)}`;if(we.has(ne))tr(a,{source:ne,target:je,flow:"async",label:"queue"},we);else tr(a,{source:"proxy",target:je,flow:"async",label:"queue"},we)}for(let de of k)tr(a,{source:"scheduler",target:`worker:${De(de.name)}`,flow:"async",label:"dispatch"},we);let Ee=[...f.map((de)=>`site:${De(de.name)}`),...k.map((de)=>`worker:${De(de.name)}`)];for(let de of Z)for(let je of Ee)tr(a,{source:je,target:`data:${de.name}`,flow:"data",label:"localhost"},we);if(Z.length&&Ee.length)l.push("Data-service edges show co-location on the box: every process on it can reach localhost. They are not a declared per-site binding.");for(let de of Z)tr(a,{source:`data:${de.name}`,target:"backup",flow:"backup",label:"snapshot"},we);for(let de of f)tr(a,{source:`site:${De(de.name)}`,target:"backup",flow:"backup"},we);return{mode:"server",project:De(t.project)||De(e.project?.name)||De(m.name,"project"),environment:De(t.environment)||De(e.environment,"production"),provider:De(m.provider,"unknown"),region:De(m.region,"unknown"),generatedAt:new Date().toISOString(),layers:dk,groups:[{id:"box",label:De(m.name,"App server"),sub:[De(m.provider),De(m.region),De(m.ip)].filter(Boolean).join(" · ")}],nodes:r,links:a,notes:l}}function gs(e,t={}){let r=[],a=[],l=[],m=e.app??{},f=Array.isArray(e.functions)?e.functions:[],b=Array.isArray(e.queues)?e.queues:[],k=e.metrics??{};if(!f.length)l.push("No Lambda functions were read for this environment, so the compute layer is empty rather than assumed.");r.push({id:"internet",label:"Internet",kind:"internet",layer:0,status:"ok",sub:"Public traffic",facts:[],external:!0});let y=De(m.url),R=y.replace(/^https?:\/\//,"").split("/")[0];r.push({id:"dns",label:R||"Application domain",kind:"dns",layer:1,status:R?"ok":"unknown",sub:"DNS & certificates",facts:[{label:"Endpoint",value:y||"not resolved"}],external:!0});let T=e.waf;if(T)r.push({id:"waf",label:"WAF",kind:"waf",layer:2,status:zn(T.status??"active"),sub:De(T.scope,"Managed rules"),facts:[{label:"Web ACL",value:De(T.name,"unnamed")},...T.blocked!=null?[{label:"Blocked (24h)",value:String(T.blocked)}]:[],{label:"Rules",value:String(gk(e.wafRules))}],href:"/serverless/firewall"});let N=e.assetsInfo;if(N)r.push({id:"cdn",label:"Asset CDN",kind:"cdn",layer:2,status:"ok",sub:De(N.cdn,"CloudFront"),facts:[{label:"Distribution",value:De(N.cdn,"unknown")},{label:"Custom domain",value:De(N.customDomain,"none")}],href:"/serverless/assets"}),r.push({id:"assets",label:"Asset bucket",kind:"storage",layer:6,status:"ok",sub:De(N.bucket,"S3"),facts:[{label:"Bucket",value:De(N.bucket,"unknown")},...N.files?[{label:"Objects",value:String(N.files)}]:[],...N.sizeMb?[{label:"Size",value:`${N.sizeMb} MB`}]:[]],href:"/serverless/assets"});let j=f.find((ne)=>De(ne.key).startsWith("http"));r.push({id:"gateway",label:"HTTP entry point",kind:"gateway",layer:3,status:j?"ok":"unknown",sub:"Function URL / API Gateway",facts:[{label:"Endpoint",value:y||"not resolved"},{label:"Invocations (24h)",value:String(k.invocations??0)},...k.errorRatePct!=null?[{label:"Error rate",value:`${k.errorRatePct}%`}]:[]],href:"/serverless/metrics"});for(let ne of f){let Me=`fn:${De(ne.name)}`;if(!De(ne.name))continue;let Je=Number(ne.errors??0),gt=Number(ne.invocations??0);r.push({id:Me,label:De(ne.key,De(ne.name)),kind:"function",layer:4,status:Je>0?gt&&Je/gt>0.02?"bad":"warn":gt?"ok":"idle",sub:De(ne.runtime,"lambda"),facts:[{label:"Function",value:De(ne.name)},{label:"Memory",value:`${ne.memory??0} MB`},{label:"Timeout",value:`${ne.timeout??0}s`},{label:"Invocations (24h)",value:String(gt)},{label:"Errors (24h)",value:String(Je)},{label:"p95",value:`${ne.p95??0} ms`},...ne.provisioned?[{label:"Provisioned",value:De(ne.provisioned)}]:[]],href:"/serverless/functions"})}for(let ne of b){let Me=`queue:${De(ne.name)}`;if(!De(ne.name))continue;let Je=Number(ne.dlq??0);r.push({id:Me,label:De(ne.name),kind:"queue",layer:5,status:Je>0?"bad":Number(ne.visible??0)>0?"warn":"ok",sub:"SQS",facts:[{label:"Visible",value:String(ne.visible??0)},{label:"In flight",value:String(ne.inFlight??0)},{label:"Processed (24h)",value:String(ne.processed??0)},{label:"Dead letter",value:String(Je)}],href:"/serverless/queues"})}let U=e.aurora;if(U)r.push({id:"database",label:"Aurora Serverless",kind:"database",layer:6,status:zn(U.status),sub:De(U.engine,"aurora"),facts:[{label:"Cluster",value:De(U.id,"unknown")},{label:"Capacity",value:`${U.currentAcu??0} ACU (${U.minAcu??0}–${U.maxAcu??0})`},{label:"Connections",value:String(U.connections??0)}],href:"/serverless/data"});let q=e.proxy;if(q)r.push({id:"rds-proxy",label:"RDS Proxy",kind:"database",layer:5,status:zn(q.status),sub:"Connection pooling",facts:[{label:"Proxy",value:De(q.name,"unknown")},{label:"Endpoint",value:De(q.endpoint,"unknown")},{label:"Pooled",value:String(q.pooledConns??0)}],href:"/serverless/data"});let Y=e.redis;if(Y)r.push({id:"cache",label:"ElastiCache",kind:"cache",layer:6,status:zn(Y.status),sub:De(Y.node,"redis"),facts:[{label:"Group",value:De(Y.id,"unknown")},{label:"Hit rate",value:`${Y.hitRate??0}%`}],href:"/serverless/data"});let ee=e.efs;if(ee)r.push({id:"efs",label:"EFS",kind:"filesystem",layer:6,status:zn(ee.status),sub:De(ee.mount,"/mnt/local"),facts:[{label:"File system",value:De(ee.id,"unknown")},{label:"Mount",value:De(ee.mount,"unknown")},{label:"Size",value:`${ee.sizeMb??0} MB`}],href:"/data/volumes"});let le=e.scheduler??{};if(le.enabled)r.push({id:"scheduler",label:"Scheduler",kind:"scheduler",layer:3,status:"ok",sub:De(le.expression,"rate(1 minute)"),facts:[{label:"Expression",value:De(le.expression,"unknown")},{label:"Last run",value:De(le.lastRun,"unknown")}],href:"/operations/jobs"});let Z=new Set(r.map((ne)=>ne.id)),ie=Z.has("waf")?"waf":"gateway";tr(a,{source:"internet",target:"dns",flow:"request",label:"https"},Z),tr(a,{source:"dns",target:ie,flow:"request"},Z),tr(a,{source:"dns",target:"cdn",flow:"request",label:"assets"},Z),tr(a,{source:"waf",target:"gateway",flow:"request",label:"allowed"},Z),tr(a,{source:"cdn",target:"assets",flow:"data",label:"origin"},Z);let we=f.filter((ne)=>De(ne.key).startsWith("http")),Ee=f.filter((ne)=>De(ne.key).startsWith("queue")),de=f.filter((ne)=>De(ne.key).startsWith("cli"));for(let ne of we)tr(a,{source:"gateway",target:`fn:${De(ne.name)}`,flow:"request",label:"invoke"},Z);for(let ne of de)tr(a,{source:"scheduler",target:`fn:${De(ne.name)}`,flow:"async",label:"schedule"},Z);for(let ne of b){for(let Me of we)tr(a,{source:`fn:${De(Me.name)}`,target:`queue:${De(ne.name)}`,flow:"async",label:"publish"},Z);for(let Me of Ee)tr(a,{source:`queue:${De(ne.name)}`,target:`fn:${De(Me.name)}`,flow:"async",label:"consume"},Z)}let je=["rds-proxy","database","cache","efs","assets"];for(let ne of f){let Me=`fn:${De(ne.name)}`;if(Z.has("rds-proxy"))tr(a,{source:Me,target:"rds-proxy",flow:"data",label:"pooled"},Z);else tr(a,{source:Me,target:"database",flow:"data",label:"sql"},Z);for(let Je of je.filter((gt)=>gt!=="rds-proxy"&&gt!=="database"))tr(a,{source:Me,target:Je,flow:"data"},Z)}return tr(a,{source:"rds-proxy",target:"database",flow:"data",label:"sql"},Z),{mode:"serverless",project:De(t.project)||De(m.name,"application"),environment:De(t.environment)||De(m.env,"production"),provider:"aws",region:De(m.region,"unknown"),generatedAt:new Date().toISOString(),layers:lk,groups:[],nodes:r,links:a,notes:l}}function Jf(e,t,r={}){return e==="serverless"?gs(t,r):Pt(t,r)}function sf(e){return String(e).padStart(2,"0")}function Qo(e){return`${e.getUTCFullYear()}-${sf(e.getUTCMonth()+1)}-${sf(e.getUTCDate())}`}function mk(e){let t=Math.max(0,Math.round((Date.now()-e)/1000));if(t<60)return`${t}s ago`;let r=Math.round(t/60);if(r<60)return`${r}m ago`;let a=Math.round(r/60);if(a<48)return`${a}h ago`;return`${Math.round(a/24)}d ago`}async function Ya(e,t,r,a,l,m){let f=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:r,Dimensions:[{Name:"FunctionName",Value:t}],StartTime:l,EndTime:m,Period:86400,Statistics:[a]}).catch(()=>[]);if(!f.length)return 0;if(a==="Sum")return f.reduce((b,k)=>b+(k.Sum??0),0);if(a==="Maximum")return Math.max(...f.map((b)=>b.Maximum??0));return f.reduce((b,k)=>b+(k.Average??0),0)/f.length}async function Za(e,t,r,a,l,m,f){let b=await e.getMetricStatistics({Namespace:t,MetricName:r,Dimensions:a,StartTime:m,EndTime:f,Period:86400,Statistics:[l]}).catch(()=>[]);if(!b.length)return 0;if(l==="Sum")return b.reduce((k,y)=>k+(y.Sum??0),0);if(l==="Maximum")return Math.max(...b.map((k)=>k.Maximum??0));return b.reduce((k,y)=>k+(y.Average??0),0)/b.length}async function tp(e,t,r,a,l){let m=await e.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:[{Name:"FunctionName",Value:t}],StartTime:a,EndTime:l,Period:86400,ExtendedStatistics:[r]}).catch(()=>[]);return Math.round(m.reduce((f,b)=>f+(b.Percentiles?.[r]??0),0))}async function bn(e,t){let r=await Ar(e,t),a=r.region,l=new ce(a),m=new E(a),f=new Ie(a),b=new Date,k=new Date(b.getTime()-86400000),y=e.environments?.[t]?.app,R={};R.app={name:r.slug,env:t,region:a,runtime:y?.kind==="php"?`php-${y?.phpVersion??"8.3"} (fpm)`:y?.kind??"node",url:r.endpoint??"",build:r.lastRelease?.sha?.slice(0,7)??"—",deployedAt:r.lastRelease?.timestamp??"—"},R.maintenance={enabled:!1},R.scheduler={enabled:r.scheduler!=="off",expression:r.scheduler==="sub-minute"?"rate(1 minute) · sub-minute":"rate(1 minute)",lastRun:"—"};let T=0,N=0,j=0,U=[],q=[],Y=[];for(let ie of r.functions){let[we,Ee,de,je,ne,Me,Je,gt,zt]=await Promise.all([Ya(l,ie.name,"Invocations","Sum",k,b),Ya(l,ie.name,"Errors","Sum",k,b),Ya(l,ie.name,"Throttles","Sum",k,b),Ya(l,ie.name,"Duration","Average",k,b),m.getFunction(ie.name).catch(()=>null),tp(l,ie.name,"p50",k,b),tp(l,ie.name,"p95",k,b),tp(l,ie.name,"p99",k,b),l.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:ie.name}],StartTime:new Date(b.getTime()-43200000),EndTime:b,Period:3600,Stat:"Sum"}).catch(()=>[])]);T+=we,N+=Ee,j=Math.max(j,je);let it=ne?.Configuration?.MemorySize??0,kt=Object.keys(ne?.Configuration?.Environment?.Variables??{}),Ut=[],dt=0;try{let{events:ue=[]}=await f.filterLogEvents({logGroupName:`/aws/lambda/${ie.name}`,startTime:k.getTime(),limit:120});for(let he of ue){let Te=(he.message??"").trim(),mt=/Max Memory Used:\s*(\d+)\s*MB/.exec(Te);if(mt)dt=Math.max(dt,Number(mt[1]));if(Te&&!/^(?:START|END|REPORT|INIT_START)/.test(Te))Y.push({source:ie.mode||ie.name,timestamp:new Date(he.timestamp??0).toISOString(),when:mk(he.timestamp??0),message:Te.slice(0,400),level:/error|exception|fatal|panic|traceback/i.test(Te)?"error":/warn|warning|timeout|retr(?:y|ies)|throttl/i.test(Te)?"warn":"info"})}Ut=ue.filter((he)=>!/^(?:START|END|REPORT|INIT_START)/.test((he.message??"").trim())).slice(-6).map((he)=>({ts:new Date(he.timestamp??0).toISOString().slice(11,19),msg:(he.message??"").trim().slice(0,120),err:/error|exception|fatal/i.test(he.message??"")}))}catch{}let K=Math.max(1,...zt);U.push({key:ie.mode,name:ie.name,version:ie.version,memory:it,timeout:ne?.Configuration?.Timeout??0,runtime:ne?.Configuration?.Runtime??"provided.al2023",invocations:Math.round(we),errors:Math.round(Ee),p95:Je||Math.round(je),status:"active",provisioned:ie.provisioned?`${ie.provisioned.allocated}/${ie.provisioned.requested}`:void 0}),q.push({key:ie.mode,name:ie.name,runtime:ne?.Configuration?.Runtime??"provided.al2023",arch:ne?.Configuration?.Architectures?.[0]??"x86_64",memory:it,timeout:ne?.Configuration?.Timeout??0,ephemeral:ne?.Configuration?.EphemeralStorage?.Size??512,version:ie.version,concurrency:y?.concurrency??"—",invocations:Math.round(we),errors:Math.round(Ee),throttles:Math.round(de),p50:Me||Math.round(je),p95:Je||Math.round(je),p99:gt||Math.round(je),maxMem:dt,spark:zt.length?zt.map((ue)=>Math.round(ue/K*100)):[0],env:kt.length?kt:["(none)"],recent:Ut.length?Ut:[{ts:"—",msg:"no recent events",err:!1}]})}R.functions=U,R.functionsDetail=q,R.serverlessLogs=Y.sort((ie,we)=>String(we.timestamp).localeCompare(String(ie.timestamp))).slice(0,600),R.serverlessLogsEmptyReason=Y.length?void 0:"No recent function logs were found in CloudWatch for this environment.";let ee=T?Number((N/T*100).toFixed(2)):0,le=Math.round(await Ya(l,r.functions[0]?.name??"","ConcurrentExecutions","Maximum",k,b));R.metrics={invocations:Math.round(T),errorRatePct:ee,p95Ms:Math.round(j),coldStartPct:void 0,concurrency:le,estCostUsd:void 0};try{let ie=new ae(a),we=[],Ee=[],de=0;try{let{QueueUrl:ne}=await ie.getQueueUrl(`${r.slug}-${t}-dlq`),{Attributes:Me}=await ie.getQueueAttributes(ne);de=Number(Me.ApproximateNumberOfMessages??0)}catch{}let je=y?nr(y,r.slug,t):[];for(let ne of je){let Me=ne.name.replace(`${r.slug}-${t}-`,""),Je=0,gt=0;try{let{QueueUrl:it}=await ie.getQueueUrl(ne.name),{Attributes:kt}=await ie.getQueueAttributes(it);Je=Number(kt.ApproximateNumberOfMessages??0),gt=Number(kt.ApproximateNumberOfMessagesNotVisible??0)}catch{}let zt=Math.round(await Za(l,"AWS/SQS","NumberOfMessagesDeleted",[{Name:"QueueName",Value:ne.name}],"Sum",k,b));we.push({name:Me,visible:Je,inFlight:gt,processed:zt,dlq:de}),Ee.push({name:ne.name,short:Me,visible:Je,inFlight:gt,delayed:0,processed:zt,oldestSec:0,concurrency:ne.concurrency??y?.queueConcurrency??"—",tries:y?.queueTries??3,visTimeout:(y?.queueTimeout??120)*6,dlq:de})}if(we.length)R.queues=we;if(Ee.length)R.queuesDetail=Ee;R.dlqItems=[]}catch{}try{let ie=new h(a),{Stacks:we}=await ie.describeStacks({stackName:Xt(e,t)}),Ee={};for(let de of we?.[0]?.Outputs??[])if(de.OutputKey)Ee[de.OutputKey]=de.OutputValue??"";if(y?.database?.connection==="aurora-serverless"){let de=`${r.slug}-${t}-db`,je=[{Name:"DBClusterIdentifier",Value:de}],[ne,Me]=await Promise.all([Za(l,"AWS/RDS","ServerlessDatabaseCapacity",je,"Average",k,b),Za(l,"AWS/RDS","DatabaseConnections",je,"Maximum",k,b)]);if(R.aurora={id:de,engine:"aurora-mysql",minAcu:y?.database?.minCapacity??0.5,maxAcu:y?.database?.maxCapacity??4,currentAcu:ne?Number(ne.toFixed(1)):y?.database?.minCapacity??0.5,database:"app",connections:Math.round(Me),status:Ee.DbEndpoint?"available":"creating"},y?.rdsProxy)R.proxy={name:`${r.slug}-${t}-proxy`,endpoint:Ee.DbProxyEndpoint??"—",pooledConns:Math.round(Me),status:"available"}}if(y?.cache?.driver==="elasticache"){let de=`${r.slug}-${t}-cache`,je=[{Name:"CacheClusterId",Value:`${de}-001`}],[ne,Me]=await Promise.all([Za(l,"AWS/ElastiCache","CacheHits",je,"Sum",k,b),Za(l,"AWS/ElastiCache","CacheMisses",je,"Sum",k,b)]),Je=ne+Me>0?Number((ne/(ne+Me)*100).toFixed(1)):0;R.redis={id:de,node:"cache.t4g.micro",engine:"redis",hitRate:Je,status:Ee.CacheEndpoint?"available":"creating"}}if(y?.efs){let de=0;try{if(Ee.EfsFileSystemId){let je=new fr(a),{FileSystems:ne}=await je.describeFileSystems({FileSystemId:Ee.EfsFileSystemId});de=Number(((ne?.[0]?.SizeInBytes?.Value??0)/1048576).toFixed(1))}}catch{}R.efs={id:Ee.EfsFileSystemId??"efs",mount:"/mnt/local",sizeMb:de,status:"available"}}R.assetsInfo=Ee.AssetsCdnDomain?{bucket:Ee.AssetsBucketName??`${r.slug}-${t}-assets`,cdn:Ee.AssetsCdnDomain,customDomain:y?.assetDomain??"—",assetUrl:r.assetUrl??"—",files:0,sizeMb:0,cacheHitPct:0,build:R.app.build}:void 0}catch{}if(R.assetsInfo)try{let we=await new o(a).list({bucket:R.assetsInfo.bucket,maxKeys:1000});R.assetsInfo.files=we.length,R.assetsInfo.sizeMb=Number((we.reduce((Ee,de)=>Ee+(de.Size??0),0)/1048576).toFixed(1)),R.assetsRecent=we.slice(0,8).map((Ee)=>({path:`/${Ee.Key}`,size:`${Math.max(1,Math.round((Ee.Size??0)/1024))} KB`,type:Ee.Key.split(".").pop()??""}))}catch{}try{if(y?.secrets){let ie=Array.isArray(y.secrets)?y.secrets.map((we)=>({key:we.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),source:we})):Object.entries(y.secrets).map(([we,Ee])=>({key:we,source:String(Ee)}));R.secretsList=ie.map((we)=>({...we,updated:"—"}))}}catch{}try{let ie=new o(a),we=`${r.slug}-${t}-deployments`,Ee=await ie.getObjectJson(we,`deployments/${r.slug}/${t}/history.json`).catch(()=>null);if(Ee?.records?.length)R.deploymentsDetail=Ee.records.slice(-12).reverse().map((de)=>({sha:(de.sha??"").slice(0,7),status:de.status??"success",when:de.timestamp??"—",took:de.took??"—",by:de.by??"—",version:de.version??"—",hooks:de.hooks??[]}))}catch{}R.metricsTotals={invocations:R.metrics.invocations,errors:Math.round(N),errorRatePct:ee,p95Ms:R.metrics.p95Ms,throttles:q.reduce((ie,we)=>ie+we.throttles,0),coldStartPct:void 0,estCostUsd:void 0,concurrency:le},R.metricsPerFn=q.map((ie)=>({key:ie.key,invocations:ie.invocations,errors:ie.errors,throttles:ie.throttles,avgMs:ie.p50,maxMs:ie.p99,costUsd:void 0}));try{R.invSpark=await l.getMetricSeries({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:[{Name:"FunctionName",Value:r.functions.find((ie)=>ie.mode==="http")?.name??""}],StartTime:new Date(b.getTime()-86400000),EndTime:b,Period:3600,Stat:"Sum"})}catch{}try{let ie=new Ts,we=b,Ee=new Date(Date.UTC(we.getUTCFullYear(),we.getUTCMonth(),1)),de=new Date(Date.UTC(we.getUTCFullYear(),we.getUTCMonth()-1,1)),[je,ne]=await Promise.all([ie.getCostByService({start:Qo(Ee),end:Qo(we),granularity:"MONTHLY"}).catch(()=>[]),ie.getCostByService({start:Qo(de),end:Qo(Ee),granularity:"MONTHLY"}).catch(()=>[])]);if(je.length){let Me=je.reduce((dt,K)=>dt+K.amount,0),Je=ne.reduce((dt,K)=>dt+K.amount,0),gt=we.getUTCDate(),zt=new Date(Date.UTC(we.getUTCFullYear(),we.getUTCMonth()+1,0)).getUTCDate();R.costSummary={monthToDateUsd:Number(Me.toFixed(2)),projectedUsd:Number((Me/gt*zt).toFixed(2)),lastMonthUsd:Number(Je.toFixed(2)),dailyAvgUsd:Number((Me/gt).toFixed(2))},R.costServices=je.filter((dt)=>dt.amount>0).sort((dt,K)=>K.amount-dt.amount).slice(0,12).map((dt)=>({name:dt.service,usd:Number(dt.amount.toFixed(2)),note:""})),R.metrics.estCostUsd=Number((Me/gt).toFixed(2)),R.metricsTotals.estCostUsd=R.metrics.estCostUsd,R.costTrend=await ie.getDailyTotals({start:Qo(Ee),end:Qo(we)}).catch(()=>[]);let it=je.find((dt)=>/lambda/i.test(dt.service))?.amount??0,kt=(dt)=>dt.invocations*(dt.p50/1000)*(dt.memory/1024),Ut=q.reduce((dt,K)=>dt+kt(K),0)||1;R.costPerFn=q.map((dt)=>({key:dt.key,requests:dt.invocations,gbSec:Math.round(kt(dt)),usd:Number((it*(kt(dt)/Ut)).toFixed(2))}))}}catch{}if(y?.firewall)try{let ie=await l.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"BlockedRequests",StartTime:k,EndTime:b,Period:86400,Statistics:["Sum"]}).catch(()=>[]),we=await l.getMetricStatistics({Namespace:"AWS/WAFV2",MetricName:"AllowedRequests",StartTime:k,EndTime:b,Period:86400,Statistics:["Sum"]}).catch(()=>[]);R.waf={enabled:!0,scope:"REGIONAL",acl:`${r.slug}-${t}-waf`,allowed24h:Math.round(we.reduce((Ee,de)=>Ee+(de.Sum??0),0)),blocked24h:Math.round(ie.reduce((Ee,de)=>Ee+(de.Sum??0),0))};try{let Ee=new ep(a),de=await Ee.listWebACLs("REGIONAL"),je=de.find((ne)=>ne.Name?.includes(`${r.slug}-${t}`))??de[0];if(je?.Name&&je.Id){R.waf.acl=je.Name;let ne=await Ee.getWebACLRules(je.Name,je.Id,"REGIONAL");if(ne.length)R.wafRules=ne.map((Me)=>({name:Me.Name??"—",detail:`priority ${Me.Priority??0}`,action:Me.Action??"count",blocked24h:0}))}}catch{}}catch{}let Z=[];if(R.aurora)Z.push({name:"Aurora Serverless v2",detail:`${R.aurora.id} · ${R.aurora.minAcu}-${R.aurora.maxAcu} ACU`,status:R.aurora.status});if(R.proxy)Z.push({name:"RDS Proxy",detail:R.proxy.name,status:R.proxy.status});if(R.redis)Z.push({name:`ElastiCache (${R.redis.engine})`,detail:`${R.redis.node} · ${R.redis.hitRate}% hit rate`,status:R.redis.status});if(R.efs)Z.push({name:"EFS",detail:`${R.efs.mount} · ${R.efs.sizeMb} MB`,status:R.efs.status});if(Z.length)R.dataServices=Z;if(r.scheduler!=="off"&&y?.kind==="php")try{let ie=await rt(e,t,"schedule:list"),we=[];for(let Ee of(ie||"").split(`
 `)){let de=/^\s*([\d*/,\-\s]+?)\s{2,}(.+?)(?:\s{2,}Next Due.*)?$/.exec(Ee);if(de&&/[*\d]/.test(de[1])&&de[1].trim().split(/\s+/).length===5)we.push({command:de[2].trim().replace(/^php artisan /,""),cron:de[1].trim(),desc:"",lastRun:"—",lastStatus:"ok"})}if(we.length)R.schedulerTasks=we}catch{}return R.topology=gs(R,{project:e.project.name,environment:t}),R}function Ni(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:null}function fk(e){if(!/^\d{4}-\d{2}-\d{2}$/.test(e))return null;let t=Date.parse(`${e}T12:00:00.000Z`);return Number.isFinite(t)?new Date(t).toISOString():null}function qu(e,t){if(!e||typeof e!=="object")return[];let r={source:t.name},a=[],l=t.now,m=(y,R,T,N=l)=>{if(R!==null)a.push({name:y,value:R,unit:T,timestamp:N,attributes:r})};m("storage.egress.month",Ni(e.monthBytes),"bytes"),m("storage.egress.today",Ni(e.todayBytes),"bytes"),m("storage.egress.projected_month",Ni(e.projectedMonthBytes),"bytes");let f=Ni(e.budgetBytes);if(f!==null&&f>0){m("storage.egress.budget",f,"bytes");let y=e.budgetUsedPercent,R=typeof y==="number"&&Number.isFinite(y)?y:Ni(e.monthBytes)!==null?Math.round(Ni(e.monthBytes)/f*1000)/10:null;m("storage.egress.budget_used_percent",R,"percent")}let b=t.maxReplayDays??45,k=Array.isArray(e.days)?e.days.slice(-b):[];for(let y of k){let R=fk(String(y?.date??"")),T=Ni(y?.bytes);if(!R||T===null)continue;a.push({name:"storage.egress.day",value:T,unit:"bytes",timestamp:R,attributes:r});let N=Ni(y?.downloads);if(N!==null)a.push({name:"storage.egress.day_downloads",value:N,unit:"count",timestamp:R,attributes:r})}return a}async function ju(e,t=process.env,r=fetch){let a=e.tokenEnv?t[e.tokenEnv]:void 0,l=await r(e.url,{headers:a?{Authorization:`Bearer ${a}`}:{},signal:AbortSignal.timeout(1e4)});if(!l.ok)throw Error(`HTTP ${l.status}`);return await l.json()}async function Oa(e,t){let r=[],a=[];if(!Array.isArray(e)||e.length===0)return{metrics:r,errors:a};let l=await Promise.all(e.map(async(m)=>{if(!m?.name||!m?.url)return{endpoint:m,error:"egress endpoint needs both a name and a url"};try{let f=await ju(m,t.env,t.fetchImpl);return{endpoint:m,report:f}}catch(f){return{endpoint:m,error:f instanceof Error?f.message:String(f)}}}));for(let m of l){let f=`egress:${m.endpoint?.name??"unnamed"}`;if("error"in m&&m.error){a.push({source:f,message:m.error});continue}r.push(...qu(m.report,{name:m.endpoint.name,now:t.now}))}return{metrics:r,errors:a}}import{createHash as O_}from"node:crypto";import{existsSync as wi,mkdtempSync as km,readdirSync as QS,rmSync as Bo,statSync as aw}from"node:fs";import{readFile as ii,writeFile as $o}from"node:fs/promises";import{tmpdir as vl}from"node:os";import{dirname as $_,extname as Ic,join as Bt,normalize as N_,relative as j_,resolve as B_,sep as M_}from"node:path";import{fileURLToPath as L_}from"node:url";class Jo extends Error{status;code;requestId;constructor(e,t,r,a){super(r);this.status=e;this.code=t;this.requestId=a}}class jl{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),a=await r.json().catch(()=>({}));if(!r.ok)throw new Jo(r.status,a.error?.code??"api_error",a.error?.message??"API request failed.",a.error?.requestId??r.headers.get("x-request-id")??void 0);return a}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,a])=>[r,String(a)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,a])=>[r,String(a)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,a])=>a!==void 0).map(([a,l])=>[a,String(l)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,a]of Object.entries(e))if(a)t.set(r,String(a));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,a]of Object.entries(e))if(a)t.set(r,String(a));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as iI}from"node:crypto";import{lstatSync as hk,readdirSync as yk,readFileSync as vk}from"node:fs";import{relative as bk,resolve as af,sep as Sk}from"node:path";function wk(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function mo(e,t,r){return{path:e,reason:t,weight:r}}function cf(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function hs(e,t,r,a,l,m){return{framework:e,strategy:t,confidence:r,evidence:a,defaults:{build:l,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:m}}function ys(e){let t=wk(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(hs("dockerfile","dockerfile",0.99,[mo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let a=cf(t.get("composer.json"));if(t.has("artisan")&&a.require?.["laravel/framework"])r.push(hs("laravel","server",0.98,[mo("artisan","Laravel Artisan entrypoint is present.",0.45),mo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(hs("php","server",0.82,[mo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let l=cf(t.get("package.json"));if(t.has("package.json")){let m=t.has("bun.lock")||t.has("bun.lockb")||l.engines?.bun,f=m?"bun":"node",b=m?"bun":"node",k=[mo("package.json",`Defines ${l.scripts?.build?"build and ":""}${l.scripts?.start?"start ":""}scripts.`,0.55)];if(m)k.push(mo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let y=!!(l.dependencies?.vite||l.devDependencies?.vite||l.dependencies?.["@stacksjs/bunpress"]||l.devDependencies?.["@stacksjs/bunpress"])&&!l.scripts?.start,R=y?{kind:"static",installCommand:`${f} install --frozen-lockfile`,buildCommand:`${f} run build`,publishDirectory:"dist"}:{kind:"server",runtime:f,installCommand:`${f} install --frozen-lockfile`,buildCommand:l.scripts?.build?`${f} run build`:void 0,startCommand:l.scripts?.start?`${f} run start`:f==="bun"?"bun run index.ts":"node index.js"};r.push(hs(b,R.kind,Math.min(0.94,k.reduce((T,N)=>T+N.weight,0)),k,R,y?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${f} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(hs("static","static",0.78,[mo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(hs("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((m,f)=>f.confidence-m.confidence||m.framework.localeCompare(f.framework))}function rp(e,t={}){let r=af(e),a=t.maxFiles??1e4,l=t.maxContentBytes??262144,m=[],f=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),b=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),k=(y)=>{for(let R of yk(y).sort()){if(b.has(R))continue;let T=af(y,R),N=bk(r,T).split(Sk).join("/");if(!N||N.startsWith("../"))throw Error("Detection path escaped the application root");let j=hk(T);if(j.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${N}`);if(j.isDirectory())k(T);else if(j.isFile()){if(m.length>=a)throw Error("Application file-count limit exceeded");let U={path:N,size:j.size};if(f.has(N)&&j.size<=l)U.content=vk(T,"utf8");m.push(U)}}};return k(r),m}function ip(e){if(Array.isArray(e))return`[${e.map(ip).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${ip(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function Xa(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function nn(e,t,r,a){return{path:e,code:t,message:r,alternatives:a}}function np(e){return JSON.parse(JSON.stringify(e))}function kk(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,a])=>[r,typeof a==="string"?a:`\${${a.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return np({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return np({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return np({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function Un(e,t=[]){let r=[],a=(U)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(U),l=Object.fromEntries(Object.entries(e.environment??{}).map(([U,q])=>{if(typeof q==="string"&&a(U))return r.push(nn(`environment.${U}`,"write_only_secret_required",`${U} must be supplied through the write-only secrets boundary.`)),[U,{secretRef:U}];return[U,q]})),m=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let U=Object.fromEntries(Object.entries(e.build.buildArgs).map(([q,Y])=>{if(a(q))return r.push(nn(`build.buildArgs.${q}`,"write_only_build_secret_required",`${q} must be declared in secretNames instead of buildArgs.`)),[q,"[REDACTED]"];return[q,Y]}));m={...e.build,buildArgs:U}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(nn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!Xa((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(nn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((U)=>!Xa(U)))r.push(nn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!Xa(e.build.context)||!Xa(e.build.dockerfile)))r.push(nn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!Xa(e.build.publishDirectory))r.push(nn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(nn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(nn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(nn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(nn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(nn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let f=e.runtime.healthCheck;if(f&&f.protocol!=="tcp"&&(!f.path||!f.path.startsWith("/")||/[\r\n]/.test(f.path)))r.push(nn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(nn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let b=Object.values(l).flatMap((U)=>typeof U==="object"?[U.secretRef]:[]),k=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...b])].sort(),y=new Set(t),R=k.filter((U)=>!y.has(U)),T={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:m,runtime:e.runtime,environment:l,domain:e.domain}},N=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),j=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&R.length===0,issues:r,missingSecrets:R,manifest:T,configPatch:kk({...e,build:m,environment:l}),capabilityRequirements:N,costDrivers:j,serializedManifest:`${ip(T)}
-`}}function df(e){let t=e.replace(/\\/g,"/");return!!t&&!t.startsWith("/")&&!/^[A-Za-z]:\//.test(t)&&!t.split("/").includes("..")&&!/[\0\r\n]/.test(t)}function lf(e,t,r={}){let a=r.maxBytes??104857600,l=r.maxEntries??1e4,m=r.maxExpandedBytes??524288000;if(e.byteLength>a)throw Error("Archive exceeds the compressed size limit");let f=new DataView(e.buffer,e.byteOffset,e.byteLength),b=[],k=0;if(t.toLowerCase().endsWith(".zip")||e[0]===80&&e[1]===75){let R=0;while(R+30<=e.length){let T=f.getUint32(R,!0);if(T===33639248||T===101010256)break;if(T!==67324752)throw Error("Malformed ZIP local header");let N=f.getUint16(R+6,!0),j=f.getUint32(R+18,!0),U=f.getUint32(R+22,!0),q=f.getUint16(R+26,!0),Y=f.getUint16(R+28,!0);if(N&8)throw Error("ZIP data descriptors are not accepted for uploaded artifacts");let ee=new TextDecoder().decode(e.subarray(R+30,R+30+q));if(!df(ee))throw Error(`Unsafe archive path: ${ee}`);if(b.push(ee),k+=U,b.length>l||k>m)throw Error("Archive expansion limit exceeded");R+=30+q+Y+j}return{format:"zip",entries:b.length,expandedBytes:k,paths:b}}if(!t.toLowerCase().match(/\.(?:tar|tar\.gz|tgz)$/))throw Error("Only ZIP and uncompressed TAR artifacts are supported");let y=0;while(y+512<=e.length){let R=e.subarray(y,y+512);if(R.every((q)=>q===0))break;let T=(q,Y)=>new TextDecoder().decode(R.subarray(q,q+Y)).replace(/\0.*$/,""),N=`${T(345,155)}${T(345,155)?"/":""}${T(0,100)}`,j=Number.parseInt(T(124,12).trim()||"0",8),U=String.fromCharCode(R[156]??0);if(!df(N))throw Error(`Unsafe archive path: ${N}`);if(U==="1"||U==="2")throw Error(`Archive links are not accepted: ${N}`);if(!Number.isFinite(j)||j<0)throw Error("Malformed TAR entry size");if(b.push(N),k+=j,b.length>l||k>m)throw Error("Archive expansion limit exceeded");y+=512+Math.ceil(j/512)*512}return{format:"tar",entries:b.length,expandedBytes:k,paths:b}}var uf=new Set(["source","build","runtime","environment","domain","review"]);function pf(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function gf(e){return/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(e)}function mf(e){for(let[r,a]of Object.entries(e.environment??{}))if(typeof a==="string"&&gf(r)&&a)throw Error(`${r} must be stored through the write-only secrets boundary`);if(e.build.kind==="dockerfile"){for(let[r,a]of Object.entries(e.build.buildArgs??{}))if(gf(r)&&a)throw Error(`${r} must be declared as a build secret name`)}let t=JSON.stringify(e);if(/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Drafts cannot contain credential-bearing URLs")}function ff(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),schemaVersion:Number(e.schema_version),name:String(e.name),step:String(e.step),input:pf(e.input,{}),suppliedSecretNames:pf(e.supplied_secret_names,[]),status:String(e.status),version:Number(e.version),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class op{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}create(e){if(mf(e.draft),e.draft.projectId!==e.projectId)throw Error("Draft project does not match its storage scope");let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Draft project was not found");let r=this.idFn(),a=this.now(),l=e.step??"source";if(!uf.has(l))throw Error("Invalid draft step");let m=[...new Set(e.suppliedSecretNames??[])].sort(),f=Un(e.draft,m).valid?"ready":"draft";return this.controlPlane.database.run("INSERT INTO application_drafts (id, organization_id, project_id, schema_version, name, step, input, supplied_secret_names, status, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.projectId,e.name.trim().slice(0,100),l,JSON.stringify(e.draft),JSON.stringify(m),f,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.draft.created",payload:{draftId:r,step:l,status:f,requiredSecretNames:e.draft.requiredSecretNames??[]}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_drafts WHERE id=?").get(e);return t?ff(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_drafts WHERE project_id=? ORDER BY updated_at DESC").all(e).map(ff)}update(e,t,r){let a=this.get(e);if(!a||a.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);if(!uf.has(r.step))throw Error("Invalid draft step");if(r.draft.projectId!==a.projectId)throw Error("Draft project cannot be changed");mf(r.draft);let l=[...new Set(r.suppliedSecretNames??a.suppliedSecretNames)].sort(),m=Un(r.draft,l).valid?"ready":"draft",f=this.now();if(this.controlPlane.database.run("UPDATE application_drafts SET name=?, step=?, input=?, supplied_secret_names=?, status=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.draft.name.slice(0,100),r.step,JSON.stringify(r.draft),JSON.stringify(l),m,f,e,t]).changes!==1)throw Error(`Application draft ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,actorId:r.actorId,type:"application.draft.updated",payload:{draftId:e,fromVersion:t,toVersion:t+1,step:r.step,status:m}}),this.get(e)}markApplied(e,t,r){let a=this.get(e);if(!a||a.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);let l=Un(a.input,a.suppliedSecretNames);if(!l.valid)throw Error(`Draft is not deployable: ${[...l.issues.map((f)=>f.message),...l.missingSecrets.map((f)=>`Missing secret ${f}`)].join("; ")}`);let m=this.now();return this.controlPlane.database.run("UPDATE application_drafts SET status='applied', step='review', version=version+1, updated_at=? WHERE id=? AND version=?",[m,e,t]),this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,actorId:r,type:"application.draft.applied",payload:s({draftId:e,manifest:l.manifest})}),this.get(e)}}import{createCipheriv as Ik,createDecipheriv as Ek,createHash as eh,randomBytes as Rk}from"node:crypto";function ec(e){return typeof e==="string"&&e?e:void 0}function sp(e){return eh("sha256").update(e).digest("hex").slice(0,16)}function hf(e){let t=new URL(e.includes("://")?e:`https://${e}`);if(t.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(t.hostname))throw Error("Registry host must use HTTPS");if(t.username||t.password||t.search||t.hash)throw Error("Registry host cannot contain credentials");return`${t.protocol}//${t.host}`}function Ak(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:ec(e.credential_fingerprint),credentialExpiresAt:ec(e.credential_expires_at),status:String(e.status),healthMessage:ec(e.health_message),lastTestedAt:ec(e.last_tested_at),version:Number(e.version),createdByActorId:ec(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class ap{controlPlane;key;nowFn;idFn;constructor(e,t){this.controlPlane=e;if(!t.encryptionKey)throw Error("Registry encryption key is required");this.key=eh("sha256").update(`ts-cloud:registry:${t.encryptionKey}`).digest(),this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}encrypt(e){let t=Rk(12),r=Ik("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Registry credential envelope is invalid");let m=Ek("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}current(e){let t=Ak(e);return t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime()?{...t,status:"expired",healthMessage:"Registry credential expired; rotate it before pulling images."}:t}create(e){if(!["docker_hub","ghcr","ecr","gcr","generic"].includes(e.provider))throw Error("A supported registry provider is required");let t=e.credential?JSON.stringify(e.credential):void 0,r=this.idFn(),a=this.now();return this.controlPlane.database.run("INSERT INTO registry_connections (id, organization_id, provider, name, host, credential_ciphertext, credential_fingerprint, credential_expires_at, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.provider,e.name.trim().slice(0,80),hf(e.host),t?this.encrypt(t):null,t?sp(t):null,e.credentialExpiresAt??null,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"registry.connection.created",payload:{connectionId:r,provider:e.provider,host:hf(e.host),credentialConfigured:!!t}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM registry_connections WHERE id=?").get(e);return t?this.current(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM registry_connections WHERE organization_id=? ORDER BY name").all(e).map((t)=>this.current(t))}credential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM registry_connections WHERE id=?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotate(e,t,r={}){let a=this.get(e);if(!a||a.status==="disconnected")throw Error("Registry connection was not found");let l=JSON.stringify(t);return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=?, credential_fingerprint=?, credential_expires_at=?, status='pending', health_message=NULL, version=version+1, updated_at=? WHERE id=?",[this.encrypt(l),sp(l),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:r.actorId,type:"registry.credential.rotated",payload:{connectionId:e,fingerprint:sp(l),expiresAt:r.expiresAt??null}}),this.get(e)}disconnect(e,t){let r=this.get(e);if(!r)throw Error("Registry connection was not found");return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=NULL, credential_fingerprint=NULL, status='disconnected', health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"registry.connection.disconnected",level:"warning",payload:{connectionId:e}}),this.get(e)}async test(e,t={}){let r=this.get(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active registry connection was not found");let a=this.credential(e),l=t.fetch??fetch,m=new AbortController,f=setTimeout(()=>m.abort(),t.timeoutMs??15000),b=a?.token?`Bearer ${a.token}`:a?.username||a?.password?`Basic ${Buffer.from(`${a.username??""}:${a.password??""}`).toString("base64")}`:void 0;try{let k=await l(`${r.host}/v2/`,{method:"GET",redirect:"error",signal:m.signal,headers:b?{Authorization:b}:void 0}),y=k.headers.get("www-authenticate")??"";if(k.status===401&&y.startsWith("Bearer ")&&a){let N=Object.fromEntries([...y.slice(7).matchAll(/(\w+)="([^"]+)"/g)].map((ee)=>[ee[1],ee[2]])),j=new URL(N.realm??"");if(j.protocol!=="https:")throw Error("Registry authentication realm must use HTTPS");if(N.service)j.searchParams.set("service",N.service);if(t.image)j.searchParams.set("scope",`repository:${th(t.image).repository}:pull`);let U=await l(j,{signal:m.signal,redirect:"error",headers:b?{Authorization:b}:void 0});if(!U.ok)throw Error(`Registry authentication failed (${U.status})`);let q=await U.json(),Y=q.token??q.access_token;if(!Y)throw Error("Registry did not return an access token");k=t.image?await Zf(l,r.host,t.image,Y,m.signal):await l(`${r.host}/v2/`,{signal:m.signal,redirect:"error",headers:{Authorization:`Bearer ${Y}`}})}else if(k.ok&&t.image)k=await Zf(l,r.host,t.image,a?.token,m.signal,b);let R=k.ok?"healthy":"degraded",T=k.ok?t.image?"Registry image is readable.":"Registry connection is healthy.":`Registry request failed (${k.status})`;return this.controlPlane.database.run("UPDATE registry_connections SET status=?, health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[R,T,this.now(),this.now(),e]),this.get(e)}catch(k){let y=m.signal.aborted?"Registry request timed out.":k instanceof Error?k.message:"Registry test failed";return this.controlPlane.database.run("UPDATE registry_connections SET status='degraded', health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[y.slice(0,1000),this.now(),this.now(),e]),this.get(e)}finally{clearTimeout(f)}}}function th(e){let t=e.replace(/^https?:\/\//,""),r=t.indexOf("/");if(r<1)throw Error("Image must include registry/repository");let a=t.slice(r+1),l=a.lastIndexOf("@"),m=a.lastIndexOf(":"),f=l>=0?l:m>a.lastIndexOf("/")?m:-1,b=f>=0?a.slice(0,f):a,k=f>=0?a.slice(f+1):"latest";if(!/^[A-Za-z0-9_.\/-]+$/.test(b)||!/^[A-Za-z0-9_.:+-]+$/.test(k))throw Error("Image reference is invalid");return{repository:b,reference:k}}async function Zf(e,t,r,a,l,m){let f=th(r);return e(`${t}/v2/${f.repository}/manifests/${encodeURIComponent(f.reference)}`,{method:"HEAD",redirect:"error",signal:l,headers:{Accept:"application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",...a?{Authorization:`Bearer ${a}`}:m?{Authorization:m}:{}}})}import{createHash as Ck}from"node:crypto";import{chmodSync as rh,existsSync as nh,mkdirSync as Pk,renameSync as _k,unlinkSync as ih,writeFileSync as Tk}from"node:fs";import{basename as xk,join as Dk}from"node:path";function cp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),filename:String(e.filename),sha256:String(e.sha256),size:Number(e.size),format:String(e.format),entryCount:Number(e.entry_count),expandedBytes:Number(e.expanded_bytes),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at)}}class dp{controlPlane;root;idFn;nowFn;constructor(e,t){this.controlPlane=e;this.root=d(t.cwd,"artifacts"),this.idFn=t.id??(()=>crypto.randomUUID()),this.nowFn=t.now??(()=>new Date)}create(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Artifact project was not found");let r=xk(e.filename).slice(0,200);if(!r||r!==e.filename)throw Error("Artifact filename must not contain a path");let a=lf(e.bytes,r),l=Ck("sha256").update(e.bytes).digest("hex"),m=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? AND sha256=?").get(e.projectId,l);if(m)return cp(m);let f=this.idFn();Pk(this.root,{recursive:!0,mode:448}),rh(this.root,448);let b=Dk(this.root,`${f}.archive`),k=`${b}.partial`;try{Tk(k,e.bytes,{mode:384,flag:"wx"}),_k(k,b),rh(b,384),this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[f,e.organizationId,e.projectId,r,b,l,e.bytes.byteLength,a.format,a.entries,a.expandedBytes,e.actorId??null,this.nowFn().toISOString()])}catch(y){if(nh(k))ih(k);if(nh(b))ih(b);throw y}return this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.artifact.created",payload:{artifactId:f,filename:r,sha256:l,size:e.bytes.byteLength,entries:a.entries}}),this.get(f)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE id=?").get(e);return t?cp(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? ORDER BY created_at DESC").all(e).map(cp)}}function jc(e){let t=e.drafts.get(e.draftId);if(!t||t.version!==e.expectedVersion)throw Error(`Application draft ${e.draftId} changed since version ${e.expectedVersion}`);if(t.status==="applied")throw Error("Application draft was already applied");let r=e.controlPlane.getProject(t.projectId),a=r?e.controlPlane.listEnvironments(r.id).find((y)=>y.id===t.input.environmentId):void 0;if(!r||!a||a.projectId!==r.id||r.organizationId!==t.organizationId)throw Error("Draft deployment scope was not found");if(e.confirmEnvironment!==a.slug)throw Error(`Type ${a.slug} to confirm this deployment target`);let l=Un(t.input,t.suppliedSecretNames);if(!l.valid)throw Error(`Application plan is invalid: ${[...l.issues.map((y)=>y.message),...l.missingSecrets.map((y)=>`Missing secret ${y}`)].join("; ")}`);let m=e.controlPlane.listResources(r.id,a.id).find((y)=>y.kind==="application"&&y.slug===t.input.slug),f=JSON.parse(JSON.stringify({manifest:l.manifest,configPatch:l.configPatch})),b=m?e.controlPlane.updateResource(m.id,m.version,{name:t.input.name,desiredState:f}):e.controlPlane.createResource({projectId:r.id,environmentId:a.id,kind:"application",slug:t.input.slug,name:t.input.name,desiredState:f,metadata:{source:"application-onboarding",draftId:t.id}}),k=new c(e.controlPlane).enqueue({projectId:r.id,environmentId:a.id,resourceId:b.id,actorId:e.actorId,kind:"application.create",idempotencyKey:`application-draft:${t.id}:v${t.version}`,correlationId:`application-draft:${t.id}`,input:f,lockKey:`resource:${b.id}`,providerKey:b.provider??"default",buildSlot:t.input.build.kind!=="prebuilt_image",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return e.drafts.markApplied(t.id,t.version,e.actorId),e.controlPlane.appendEvent({organizationId:t.organizationId,projectId:r.id,resourceId:b.id,operationId:k.id,actorId:e.actorId,type:"application.create.queued",payload:{draftId:t.id,environment:a.slug,strategy:t.input.build.kind,costDrivers:l.costDrivers}}),{plan:l,resource:b,operation:k}}function cn(e){let t=["static","compute","serverless_zip","serverless_image"].includes(e.kind),r=["container","compose"].includes(e.kind)&&(e.replicas??1)>1,a=e.kind==="container"||e.kind==="serverless_zip"||e.kind==="serverless_image",l=(m,f)=>f&&(m==="atomic"?e.kind==="static"||e.hasHealthGate:e.hasHealthGate);return[{strategy:"atomic",supported:l("atomic",t),explanation:t?e.hasHealthGate||e.kind==="static"?"Activate an immutable version with an atomic pointer/alias switch.":"Atomic activation needs a readiness gate for this runtime.":"This driver has no atomic pointer or alias primitive.",capacityMultiplier:1,costImpact:"none",rollback:"Switch the pointer/alias back to the previous immutable release."},{strategy:"rolling",supported:l("rolling",r),explanation:r?e.hasHealthGate?"Replace healthy replicas within the configured capacity envelope.":"Rolling activation requires a health/readiness gate.":"Rolling activation requires a capable container/Compose driver and at least two replicas.",capacityMultiplier:1.5,costImpact:"temporary",rollback:"Stop replacement and restore the prior task/service definition."},{strategy:"blue_green",supported:l("blue_green",a),explanation:a?e.hasHealthGate?"Provision a complete green target and switch traffic after health passes.":"Blue-green requires a health gate before traffic can switch.":"The provider does not expose two traffic-addressable revisions.",capacityMultiplier:2,costImpact:"temporary",rollback:"Return all traffic to the preserved blue target."},{strategy:"canary",supported:l("canary",a),explanation:a?e.hasHealthGate?"Shift bounded traffic steps while evaluating health.":"Canary requires a health gate and measurable traffic target.":"The provider does not expose weighted traffic primitives.",capacityMultiplier:1.25,costImpact:"temporary",rollback:"Set canary weight to zero and preserve its diagnostics."}]}function Zi(e,t){let r=cn(e).find((a)=>a.strategy===t);if(!r.supported)throw Error(`${t} is unavailable: ${r.explanation}`);return r}import{createHash as Ok}from"node:crypto";var $k=/^sha256:[a-f0-9]{64}$/,Nk=/^[a-f0-9]{40,64}$/i;function Zn(e){return typeof e==="string"&&e?e:void 0}function fo(e,t){try{return JSON.parse(String(e))}catch{return t}}function oh(e){return{id:String(e.id),organizationId:String(e.organization_id),digest:String(e.digest),kind:String(e.kind),uri:String(e.uri),size:Number(e.size),mediaType:String(e.media_type),provenance:fo(e.provenance,{}),attestation:fo(e.attestation,{}),verifiedAt:String(e.verified_at),createdAt:String(e.created_at)}}function sh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),artifactId:String(e.artifact_id),kind:String(e.kind),sourceSha:Zn(e.source_sha),configHash:String(e.config_hash),manifest:fo(e.manifest,{}),provenance:fo(e.provenance,{}),strategy:String(e.strategy),status:String(e.status),healthGate:e.health_gate==null?void 0:fo(e.health_gate,void 0),hooks:fo(e.hooks,{migrations:"none",preActivate:[],postActivate:[]}),drainSeconds:Number(e.drain_seconds),graceSeconds:Number(e.grace_seconds),automaticRollback:Number(e.automatic_rollback)===1,rollbackAttempts:Number(e.rollback_attempts),previousReleaseId:Zn(e.previous_release_id),promotedFromReleaseId:Zn(e.promoted_from_release_id),actorId:Zn(e.actor_id),trigger:String(e.trigger),pinned:Number(e.pinned)===1,pinReason:Zn(e.pin_reason),activatedAt:Zn(e.activated_at),failedAt:Zn(e.failed_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function jk(e){return{sequence:Number(e.sequence),id:String(e.id),releaseId:String(e.release_id),fromStatus:Zn(e.from_status),toStatus:String(e.to_status),trafficPercent:e.traffic_percent==null?void 0:Number(e.traffic_percent),health:fo(e.health,{}),message:String(e.message),operationId:Zn(e.operation_id),createdAt:String(e.created_at)}}function Bk(e,t){let r=[],a=(l,m,f)=>{if(JSON.stringify(m)===JSON.stringify(f))return;if(m&&f&&typeof m==="object"&&typeof f==="object"&&!Array.isArray(m)&&!Array.isArray(f)){for(let b of[...new Set([...Object.keys(m),...Object.keys(f)])].sort())a(l?`${l}.${b}`:b,m[b],f[b]);return}r.push({path:l,...m!==void 0?{before:m}:{},...f!==void 0?{after:f}:{}})};return a("",e,t),r}class Xo{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}registerArtifact(e){if(!$k.test(e.digest)||!/^(?:s3|https|oci|file):/.test(e.uri)||!Number.isInteger(e.size)||e.size<0)throw Error("Artifact requires a SHA-256 digest, supported immutable URI, and non-negative byte size");let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE organization_id=? AND digest=?").get(e.organizationId,e.digest);if(t)return oh(t);let r=this.id(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_artifacts (id, organization_id, digest, kind, uri, size, media_type, provenance, attestation, verified_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.digest,e.kind,e.uri,e.size,e.mediaType??"application/octet-stream",JSON.stringify(s(e.provenance??{})),JSON.stringify(s(e.attestation??{})),a,a]),this.getArtifact(r)}getArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE id=?").get(e);return t?oh(t):void 0}create(e){let t=this.getArtifact(e.artifactId),r=this.controlPlane.getResource(e.resourceId),a=this.controlPlane.listEnvironments(e.projectId).find((T)=>T.id===e.environmentId);if(!t||t.organizationId!==e.organizationId||t.kind!==e.kind)throw Error("Release artifact does not match the organization and deployable kind");if(!r||r.projectId!==e.projectId||r.environmentId!==e.environmentId||!a)throw Error("Release target scope does not match the resource");if(e.sourceSha&&!Nk.test(e.sourceSha))throw Error("Release source must be an immutable commit SHA");Zi({kind:e.kind,provider:r.provider,hasHealthGate:!!e.healthGate,replicas:e.replicas},e.strategy);let l=s(e.config),m=Ok("sha256").update(JSON.stringify(l)).digest("hex"),f=this.active(e.resourceId),b=this.id(),k=this.now().toISOString(),y=e.approvalRequired?"awaiting_approval":"built",R=e.hooks??{migrations:"none",preActivate:[],postActivate:[]};return this.controlPlane.database.run("INSERT INTO releases (id, organization_id, project_id, environment_id, resource_id, artifact_id, kind, source_sha, config_hash, manifest, provenance, strategy, status, health_gate, hooks, drain_seconds, grace_seconds, automatic_rollback, previous_release_id, promoted_from_release_id, actor_id, trigger, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[b,e.organizationId,e.projectId,e.environmentId,e.resourceId,e.artifactId,e.kind,e.sourceSha??null,m,JSON.stringify(s(e.manifest)),JSON.stringify(s(e.provenance??{})),e.strategy,y,e.healthGate?JSON.stringify(e.healthGate):null,JSON.stringify(R),Math.max(0,Math.min(3600,Math.floor(e.drainSeconds??30))),Math.max(0,Math.min(3600,Math.floor(e.graceSeconds??30))),e.automaticRollback===!1?0:1,f?.id??null,e.promotedFromReleaseId??null,e.actorId??null,e.trigger??"manual",k,k]),this.recordTransition(b,void 0,y,{message:e.promotedFromReleaseId?"Immutable artifact promoted without rebuild.":"Immutable release record created."}),this.get(b)}get(e){let t=this.controlPlane.database.query("SELECT * FROM releases WHERE id=?").get(e);return t?sh(t):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM releases ORDER BY created_at DESC, rowid DESC").all().map(sh).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(!e.resourceId||t.resourceId===e.resourceId)&&(!e.status||t.status===e.status))}active(e){return this.list({resourceId:e,status:"active"})[0]}transitions(e){return this.controlPlane.database.query("SELECT * FROM release_transitions WHERE release_id=? ORDER BY sequence").all(e).map(jk)}recordTransition(e,t,r,a){this.controlPlane.database.run("INSERT INTO release_transitions (id, release_id, from_status, to_status, traffic_percent, health, message, operation_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",[this.id(),e,t??null,r,a.trafficPercent??null,JSON.stringify(s(a.health??{})),a.message.slice(0,1000),a.operationId??null,this.now().toISOString()])}progress(e,t){let r=this.get(e);if(!r)throw Error(`Release ${e} was not found`);return this.recordTransition(e,r.status,r.status,t),this.transitions(e).at(-1)}transition(e,t,r){let a=this.get(e);if(!a)throw Error(`Release ${e} was not found`);if(!{built:["awaiting_approval","activating","failed"],awaiting_approval:["built","failed"],activating:["active","failed","rolled_back"],active:["superseded","failed","rolled_back"],failed:["activating","rolled_back"],rolled_back:["activating"],superseded:["activating"]}[a.status].includes(t))throw Error(`Invalid release transition ${a.status} → ${t}`);let m=this.now().toISOString();if(t==="active"){let f=this.active(a.resourceId);if(f&&f.id!==e)this.controlPlane.database.run("UPDATE releases SET status='superseded', updated_at=? WHERE id=?",[m,f.id]),this.recordTransition(f.id,"active","superseded",{message:`Superseded by ${e}.`,operationId:r.operationId})}return this.controlPlane.database.run("UPDATE releases SET status=?, rollback_attempts=rollback_attempts+?, activated_at=CASE WHEN ?='active' THEN ? ELSE activated_at END, failed_at=CASE WHEN ?='failed' THEN ? ELSE failed_at END, updated_at=? WHERE id=?",[t,t==="rolled_back"?1:0,t,m,t,m,m,e]),this.recordTransition(e,a.status,t,r),this.get(e)}approve(e,t){let r=this.get(e);if(!r||r.status!=="awaiting_approval")throw Error("Release is not awaiting approval");let a=this.id(),l=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_approvals (id, release_id, environment_id, decision, actor_id, comment, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,r.environmentId,t.decision,t.actorId,t.comment?.slice(0,1000)??null,l]),this.transition(e,t.decision==="approved"?"built":"failed",{message:t.decision==="approved"?"Environment gate approved.":"Environment gate rejected."})}approvals(e){return this.controlPlane.database.query("SELECT * FROM release_approvals WHERE release_id=? ORDER BY created_at").all(e).map((t)=>({id:String(t.id),releaseId:String(t.release_id),environmentId:String(t.environment_id),decision:String(t.decision),actorId:String(t.actor_id),comment:Zn(t.comment),createdAt:String(t.created_at)}))}promote(e,t){let r=this.get(e);if(!r||!["active","superseded"].includes(r.status))throw Error("Only a tested active/superseded release can be promoted");return this.create({organizationId:r.organizationId,projectId:r.projectId,environmentId:t.targetEnvironmentId,resourceId:t.targetResourceId,artifactId:r.artifactId,kind:r.kind,sourceSha:r.sourceSha,config:t.config,manifest:r.manifest,provenance:r.provenance,strategy:t.strategy??r.strategy,healthGate:t.healthGate??r.healthGate,hooks:r.hooks,drainSeconds:r.drainSeconds,graceSeconds:r.graceSeconds,automaticRollback:r.automaticRollback,promotedFromReleaseId:r.id,actorId:t.actorId,trigger:"promotion",approvalRequired:t.approvalRequired})}compare(e,t){let r=this.get(e),a=this.get(t);if(!r||!a)throw Error("Both releases are required for comparison");return{artifactChanged:r.artifactId!==a.artifactId,sourceChanged:r.sourceSha!==a.sourceSha,configChanged:r.configHash!==a.configHash,manifestChanges:Bk(r.manifest,a.manifest),dataCaveat:a.hooks.migrations==="none"?"No database migration is recorded.":`Database hooks are ${a.hooks.migrations}; release rollback does not roll back data.`}}pin(e,t,r){if(!this.get(e))throw Error("Release was not found");return this.controlPlane.database.run("UPDATE releases SET pinned=?, pin_reason=?, updated_at=? WHERE id=?",[t?1:0,t?r?.slice(0,500)??"operator":null,this.now().toISOString(),e]),this.get(e)}retentionCandidates(e){let t=Math.max(1,Math.min(100,Math.floor(e.keepPerResource??10))),r=new Map;for(let a of this.list()){let l=r.get(a.resourceId)??[];l.push(a),r.set(a.resourceId,l)}return[...r.values()].flatMap((a)=>a.slice(t)).filter((a)=>new Date(a.createdAt)<e.before&&!a.pinned&&!["active","activating","awaiting_approval"].includes(a.status)&&!this.list().some((l)=>l.previousReleaseId===a.id&&["active","activating"].includes(l.status)))}}class Et{controlPlane;releases;queue;constructor(e){this.controlPlane=e;this.releases=new Xo(e),this.queue=new c(e)}enqueueActivation(e,t={}){let r=this.releases.get(e.id);if(!r)throw Error("Release was not found");if(!["built","failed","rolled_back","superseded"].includes(r.status))throw Error(`Release ${r.status} cannot be activated`);let a=t.action??"activate",l=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:`release.${a}`,idempotencyKey:`release:${r.id}:${a}:${r.rollbackAttempts}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:t.targetReleaseId??null},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:r.automaticRollback?2:1,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return this.releases.transition(r.id,"activating",{message:`${a} queued.`,operationId:l.id,trafficPercent:0}),l}completeHealthGate(e,t){let r=this.releases.get(e);if(!r||r.status!=="activating")throw Error("Release is not activating");if(t.healthy)return{release:this.releases.transition(r.id,"active",{message:t.message??"Health gate passed; activation completed.",operationId:t.operationId,trafficPercent:100,health:t.health})};let a=this.releases.transition(r.id,"failed",{message:t.message??"Health gate failed.",operationId:t.operationId,trafficPercent:0,health:t.health}),l=r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!r.automaticRollback||r.rollbackAttempts>=1||!l)return{release:a};let m=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"release.rollback",idempotencyKey:`release:${r.id}:automatic-rollback`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:l.id,automatic:!0},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return{release:a,rollbackOperation:m}}enqueueRollback(e,t={}){let r=this.releases.get(e.id);if(!r||r.status!=="active")throw Error("Only the active release can be rolled back");let a=t.targetReleaseId?this.releases.get(t.targetReleaseId):r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!a||a.resourceId!==r.resourceId||!["superseded","active"].includes(a.status))throw Error("Rollback requires a preserved prior release for the same resource");return this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:"release.rollback",idempotencyKey:`release:${r.id}:manual-rollback:${a.id}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:a.id,automatic:!1},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}}function bf(e){if(e.strategy==="canary")return[5,25,50,100].map((t,r)=>({step:`canary-${t}`,trafficPercent:t,waitSeconds:r===3?e.drainSeconds:e.graceSeconds,requiresHealth:!0}));if(e.strategy==="blue_green")return[{step:"green-health",trafficPercent:0,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"traffic-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];if(e.strategy==="rolling")return[{step:"rolling-replacement",trafficPercent:50,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"rolling-complete",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];return[{step:"immutable-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!!e.healthGate}]}async function zl(e,t){if(t.release.artifactId!==t.artifact.id)throw Error("Release activation artifact identity changed");Zi({kind:t.release.kind,hasHealthGate:!!t.release.healthGate,replicas:Number(t.release.manifest?.replicas)||void 0},t.release.strategy);let r=e.capability(t);if(!r.supported)throw Error(`${t.release.strategy} is unavailable in ${e.name}: ${r.explanation}`);return e.activate({...t,transitions:bf(t.release)})}async function Kl(e,t){if(!t.previous)throw Error("Rollback requires the preserved previous release");return e.rollback({...t,transitions:[{step:"rollback",trafficPercent:0,waitSeconds:t.release.drainSeconds,requiresHealth:!0}]})}var Cf=["release.activate","release.rollback"];function Mk(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function Wl(e){let t=new Et(e.store),r=async(a)=>{let l=Mk(a.operation.input),m=typeof l.releaseId==="string"?l.releaseId:"",f=t.releases.get(m);if(!f)throw Error(`Queued release ${m||"(missing)"} was not found`);if(f.projectId!==a.operation.projectId||f.environmentId!==a.operation.environmentId||f.resourceId!==a.operation.resourceId)throw Error("Queued release does not match the operation scope");let b=t.releases.getArtifact(f.artifactId);if(!b||b.digest!==t.releases.getArtifact(f.artifactId)?.digest)throw Error("Immutable release artifact is unavailable");let k=typeof l.targetReleaseId==="string"&&l.targetReleaseId?l.targetReleaseId:f.previousReleaseId,y=k?t.releases.get(k):void 0;if(y&&(y.resourceId!==f.resourceId||y.artifactId===f.artifactId&&y.id===f.id))throw Error("Rollback target does not match the release resource");let R=await e.resolveDriver(f);a.checkpoint("verify",`Verifying ${b.digest} and ${f.configHash} for ${R.name}.`),a.log(`Artifact ${b.digest}; source ${f.sourceSha??"not recorded"}; config ${f.configHash}.`,{stream:"system"}),a.throwIfCancellationRequested();let T;try{T=a.operation.kind==="release.rollback"?await Kl(R,{release:f,artifact:b,previous:y}):await zl(R,{release:f,artifact:b,previous:y})}catch(N){if(a.operation.kind==="release.activate"&&t.releases.get(f.id)?.status==="activating")t.completeHealthGate(f.id,{healthy:!1,operationId:a.operation.id,message:N instanceof Error?N.message:String(N)});throw N}for(let N of T.transitions)t.releases.progress(f.id,{message:`${a.operation.kind==="release.rollback"?"Rollback":"Activation"} traffic at ${N.trafficPercent}%.`,trafficPercent:N.trafficPercent,health:N.observed,operationId:a.operation.id}),a.log(`Traffic ${N.trafficPercent}%: ${N.healthy?"healthy":"unhealthy"}.`,{stream:N.healthy?"step":"stderr",step:"health"});if(a.checkpoint("health","Evaluating the provider health result."),!T.activated||!T.healthy){if(a.operation.kind==="release.activate"&&t.releases.get(f.id)?.status==="activating")t.completeHealthGate(f.id,{healthy:!1,operationId:a.operation.id,health:{resourceVersions:T.resourceVersions},message:T.error??"Provider health gate failed."});throw Error(T.error??`${R.name} reported an unhealthy release`)}if(a.operation.kind==="release.activate"&&f.healthGate?.name){if(!e.resolveHealthGate)throw t.completeHealthGate(f.id,{healthy:!1,operationId:a.operation.id,message:`Named health gate ${f.healthGate.name} is not available to this worker.`}),Error(`Named health gate ${f.healthGate.name} is unavailable`);a.checkpoint("named-health-gate",`Waiting on ${f.healthGate.name}.`);let N=await e.resolveHealthGate(f.healthGate.name,f);if(a.log(`${f.healthGate.name}: ${N.healthy?"healthy":"unhealthy"}${N.message?` — ${N.message}`:""}.`,{stream:N.healthy?"step":"stderr",step:"health"}),!N.healthy)throw t.completeHealthGate(f.id,{healthy:!1,operationId:a.operation.id,health:N.evidence,message:N.message??`Named health gate ${f.healthGate.name} failed.`}),Error(N.message??`Named health gate ${f.healthGate.name} failed`)}if(a.operation.kind==="release.rollback"){let N=t.releases.get(f.id);if(N.status!=="rolled_back")t.releases.transition(N.id,"rolled_back",{message:`Traffic restored through ${R.name}.`,operationId:a.operation.id,trafficPercent:0,health:{resourceVersions:T.resourceVersions}});if(y&&y.status!=="active"){let j=y.status==="activating"?y:t.releases.transition(y.id,"activating",{message:"Rollback target restoring traffic.",operationId:a.operation.id,trafficPercent:0});t.releases.transition(j.id,"active",{message:"Previous immutable release restored.",operationId:a.operation.id,trafficPercent:100,health:{resourceVersions:T.resourceVersions}})}}else t.completeHealthGate(f.id,{healthy:!0,operationId:a.operation.id,health:{providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions},message:"Provider activation and health gates completed."});return a.checkpoint("finalize","Persisted the terminal release state."),{releaseId:f.id,artifactDigest:b.digest,provider:R.name,providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions,status:t.releases.get(f.id).status}};return Object.fromEntries(Cf.map((a)=>[a,r]))}import{createCipheriv as Lk,createDecipheriv as Fk,createHash as uh,randomBytes as lp}from"node:crypto";var ph={github:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitlab:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},bitbucket:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitea:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!1,deployKeys:!0},generic_https:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!1},generic_ssh:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!0}};function Lt(e){return typeof e==="string"&&e?e:void 0}function yo(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function Xn(e){return JSON.stringify(s(e))}function ho(e){return uh("sha256").update(e).digest("hex")}function ah(e){let t=e.trim().replace(/\/$/,""),r=new URL(t.includes("://")?t:`https://${t}`);if(r.username||r.password||r.search||r.hash)throw Error("Source host cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(r.hostname)))throw Error("Source host must use HTTPS");return`${r.protocol}//${r.host}${r.pathname.replace(/\/$/,"")}`}function ch(e){let t=e.trim();if(t.length<2||t.length>80)throw Error("Connection name must contain 2-80 characters");return t}function up(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function dh(e){let t=e.trim()||".";if(t.startsWith("/")||t.split("/").includes("..")||/[\0\r\n]/.test(t))throw Error("Monorepo root must stay inside the repository");return t.replace(/^\.\//,"")||"."}function Bc(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Boolean))].slice(0,100)}function zk(e){let t=e.trim();if(/\r|\n/.test(t)||/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Clone URL cannot contain credentials or control characters");if(!/^(?:https?:\/\/|ssh:\/\/|git@[A-Za-z0-9.-]+:)/.test(t))throw Error("Clone URL must use HTTPS or SSH");return t}function Uk(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),owner:Lt(e.owner),authKind:String(e.auth_kind),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:Lt(e.credential_fingerprint),grantedScopes:yo(e.granted_scopes,[]),capabilities:yo(e.capabilities,ph[String(e.provider)]),status:String(e.status),healthMessage:Lt(e.health_message),lastTestedAt:Lt(e.last_tested_at),lastSyncedAt:Lt(e.last_synced_at),credentialExpiresAt:Lt(e.credential_expires_at),version:Number(e.version),createdByActorId:Lt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function pp(e){return{id:String(e.id),connectionId:String(e.connection_id),providerRepositoryId:String(e.provider_repository_id),fullName:String(e.full_name),cloneUrl:String(e.clone_url),defaultBranch:String(e.default_branch),visibility:String(e.visibility),archived:Number(e.archived)===1,metadata:yo(e.metadata,{}),syncedAt:String(e.synced_at)}}function lh(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Lt(e.environment_id),resourceId:Lt(e.resource_id),connectionId:String(e.connection_id),repositoryId:Lt(e.repository_id),repositoryFullName:String(e.repository_full_name),defaultBranch:String(e.default_branch),branchRule:Lt(e.branch_rule),tagRule:Lt(e.tag_rule),monorepoRoot:String(e.monorepo_root),includePaths:yo(e.include_paths,[]),excludePaths:yo(e.exclude_paths,[]),submodules:Number(e.submodules)===1,cloneDepth:e.clone_depth==null?void 0:Number(e.clone_depth),deployKeyId:Lt(e.deploy_key_id),autoDeploy:Number(e.auto_deploy)===1,pullRequestPreviews:Number(e.pull_request_previews)===1,status:String(e.status),disabledReason:Lt(e.disabled_reason),version:Number(e.version),createdByActorId:Lt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function gp(e){return{id:String(e.id),connectionId:String(e.connection_id),name:String(e.name),publicKey:String(e.public_key),publicKeyFingerprint:String(e.public_key_fingerprint),host:String(e.host),hostKey:String(e.host_key),hostKeyFingerprint:String(e.host_key_fingerprint),createdByActorId:Lt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function mp(e){return{id:String(e.id),connectionId:String(e.connection_id),repositoryId:Lt(e.repository_id),repositoryFullName:String(e.repository_full_name),providerWebhookId:Lt(e.provider_webhook_id),events:yo(e.events,[]),status:String(e.status),healthMessage:Lt(e.health_message),lastDeliveryAt:Lt(e.last_delivery_at),lastReconciledAt:Lt(e.last_reconciled_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function fp(e){return{id:String(e.id),connectionId:String(e.connection_id),webhookId:String(e.webhook_id),providerDeliveryId:String(e.provider_delivery_id),event:String(e.event),action:Lt(e.action),commitSha:Lt(e.commit_sha),signatureStatus:String(e.signature_status),status:String(e.status),payloadSummary:yo(e.payload_summary,{}),operationId:Lt(e.operation_id),error:Lt(e.error),receivedAt:String(e.received_at),processedAt:Lt(e.processed_at)}}class Yo{controlPlane;key;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.key=t.encryptionKey?uh("sha256").update(t.encryptionKey).digest():void 0,this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let t=lp(12),r=Lk("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted source credential is unavailable");let m=Fk("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}createConnection(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Source connection organization was not found");let t=this.now(),r=this.idFn(),a=e.credential?JSON.stringify(e.credential):void 0;return this.run(`INSERT INTO source_connections (id, organization_id, provider, name, host, owner, auth_kind, credential_ciphertext, credential_fingerprint, granted_scopes, capabilities, status, credential_expires_at, created_by_actor_id, created_at, updated_at)
+`}}function df(e){let t=e.replace(/\\/g,"/");return!!t&&!t.startsWith("/")&&!/^[A-Za-z]:\//.test(t)&&!t.split("/").includes("..")&&!/[\0\r\n]/.test(t)}function lf(e,t,r={}){let a=r.maxBytes??104857600,l=r.maxEntries??1e4,m=r.maxExpandedBytes??524288000;if(e.byteLength>a)throw Error("Archive exceeds the compressed size limit");let f=new DataView(e.buffer,e.byteOffset,e.byteLength),b=[],k=0;if(t.toLowerCase().endsWith(".zip")||e[0]===80&&e[1]===75){let R=0;while(R+30<=e.length){let T=f.getUint32(R,!0);if(T===33639248||T===101010256)break;if(T!==67324752)throw Error("Malformed ZIP local header");let N=f.getUint16(R+6,!0),j=f.getUint32(R+18,!0),U=f.getUint32(R+22,!0),q=f.getUint16(R+26,!0),Y=f.getUint16(R+28,!0);if(N&8)throw Error("ZIP data descriptors are not accepted for uploaded artifacts");let ee=new TextDecoder().decode(e.subarray(R+30,R+30+q));if(!df(ee))throw Error(`Unsafe archive path: ${ee}`);if(b.push(ee),k+=U,b.length>l||k>m)throw Error("Archive expansion limit exceeded");R+=30+q+Y+j}return{format:"zip",entries:b.length,expandedBytes:k,paths:b}}if(!t.toLowerCase().match(/\.(?:tar|tar\.gz|tgz)$/))throw Error("Only ZIP and uncompressed TAR artifacts are supported");let y=0;while(y+512<=e.length){let R=e.subarray(y,y+512);if(R.every((q)=>q===0))break;let T=(q,Y)=>new TextDecoder().decode(R.subarray(q,q+Y)).replace(/\0.*$/,""),N=`${T(345,155)}${T(345,155)?"/":""}${T(0,100)}`,j=Number.parseInt(T(124,12).trim()||"0",8),U=String.fromCharCode(R[156]??0);if(!df(N))throw Error(`Unsafe archive path: ${N}`);if(U==="1"||U==="2")throw Error(`Archive links are not accepted: ${N}`);if(!Number.isFinite(j)||j<0)throw Error("Malformed TAR entry size");if(b.push(N),k+=j,b.length>l||k>m)throw Error("Archive expansion limit exceeded");y+=512+Math.ceil(j/512)*512}return{format:"tar",entries:b.length,expandedBytes:k,paths:b}}var uf=new Set(["source","build","runtime","environment","domain","review"]);function pf(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function gf(e){return/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(e)}function mf(e){for(let[r,a]of Object.entries(e.environment??{}))if(typeof a==="string"&&gf(r)&&a)throw Error(`${r} must be stored through the write-only secrets boundary`);if(e.build.kind==="dockerfile"){for(let[r,a]of Object.entries(e.build.buildArgs??{}))if(gf(r)&&a)throw Error(`${r} must be declared as a build secret name`)}let t=JSON.stringify(e);if(/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Drafts cannot contain credential-bearing URLs")}function ff(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),schemaVersion:Number(e.schema_version),name:String(e.name),step:String(e.step),input:pf(e.input,{}),suppliedSecretNames:pf(e.supplied_secret_names,[]),status:String(e.status),version:Number(e.version),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class op{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}create(e){if(mf(e.draft),e.draft.projectId!==e.projectId)throw Error("Draft project does not match its storage scope");let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Draft project was not found");let r=this.idFn(),a=this.now(),l=e.step??"source";if(!uf.has(l))throw Error("Invalid draft step");let m=[...new Set(e.suppliedSecretNames??[])].sort(),f=Un(e.draft,m).valid?"ready":"draft";return this.controlPlane.database.run("INSERT INTO application_drafts (id, organization_id, project_id, schema_version, name, step, input, supplied_secret_names, status, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.projectId,e.name.trim().slice(0,100),l,JSON.stringify(e.draft),JSON.stringify(m),f,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.draft.created",payload:{draftId:r,step:l,status:f,requiredSecretNames:e.draft.requiredSecretNames??[]}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_drafts WHERE id=?").get(e);return t?ff(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_drafts WHERE project_id=? ORDER BY updated_at DESC").all(e).map(ff)}update(e,t,r){let a=this.get(e);if(!a||a.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);if(!uf.has(r.step))throw Error("Invalid draft step");if(r.draft.projectId!==a.projectId)throw Error("Draft project cannot be changed");mf(r.draft);let l=[...new Set(r.suppliedSecretNames??a.suppliedSecretNames)].sort(),m=Un(r.draft,l).valid?"ready":"draft",f=this.now();if(this.controlPlane.database.run("UPDATE application_drafts SET name=?, step=?, input=?, supplied_secret_names=?, status=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.draft.name.slice(0,100),r.step,JSON.stringify(r.draft),JSON.stringify(l),m,f,e,t]).changes!==1)throw Error(`Application draft ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,actorId:r.actorId,type:"application.draft.updated",payload:{draftId:e,fromVersion:t,toVersion:t+1,step:r.step,status:m}}),this.get(e)}markApplied(e,t,r){let a=this.get(e);if(!a||a.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);let l=Un(a.input,a.suppliedSecretNames);if(!l.valid)throw Error(`Draft is not deployable: ${[...l.issues.map((f)=>f.message),...l.missingSecrets.map((f)=>`Missing secret ${f}`)].join("; ")}`);let m=this.now();return this.controlPlane.database.run("UPDATE application_drafts SET status='applied', step='review', version=version+1, updated_at=? WHERE id=? AND version=?",[m,e,t]),this.controlPlane.appendEvent({organizationId:a.organizationId,projectId:a.projectId,actorId:r,type:"application.draft.applied",payload:s({draftId:e,manifest:l.manifest})}),this.get(e)}}import{createCipheriv as Ik,createDecipheriv as Ek,createHash as eh,randomBytes as Rk}from"node:crypto";function ec(e){return typeof e==="string"&&e?e:void 0}function sp(e){return eh("sha256").update(e).digest("hex").slice(0,16)}function hf(e){let t=new URL(e.includes("://")?e:`https://${e}`);if(t.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(t.hostname))throw Error("Registry host must use HTTPS");if(t.username||t.password||t.search||t.hash)throw Error("Registry host cannot contain credentials");return`${t.protocol}//${t.host}`}function Ak(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:ec(e.credential_fingerprint),credentialExpiresAt:ec(e.credential_expires_at),status:String(e.status),healthMessage:ec(e.health_message),lastTestedAt:ec(e.last_tested_at),version:Number(e.version),createdByActorId:ec(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class ap{controlPlane;key;nowFn;idFn;constructor(e,t){this.controlPlane=e;if(!t.encryptionKey)throw Error("Registry encryption key is required");this.key=eh("sha256").update(`ts-cloud:registry:${t.encryptionKey}`).digest(),this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}encrypt(e){let t=Rk(12),r=Ik("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Registry credential envelope is invalid");let m=Ek("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}current(e){let t=Ak(e);return t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime()?{...t,status:"expired",healthMessage:"Registry credential expired; rotate it before pulling images."}:t}create(e){if(!["docker_hub","ghcr","ecr","gcr","generic"].includes(e.provider))throw Error("A supported registry provider is required");let t=e.credential?JSON.stringify(e.credential):void 0,r=this.idFn(),a=this.now();return this.controlPlane.database.run("INSERT INTO registry_connections (id, organization_id, provider, name, host, credential_ciphertext, credential_fingerprint, credential_expires_at, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.provider,e.name.trim().slice(0,80),hf(e.host),t?this.encrypt(t):null,t?sp(t):null,e.credentialExpiresAt??null,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"registry.connection.created",payload:{connectionId:r,provider:e.provider,host:hf(e.host),credentialConfigured:!!t}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM registry_connections WHERE id=?").get(e);return t?this.current(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM registry_connections WHERE organization_id=? ORDER BY name").all(e).map((t)=>this.current(t))}credential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM registry_connections WHERE id=?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotate(e,t,r={}){let a=this.get(e);if(!a||a.status==="disconnected")throw Error("Registry connection was not found");let l=JSON.stringify(t);return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=?, credential_fingerprint=?, credential_expires_at=?, status='pending', health_message=NULL, version=version+1, updated_at=? WHERE id=?",[this.encrypt(l),sp(l),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:r.actorId,type:"registry.credential.rotated",payload:{connectionId:e,fingerprint:sp(l),expiresAt:r.expiresAt??null}}),this.get(e)}disconnect(e,t){let r=this.get(e);if(!r)throw Error("Registry connection was not found");return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=NULL, credential_fingerprint=NULL, status='disconnected', health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"registry.connection.disconnected",level:"warning",payload:{connectionId:e}}),this.get(e)}async test(e,t={}){let r=this.get(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active registry connection was not found");let a=this.credential(e),l=t.fetch??fetch,m=new AbortController,f=setTimeout(()=>m.abort(),t.timeoutMs??15000),b=a?.token?`Bearer ${a.token}`:a?.username||a?.password?`Basic ${Buffer.from(`${a.username??""}:${a.password??""}`).toString("base64")}`:void 0;try{let k=await l(`${r.host}/v2/`,{method:"GET",redirect:"error",signal:m.signal,headers:b?{Authorization:b}:void 0}),y=k.headers.get("www-authenticate")??"";if(k.status===401&&y.startsWith("Bearer ")&&a){let N=Object.fromEntries([...y.slice(7).matchAll(/(\w+)="([^"]+)"/g)].map((ee)=>[ee[1],ee[2]])),j=new URL(N.realm??"");if(j.protocol!=="https:")throw Error("Registry authentication realm must use HTTPS");if(N.service)j.searchParams.set("service",N.service);if(t.image)j.searchParams.set("scope",`repository:${th(t.image).repository}:pull`);let U=await l(j,{signal:m.signal,redirect:"error",headers:b?{Authorization:b}:void 0});if(!U.ok)throw Error(`Registry authentication failed (${U.status})`);let q=await U.json(),Y=q.token??q.access_token;if(!Y)throw Error("Registry did not return an access token");k=t.image?await Af(l,r.host,t.image,Y,m.signal):await l(`${r.host}/v2/`,{signal:m.signal,redirect:"error",headers:{Authorization:`Bearer ${Y}`}})}else if(k.ok&&t.image)k=await Af(l,r.host,t.image,a?.token,m.signal,b);let R=k.ok?"healthy":"degraded",T=k.ok?t.image?"Registry image is readable.":"Registry connection is healthy.":`Registry request failed (${k.status})`;return this.controlPlane.database.run("UPDATE registry_connections SET status=?, health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[R,T,this.now(),this.now(),e]),this.get(e)}catch(k){let y=m.signal.aborted?"Registry request timed out.":k instanceof Error?k.message:"Registry test failed";return this.controlPlane.database.run("UPDATE registry_connections SET status='degraded', health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[y.slice(0,1000),this.now(),this.now(),e]),this.get(e)}finally{clearTimeout(f)}}}function th(e){let t=e.replace(/^https?:\/\//,""),r=t.indexOf("/");if(r<1)throw Error("Image must include registry/repository");let a=t.slice(r+1),l=a.lastIndexOf("@"),m=a.lastIndexOf(":"),f=l>=0?l:m>a.lastIndexOf("/")?m:-1,b=f>=0?a.slice(0,f):a,k=f>=0?a.slice(f+1):"latest";if(!/^[A-Za-z0-9_.\/-]+$/.test(b)||!/^[A-Za-z0-9_.:+-]+$/.test(k))throw Error("Image reference is invalid");return{repository:b,reference:k}}async function Af(e,t,r,a,l,m){let f=th(r);return e(`${t}/v2/${f.repository}/manifests/${encodeURIComponent(f.reference)}`,{method:"HEAD",redirect:"error",signal:l,headers:{Accept:"application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",...a?{Authorization:`Bearer ${a}`}:m?{Authorization:m}:{}}})}import{createHash as Ck}from"node:crypto";import{chmodSync as rh,existsSync as nh,mkdirSync as Pk,renameSync as _k,unlinkSync as ih,writeFileSync as Tk}from"node:fs";import{basename as xk,join as Dk}from"node:path";function cp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),filename:String(e.filename),sha256:String(e.sha256),size:Number(e.size),format:String(e.format),entryCount:Number(e.entry_count),expandedBytes:Number(e.expanded_bytes),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at)}}class dp{controlPlane;root;idFn;nowFn;constructor(e,t){this.controlPlane=e;this.root=d(t.cwd,"artifacts"),this.idFn=t.id??(()=>crypto.randomUUID()),this.nowFn=t.now??(()=>new Date)}create(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Artifact project was not found");let r=xk(e.filename).slice(0,200);if(!r||r!==e.filename)throw Error("Artifact filename must not contain a path");let a=lf(e.bytes,r),l=Ck("sha256").update(e.bytes).digest("hex"),m=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? AND sha256=?").get(e.projectId,l);if(m)return cp(m);let f=this.idFn();Pk(this.root,{recursive:!0,mode:448}),rh(this.root,448);let b=Dk(this.root,`${f}.archive`),k=`${b}.partial`;try{Tk(k,e.bytes,{mode:384,flag:"wx"}),_k(k,b),rh(b,384),this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[f,e.organizationId,e.projectId,r,b,l,e.bytes.byteLength,a.format,a.entries,a.expandedBytes,e.actorId??null,this.nowFn().toISOString()])}catch(y){if(nh(k))ih(k);if(nh(b))ih(b);throw y}return this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.artifact.created",payload:{artifactId:f,filename:r,sha256:l,size:e.bytes.byteLength,entries:a.entries}}),this.get(f)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE id=?").get(e);return t?cp(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? ORDER BY created_at DESC").all(e).map(cp)}}function jc(e){let t=e.drafts.get(e.draftId);if(!t||t.version!==e.expectedVersion)throw Error(`Application draft ${e.draftId} changed since version ${e.expectedVersion}`);if(t.status==="applied")throw Error("Application draft was already applied");let r=e.controlPlane.getProject(t.projectId),a=r?e.controlPlane.listEnvironments(r.id).find((y)=>y.id===t.input.environmentId):void 0;if(!r||!a||a.projectId!==r.id||r.organizationId!==t.organizationId)throw Error("Draft deployment scope was not found");if(e.confirmEnvironment!==a.slug)throw Error(`Type ${a.slug} to confirm this deployment target`);let l=Un(t.input,t.suppliedSecretNames);if(!l.valid)throw Error(`Application plan is invalid: ${[...l.issues.map((y)=>y.message),...l.missingSecrets.map((y)=>`Missing secret ${y}`)].join("; ")}`);let m=e.controlPlane.listResources(r.id,a.id).find((y)=>y.kind==="application"&&y.slug===t.input.slug),f=JSON.parse(JSON.stringify({manifest:l.manifest,configPatch:l.configPatch})),b=m?e.controlPlane.updateResource(m.id,m.version,{name:t.input.name,desiredState:f}):e.controlPlane.createResource({projectId:r.id,environmentId:a.id,kind:"application",slug:t.input.slug,name:t.input.name,desiredState:f,metadata:{source:"application-onboarding",draftId:t.id}}),k=new c(e.controlPlane).enqueue({projectId:r.id,environmentId:a.id,resourceId:b.id,actorId:e.actorId,kind:"application.create",idempotencyKey:`application-draft:${t.id}:v${t.version}`,correlationId:`application-draft:${t.id}`,input:f,lockKey:`resource:${b.id}`,providerKey:b.provider??"default",buildSlot:t.input.build.kind!=="prebuilt_image",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return e.drafts.markApplied(t.id,t.version,e.actorId),e.controlPlane.appendEvent({organizationId:t.organizationId,projectId:r.id,resourceId:b.id,operationId:k.id,actorId:e.actorId,type:"application.create.queued",payload:{draftId:t.id,environment:a.slug,strategy:t.input.build.kind,costDrivers:l.costDrivers}}),{plan:l,resource:b,operation:k}}function cn(e){let t=["static","compute","serverless_zip","serverless_image"].includes(e.kind),r=["container","compose"].includes(e.kind)&&(e.replicas??1)>1,a=e.kind==="container"||e.kind==="serverless_zip"||e.kind==="serverless_image",l=(m,f)=>f&&(m==="atomic"?e.kind==="static"||e.hasHealthGate:e.hasHealthGate);return[{strategy:"atomic",supported:l("atomic",t),explanation:t?e.hasHealthGate||e.kind==="static"?"Activate an immutable version with an atomic pointer/alias switch.":"Atomic activation needs a readiness gate for this runtime.":"This driver has no atomic pointer or alias primitive.",capacityMultiplier:1,costImpact:"none",rollback:"Switch the pointer/alias back to the previous immutable release."},{strategy:"rolling",supported:l("rolling",r),explanation:r?e.hasHealthGate?"Replace healthy replicas within the configured capacity envelope.":"Rolling activation requires a health/readiness gate.":"Rolling activation requires a capable container/Compose driver and at least two replicas.",capacityMultiplier:1.5,costImpact:"temporary",rollback:"Stop replacement and restore the prior task/service definition."},{strategy:"blue_green",supported:l("blue_green",a),explanation:a?e.hasHealthGate?"Provision a complete green target and switch traffic after health passes.":"Blue-green requires a health gate before traffic can switch.":"The provider does not expose two traffic-addressable revisions.",capacityMultiplier:2,costImpact:"temporary",rollback:"Return all traffic to the preserved blue target."},{strategy:"canary",supported:l("canary",a),explanation:a?e.hasHealthGate?"Shift bounded traffic steps while evaluating health.":"Canary requires a health gate and measurable traffic target.":"The provider does not expose weighted traffic primitives.",capacityMultiplier:1.25,costImpact:"temporary",rollback:"Set canary weight to zero and preserve its diagnostics."}]}function Zi(e,t){let r=cn(e).find((a)=>a.strategy===t);if(!r.supported)throw Error(`${t} is unavailable: ${r.explanation}`);return r}import{createHash as Ok}from"node:crypto";var $k=/^sha256:[a-f0-9]{64}$/,Nk=/^[a-f0-9]{40,64}$/i;function Zn(e){return typeof e==="string"&&e?e:void 0}function fo(e,t){try{return JSON.parse(String(e))}catch{return t}}function oh(e){return{id:String(e.id),organizationId:String(e.organization_id),digest:String(e.digest),kind:String(e.kind),uri:String(e.uri),size:Number(e.size),mediaType:String(e.media_type),provenance:fo(e.provenance,{}),attestation:fo(e.attestation,{}),verifiedAt:String(e.verified_at),createdAt:String(e.created_at)}}function sh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),artifactId:String(e.artifact_id),kind:String(e.kind),sourceSha:Zn(e.source_sha),configHash:String(e.config_hash),manifest:fo(e.manifest,{}),provenance:fo(e.provenance,{}),strategy:String(e.strategy),status:String(e.status),healthGate:e.health_gate==null?void 0:fo(e.health_gate,void 0),hooks:fo(e.hooks,{migrations:"none",preActivate:[],postActivate:[]}),drainSeconds:Number(e.drain_seconds),graceSeconds:Number(e.grace_seconds),automaticRollback:Number(e.automatic_rollback)===1,rollbackAttempts:Number(e.rollback_attempts),previousReleaseId:Zn(e.previous_release_id),promotedFromReleaseId:Zn(e.promoted_from_release_id),actorId:Zn(e.actor_id),trigger:String(e.trigger),pinned:Number(e.pinned)===1,pinReason:Zn(e.pin_reason),activatedAt:Zn(e.activated_at),failedAt:Zn(e.failed_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function jk(e){return{sequence:Number(e.sequence),id:String(e.id),releaseId:String(e.release_id),fromStatus:Zn(e.from_status),toStatus:String(e.to_status),trafficPercent:e.traffic_percent==null?void 0:Number(e.traffic_percent),health:fo(e.health,{}),message:String(e.message),operationId:Zn(e.operation_id),createdAt:String(e.created_at)}}function Bk(e,t){let r=[],a=(l,m,f)=>{if(JSON.stringify(m)===JSON.stringify(f))return;if(m&&f&&typeof m==="object"&&typeof f==="object"&&!Array.isArray(m)&&!Array.isArray(f)){for(let b of[...new Set([...Object.keys(m),...Object.keys(f)])].sort())a(l?`${l}.${b}`:b,m[b],f[b]);return}r.push({path:l,...m!==void 0?{before:m}:{},...f!==void 0?{after:f}:{}})};return a("",e,t),r}class Xo{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}registerArtifact(e){if(!$k.test(e.digest)||!/^(?:s3|https|oci|file):/.test(e.uri)||!Number.isInteger(e.size)||e.size<0)throw Error("Artifact requires a SHA-256 digest, supported immutable URI, and non-negative byte size");let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE organization_id=? AND digest=?").get(e.organizationId,e.digest);if(t)return oh(t);let r=this.id(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_artifacts (id, organization_id, digest, kind, uri, size, media_type, provenance, attestation, verified_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.digest,e.kind,e.uri,e.size,e.mediaType??"application/octet-stream",JSON.stringify(s(e.provenance??{})),JSON.stringify(s(e.attestation??{})),a,a]),this.getArtifact(r)}getArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE id=?").get(e);return t?oh(t):void 0}create(e){let t=this.getArtifact(e.artifactId),r=this.controlPlane.getResource(e.resourceId),a=this.controlPlane.listEnvironments(e.projectId).find((T)=>T.id===e.environmentId);if(!t||t.organizationId!==e.organizationId||t.kind!==e.kind)throw Error("Release artifact does not match the organization and deployable kind");if(!r||r.projectId!==e.projectId||r.environmentId!==e.environmentId||!a)throw Error("Release target scope does not match the resource");if(e.sourceSha&&!Nk.test(e.sourceSha))throw Error("Release source must be an immutable commit SHA");Zi({kind:e.kind,provider:r.provider,hasHealthGate:!!e.healthGate,replicas:e.replicas},e.strategy);let l=s(e.config),m=Ok("sha256").update(JSON.stringify(l)).digest("hex"),f=this.active(e.resourceId),b=this.id(),k=this.now().toISOString(),y=e.approvalRequired?"awaiting_approval":"built",R=e.hooks??{migrations:"none",preActivate:[],postActivate:[]};return this.controlPlane.database.run("INSERT INTO releases (id, organization_id, project_id, environment_id, resource_id, artifact_id, kind, source_sha, config_hash, manifest, provenance, strategy, status, health_gate, hooks, drain_seconds, grace_seconds, automatic_rollback, previous_release_id, promoted_from_release_id, actor_id, trigger, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[b,e.organizationId,e.projectId,e.environmentId,e.resourceId,e.artifactId,e.kind,e.sourceSha??null,m,JSON.stringify(s(e.manifest)),JSON.stringify(s(e.provenance??{})),e.strategy,y,e.healthGate?JSON.stringify(e.healthGate):null,JSON.stringify(R),Math.max(0,Math.min(3600,Math.floor(e.drainSeconds??30))),Math.max(0,Math.min(3600,Math.floor(e.graceSeconds??30))),e.automaticRollback===!1?0:1,f?.id??null,e.promotedFromReleaseId??null,e.actorId??null,e.trigger??"manual",k,k]),this.recordTransition(b,void 0,y,{message:e.promotedFromReleaseId?"Immutable artifact promoted without rebuild.":"Immutable release record created."}),this.get(b)}get(e){let t=this.controlPlane.database.query("SELECT * FROM releases WHERE id=?").get(e);return t?sh(t):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM releases ORDER BY created_at DESC, rowid DESC").all().map(sh).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(!e.resourceId||t.resourceId===e.resourceId)&&(!e.status||t.status===e.status))}active(e){return this.list({resourceId:e,status:"active"})[0]}transitions(e){return this.controlPlane.database.query("SELECT * FROM release_transitions WHERE release_id=? ORDER BY sequence").all(e).map(jk)}recordTransition(e,t,r,a){this.controlPlane.database.run("INSERT INTO release_transitions (id, release_id, from_status, to_status, traffic_percent, health, message, operation_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",[this.id(),e,t??null,r,a.trafficPercent??null,JSON.stringify(s(a.health??{})),a.message.slice(0,1000),a.operationId??null,this.now().toISOString()])}progress(e,t){let r=this.get(e);if(!r)throw Error(`Release ${e} was not found`);return this.recordTransition(e,r.status,r.status,t),this.transitions(e).at(-1)}transition(e,t,r){let a=this.get(e);if(!a)throw Error(`Release ${e} was not found`);if(!{built:["awaiting_approval","activating","failed"],awaiting_approval:["built","failed"],activating:["active","failed","rolled_back"],active:["superseded","failed","rolled_back"],failed:["activating","rolled_back"],rolled_back:["activating"],superseded:["activating"]}[a.status].includes(t))throw Error(`Invalid release transition ${a.status} → ${t}`);let m=this.now().toISOString();if(t==="active"){let f=this.active(a.resourceId);if(f&&f.id!==e)this.controlPlane.database.run("UPDATE releases SET status='superseded', updated_at=? WHERE id=?",[m,f.id]),this.recordTransition(f.id,"active","superseded",{message:`Superseded by ${e}.`,operationId:r.operationId})}return this.controlPlane.database.run("UPDATE releases SET status=?, rollback_attempts=rollback_attempts+?, activated_at=CASE WHEN ?='active' THEN ? ELSE activated_at END, failed_at=CASE WHEN ?='failed' THEN ? ELSE failed_at END, updated_at=? WHERE id=?",[t,t==="rolled_back"?1:0,t,m,t,m,m,e]),this.recordTransition(e,a.status,t,r),this.get(e)}approve(e,t){let r=this.get(e);if(!r||r.status!=="awaiting_approval")throw Error("Release is not awaiting approval");let a=this.id(),l=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_approvals (id, release_id, environment_id, decision, actor_id, comment, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[a,e,r.environmentId,t.decision,t.actorId,t.comment?.slice(0,1000)??null,l]),this.transition(e,t.decision==="approved"?"built":"failed",{message:t.decision==="approved"?"Environment gate approved.":"Environment gate rejected."})}approvals(e){return this.controlPlane.database.query("SELECT * FROM release_approvals WHERE release_id=? ORDER BY created_at").all(e).map((t)=>({id:String(t.id),releaseId:String(t.release_id),environmentId:String(t.environment_id),decision:String(t.decision),actorId:String(t.actor_id),comment:Zn(t.comment),createdAt:String(t.created_at)}))}promote(e,t){let r=this.get(e);if(!r||!["active","superseded"].includes(r.status))throw Error("Only a tested active/superseded release can be promoted");return this.create({organizationId:r.organizationId,projectId:r.projectId,environmentId:t.targetEnvironmentId,resourceId:t.targetResourceId,artifactId:r.artifactId,kind:r.kind,sourceSha:r.sourceSha,config:t.config,manifest:r.manifest,provenance:r.provenance,strategy:t.strategy??r.strategy,healthGate:t.healthGate??r.healthGate,hooks:r.hooks,drainSeconds:r.drainSeconds,graceSeconds:r.graceSeconds,automaticRollback:r.automaticRollback,promotedFromReleaseId:r.id,actorId:t.actorId,trigger:"promotion",approvalRequired:t.approvalRequired})}compare(e,t){let r=this.get(e),a=this.get(t);if(!r||!a)throw Error("Both releases are required for comparison");return{artifactChanged:r.artifactId!==a.artifactId,sourceChanged:r.sourceSha!==a.sourceSha,configChanged:r.configHash!==a.configHash,manifestChanges:Bk(r.manifest,a.manifest),dataCaveat:a.hooks.migrations==="none"?"No database migration is recorded.":`Database hooks are ${a.hooks.migrations}; release rollback does not roll back data.`}}pin(e,t,r){if(!this.get(e))throw Error("Release was not found");return this.controlPlane.database.run("UPDATE releases SET pinned=?, pin_reason=?, updated_at=? WHERE id=?",[t?1:0,t?r?.slice(0,500)??"operator":null,this.now().toISOString(),e]),this.get(e)}retentionCandidates(e){let t=Math.max(1,Math.min(100,Math.floor(e.keepPerResource??10))),r=new Map;for(let a of this.list()){let l=r.get(a.resourceId)??[];l.push(a),r.set(a.resourceId,l)}return[...r.values()].flatMap((a)=>a.slice(t)).filter((a)=>new Date(a.createdAt)<e.before&&!a.pinned&&!["active","activating","awaiting_approval"].includes(a.status)&&!this.list().some((l)=>l.previousReleaseId===a.id&&["active","activating"].includes(l.status)))}}class Et{controlPlane;releases;queue;constructor(e){this.controlPlane=e;this.releases=new Xo(e),this.queue=new c(e)}enqueueActivation(e,t={}){let r=this.releases.get(e.id);if(!r)throw Error("Release was not found");if(!["built","failed","rolled_back","superseded"].includes(r.status))throw Error(`Release ${r.status} cannot be activated`);let a=t.action??"activate",l=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:`release.${a}`,idempotencyKey:`release:${r.id}:${a}:${r.rollbackAttempts}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:t.targetReleaseId??null},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:r.automaticRollback?2:1,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return this.releases.transition(r.id,"activating",{message:`${a} queued.`,operationId:l.id,trafficPercent:0}),l}completeHealthGate(e,t){let r=this.releases.get(e);if(!r||r.status!=="activating")throw Error("Release is not activating");if(t.healthy)return{release:this.releases.transition(r.id,"active",{message:t.message??"Health gate passed; activation completed.",operationId:t.operationId,trafficPercent:100,health:t.health})};let a=this.releases.transition(r.id,"failed",{message:t.message??"Health gate failed.",operationId:t.operationId,trafficPercent:0,health:t.health}),l=r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!r.automaticRollback||r.rollbackAttempts>=1||!l)return{release:a};let m=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"release.rollback",idempotencyKey:`release:${r.id}:automatic-rollback`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:l.id,automatic:!0},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return{release:a,rollbackOperation:m}}enqueueRollback(e,t={}){let r=this.releases.get(e.id);if(!r||r.status!=="active")throw Error("Only the active release can be rolled back");let a=t.targetReleaseId?this.releases.get(t.targetReleaseId):r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!a||a.resourceId!==r.resourceId||!["superseded","active"].includes(a.status))throw Error("Rollback requires a preserved prior release for the same resource");return this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:"release.rollback",idempotencyKey:`release:${r.id}:manual-rollback:${a.id}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:a.id,automatic:!1},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}}function Cf(e){if(e.strategy==="canary")return[5,25,50,100].map((t,r)=>({step:`canary-${t}`,trafficPercent:t,waitSeconds:r===3?e.drainSeconds:e.graceSeconds,requiresHealth:!0}));if(e.strategy==="blue_green")return[{step:"green-health",trafficPercent:0,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"traffic-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];if(e.strategy==="rolling")return[{step:"rolling-replacement",trafficPercent:50,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"rolling-complete",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];return[{step:"immutable-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!!e.healthGate}]}async function zl(e,t){if(t.release.artifactId!==t.artifact.id)throw Error("Release activation artifact identity changed");Zi({kind:t.release.kind,hasHealthGate:!!t.release.healthGate,replicas:Number(t.release.manifest?.replicas)||void 0},t.release.strategy);let r=e.capability(t);if(!r.supported)throw Error(`${t.release.strategy} is unavailable in ${e.name}: ${r.explanation}`);return e.activate({...t,transitions:Cf(t.release)})}async function Kl(e,t){if(!t.previous)throw Error("Rollback requires the preserved previous release");return e.rollback({...t,transitions:[{step:"rollback",trafficPercent:0,waitSeconds:t.release.drainSeconds,requiresHealth:!0}]})}var Ef=["release.activate","release.rollback"];function Mk(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function Wl(e){let t=new Et(e.store),r=async(a)=>{let l=Mk(a.operation.input),m=typeof l.releaseId==="string"?l.releaseId:"",f=t.releases.get(m);if(!f)throw Error(`Queued release ${m||"(missing)"} was not found`);if(f.projectId!==a.operation.projectId||f.environmentId!==a.operation.environmentId||f.resourceId!==a.operation.resourceId)throw Error("Queued release does not match the operation scope");let b=t.releases.getArtifact(f.artifactId);if(!b||b.digest!==t.releases.getArtifact(f.artifactId)?.digest)throw Error("Immutable release artifact is unavailable");let k=typeof l.targetReleaseId==="string"&&l.targetReleaseId?l.targetReleaseId:f.previousReleaseId,y=k?t.releases.get(k):void 0;if(y&&(y.resourceId!==f.resourceId||y.artifactId===f.artifactId&&y.id===f.id))throw Error("Rollback target does not match the release resource");let R=await e.resolveDriver(f);a.checkpoint("verify",`Verifying ${b.digest} and ${f.configHash} for ${R.name}.`),a.log(`Artifact ${b.digest}; source ${f.sourceSha??"not recorded"}; config ${f.configHash}.`,{stream:"system"}),a.throwIfCancellationRequested();let T;try{T=a.operation.kind==="release.rollback"?await Kl(R,{release:f,artifact:b,previous:y}):await zl(R,{release:f,artifact:b,previous:y})}catch(N){if(a.operation.kind==="release.activate"&&t.releases.get(f.id)?.status==="activating")t.completeHealthGate(f.id,{healthy:!1,operationId:a.operation.id,message:N instanceof Error?N.message:String(N)});throw N}for(let N of T.transitions)t.releases.progress(f.id,{message:`${a.operation.kind==="release.rollback"?"Rollback":"Activation"} traffic at ${N.trafficPercent}%.`,trafficPercent:N.trafficPercent,health:N.observed,operationId:a.operation.id}),a.log(`Traffic ${N.trafficPercent}%: ${N.healthy?"healthy":"unhealthy"}.`,{stream:N.healthy?"step":"stderr",step:"health"});if(a.checkpoint("health","Evaluating the provider health result."),!T.activated||!T.healthy){if(a.operation.kind==="release.activate"&&t.releases.get(f.id)?.status==="activating")t.completeHealthGate(f.id,{healthy:!1,operationId:a.operation.id,health:{resourceVersions:T.resourceVersions},message:T.error??"Provider health gate failed."});throw Error(T.error??`${R.name} reported an unhealthy release`)}if(a.operation.kind==="release.activate"&&f.healthGate?.name){if(!e.resolveHealthGate)throw t.completeHealthGate(f.id,{healthy:!1,operationId:a.operation.id,message:`Named health gate ${f.healthGate.name} is not available to this worker.`}),Error(`Named health gate ${f.healthGate.name} is unavailable`);a.checkpoint("named-health-gate",`Waiting on ${f.healthGate.name}.`);let N=await e.resolveHealthGate(f.healthGate.name,f);if(a.log(`${f.healthGate.name}: ${N.healthy?"healthy":"unhealthy"}${N.message?` — ${N.message}`:""}.`,{stream:N.healthy?"step":"stderr",step:"health"}),!N.healthy)throw t.completeHealthGate(f.id,{healthy:!1,operationId:a.operation.id,health:N.evidence,message:N.message??`Named health gate ${f.healthGate.name} failed.`}),Error(N.message??`Named health gate ${f.healthGate.name} failed`)}if(a.operation.kind==="release.rollback"){let N=t.releases.get(f.id);if(N.status!=="rolled_back")t.releases.transition(N.id,"rolled_back",{message:`Traffic restored through ${R.name}.`,operationId:a.operation.id,trafficPercent:0,health:{resourceVersions:T.resourceVersions}});if(y&&y.status!=="active"){let j=y.status==="activating"?y:t.releases.transition(y.id,"activating",{message:"Rollback target restoring traffic.",operationId:a.operation.id,trafficPercent:0});t.releases.transition(j.id,"active",{message:"Previous immutable release restored.",operationId:a.operation.id,trafficPercent:100,health:{resourceVersions:T.resourceVersions}})}}else t.completeHealthGate(f.id,{healthy:!0,operationId:a.operation.id,health:{providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions},message:"Provider activation and health gates completed."});return a.checkpoint("finalize","Persisted the terminal release state."),{releaseId:f.id,artifactDigest:b.digest,provider:R.name,providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions,status:t.releases.get(f.id).status}};return Object.fromEntries(Ef.map((a)=>[a,r]))}import{createCipheriv as Lk,createDecipheriv as Fk,createHash as uh,randomBytes as lp}from"node:crypto";var ph={github:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitlab:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},bitbucket:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitea:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!1,deployKeys:!0},generic_https:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!1},generic_ssh:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!0}};function Lt(e){return typeof e==="string"&&e?e:void 0}function yo(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function Xn(e){return JSON.stringify(s(e))}function ho(e){return uh("sha256").update(e).digest("hex")}function ah(e){let t=e.trim().replace(/\/$/,""),r=new URL(t.includes("://")?t:`https://${t}`);if(r.username||r.password||r.search||r.hash)throw Error("Source host cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(r.hostname)))throw Error("Source host must use HTTPS");return`${r.protocol}//${r.host}${r.pathname.replace(/\/$/,"")}`}function ch(e){let t=e.trim();if(t.length<2||t.length>80)throw Error("Connection name must contain 2-80 characters");return t}function up(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function dh(e){let t=e.trim()||".";if(t.startsWith("/")||t.split("/").includes("..")||/[\0\r\n]/.test(t))throw Error("Monorepo root must stay inside the repository");return t.replace(/^\.\//,"")||"."}function Bc(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Boolean))].slice(0,100)}function zk(e){let t=e.trim();if(/\r|\n/.test(t)||/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Clone URL cannot contain credentials or control characters");if(!/^(?:https?:\/\/|ssh:\/\/|git@[A-Za-z0-9.-]+:)/.test(t))throw Error("Clone URL must use HTTPS or SSH");return t}function Uk(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),owner:Lt(e.owner),authKind:String(e.auth_kind),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:Lt(e.credential_fingerprint),grantedScopes:yo(e.granted_scopes,[]),capabilities:yo(e.capabilities,ph[String(e.provider)]),status:String(e.status),healthMessage:Lt(e.health_message),lastTestedAt:Lt(e.last_tested_at),lastSyncedAt:Lt(e.last_synced_at),credentialExpiresAt:Lt(e.credential_expires_at),version:Number(e.version),createdByActorId:Lt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function pp(e){return{id:String(e.id),connectionId:String(e.connection_id),providerRepositoryId:String(e.provider_repository_id),fullName:String(e.full_name),cloneUrl:String(e.clone_url),defaultBranch:String(e.default_branch),visibility:String(e.visibility),archived:Number(e.archived)===1,metadata:yo(e.metadata,{}),syncedAt:String(e.synced_at)}}function lh(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Lt(e.environment_id),resourceId:Lt(e.resource_id),connectionId:String(e.connection_id),repositoryId:Lt(e.repository_id),repositoryFullName:String(e.repository_full_name),defaultBranch:String(e.default_branch),branchRule:Lt(e.branch_rule),tagRule:Lt(e.tag_rule),monorepoRoot:String(e.monorepo_root),includePaths:yo(e.include_paths,[]),excludePaths:yo(e.exclude_paths,[]),submodules:Number(e.submodules)===1,cloneDepth:e.clone_depth==null?void 0:Number(e.clone_depth),deployKeyId:Lt(e.deploy_key_id),autoDeploy:Number(e.auto_deploy)===1,pullRequestPreviews:Number(e.pull_request_previews)===1,status:String(e.status),disabledReason:Lt(e.disabled_reason),version:Number(e.version),createdByActorId:Lt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function gp(e){return{id:String(e.id),connectionId:String(e.connection_id),name:String(e.name),publicKey:String(e.public_key),publicKeyFingerprint:String(e.public_key_fingerprint),host:String(e.host),hostKey:String(e.host_key),hostKeyFingerprint:String(e.host_key_fingerprint),createdByActorId:Lt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function mp(e){return{id:String(e.id),connectionId:String(e.connection_id),repositoryId:Lt(e.repository_id),repositoryFullName:String(e.repository_full_name),providerWebhookId:Lt(e.provider_webhook_id),events:yo(e.events,[]),status:String(e.status),healthMessage:Lt(e.health_message),lastDeliveryAt:Lt(e.last_delivery_at),lastReconciledAt:Lt(e.last_reconciled_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function fp(e){return{id:String(e.id),connectionId:String(e.connection_id),webhookId:String(e.webhook_id),providerDeliveryId:String(e.provider_delivery_id),event:String(e.event),action:Lt(e.action),commitSha:Lt(e.commit_sha),signatureStatus:String(e.signature_status),status:String(e.status),payloadSummary:yo(e.payload_summary,{}),operationId:Lt(e.operation_id),error:Lt(e.error),receivedAt:String(e.received_at),processedAt:Lt(e.processed_at)}}class Yo{controlPlane;key;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.key=t.encryptionKey?uh("sha256").update(t.encryptionKey).digest():void 0,this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let t=lp(12),r=Lk("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted source credential is unavailable");let m=Fk("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}createConnection(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Source connection organization was not found");let t=this.now(),r=this.idFn(),a=e.credential?JSON.stringify(e.credential):void 0;return this.run(`INSERT INTO source_connections (id, organization_id, provider, name, host, owner, auth_kind, credential_ciphertext, credential_fingerprint, granted_scopes, capabilities, status, credential_expires_at, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)`,[r,e.organizationId,e.provider,ch(e.name),ah(e.host),e.owner?.trim()||null,e.authKind??(a?"access_token":"none"),a?this.encrypt(a):null,a?ho(a).slice(0,16):null,Xn([...new Set(e.grantedScopes??[])].sort()),Xn(ph[e.provider]),e.credentialExpiresAt??null,e.createdByActorId??null,t,t]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"source.connection.created",payload:{connectionId:r,provider:e.provider,host:ah(e.host),owner:e.owner??null,scopes:e.grantedScopes??[]}}),this.getConnection(r)}getConnection(e){let t=this.controlPlane.database.query("SELECT * FROM source_connections WHERE id = ?").get(e);return t?this.currentConnection(t):void 0}listConnections(e){return this.controlPlane.database.query("SELECT * FROM source_connections WHERE organization_id = ? ORDER BY name").all(e).map((t)=>this.currentConnection(t))}currentConnection(e){let t=Uk(e);if(t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime())return{...t,status:"expired",healthMessage:"Source credential expired; rotate it before deploying."};return t}getCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM source_connections WHERE id = ?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotateCredential(e,t,r={}){let a=this.getConnection(e);if(!a||a.status==="disconnected")throw Error("Active source connection was not found");let l=JSON.stringify(t);return this.run("UPDATE source_connections SET credential_ciphertext = ?, credential_fingerprint = ?, credential_expires_at = ?, status = 'pending', health_message = NULL, version = version + 1, updated_at = ? WHERE id = ?",[this.encrypt(l),ho(l).slice(0,16),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:r.actorId,type:"source.credential.rotated",payload:{connectionId:e,fingerprint:ho(l).slice(0,16),expiresAt:r.expiresAt??null}}),this.getConnection(e)}updateHealth(e,t){let r=this.getConnection(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");let a=this.now(),l=t.grantedScopes?[...new Set(t.grantedScopes.map((m)=>m.trim()).filter(Boolean))].sort():void 0;if(this.run("UPDATE source_connections SET status = ?, health_message = ?, granted_scopes = COALESCE(?, granted_scopes), last_tested_at = COALESCE(?, last_tested_at), last_synced_at = COALESCE(?, last_synced_at), version = version + 1, updated_at = ? WHERE id = ?",[t.status,t.message?.slice(0,1000)??null,l?Xn(l):null,t.tested?a:null,t.synced?a:null,a,e]),l&&JSON.stringify(l)!==JSON.stringify([...r.grantedScopes].sort()))this.controlPlane.appendEvent({organizationId:r.organizationId,type:"source.connection.scopes_updated",payload:{connectionId:e,grantedScopes:l}});return this.getConnection(e)}upsertRepository(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");let r=this.now(),a=this.controlPlane.database.query("SELECT id FROM source_repositories WHERE connection_id = ? AND provider_repository_id = ?").get(e.connectionId,e.providerRepositoryId),l=a?String(a.id):this.idFn();return this.run(`INSERT INTO source_repositories (id, connection_id, provider_repository_id, full_name, clone_url, default_branch, visibility, archived, metadata, synced_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(connection_id, provider_repository_id) DO UPDATE SET full_name=excluded.full_name, clone_url=excluded.clone_url, default_branch=excluded.default_branch, visibility=excluded.visibility, archived=excluded.archived, metadata=excluded.metadata, synced_at=excluded.synced_at`,[l,e.connectionId,e.providerRepositoryId,up(e.fullName),zk(e.cloneUrl),e.defaultBranch.trim()||"main",e.visibility,e.archived?1:0,Xn(e.metadata),r]),pp(this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(l))}listRepositories(e,t,r=100){let a=t?.trim().toLowerCase();return(a?this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? AND lower(full_name) LIKE ? ORDER BY full_name LIMIT ?").all(e,`%${a}%`,Math.min(500,r)):this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? ORDER BY full_name LIMIT ?").all(e,Math.min(500,r))).map(pp)}getRepository(e){let t=this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(e);return t?pp(t):void 0}createDeployKey(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status)||!t.capabilities.deployKeys)throw Error("An active deploy-key capable source connection is required");if(!/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/=]+/.test(e.publicKey.trim()))throw Error("A valid SSH public key is required");if(!/BEGIN (?:OPENSSH|RSA) PRIVATE KEY/.test(e.privateKey))throw Error("A valid SSH private key is required");if(!/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+)\s+[A-Za-z0-9+/=]+/.test(e.hostKey.trim()))throw Error("A pinned SSH host key is required");let r=this.idFn(),a=this.now(),l=`sha256:${ho(e.publicKey.trim())}`,m=`sha256:${ho(e.hostKey.trim())}`;return this.run("INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,ch(e.name),e.publicKey.trim(),l,this.encrypt(e.privateKey),e.host.trim().toLowerCase(),e.hostKey.trim(),m,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"source.deploy_key.created",payload:{connectionId:e.connectionId,deployKeyId:r,publicFingerprint:l,hostFingerprint:m}}),gp(this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(r))}getDeployKey(e){let t=this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(e);return t?gp(t):void 0}listDeployKeys(e){return this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE connection_id = ? ORDER BY name, created_at").all(e).map(gp)}revokeDeployKey(e,t){let r=this.getDeployKey(e),a=r?this.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Deploy key was not found");let l=this.listBindings({connectionId:a.id}).filter((f)=>f.deployKeyId===e),m=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_bindings SET deploy_key_id=NULL, status='disabled', auto_deploy=0, disabled_reason='Source deploy key was revoked', version=version+1, updated_at=? WHERE deploy_key_id=?",[m,e]),this.run("DELETE FROM source_deploy_keys WHERE id=?",[e])})(),this.controlPlane.appendEvent({organizationId:a.organizationId,actorId:t,type:"source.deploy_key.revoked",level:"warning",payload:{connectionId:a.id,deployKeyId:e,affectedBindingIds:l.map((f)=>f.id)}}),{affectedBindings:l}}getDeployPrivateKey(e){let t=this.controlPlane.database.query("SELECT private_key_ciphertext FROM source_deploy_keys WHERE id = ?").get(e);if(!t)throw Error("Deploy key was not found");return this.decrypt(String(t.private_key_ciphertext))}createBinding(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");if(e.deployKeyId&&this.getDeployKey(e.deployKeyId)?.connectionId!==t.id)throw Error("Deploy key does not belong to this connection");let r=this.idFn(),a=this.now();return this.run(`INSERT INTO source_bindings (id, project_id, environment_id, resource_id, connection_id, repository_id, repository_full_name, default_branch, branch_rule, tag_rule, monorepo_root, include_paths, exclude_paths, submodules, clone_depth, deploy_key_id, auto_deploy, pull_request_previews, status, created_by_actor_id, created_at, updated_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`,[r,e.projectId,e.environmentId??null,e.resourceId??null,e.connectionId,e.repositoryId??null,up(e.repositoryFullName),e.defaultBranch?.trim()||"main",e.branchRule?.trim()||null,e.tagRule?.trim()||null,dh(e.monorepoRoot??"."),Xn(Bc(e.includePaths)),Xn(Bc(e.excludePaths)),e.submodules?1:0,e.cloneDepth??null,e.deployKeyId??null,e.autoDeploy===!1?0:1,e.pullRequestPreviews===!1?0:1,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,projectId:e.projectId,actorId:e.actorId,type:"source.binding.created",payload:{bindingId:r,connectionId:e.connectionId,repository:e.repositoryFullName,branch:e.defaultBranch??"main"}}),this.getBinding(r)}getBinding(e){let t=this.controlPlane.database.query("SELECT * FROM source_bindings WHERE id = ?").get(e);return t?lh(t):void 0}listBindings(e={}){return this.controlPlane.database.query("SELECT * FROM source_bindings ORDER BY created_at DESC").all().map(lh).filter((r)=>(!e.connectionId||r.connectionId===e.connectionId)&&(!e.projectId||r.projectId===e.projectId)&&(!e.status||r.status===e.status))}updateBinding(e,t,r){let a=this.getBinding(e);if(!a||a.version!==t)throw Error(`Source binding ${e} changed since version ${t}`);let l=this.getConnection(a.connectionId);if((!l||["disconnected","expired"].includes(l.status))&&(r.status==="active"||r.autoDeploy===!0))throw Error("Rotate or reconnect the source credential before enabling this binding");if(r.deployKeyId&&this.getDeployKey(r.deployKeyId)?.connectionId!==a.connectionId)throw Error("Deploy key does not belong to this connection");let m=this.now();if(this.controlPlane.database.run("UPDATE source_bindings SET default_branch=?, branch_rule=?, tag_rule=?, monorepo_root=?, include_paths=?, exclude_paths=?, submodules=?, clone_depth=?, deploy_key_id=?, auto_deploy=?, pull_request_previews=?, status=?, disabled_reason=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.defaultBranch?.trim()||a.defaultBranch,r.branchRule===void 0?a.branchRule??null:r.branchRule.trim()||null,r.tagRule===void 0?a.tagRule??null:r.tagRule.trim()||null,r.monorepoRoot===void 0?a.monorepoRoot:dh(r.monorepoRoot),Xn(r.includePaths===void 0?a.includePaths:Bc(r.includePaths)),Xn(r.excludePaths===void 0?a.excludePaths:Bc(r.excludePaths)),r.submodules??a.submodules?1:0,r.cloneDepth===void 0?a.cloneDepth??null:r.cloneDepth,r.deployKeyId===void 0?a.deployKeyId??null:r.deployKeyId,r.autoDeploy??a.autoDeploy?1:0,r.pullRequestPreviews??a.pullRequestPreviews?1:0,r.status??a.status,r.disabledReason===void 0?a.disabledReason??null:r.disabledReason.slice(0,1000),m,e,t]).changes!==1)throw Error(`Source binding ${e} changed since version ${t}`);let b=this.getConnection(a.connectionId);return this.controlPlane.appendEvent({organizationId:b.organizationId,projectId:a.projectId,actorId:r.actorId,type:"source.binding.updated",payload:{bindingId:e,fromVersion:t,toVersion:t+1,status:r.status??a.status}}),this.getBinding(e)}createWebhook(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");let r=this.idFn(),a=this.now(),l=e.endpointToken??lp(24).toString("base64url"),m=e.secret??lp(32).toString("base64url"),f=[...new Set(e.events??["push","pull_request"])].filter((b)=>["push","pull_request"].includes(b));if(!f.length)throw Error("At least one supported webhook event is required");return this.run("INSERT INTO source_webhooks (id, connection_id, repository_id, repository_full_name, endpoint_token_hash, endpoint_token_ciphertext, secret_ciphertext, events, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)",[r,e.connectionId,e.repositoryId??null,up(e.repositoryFullName),ho(l),this.encrypt(l),this.encrypt(m),Xn(f),a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,type:"source.webhook.created",payload:{webhookId:r,connectionId:t.id,repository:e.repositoryFullName,events:f}}),{webhook:{...this.getWebhook(r),endpointToken:l},secret:m}}getWebhook(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE id = ?").get(e);return t?mp(t):void 0}getWebhookByEndpointToken(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE endpoint_token_hash = ?").get(ho(e));return t?mp(t):void 0}getWebhookSecret(e){let t=this.controlPlane.database.query("SELECT secret_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t)throw Error("Source webhook was not found");return this.decrypt(String(t.secret_ciphertext))}getWebhookEndpointToken(e){let t=this.controlPlane.database.query("SELECT endpoint_token_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t?.endpoint_token_ciphertext)throw Error("Source webhook endpoint token is unavailable");return this.decrypt(String(t.endpoint_token_ciphertext))}listWebhooks(e){return this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE connection_id = ? ORDER BY repository_full_name").all(e).map(mp)}updateWebhookState(e,t){let r=this.getWebhook(e);if(!r)throw Error("Source webhook was not found");let a=this.now();this.run("UPDATE source_webhooks SET provider_webhook_id=COALESCE(?, provider_webhook_id), status=?, health_message=?, last_reconciled_at=COALESCE(?, last_reconciled_at), updated_at=? WHERE id=?",[t.providerWebhookId??null,t.status,t.healthMessage?.slice(0,1000)??null,t.reconciled?a:null,a,e]);let l=this.getConnection(r.connectionId);if(l)this.controlPlane.appendEvent({organizationId:l.organizationId,type:"source.webhook.updated",payload:{webhookId:e,connectionId:l.id,repository:r.repositoryFullName,status:t.status,reconciled:t.reconciled??!1,providerWebhookId:t.providerWebhookId??r.providerWebhookId??null}});return this.getWebhook(e)}getDeliveryByProviderId(e,t){let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE connection_id = ? AND provider_delivery_id = ?").get(e,t);return r?fp(r):void 0}recordDelivery(e){let t=this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId);if(t)return{delivery:t,duplicate:!0};let r=this.idFn(),a=this.now();return this.controlPlane.database.transaction(()=>{this.run("INSERT INTO source_webhook_deliveries (id, connection_id, webhook_id, provider_delivery_id, event, action, commit_sha, signature_status, status, payload_summary, operation_id, error, received_at, processed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,e.webhookId,e.providerDeliveryId,e.event.slice(0,100),e.action?.slice(0,100)??null,e.commitSha?.slice(0,128)??null,e.signatureStatus,e.status,Xn(e.payloadSummary??{}),e.operationId??null,e.error?.slice(0,2000)??null,a,["enqueued","ignored","rejected","failed"].includes(e.status)?a:null]),this.run("UPDATE source_webhooks SET last_delivery_at=?, updated_at=? WHERE id=?",[a,a,e.webhookId])})(),{delivery:this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId),duplicate:!1}}updateDelivery(e,t){this.run("UPDATE source_webhook_deliveries SET status=?, operation_id=?, error=?, processed_at=? WHERE id=?",[t.status,t.operationId??null,t.error?.slice(0,2000)??null,this.now(),e]);let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE id = ?").get(e);if(!r)throw Error("Source webhook delivery was not found");return fp(r)}listDeliveries(e,t=100){return this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE webhook_id = ? ORDER BY received_at DESC LIMIT ?").all(e,Math.min(500,Math.max(1,t))).map(fp)}disconnectConnection(e,t){let r=this.getConnection(e);if(!r)throw Error("Source connection was not found");let a=this.listBindings({connectionId:e,status:"active"}),l=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_connections SET status='disconnected', credential_ciphertext=NULL, health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[l,e]),this.run("UPDATE source_bindings SET status='disabled', auto_deploy=0, disabled_reason='Source connection was disconnected', version=version+1, updated_at=? WHERE connection_id=? AND status='active'",[l,e]),this.run("UPDATE source_webhooks SET status='disabled', health_message='Source connection was disconnected', updated_at=? WHERE connection_id=?",[l,e])})(),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"source.connection.disconnected",level:"warning",payload:{connectionId:e,affectedBindingIds:a.map((m)=>m.id),affectedRepositories:a.map((m)=>m.repositoryFullName)}}),{connection:this.getConnection(e),affectedBindings:a}}}import{createSign as qk}from"node:crypto";class ir extends Error{status;retryAfterSeconds;constructor(e,t,r){super(e);this.status=t;this.retryAfterSeconds=r;this.name="SourceProviderError"}}var mh={repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0};function ji(e){let t=Number(e??"1");return Number.isInteger(t)&&t>0?t:1}function Mi(e){return Math.max(1,Math.min(100,e??50))}function Nn(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function tc(e){let t=new URL(e);if(t.username||t.password||t.protocol!=="https:")throw Error("Webhook endpoint must be credential-free HTTPS");return t.href}function gh(e){return Buffer.from(e).toString("base64url")}function Vk(e,t){if(!e.appId||!e.privateKey)throw Error("GitHub App credentials require appId and privateKey");let r=gh(JSON.stringify({alg:"RS256",typ:"JWT"})),a=Math.floor(t.getTime()/1000)-30,l=gh(JSON.stringify({iat:a,exp:a+540,iss:e.appId})),m=qk("RSA-SHA256");return m.update(`${r}.${l}`),m.end(),`${r}.${l}.${m.sign(e.privateKey).toString("base64url")}`}class rc{connection;credential;capabilities=mh;fetchFn;timeoutMs;nowFn;constructor(e,t,r={}){this.connection=e;this.credential=t;this.fetchFn=r.fetch??((a,l)=>globalThis.fetch(a,l)),this.timeoutMs=Math.max(100,r.timeoutMs??20000),this.nowFn=r.now??(()=>new Date)}async request(e,t={}){let r=new URL(`${this.apiRoot().replace(/\/$/,"")}/`),a=new URL(e.replace(/^\//,""),r);if(a.origin!==r.origin)throw Error("Provider pagination cannot leave the configured host");let l=new AbortController,m=setTimeout(()=>l.abort(),this.timeoutMs);try{let f=await this.fetchFn(a,{...t,redirect:"error",signal:l.signal,headers:{Accept:"application/json","User-Agent":"ts-cloud-source/1",...await this.authorization(),...t.headers}});if(!f.ok){let b=Number(f.headers.get("retry-after")??""),k=f.headers.get("x-request-id")??f.headers.get("x-github-request-id");throw new ir(`Source provider request failed (${f.status})${k?` [request ${k}]`:""}`,f.status,Number.isFinite(b)?b:void 0)}if(f.status===204)return{data:void 0,headers:f.headers};return{data:await f.json(),headers:f.headers}}catch(f){if(f instanceof ir)throw f;if(l.signal.aborted)throw new ir(`Source provider request exceeded ${this.timeoutMs}ms`);throw new ir(f instanceof Error?f.message.replace(/(?:token|password|secret)=[^\s&]+/gi,"$1=[REDACTED]"):"Source provider request failed")}finally{clearTimeout(m)}}async deleteWebhook(e,t){await this.request(this.webhookPath(e,t),{method:"DELETE"})}}class Jl extends rc{provider="github";installationToken;apiRoot(){return this.connection.host==="https://github.com"?"https://api.github.com":`${this.connection.host}/api/v3`}async authorization(){if(this.credential?.token)return{Authorization:`Bearer ${this.credential.token}`,"X-GitHub-Api-Version":"2022-11-28"};if(!this.credential?.installationId)return{};if(!this.installationToken||this.installationToken.expiresAt<this.nowFn().getTime()+60000){let e=Vk(this.credential,this.nowFn()),t=this.apiRoot().replace(/\/$/,""),r=new AbortController,a=setTimeout(()=>r.abort(),this.timeoutMs);try{let l=await this.fetchFn(`${t}/app/installations/${encodeURIComponent(this.credential.installationId)}/access_tokens`,{method:"POST",signal:r.signal,redirect:"error",headers:{Accept:"application/vnd.github+json",Authorization:`Bearer ${e}`,"X-GitHub-Api-Version":"2022-11-28","User-Agent":"ts-cloud-source/1"}});if(!l.ok)throw new ir(`GitHub App token refresh failed (${l.status})`,l.status);let m=await l.json();this.installationToken={value:m.token,expiresAt:new Date(m.expires_at).getTime()}}finally{clearTimeout(a)}}return{Authorization:`Bearer ${this.installationToken.value}`,"X-GitHub-Api-Version":"2022-11-28"}}async testConnection(){let e=this.credential?.installationId?"/installation/repositories?per_page=1":"/user",{data:t,headers:r}=await this.request(e);return{ok:!0,account:t.login??this.connection.owner,scopes:(r.get("x-oauth-scopes")??this.connection.grantedScopes.join(",")).split(",").map((a)=>a.trim()).filter(Boolean),message:"GitHub connection is healthy"}}async listRepositories(e={}){let t=Mi(e.limit),r=ji(e.cursor),a=this.credential?.installationId?`/installation/repositories?per_page=${t}&page=${r}`:`/user/repos?per_page=${t}&page=${r}&sort=updated`,{data:l}=await this.request(a),m=Array.isArray(l)?l:l.repositories;return{repositories:(e.search?m.filter((b)=>b.full_name.toLowerCase().includes(e.search.toLowerCase())):m).map((b)=>({providerRepositoryId:String(b.id),fullName:b.full_name,cloneUrl:b.clone_url,defaultBranch:b.default_branch||"main",visibility:b.visibility??(b.private?"private":"public"),archived:!!b.archived,metadata:{}})),nextCursor:m.length===t?String(r+1):void 0}}async refs(e,t,r={}){let a=Mi(r.limit),l=ji(r.cursor),{data:m}=await this.request(`/repos/${Nn(e)}/${t}?per_page=${a}&page=${l}`);return{refs:m.map((f)=>({name:f.name,commitSha:f.commit.sha,protected:f.protected})),nextCursor:m.length===a?String(l+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${Nn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events,url:e.config.url??""}}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:JSON.stringify({name:"web",active:!0,events:t.events,config:{url:tc(t.url),content_type:"json",secret:t.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:JSON.stringify({active:!0,events:r.events,config:{url:tc(r.url),content_type:"json",secret:r.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${Nn(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}class Xl extends rc{provider="gitlab";apiRoot(){return`${this.connection.host}/api/v4`}async authorization(){return this.credential?.token?{"PRIVATE-TOKEN":this.credential.token}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username,scopes:this.connection.grantedScopes,message:"GitLab connection is healthy"}}async listRepositories(e={}){let t=Mi(e.limit),r=ji(e.cursor),a=e.search?`&search=${encodeURIComponent(e.search)}`:"",{data:l,headers:m}=await this.request(`/projects?membership=true&simple=true&order_by=last_activity_at&per_page=${t}&page=${r}${a}`);return{repositories:l.map((f)=>({providerRepositoryId:String(f.id),fullName:f.path_with_namespace,cloneUrl:f.http_url_to_repo,defaultBranch:f.default_branch??"main",visibility:f.visibility??"unknown",archived:!!f.archived,metadata:{}})),nextCursor:m.get("x-next-page")||void 0}}async refs(e,t,r={}){let a=Mi(r.limit),l=ji(r.cursor),{data:m,headers:f}=await this.request(`/projects/${encodeURIComponent(Nn(e))}/repository/${t}?per_page=${a}&page=${l}`);return{refs:m.map((b)=>({name:b.name,commitSha:b.commit.id,protected:b.protected})),nextCursor:f.get("x-next-page")||void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/projects/${encodeURIComponent(Nn(e))}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:!0,events:[...e.push_events?["push"]:[],...e.merge_requests_events?["pull_request"]:[]],url:e.url}}body(e){return JSON.stringify({url:tc(e.url),token:e.secret,enable_ssl_verification:!0,push_events:e.events.includes("push"),merge_requests_events:e.events.includes("pull_request")})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="failure"||r.state==="error"?"failed":r.state;await this.request(`/projects/${encodeURIComponent(Nn(e))}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,target_url:r.url,description:r.description.slice(0,255),name:r.context??"ts-cloud/preview"})})}}class Yl extends rc{provider="bitbucket";apiRoot(){return this.connection.host==="https://bitbucket.org"?"https://api.bitbucket.org/2.0":`${this.connection.host}/2.0`}async authorization(){return this.credential?.token?{Authorization:`Bearer ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username??e.display_name,scopes:this.connection.grantedScopes,message:"Bitbucket connection is healthy"}}async listRepositories(e={}){if(!this.connection.owner)throw Error("Bitbucket repository discovery requires an owner/workspace");let t=ji(e.cursor),r=Mi(e.limit),a=e.search?`&q=name~%22${encodeURIComponent(e.search)}%22`:"",{data:l}=await this.request(`/repositories/${encodeURIComponent(this.connection.owner)}?pagelen=${r}&page=${t}${a}`);return{repositories:l.values.map((m)=>({providerRepositoryId:m.uuid,fullName:m.full_name,cloneUrl:m.links.clone.find((f)=>f.name==="https")?.href??m.links.clone[0]?.href??"",defaultBranch:m.mainbranch?.name??"main",visibility:m.is_private?"private":"public",archived:!1,metadata:{}})),nextCursor:l.next?String(t+1):void 0}}async refs(e,t,r={}){let a=ji(r.cursor),l=Mi(r.limit),{data:m}=await this.request(`/repositories/${Nn(e)}/refs/${t}?pagelen=${l}&page=${a}`);return{refs:m.values.map((f)=>({name:f.name,commitSha:f.target.hash})),nextCursor:m.next?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repositories/${Nn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:e.uuid,active:e.active,events:e.events.map((t)=>t.replace("repo:push","push").replace("pullrequest:","pull_request:")),url:e.url}}body(e){return JSON.stringify({description:"ts-cloud deploy",url:tc(e.url),active:!0,events:e.events.map((t)=>t==="push"?"repo:push":t.replace("pull_request:","pullrequest:"))})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.values.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="success"?"SUCCESSFUL":r.state==="pending"?"INPROGRESS":"FAILED";await this.request(`/repositories/${Nn(e)}/commit/${encodeURIComponent(t)}/statuses/build/ts-cloud-preview`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,key:"ts-cloud-preview",name:r.context??"ts-cloud/preview",url:r.url,description:r.description.slice(0,255)})})}}class Zl extends rc{provider="gitea";capabilities={...mh,tokenRefresh:!1};apiRoot(){return`${this.connection.host}/api/v1`}async authorization(){return this.credential?.token?{Authorization:`token ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.login,scopes:this.connection.grantedScopes,message:"Gitea connection is healthy"}}async listRepositories(e={}){let t=ji(e.cursor),r=Mi(e.limit),a=e.search?`/repos/search?q=${encodeURIComponent(e.search)}&limit=${r}&page=${t}`:`/user/repos?limit=${r}&page=${t}`,{data:l,headers:m}=await this.request(a),f=Array.isArray(l)?l:l.data;return{repositories:f.map((b)=>({providerRepositoryId:String(b.id),fullName:b.full_name,cloneUrl:b.clone_url,defaultBranch:b.default_branch??"main",visibility:b.private?"private":"public",archived:!!b.archived,metadata:{}})),nextCursor:m.get("x-hasmore")==="true"||f.length===r?String(t+1):void 0}}async refs(e,t,r={}){let a=ji(r.cursor),l=Mi(r.limit),{data:m}=await this.request(`/repos/${Nn(e)}/${t}?limit=${l}&page=${a}`);return{refs:m.map((f)=>({name:f.name,commitSha:f.commit.id})),nextCursor:m.length===l?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${Nn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events??[],url:e.config.url??""}}body(e){return JSON.stringify({type:"gitea",active:!0,events:e.events,config:{url:tc(e.url),content_type:"json",secret:e.secret,insecure_ssl:"0"}})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${Nn(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}function et(e,t,r={}){switch(e.provider){case"github":return new Jl(e,t,r);case"gitlab":return new Xl(e,t,r);case"bitbucket":return new Yl(e,t,r);case"gitea":return new Zl(e,t,r);default:throw Error(`${e.provider} uses bounded Git discovery instead of a hosted provider API`)}}import{createHmac as Wk,timingSafeEqual as Hk}from"node:crypto";function Hr(e,t){if(e instanceof Headers)return e.get(t)??void 0;return Object.entries(e).find(([a])=>a.toLowerCase()===t.toLowerCase())?.[1]}function fh(e,t){let r=Buffer.from(e),a=Buffer.from(t);return r.length===a.length&&Hk(r,a)}function Kk(e,t){return Wk("sha256",e).update(t).digest("hex")}function Jk(e,t,r,a,l){if(e==="gitlab")return fh(Hr(r,"x-gitlab-token")??"",t);let m=e==="github"?Hr(r,"x-hub-signature-256"):e==="gitea"?Hr(r,"x-gitea-signature"):Hr(r,"x-hub-signature")??Hr(r,"x-ts-cloud-signature");if(!m)return!1;if(e==="generic_https"||e==="generic_ssh"){let f=Number(Hr(r,"x-ts-cloud-timestamp"));if(!Number.isFinite(f)||Math.abs(l.getTime()-f*1000)>300000)return!1}return fh(m.replace(/^sha256=/,""),Kk(t,a))}function Gk(e,t){return{github:["x-github-delivery"],gitlab:["x-gitlab-event-uuid","x-request-id"],bitbucket:["x-request-uuid"],gitea:["x-gitea-delivery"],generic_https:["x-ts-cloud-delivery"],generic_ssh:["x-ts-cloud-delivery"]}[e].map((a)=>Hr(t,a)?.trim()).find(Boolean)}function zi(e){let t=String(e??"").trim().replace(/^\/+|\/+$/g,"");return/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t)?t:""}function hp(e){return[...new Set(e.flatMap((t)=>{if(!t||typeof t!=="object")return[];let r=t;return[...r.added??[],...r.modified??[],...r.removed??[]].map(String)}).filter((t)=>t&&!t.includes("\x00")).slice(0,500))]}function Ef(e,t,r){let a=e,l=t,m=r;if(a==="github"){let f=Hr(l,"x-github-event"),b=zi(m.repository?.full_name);if(f==="push")return{event:"push",repository:b,ref:String(m.ref??""),branch:String(m.ref??"").replace(/^refs\/heads\//,""),tag:String(m.ref??"").startsWith("refs/tags/")?String(m.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(m.after??m.head_commit?.id??""),changedPaths:hp(m.commits??[]),deleted:m.deleted===!0||/^0{40,64}$/.test(String(m.after??""))};if(f==="pull_request")return{event:"pull_request",action:String(m.action??""),repository:b,branch:String(m.pull_request?.head?.ref??""),commitSha:String(m.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(m.number)||void 0,fork:zi(m.pull_request?.head?.repo?.full_name)!==b}}if(a==="gitlab"){let f=String(m.object_kind??"").toLowerCase(),b=zi(m.project?.path_with_namespace);if(f==="push"||f==="tag_push")return{event:"push",repository:b,ref:String(m.ref??""),branch:String(m.ref??"").replace(/^refs\/heads\//,""),tag:f==="tag_push"?String(m.ref??"").replace(/^refs\/tags\//,""):void 0,commitSha:String(m.checkout_sha??m.after??""),changedPaths:hp(m.commits??[]),deleted:/^0{40,64}$/.test(String(m.after??""))};if(f==="merge_request")return{event:"pull_request",action:String(m.object_attributes?.action??m.object_attributes?.state??""),repository:b,branch:String(m.object_attributes?.source_branch??""),commitSha:String(m.object_attributes?.last_commit?.id??""),changedPaths:[],pullRequestNumber:Number(m.object_attributes?.iid)||void 0,fork:m.object_attributes?.source_project_id!==m.object_attributes?.target_project_id}}if(a==="bitbucket"){let f=Hr(l,"x-event-key")??"",b=zi(m.repository?.full_name);if(f==="repo:push"){let k=m.push?.changes?.[0]??{},y=k.new??k.old??{},R=k.new?.target??k.old?.target;return{event:"push",repository:b,ref:String(y.name??""),branch:y.type==="branch"?String(y.name):void 0,tag:y.type==="tag"?String(y.name):void 0,commitSha:String(R?.hash??""),changedPaths:[],deleted:k.closed===!0||k.new==null}}if(f.startsWith("pullrequest:"))return{event:"pull_request",action:f.replace("pullrequest:",""),repository:b,branch:String(m.pullrequest?.source?.branch?.name??""),commitSha:String(m.pullrequest?.source?.commit?.hash??""),changedPaths:[],pullRequestNumber:Number(m.pullrequest?.id)||void 0,fork:zi(m.pullrequest?.source?.repository?.full_name)!==b}}if(a==="gitea"){let f=Hr(l,"x-gitea-event"),b=zi(m.repository?.full_name);if(f==="push")return{event:"push",repository:b,ref:String(m.ref??""),branch:String(m.ref??"").replace(/^refs\/heads\//,""),tag:String(m.ref??"").startsWith("refs/tags/")?String(m.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(m.after??""),changedPaths:hp(m.commits??[]),deleted:m.deleted===!0||/^0{40,64}$/.test(String(m.after??""))};if(f==="pull_request")return{event:"pull_request",action:String(m.action??""),repository:b,branch:String(m.pull_request?.head?.ref??""),commitSha:String(m.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(m.number)||void 0,fork:zi(m.pull_request?.head?.repo?.full_name)!==b}}if(a==="generic_https"||a==="generic_ssh"){if(m.event!=="push"&&m.event!=="pull_request")return;return{event:m.event,action:typeof m.action==="string"?m.action:void 0,repository:zi(m.repository),ref:typeof m.ref==="string"?m.ref:void 0,branch:typeof m.branch==="string"?m.branch:void 0,tag:typeof m.tag==="string"?m.tag:void 0,commitSha:String(m.commitSha??""),changedPaths:Array.isArray(m.changedPaths)?m.changedPaths.map(String).slice(0,500):[],pullRequestNumber:Number(m.pullRequestNumber)||void 0,fork:m.fork===!0,deleted:m.deleted===!0}}return}function vs(e,t){let r="^";for(let a=0;a<t.length;a++){let l=t[a];if(l==="*"&&t[a+1]==="*")r+=".*",a++;else if(l==="*")r+="[^/]*";else if(l==="?")r+="[^/]";else r+=l.replace(/[|\\{}()[\]^$+?.]/g,"\\$&")}return new RegExp(`${r}$`).test(e)}function Qk(e,t){if(t.event==="pull_request")return e.pullRequestPreviews;if(!e.autoDeploy)return!1;if(t.tag)return!!e.tagRule&&vs(t.tag,e.tagRule);return vs(t.branch??"",e.branchRule??e.defaultBranch)}function Yk(e,t){if(!t.length)return!0;return t.filter((a)=>!e.excludePaths.some((l)=>vs(a,l))).some((a)=>!e.includePaths.length||e.includePaths.some((l)=>vs(a,l)))}function hh(e,t){return Hr(t,e==="github"?"x-github-event":e==="gitlab"?"x-gitlab-event":e==="bitbucket"?"x-event-key":e==="gitea"?"x-gitea-event":"x-ts-cloud-event")??"unknown"}function vo(){return{accepted:!1,duplicate:!1,status:"rejected",operations:[],message:"Webhook unavailable"}}async function eu(e){if(e.rawBody.byteLength>2097152)return vo();let t=e.sources.getWebhookByEndpointToken(e.endpointToken);if(!t||t.status==="disabled")return vo();let r=e.sources.getConnection(t.connectionId);if(!r||r.status==="disconnected"||r.status==="expired")return vo();let a=Gk(r.provider,e.headers);if(!a||a.length>200)return vo();if(!Jk(r.provider,e.sources.getWebhookSecret(t.id),e.headers,e.rawBody,e.now??new Date))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:hh(r.provider,e.headers),signatureStatus:Hr(e.headers,"x-hub-signature-256")||Hr(e.headers,"x-gitlab-token")||Hr(e.headers,"x-hub-signature")||Hr(e.headers,"x-gitea-signature")?"invalid":"missing",status:"rejected",error:"Webhook signature verification failed"}),vo();let m;try{m=JSON.parse(new TextDecoder().decode(e.rawBody))}catch{return vo()}let f=Ef(r.provider,e.headers,m);if(!f||!f.repository||!/^[a-f0-9]{7,64}$/i.test(f.commitSha))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:hh(r.provider,e.headers),signatureStatus:"verified",status:"rejected",error:"Unsupported or malformed source event"}),vo();let b=e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:f.event,action:f.action,commitSha:f.commitSha,signatureStatus:"verified",status:"accepted",payloadSummary:{repository:f.repository,ref:f.ref??null,branch:f.branch??null,tag:f.tag??null,commitSha:f.commitSha,pullRequestNumber:f.pullRequestNumber??null,changedPathCount:f.changedPaths.length}});if(b.duplicate&&b.delivery.status!=="accepted")return{accepted:!0,duplicate:!0,status:"duplicate",operations:[],message:"Delivery already processed"};let k=new Ve(e.controlPlane),y=e.sources.listBindings({connectionId:r.id,status:"active"}).filter((j)=>{if(j.repositoryFullName.toLowerCase()!==f.repository.toLowerCase()||!Yk(j,f.changedPaths))return!1;let U=j.resourceId?k.getDefinitionForResource(j.resourceId):void 0,q=f.event==="push"&&!!U?.branchRule&&!!f.branch&&vs(f.branch,U.branchRule);return Qk(j,f)||q});if(!y.length)return e.sources.updateDelivery(b.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:b.duplicate,status:"ignored",operations:[],message:"Verified event did not match an active deployment rule"};let R=new c(e.controlPlane),T=new Set(["closed","merged","declined"]),N=y.flatMap((j)=>{if(f.event==="push"&&j.resourceId&&f.branch){let q=k.getDefinitionForResource(j.resourceId);if(q?.branchRule&&vs(f.branch,q.branchRule)){let Y=k.findForBranch(q.id,f.repository,f.branch);if(f.deleted){if(!q.cleanupOnClose||!Y||Y.status==="destroyed")return[];let ie=R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${Y.id}:branch-delete:${a}`,correlationId:`preview:${Y.id}`,input:{previewId:Y.id,reason:"branch_deleted",source:{repository:f.repository,commitSha:f.commitSha,branch:f.branch}},lockKey:`preview:${Y.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(Y.id,"queued",{operationId:ie.id}),[ie]}let ee=k.upsert({definitionId:q.id,sourceProvider:r.provider,repository:f.repository,branch:f.branch,commitSha:f.commitSha});if(!ee.changed)return[];let le=ee.created?"preview.create":"preview.update",Z=R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:le,idempotencyKey:`preview:${ee.preview.id}:${f.commitSha}`,correlationId:`preview:${ee.preview.id}`,input:{previewId:ee.preview.id,source:{connectionId:r.id,bindingId:j.id,repository:f.repository,commitSha:f.commitSha,branch:f.branch,monorepoRoot:j.monorepoRoot,submodules:j.submodules,cloneDepth:j.cloneDepth??null}},lockKey:`preview:${ee.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(ee.preview.id,"queued",{operationId:Z.id}),[Z]}}if(f.event==="pull_request"&&j.resourceId&&f.pullRequestNumber){let q=k.getDefinitionForResource(j.resourceId);if(q){let Y=T.has(String(f.action??"").toLowerCase()),ee=k.findForPullRequest(q.id,f.repository,f.pullRequestNumber);if(Y){if(!q.cleanupOnClose||!ee||ee.status==="destroyed")return[];let le=R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${ee.id}:destroy:${a}`,correlationId:`preview:${ee.id}`,input:{previewId:ee.id,reason:"pull_request_closed",source:{repository:f.repository,commitSha:f.commitSha,branch:f.branch??null,pullRequestNumber:f.pullRequestNumber}},lockKey:`preview:${ee.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(ee.id,"queued",{operationId:le.id}),[le]}try{let le=k.upsert({definitionId:q.id,sourceProvider:r.provider,repository:f.repository,branch:f.branch??`pr-${f.pullRequestNumber}`,pullRequestNumber:f.pullRequestNumber,fork:f.fork,commitSha:f.commitSha});if(!le.changed)return[];let Z=le.created?"preview.create":"preview.update",ie=R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:Z,idempotencyKey:`preview:${le.preview.id}:${f.commitSha}`,correlationId:`preview:${le.preview.id}`,input:{previewId:le.preview.id,source:{connectionId:r.id,bindingId:j.id,repository:f.repository,commitSha:f.commitSha,branch:f.branch??null,pullRequestNumber:f.pullRequestNumber,fork:!!f.fork,monorepoRoot:j.monorepoRoot,submodules:j.submodules,cloneDepth:j.cloneDepth??null},inheritedSecretNames:le.inheritedSecrets},lockKey:`preview:${le.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(le.preview.id,"queued",{operationId:ie.id}),[ie]}catch(le){return e.controlPlane.appendEvent({projectId:j.projectId,resourceId:j.resourceId,type:"preview.rejected",level:"warning",payload:{repository:f.repository,pullRequestNumber:f.pullRequestNumber,fork:!!f.fork,reason:le instanceof Error?le.message:String(le)}}),[]}}}let U=f.event==="pull_request"?"deploy.preview":"deploy.source";return[R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:U,idempotencyKey:`source:${r.id}:${a}:${j.id}:${f.commitSha}`,correlationId:`source:${a}`,input:{source:{connectionId:r.id,bindingId:j.id,repository:f.repository,commitSha:f.commitSha,branch:f.branch??null,tag:f.tag??null,monorepoRoot:j.monorepoRoot,submodules:j.submodules,cloneDepth:j.cloneDepth??null},preview:f.event==="pull_request"?{number:f.pullRequestNumber??null,action:f.action??null}:null},lockKey:j.resourceId?`resource:${j.resourceId}`:`environment:${j.environmentId??j.projectId}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:f.event==="pull_request"?14:90}).operation]});if(!N.length)return e.sources.updateDelivery(b.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:b.duplicate,status:"ignored",operations:[],message:"Verified event required no preview lifecycle change"};return e.sources.updateDelivery(b.delivery.id,{status:"enqueued",operationId:N[0]?.id}),e.controlPlane.appendEvent({organizationId:r.organizationId,projectId:y[0]?.projectId,operationId:N[0]?.id,type:"source.webhook.enqueued",payload:{webhookId:t.id,deliveryId:b.delivery.id,repository:f.repository,commitSha:f.commitSha,operationIds:N.map((j)=>j.id)}}),{accepted:!0,duplicate:b.duplicate,status:"enqueued",operations:N,message:`${N.length} deployment operation${N.length===1?"":"s"} enqueued`}}function sr(e,t){if(!t.endpointToken)throw Error("The webhook endpoint token is only available at creation time");let r=new URL(e);if(r.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(r.hostname))throw Error("Webhook base URL must use HTTPS");return new URL(`/api/source/webhooks/${encodeURIComponent(t.endpointToken)}`,r).href}import{chmodSync as yh,mkdtempSync as Zk,rmSync as Xk,writeFileSync as vh}from"node:fs";import{tmpdir as eI}from"node:os";import{join as Mc,resolve as tI}from"node:path";function Sh(e,t){let r=e.trim();if(/\r|\n|\0/.test(r))throw Error("Git remote contains control characters");if(r.startsWith("https://")){let l=new URL(r);if(l.username||l.password||l.search||l.hash)throw Error("HTTPS Git remotes cannot contain credentials, queries, or fragments");return l.href}let a=r.startsWith("ssh://")?new URL(r).hostname:r.match(/^git@([A-Za-z0-9.-]+):/)?.[1];if(!a)throw Error("Git remote must use credential-free HTTPS or SSH");if(!t||t.host.toLowerCase()!==a.toLowerCase())throw Error("SSH Git remote requires a deploy key with a pinned key for the same host");return r}function rI(e,t,r){let a=e.replaceAll(t,"[REMOTE]").slice(0,4000);for(let l of[r?.token,r?.privateKey])if(l)a=a.replaceAll(l,"[REDACTED]");return a}function nI(e){let t={PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",GIT_TERMINAL_PROMPT:"0",GIT_CONFIG_NOSYSTEM:"1",GIT_OPTIONAL_LOCKS:"0"},r;if(e.credential?.token){let a=e.credential.username??"oauth2";t.GIT_CONFIG_COUNT="1",t.GIT_CONFIG_KEY_0="http.extraHeader",t.GIT_CONFIG_VALUE_0=`Authorization: Basic ${Buffer.from(`${a}:${e.credential.token}`).toString("base64")}`}if(e.deployKey){r=Zk(Mc(eI(),"ts-cloud-git-transport-"));let a=Mc(r,"key"),l=Mc(r,"known_hosts");vh(a,e.deployKey.privateKey,{mode:384}),vh(l,`${e.deployKey.host} ${e.deployKey.hostKey}
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)`,[r,e.projectId,e.environmentId??null,e.resourceId??null,e.connectionId,e.repositoryId??null,up(e.repositoryFullName),e.defaultBranch?.trim()||"main",e.branchRule?.trim()||null,e.tagRule?.trim()||null,dh(e.monorepoRoot??"."),Xn(Bc(e.includePaths)),Xn(Bc(e.excludePaths)),e.submodules?1:0,e.cloneDepth??null,e.deployKeyId??null,e.autoDeploy===!1?0:1,e.pullRequestPreviews===!1?0:1,e.actorId??null,a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,projectId:e.projectId,actorId:e.actorId,type:"source.binding.created",payload:{bindingId:r,connectionId:e.connectionId,repository:e.repositoryFullName,branch:e.defaultBranch??"main"}}),this.getBinding(r)}getBinding(e){let t=this.controlPlane.database.query("SELECT * FROM source_bindings WHERE id = ?").get(e);return t?lh(t):void 0}listBindings(e={}){return this.controlPlane.database.query("SELECT * FROM source_bindings ORDER BY created_at DESC").all().map(lh).filter((r)=>(!e.connectionId||r.connectionId===e.connectionId)&&(!e.projectId||r.projectId===e.projectId)&&(!e.status||r.status===e.status))}updateBinding(e,t,r){let a=this.getBinding(e);if(!a||a.version!==t)throw Error(`Source binding ${e} changed since version ${t}`);let l=this.getConnection(a.connectionId);if((!l||["disconnected","expired"].includes(l.status))&&(r.status==="active"||r.autoDeploy===!0))throw Error("Rotate or reconnect the source credential before enabling this binding");if(r.deployKeyId&&this.getDeployKey(r.deployKeyId)?.connectionId!==a.connectionId)throw Error("Deploy key does not belong to this connection");let m=this.now();if(this.controlPlane.database.run("UPDATE source_bindings SET default_branch=?, branch_rule=?, tag_rule=?, monorepo_root=?, include_paths=?, exclude_paths=?, submodules=?, clone_depth=?, deploy_key_id=?, auto_deploy=?, pull_request_previews=?, status=?, disabled_reason=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.defaultBranch?.trim()||a.defaultBranch,r.branchRule===void 0?a.branchRule??null:r.branchRule.trim()||null,r.tagRule===void 0?a.tagRule??null:r.tagRule.trim()||null,r.monorepoRoot===void 0?a.monorepoRoot:dh(r.monorepoRoot),Xn(r.includePaths===void 0?a.includePaths:Bc(r.includePaths)),Xn(r.excludePaths===void 0?a.excludePaths:Bc(r.excludePaths)),r.submodules??a.submodules?1:0,r.cloneDepth===void 0?a.cloneDepth??null:r.cloneDepth,r.deployKeyId===void 0?a.deployKeyId??null:r.deployKeyId,r.autoDeploy??a.autoDeploy?1:0,r.pullRequestPreviews??a.pullRequestPreviews?1:0,r.status??a.status,r.disabledReason===void 0?a.disabledReason??null:r.disabledReason.slice(0,1000),m,e,t]).changes!==1)throw Error(`Source binding ${e} changed since version ${t}`);let b=this.getConnection(a.connectionId);return this.controlPlane.appendEvent({organizationId:b.organizationId,projectId:a.projectId,actorId:r.actorId,type:"source.binding.updated",payload:{bindingId:e,fromVersion:t,toVersion:t+1,status:r.status??a.status}}),this.getBinding(e)}createWebhook(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");let r=this.idFn(),a=this.now(),l=e.endpointToken??lp(24).toString("base64url"),m=e.secret??lp(32).toString("base64url"),f=[...new Set(e.events??["push","pull_request"])].filter((b)=>["push","pull_request"].includes(b));if(!f.length)throw Error("At least one supported webhook event is required");return this.run("INSERT INTO source_webhooks (id, connection_id, repository_id, repository_full_name, endpoint_token_hash, endpoint_token_ciphertext, secret_ciphertext, events, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)",[r,e.connectionId,e.repositoryId??null,up(e.repositoryFullName),ho(l),this.encrypt(l),this.encrypt(m),Xn(f),a,a]),this.controlPlane.appendEvent({organizationId:t.organizationId,type:"source.webhook.created",payload:{webhookId:r,connectionId:t.id,repository:e.repositoryFullName,events:f}}),{webhook:{...this.getWebhook(r),endpointToken:l},secret:m}}getWebhook(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE id = ?").get(e);return t?mp(t):void 0}getWebhookByEndpointToken(e){let t=this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE endpoint_token_hash = ?").get(ho(e));return t?mp(t):void 0}getWebhookSecret(e){let t=this.controlPlane.database.query("SELECT secret_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t)throw Error("Source webhook was not found");return this.decrypt(String(t.secret_ciphertext))}getWebhookEndpointToken(e){let t=this.controlPlane.database.query("SELECT endpoint_token_ciphertext FROM source_webhooks WHERE id = ?").get(e);if(!t?.endpoint_token_ciphertext)throw Error("Source webhook endpoint token is unavailable");return this.decrypt(String(t.endpoint_token_ciphertext))}listWebhooks(e){return this.controlPlane.database.query("SELECT * FROM source_webhooks WHERE connection_id = ? ORDER BY repository_full_name").all(e).map(mp)}updateWebhookState(e,t){let r=this.getWebhook(e);if(!r)throw Error("Source webhook was not found");let a=this.now();this.run("UPDATE source_webhooks SET provider_webhook_id=COALESCE(?, provider_webhook_id), status=?, health_message=?, last_reconciled_at=COALESCE(?, last_reconciled_at), updated_at=? WHERE id=?",[t.providerWebhookId??null,t.status,t.healthMessage?.slice(0,1000)??null,t.reconciled?a:null,a,e]);let l=this.getConnection(r.connectionId);if(l)this.controlPlane.appendEvent({organizationId:l.organizationId,type:"source.webhook.updated",payload:{webhookId:e,connectionId:l.id,repository:r.repositoryFullName,status:t.status,reconciled:t.reconciled??!1,providerWebhookId:t.providerWebhookId??r.providerWebhookId??null}});return this.getWebhook(e)}getDeliveryByProviderId(e,t){let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE connection_id = ? AND provider_delivery_id = ?").get(e,t);return r?fp(r):void 0}recordDelivery(e){let t=this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId);if(t)return{delivery:t,duplicate:!0};let r=this.idFn(),a=this.now();return this.controlPlane.database.transaction(()=>{this.run("INSERT INTO source_webhook_deliveries (id, connection_id, webhook_id, provider_delivery_id, event, action, commit_sha, signature_status, status, payload_summary, operation_id, error, received_at, processed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,e.webhookId,e.providerDeliveryId,e.event.slice(0,100),e.action?.slice(0,100)??null,e.commitSha?.slice(0,128)??null,e.signatureStatus,e.status,Xn(e.payloadSummary??{}),e.operationId??null,e.error?.slice(0,2000)??null,a,["enqueued","ignored","rejected","failed"].includes(e.status)?a:null]),this.run("UPDATE source_webhooks SET last_delivery_at=?, updated_at=? WHERE id=?",[a,a,e.webhookId])})(),{delivery:this.getDeliveryByProviderId(e.connectionId,e.providerDeliveryId),duplicate:!1}}updateDelivery(e,t){this.run("UPDATE source_webhook_deliveries SET status=?, operation_id=?, error=?, processed_at=? WHERE id=?",[t.status,t.operationId??null,t.error?.slice(0,2000)??null,this.now(),e]);let r=this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE id = ?").get(e);if(!r)throw Error("Source webhook delivery was not found");return fp(r)}listDeliveries(e,t=100){return this.controlPlane.database.query("SELECT * FROM source_webhook_deliveries WHERE webhook_id = ? ORDER BY received_at DESC LIMIT ?").all(e,Math.min(500,Math.max(1,t))).map(fp)}disconnectConnection(e,t){let r=this.getConnection(e);if(!r)throw Error("Source connection was not found");let a=this.listBindings({connectionId:e,status:"active"}),l=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_connections SET status='disconnected', credential_ciphertext=NULL, health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[l,e]),this.run("UPDATE source_bindings SET status='disabled', auto_deploy=0, disabled_reason='Source connection was disconnected', version=version+1, updated_at=? WHERE connection_id=? AND status='active'",[l,e]),this.run("UPDATE source_webhooks SET status='disabled', health_message='Source connection was disconnected', updated_at=? WHERE connection_id=?",[l,e])})(),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"source.connection.disconnected",level:"warning",payload:{connectionId:e,affectedBindingIds:a.map((m)=>m.id),affectedRepositories:a.map((m)=>m.repositoryFullName)}}),{connection:this.getConnection(e),affectedBindings:a}}}import{createSign as qk}from"node:crypto";class ir extends Error{status;retryAfterSeconds;constructor(e,t,r){super(e);this.status=t;this.retryAfterSeconds=r;this.name="SourceProviderError"}}var mh={repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0};function ji(e){let t=Number(e??"1");return Number.isInteger(t)&&t>0?t:1}function Mi(e){return Math.max(1,Math.min(100,e??50))}function Nn(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function tc(e){let t=new URL(e);if(t.username||t.password||t.protocol!=="https:")throw Error("Webhook endpoint must be credential-free HTTPS");return t.href}function gh(e){return Buffer.from(e).toString("base64url")}function Vk(e,t){if(!e.appId||!e.privateKey)throw Error("GitHub App credentials require appId and privateKey");let r=gh(JSON.stringify({alg:"RS256",typ:"JWT"})),a=Math.floor(t.getTime()/1000)-30,l=gh(JSON.stringify({iat:a,exp:a+540,iss:e.appId})),m=qk("RSA-SHA256");return m.update(`${r}.${l}`),m.end(),`${r}.${l}.${m.sign(e.privateKey).toString("base64url")}`}class rc{connection;credential;capabilities=mh;fetchFn;timeoutMs;nowFn;constructor(e,t,r={}){this.connection=e;this.credential=t;this.fetchFn=r.fetch??((a,l)=>globalThis.fetch(a,l)),this.timeoutMs=Math.max(100,r.timeoutMs??20000),this.nowFn=r.now??(()=>new Date)}async request(e,t={}){let r=new URL(`${this.apiRoot().replace(/\/$/,"")}/`),a=new URL(e.replace(/^\//,""),r);if(a.origin!==r.origin)throw Error("Provider pagination cannot leave the configured host");let l=new AbortController,m=setTimeout(()=>l.abort(),this.timeoutMs);try{let f=await this.fetchFn(a,{...t,redirect:"error",signal:l.signal,headers:{Accept:"application/json","User-Agent":"ts-cloud-source/1",...await this.authorization(),...t.headers}});if(!f.ok){let b=Number(f.headers.get("retry-after")??""),k=f.headers.get("x-request-id")??f.headers.get("x-github-request-id");throw new ir(`Source provider request failed (${f.status})${k?` [request ${k}]`:""}`,f.status,Number.isFinite(b)?b:void 0)}if(f.status===204)return{data:void 0,headers:f.headers};return{data:await f.json(),headers:f.headers}}catch(f){if(f instanceof ir)throw f;if(l.signal.aborted)throw new ir(`Source provider request exceeded ${this.timeoutMs}ms`);throw new ir(f instanceof Error?f.message.replace(/(?:token|password|secret)=[^\s&]+/gi,"$1=[REDACTED]"):"Source provider request failed")}finally{clearTimeout(m)}}async deleteWebhook(e,t){await this.request(this.webhookPath(e,t),{method:"DELETE"})}}class Jl extends rc{provider="github";installationToken;apiRoot(){return this.connection.host==="https://github.com"?"https://api.github.com":`${this.connection.host}/api/v3`}async authorization(){if(this.credential?.token)return{Authorization:`Bearer ${this.credential.token}`,"X-GitHub-Api-Version":"2022-11-28"};if(!this.credential?.installationId)return{};if(!this.installationToken||this.installationToken.expiresAt<this.nowFn().getTime()+60000){let e=Vk(this.credential,this.nowFn()),t=this.apiRoot().replace(/\/$/,""),r=new AbortController,a=setTimeout(()=>r.abort(),this.timeoutMs);try{let l=await this.fetchFn(`${t}/app/installations/${encodeURIComponent(this.credential.installationId)}/access_tokens`,{method:"POST",signal:r.signal,redirect:"error",headers:{Accept:"application/vnd.github+json",Authorization:`Bearer ${e}`,"X-GitHub-Api-Version":"2022-11-28","User-Agent":"ts-cloud-source/1"}});if(!l.ok)throw new ir(`GitHub App token refresh failed (${l.status})`,l.status);let m=await l.json();this.installationToken={value:m.token,expiresAt:new Date(m.expires_at).getTime()}}finally{clearTimeout(a)}}return{Authorization:`Bearer ${this.installationToken.value}`,"X-GitHub-Api-Version":"2022-11-28"}}async testConnection(){let e=this.credential?.installationId?"/installation/repositories?per_page=1":"/user",{data:t,headers:r}=await this.request(e);return{ok:!0,account:t.login??this.connection.owner,scopes:(r.get("x-oauth-scopes")??this.connection.grantedScopes.join(",")).split(",").map((a)=>a.trim()).filter(Boolean),message:"GitHub connection is healthy"}}async listRepositories(e={}){let t=Mi(e.limit),r=ji(e.cursor),a=this.credential?.installationId?`/installation/repositories?per_page=${t}&page=${r}`:`/user/repos?per_page=${t}&page=${r}&sort=updated`,{data:l}=await this.request(a),m=Array.isArray(l)?l:l.repositories;return{repositories:(e.search?m.filter((b)=>b.full_name.toLowerCase().includes(e.search.toLowerCase())):m).map((b)=>({providerRepositoryId:String(b.id),fullName:b.full_name,cloneUrl:b.clone_url,defaultBranch:b.default_branch||"main",visibility:b.visibility??(b.private?"private":"public"),archived:!!b.archived,metadata:{}})),nextCursor:m.length===t?String(r+1):void 0}}async refs(e,t,r={}){let a=Mi(r.limit),l=ji(r.cursor),{data:m}=await this.request(`/repos/${Nn(e)}/${t}?per_page=${a}&page=${l}`);return{refs:m.map((f)=>({name:f.name,commitSha:f.commit.sha,protected:f.protected})),nextCursor:m.length===a?String(l+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${Nn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events,url:e.config.url??""}}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:JSON.stringify({name:"web",active:!0,events:t.events,config:{url:tc(t.url),content_type:"json",secret:t.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:JSON.stringify({active:!0,events:r.events,config:{url:tc(r.url),content_type:"json",secret:r.secret,insecure_ssl:"0"}}),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${Nn(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}class Xl extends rc{provider="gitlab";apiRoot(){return`${this.connection.host}/api/v4`}async authorization(){return this.credential?.token?{"PRIVATE-TOKEN":this.credential.token}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username,scopes:this.connection.grantedScopes,message:"GitLab connection is healthy"}}async listRepositories(e={}){let t=Mi(e.limit),r=ji(e.cursor),a=e.search?`&search=${encodeURIComponent(e.search)}`:"",{data:l,headers:m}=await this.request(`/projects?membership=true&simple=true&order_by=last_activity_at&per_page=${t}&page=${r}${a}`);return{repositories:l.map((f)=>({providerRepositoryId:String(f.id),fullName:f.path_with_namespace,cloneUrl:f.http_url_to_repo,defaultBranch:f.default_branch??"main",visibility:f.visibility??"unknown",archived:!!f.archived,metadata:{}})),nextCursor:m.get("x-next-page")||void 0}}async refs(e,t,r={}){let a=Mi(r.limit),l=ji(r.cursor),{data:m,headers:f}=await this.request(`/projects/${encodeURIComponent(Nn(e))}/repository/${t}?per_page=${a}&page=${l}`);return{refs:m.map((b)=>({name:b.name,commitSha:b.commit.id,protected:b.protected})),nextCursor:f.get("x-next-page")||void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/projects/${encodeURIComponent(Nn(e))}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:!0,events:[...e.push_events?["push"]:[],...e.merge_requests_events?["pull_request"]:[]],url:e.url}}body(e){return JSON.stringify({url:tc(e.url),token:e.secret,enable_ssl_verification:!0,push_events:e.events.includes("push"),merge_requests_events:e.events.includes("pull_request")})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="failure"||r.state==="error"?"failed":r.state;await this.request(`/projects/${encodeURIComponent(Nn(e))}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,target_url:r.url,description:r.description.slice(0,255),name:r.context??"ts-cloud/preview"})})}}class Yl extends rc{provider="bitbucket";apiRoot(){return this.connection.host==="https://bitbucket.org"?"https://api.bitbucket.org/2.0":`${this.connection.host}/2.0`}async authorization(){return this.credential?.token?{Authorization:`Bearer ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.username??e.display_name,scopes:this.connection.grantedScopes,message:"Bitbucket connection is healthy"}}async listRepositories(e={}){if(!this.connection.owner)throw Error("Bitbucket repository discovery requires an owner/workspace");let t=ji(e.cursor),r=Mi(e.limit),a=e.search?`&q=name~%22${encodeURIComponent(e.search)}%22`:"",{data:l}=await this.request(`/repositories/${encodeURIComponent(this.connection.owner)}?pagelen=${r}&page=${t}${a}`);return{repositories:l.values.map((m)=>({providerRepositoryId:m.uuid,fullName:m.full_name,cloneUrl:m.links.clone.find((f)=>f.name==="https")?.href??m.links.clone[0]?.href??"",defaultBranch:m.mainbranch?.name??"main",visibility:m.is_private?"private":"public",archived:!1,metadata:{}})),nextCursor:l.next?String(t+1):void 0}}async refs(e,t,r={}){let a=ji(r.cursor),l=Mi(r.limit),{data:m}=await this.request(`/repositories/${Nn(e)}/refs/${t}?pagelen=${l}&page=${a}`);return{refs:m.values.map((f)=>({name:f.name,commitSha:f.target.hash})),nextCursor:m.next?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repositories/${Nn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:e.uuid,active:e.active,events:e.events.map((t)=>t.replace("repo:push","push").replace("pullrequest:","pull_request:")),url:e.url}}body(e){return JSON.stringify({description:"ts-cloud deploy",url:tc(e.url),active:!0,events:e.events.map((t)=>t==="push"?"repo:push":t.replace("pull_request:","pullrequest:"))})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.values.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PUT",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){let a=r.state==="success"?"SUCCESSFUL":r.state==="pending"?"INPROGRESS":"FAILED";await this.request(`/repositories/${Nn(e)}/commit/${encodeURIComponent(t)}/statuses/build/ts-cloud-preview`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:a,key:"ts-cloud-preview",name:r.context??"ts-cloud/preview",url:r.url,description:r.description.slice(0,255)})})}}class Zl extends rc{provider="gitea";capabilities={...mh,tokenRefresh:!1};apiRoot(){return`${this.connection.host}/api/v1`}async authorization(){return this.credential?.token?{Authorization:`token ${this.credential.token}`}:{}}async testConnection(){let{data:e}=await this.request("/user");return{ok:!0,account:e.login,scopes:this.connection.grantedScopes,message:"Gitea connection is healthy"}}async listRepositories(e={}){let t=ji(e.cursor),r=Mi(e.limit),a=e.search?`/repos/search?q=${encodeURIComponent(e.search)}&limit=${r}&page=${t}`:`/user/repos?limit=${r}&page=${t}`,{data:l,headers:m}=await this.request(a),f=Array.isArray(l)?l:l.data;return{repositories:f.map((b)=>({providerRepositoryId:String(b.id),fullName:b.full_name,cloneUrl:b.clone_url,defaultBranch:b.default_branch??"main",visibility:b.private?"private":"public",archived:!!b.archived,metadata:{}})),nextCursor:m.get("x-hasmore")==="true"||f.length===r?String(t+1):void 0}}async refs(e,t,r={}){let a=ji(r.cursor),l=Mi(r.limit),{data:m}=await this.request(`/repos/${Nn(e)}/${t}?limit=${l}&page=${a}`);return{refs:m.map((f)=>({name:f.name,commitSha:f.commit.id})),nextCursor:m.length===l?String(a+1):void 0}}listBranches(e,t){return this.refs(e,"branches",t)}listTags(e,t){return this.refs(e,"tags",t)}webhookPath(e,t){return`/repos/${Nn(e)}/hooks${t?`/${encodeURIComponent(t)}`:""}`}hook(e){return{providerWebhookId:String(e.id),active:e.active,events:e.events??[],url:e.config.url??""}}body(e){return JSON.stringify({type:"gitea",active:!0,events:e.events,config:{url:tc(e.url),content_type:"json",secret:e.secret,insecure_ssl:"0"}})}async createWebhook(e,t){let{data:r}=await this.request(this.webhookPath(e),{method:"POST",body:this.body(t),headers:{"Content-Type":"application/json"}});return this.hook(r)}async listWebhooks(e){let{data:t}=await this.request(this.webhookPath(e));return t.map((r)=>this.hook(r))}async updateWebhook(e,t,r){let{data:a}=await this.request(this.webhookPath(e,t),{method:"PATCH",body:this.body(r),headers:{"Content-Type":"application/json"}});return this.hook(a)}async setCommitStatus(e,t,r){await this.request(`/repos/${Nn(e)}/statuses/${encodeURIComponent(t)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({state:r.state,target_url:r.url,description:r.description.slice(0,140),context:r.context??"ts-cloud/preview"})})}}function et(e,t,r={}){switch(e.provider){case"github":return new Jl(e,t,r);case"gitlab":return new Xl(e,t,r);case"bitbucket":return new Yl(e,t,r);case"gitea":return new Zl(e,t,r);default:throw Error(`${e.provider} uses bounded Git discovery instead of a hosted provider API`)}}import{createHmac as Wk,timingSafeEqual as Hk}from"node:crypto";function Hr(e,t){if(e instanceof Headers)return e.get(t)??void 0;return Object.entries(e).find(([a])=>a.toLowerCase()===t.toLowerCase())?.[1]}function fh(e,t){let r=Buffer.from(e),a=Buffer.from(t);return r.length===a.length&&Hk(r,a)}function Kk(e,t){return Wk("sha256",e).update(t).digest("hex")}function Jk(e,t,r,a,l){if(e==="gitlab")return fh(Hr(r,"x-gitlab-token")??"",t);let m=e==="github"?Hr(r,"x-hub-signature-256"):e==="gitea"?Hr(r,"x-gitea-signature"):Hr(r,"x-hub-signature")??Hr(r,"x-ts-cloud-signature");if(!m)return!1;if(e==="generic_https"||e==="generic_ssh"){let f=Number(Hr(r,"x-ts-cloud-timestamp"));if(!Number.isFinite(f)||Math.abs(l.getTime()-f*1000)>300000)return!1}return fh(m.replace(/^sha256=/,""),Kk(t,a))}function Gk(e,t){return{github:["x-github-delivery"],gitlab:["x-gitlab-event-uuid","x-request-id"],bitbucket:["x-request-uuid"],gitea:["x-gitea-delivery"],generic_https:["x-ts-cloud-delivery"],generic_ssh:["x-ts-cloud-delivery"]}[e].map((a)=>Hr(t,a)?.trim()).find(Boolean)}function zi(e){let t=String(e??"").trim().replace(/^\/+|\/+$/g,"");return/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t)?t:""}function hp(e){return[...new Set(e.flatMap((t)=>{if(!t||typeof t!=="object")return[];let r=t;return[...r.added??[],...r.modified??[],...r.removed??[]].map(String)}).filter((t)=>t&&!t.includes("\x00")).slice(0,500))]}function vf(e,t,r){let a=e,l=t,m=r;if(a==="github"){let f=Hr(l,"x-github-event"),b=zi(m.repository?.full_name);if(f==="push")return{event:"push",repository:b,ref:String(m.ref??""),branch:String(m.ref??"").replace(/^refs\/heads\//,""),tag:String(m.ref??"").startsWith("refs/tags/")?String(m.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(m.after??m.head_commit?.id??""),changedPaths:hp(m.commits??[]),deleted:m.deleted===!0||/^0{40,64}$/.test(String(m.after??""))};if(f==="pull_request")return{event:"pull_request",action:String(m.action??""),repository:b,branch:String(m.pull_request?.head?.ref??""),commitSha:String(m.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(m.number)||void 0,fork:zi(m.pull_request?.head?.repo?.full_name)!==b}}if(a==="gitlab"){let f=String(m.object_kind??"").toLowerCase(),b=zi(m.project?.path_with_namespace);if(f==="push"||f==="tag_push")return{event:"push",repository:b,ref:String(m.ref??""),branch:String(m.ref??"").replace(/^refs\/heads\//,""),tag:f==="tag_push"?String(m.ref??"").replace(/^refs\/tags\//,""):void 0,commitSha:String(m.checkout_sha??m.after??""),changedPaths:hp(m.commits??[]),deleted:/^0{40,64}$/.test(String(m.after??""))};if(f==="merge_request")return{event:"pull_request",action:String(m.object_attributes?.action??m.object_attributes?.state??""),repository:b,branch:String(m.object_attributes?.source_branch??""),commitSha:String(m.object_attributes?.last_commit?.id??""),changedPaths:[],pullRequestNumber:Number(m.object_attributes?.iid)||void 0,fork:m.object_attributes?.source_project_id!==m.object_attributes?.target_project_id}}if(a==="bitbucket"){let f=Hr(l,"x-event-key")??"",b=zi(m.repository?.full_name);if(f==="repo:push"){let k=m.push?.changes?.[0]??{},y=k.new??k.old??{},R=k.new?.target??k.old?.target;return{event:"push",repository:b,ref:String(y.name??""),branch:y.type==="branch"?String(y.name):void 0,tag:y.type==="tag"?String(y.name):void 0,commitSha:String(R?.hash??""),changedPaths:[],deleted:k.closed===!0||k.new==null}}if(f.startsWith("pullrequest:"))return{event:"pull_request",action:f.replace("pullrequest:",""),repository:b,branch:String(m.pullrequest?.source?.branch?.name??""),commitSha:String(m.pullrequest?.source?.commit?.hash??""),changedPaths:[],pullRequestNumber:Number(m.pullrequest?.id)||void 0,fork:zi(m.pullrequest?.source?.repository?.full_name)!==b}}if(a==="gitea"){let f=Hr(l,"x-gitea-event"),b=zi(m.repository?.full_name);if(f==="push")return{event:"push",repository:b,ref:String(m.ref??""),branch:String(m.ref??"").replace(/^refs\/heads\//,""),tag:String(m.ref??"").startsWith("refs/tags/")?String(m.ref).replace(/^refs\/tags\//,""):void 0,commitSha:String(m.after??""),changedPaths:hp(m.commits??[]),deleted:m.deleted===!0||/^0{40,64}$/.test(String(m.after??""))};if(f==="pull_request")return{event:"pull_request",action:String(m.action??""),repository:b,branch:String(m.pull_request?.head?.ref??""),commitSha:String(m.pull_request?.head?.sha??""),changedPaths:[],pullRequestNumber:Number(m.number)||void 0,fork:zi(m.pull_request?.head?.repo?.full_name)!==b}}if(a==="generic_https"||a==="generic_ssh"){if(m.event!=="push"&&m.event!=="pull_request")return;return{event:m.event,action:typeof m.action==="string"?m.action:void 0,repository:zi(m.repository),ref:typeof m.ref==="string"?m.ref:void 0,branch:typeof m.branch==="string"?m.branch:void 0,tag:typeof m.tag==="string"?m.tag:void 0,commitSha:String(m.commitSha??""),changedPaths:Array.isArray(m.changedPaths)?m.changedPaths.map(String).slice(0,500):[],pullRequestNumber:Number(m.pullRequestNumber)||void 0,fork:m.fork===!0,deleted:m.deleted===!0}}return}function vs(e,t){let r="^";for(let a=0;a<t.length;a++){let l=t[a];if(l==="*"&&t[a+1]==="*")r+=".*",a++;else if(l==="*")r+="[^/]*";else if(l==="?")r+="[^/]";else r+=l.replace(/[|\\{}()[\]^$+?.]/g,"\\$&")}return new RegExp(`${r}$`).test(e)}function Qk(e,t){if(t.event==="pull_request")return e.pullRequestPreviews;if(!e.autoDeploy)return!1;if(t.tag)return!!e.tagRule&&vs(t.tag,e.tagRule);return vs(t.branch??"",e.branchRule??e.defaultBranch)}function Yk(e,t){if(!t.length)return!0;return t.filter((a)=>!e.excludePaths.some((l)=>vs(a,l))).some((a)=>!e.includePaths.length||e.includePaths.some((l)=>vs(a,l)))}function hh(e,t){return Hr(t,e==="github"?"x-github-event":e==="gitlab"?"x-gitlab-event":e==="bitbucket"?"x-event-key":e==="gitea"?"x-gitea-event":"x-ts-cloud-event")??"unknown"}function vo(){return{accepted:!1,duplicate:!1,status:"rejected",operations:[],message:"Webhook unavailable"}}async function eu(e){if(e.rawBody.byteLength>2097152)return vo();let t=e.sources.getWebhookByEndpointToken(e.endpointToken);if(!t||t.status==="disabled")return vo();let r=e.sources.getConnection(t.connectionId);if(!r||r.status==="disconnected"||r.status==="expired")return vo();let a=Gk(r.provider,e.headers);if(!a||a.length>200)return vo();if(!Jk(r.provider,e.sources.getWebhookSecret(t.id),e.headers,e.rawBody,e.now??new Date))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:hh(r.provider,e.headers),signatureStatus:Hr(e.headers,"x-hub-signature-256")||Hr(e.headers,"x-gitlab-token")||Hr(e.headers,"x-hub-signature")||Hr(e.headers,"x-gitea-signature")?"invalid":"missing",status:"rejected",error:"Webhook signature verification failed"}),vo();let m;try{m=JSON.parse(new TextDecoder().decode(e.rawBody))}catch{return vo()}let f=vf(r.provider,e.headers,m);if(!f||!f.repository||!/^[a-f0-9]{7,64}$/i.test(f.commitSha))return e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:hh(r.provider,e.headers),signatureStatus:"verified",status:"rejected",error:"Unsupported or malformed source event"}),vo();let b=e.sources.recordDelivery({connectionId:r.id,webhookId:t.id,providerDeliveryId:a,event:f.event,action:f.action,commitSha:f.commitSha,signatureStatus:"verified",status:"accepted",payloadSummary:{repository:f.repository,ref:f.ref??null,branch:f.branch??null,tag:f.tag??null,commitSha:f.commitSha,pullRequestNumber:f.pullRequestNumber??null,changedPathCount:f.changedPaths.length}});if(b.duplicate&&b.delivery.status!=="accepted")return{accepted:!0,duplicate:!0,status:"duplicate",operations:[],message:"Delivery already processed"};let k=new Ve(e.controlPlane),y=e.sources.listBindings({connectionId:r.id,status:"active"}).filter((j)=>{if(j.repositoryFullName.toLowerCase()!==f.repository.toLowerCase()||!Yk(j,f.changedPaths))return!1;let U=j.resourceId?k.getDefinitionForResource(j.resourceId):void 0,q=f.event==="push"&&!!U?.branchRule&&!!f.branch&&vs(f.branch,U.branchRule);return Qk(j,f)||q});if(!y.length)return e.sources.updateDelivery(b.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:b.duplicate,status:"ignored",operations:[],message:"Verified event did not match an active deployment rule"};let R=new c(e.controlPlane),T=new Set(["closed","merged","declined"]),N=y.flatMap((j)=>{if(f.event==="push"&&j.resourceId&&f.branch){let q=k.getDefinitionForResource(j.resourceId);if(q?.branchRule&&vs(f.branch,q.branchRule)){let Y=k.findForBranch(q.id,f.repository,f.branch);if(f.deleted){if(!q.cleanupOnClose||!Y||Y.status==="destroyed")return[];let ie=R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${Y.id}:branch-delete:${a}`,correlationId:`preview:${Y.id}`,input:{previewId:Y.id,reason:"branch_deleted",source:{repository:f.repository,commitSha:f.commitSha,branch:f.branch}},lockKey:`preview:${Y.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(Y.id,"queued",{operationId:ie.id}),[ie]}let ee=k.upsert({definitionId:q.id,sourceProvider:r.provider,repository:f.repository,branch:f.branch,commitSha:f.commitSha});if(!ee.changed)return[];let le=ee.created?"preview.create":"preview.update",Z=R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:le,idempotencyKey:`preview:${ee.preview.id}:${f.commitSha}`,correlationId:`preview:${ee.preview.id}`,input:{previewId:ee.preview.id,source:{connectionId:r.id,bindingId:j.id,repository:f.repository,commitSha:f.commitSha,branch:f.branch,monorepoRoot:j.monorepoRoot,submodules:j.submodules,cloneDepth:j.cloneDepth??null}},lockKey:`preview:${ee.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(ee.preview.id,"queued",{operationId:Z.id}),[Z]}}if(f.event==="pull_request"&&j.resourceId&&f.pullRequestNumber){let q=k.getDefinitionForResource(j.resourceId);if(q){let Y=T.has(String(f.action??"").toLowerCase()),ee=k.findForPullRequest(q.id,f.repository,f.pullRequestNumber);if(Y){if(!q.cleanupOnClose||!ee||ee.status==="destroyed")return[];let le=R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:"preview.destroy",idempotencyKey:`preview:${ee.id}:destroy:${a}`,correlationId:`preview:${ee.id}`,input:{previewId:ee.id,reason:"pull_request_closed",source:{repository:f.repository,commitSha:f.commitSha,branch:f.branch??null,pullRequestNumber:f.pullRequestNumber}},lockKey:`preview:${ee.id}`,providerKey:r.provider,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(ee.id,"queued",{operationId:le.id}),[le]}try{let le=k.upsert({definitionId:q.id,sourceProvider:r.provider,repository:f.repository,branch:f.branch??`pr-${f.pullRequestNumber}`,pullRequestNumber:f.pullRequestNumber,fork:f.fork,commitSha:f.commitSha});if(!le.changed)return[];let Z=le.created?"preview.create":"preview.update",ie=R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:Z,idempotencyKey:`preview:${le.preview.id}:${f.commitSha}`,correlationId:`preview:${le.preview.id}`,input:{previewId:le.preview.id,source:{connectionId:r.id,bindingId:j.id,repository:f.repository,commitSha:f.commitSha,branch:f.branch??null,pullRequestNumber:f.pullRequestNumber,fork:!!f.fork,monorepoRoot:j.monorepoRoot,submodules:j.submodules,cloneDepth:j.cloneDepth??null},inheritedSecretNames:le.inheritedSecrets},lockKey:`preview:${le.preview.id}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return k.transition(le.preview.id,"queued",{operationId:ie.id}),[ie]}catch(le){return e.controlPlane.appendEvent({projectId:j.projectId,resourceId:j.resourceId,type:"preview.rejected",level:"warning",payload:{repository:f.repository,pullRequestNumber:f.pullRequestNumber,fork:!!f.fork,reason:le instanceof Error?le.message:String(le)}}),[]}}}let U=f.event==="pull_request"?"deploy.preview":"deploy.source";return[R.enqueue({projectId:j.projectId,environmentId:j.environmentId,resourceId:j.resourceId,kind:U,idempotencyKey:`source:${r.id}:${a}:${j.id}:${f.commitSha}`,correlationId:`source:${a}`,input:{source:{connectionId:r.id,bindingId:j.id,repository:f.repository,commitSha:f.commitSha,branch:f.branch??null,tag:f.tag??null,monorepoRoot:j.monorepoRoot,submodules:j.submodules,cloneDepth:j.cloneDepth??null},preview:f.event==="pull_request"?{number:f.pullRequestNumber??null,action:f.action??null}:null},lockKey:j.resourceId?`resource:${j.resourceId}`:`environment:${j.environmentId??j.projectId}`,providerKey:r.provider,buildSlot:!0,maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:f.event==="pull_request"?14:90}).operation]});if(!N.length)return e.sources.updateDelivery(b.delivery.id,{status:"ignored"}),{accepted:!0,duplicate:b.duplicate,status:"ignored",operations:[],message:"Verified event required no preview lifecycle change"};return e.sources.updateDelivery(b.delivery.id,{status:"enqueued",operationId:N[0]?.id}),e.controlPlane.appendEvent({organizationId:r.organizationId,projectId:y[0]?.projectId,operationId:N[0]?.id,type:"source.webhook.enqueued",payload:{webhookId:t.id,deliveryId:b.delivery.id,repository:f.repository,commitSha:f.commitSha,operationIds:N.map((j)=>j.id)}}),{accepted:!0,duplicate:b.duplicate,status:"enqueued",operations:N,message:`${N.length} deployment operation${N.length===1?"":"s"} enqueued`}}function sr(e,t){if(!t.endpointToken)throw Error("The webhook endpoint token is only available at creation time");let r=new URL(e);if(r.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(r.hostname))throw Error("Webhook base URL must use HTTPS");return new URL(`/api/source/webhooks/${encodeURIComponent(t.endpointToken)}`,r).href}import{chmodSync as yh,mkdtempSync as Zk,rmSync as Xk,writeFileSync as vh}from"node:fs";import{tmpdir as eI}from"node:os";import{join as Mc,resolve as tI}from"node:path";function Sh(e,t){let r=e.trim();if(/\r|\n|\0/.test(r))throw Error("Git remote contains control characters");if(r.startsWith("https://")){let l=new URL(r);if(l.username||l.password||l.search||l.hash)throw Error("HTTPS Git remotes cannot contain credentials, queries, or fragments");return l.href}let a=r.startsWith("ssh://")?new URL(r).hostname:r.match(/^git@([A-Za-z0-9.-]+):/)?.[1];if(!a)throw Error("Git remote must use credential-free HTTPS or SSH");if(!t||t.host.toLowerCase()!==a.toLowerCase())throw Error("SSH Git remote requires a deploy key with a pinned key for the same host");return r}function rI(e,t,r){let a=e.replaceAll(t,"[REMOTE]").slice(0,4000);for(let l of[r?.token,r?.privateKey])if(l)a=a.replaceAll(l,"[REDACTED]");return a}function nI(e){let t={PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",GIT_TERMINAL_PROMPT:"0",GIT_CONFIG_NOSYSTEM:"1",GIT_OPTIONAL_LOCKS:"0"},r;if(e.credential?.token){let a=e.credential.username??"oauth2";t.GIT_CONFIG_COUNT="1",t.GIT_CONFIG_KEY_0="http.extraHeader",t.GIT_CONFIG_VALUE_0=`Authorization: Basic ${Buffer.from(`${a}:${e.credential.token}`).toString("base64")}`}if(e.deployKey){r=Zk(Mc(eI(),"ts-cloud-git-transport-"));let a=Mc(r,"key"),l=Mc(r,"known_hosts");vh(a,e.deployKey.privateKey,{mode:384}),vh(l,`${e.deployKey.host} ${e.deployKey.hostKey}
 `,{mode:384}),yh(a,384),yh(l,384),t.GIT_SSH_COMMAND=`ssh -i ${a} -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=${l} -o GlobalKnownHostsFile=/dev/null -o BatchMode=yes`}return{env:t,cleanup:()=>{if(r)Xk(r,{recursive:!0,force:!0})}}}async function wo(e,t,r){let a=nI(r),l=Bun.spawn([r.executable??"git",...e],{stdout:"pipe",stderr:"pipe",env:a.env}),m=Math.max(100,r.timeoutMs??120000),f,b=new Promise((k,y)=>{f=setTimeout(()=>{l.kill(),y(Error(`Git operation exceeded ${m}ms`))},m)});try{let k=Promise.all([l.exited,new Response(l.stdout).text(),new Response(l.stderr).text()]),[y,R,T]=await Promise.race([k,b]);if(y!==0)throw Error(rI(T||`Git exited with ${y}`,t,r.credential));return R}finally{if(f)clearTimeout(f);a.cleanup()}}function bh(e,t){let r=new Map;for(let a of e.split(`
 `)){let l=a.trim().match(/^([a-f0-9]{40,64})\s+(.+)$/i);if(!l||!l[2].startsWith(t)||l[2].endsWith("^{}"))continue;let m=l[2].slice(t.length);r.set(m,{name:m,commitSha:l[1]})}return[...r.values()].sort((a,l)=>a.name.localeCompare(l.name))}async function Zo(e,t={}){let r=Sh(e,t.deployKey),a=await wo(["ls-remote","--heads","--tags","--",r],r,t);return{branches:bh(a,"refs/heads/"),tags:bh(a,"refs/tags/")}}async function ea(e,t={}){let r=Sh(e.remote,t.deployKey),a=tI(e.destination),l=e.ref?.trim()||e.binding.defaultBranch;if(!/^[A-Za-z0-9._/-]{1,255}$/.test(l)||l.startsWith("-")||l.includes(".."))throw Error("Git ref contains unsupported characters");let m=["clone","--no-tags","--single-branch","--branch",l],f=[...new Set(e.sparsePaths??[])];if(f.some((k)=>!k||k.startsWith("/")||k.split("/").includes("..")||/[\0\r\n]/.test(k)))throw Error("Sparse checkout paths must stay inside the repository");if(f.length)m.push("--filter=blob:none","--no-checkout");if(e.binding.cloneDepth)m.push("--depth",String(e.binding.cloneDepth));if(e.binding.submodules)m.push("--recurse-submodules","--shallow-submodules");if(m.push("--",r,a),await wo(m,r,t),f.length)await wo(["-C",a,"sparse-checkout","set","--cone","--",...f],r,t),await wo(["-C",a,"checkout","--force"],r,t);if(e.commitSha){if(!/^[a-f0-9]{40,64}$/i.test(e.commitSha))throw Error("Expected source commit must be an immutable 40-64 character SHA");await wo(["-C",a,"fetch","--no-tags","--depth","1","origin",e.commitSha],r,t),await wo(["-C",a,"checkout","--detach","--force",e.commitSha],r,t)}let b=(await wo(["-C",a,"rev-parse","HEAD"],r,t)).trim();if(!/^[a-f0-9]{40,64}$/i.test(b))throw Error("Git clone did not produce a valid commit SHA");if(e.commitSha&&b.toLowerCase()!==e.commitSha.toLowerCase())throw Error(`Git checkout resolved ${b} instead of the requested immutable commit`);return{directory:e.binding.monorepoRoot==="."?a:Mc(a,e.binding.monorepoRoot),commitSha:b}}function nc(e){return["github","gitlab","bitbucket","gitea"].includes(e)}async function ta(e,t,r){let a=e.getConnection(t);if(!a||["disconnected","expired"].includes(a.status))throw Error("Active source connection was not found");try{if(nc(a.provider)){let f=await et(a,e.getCredential(a.id)).testConnection();return e.updateHealth(a.id,{status:f.ok?"healthy":"degraded",message:f.message,tested:!0,grantedScopes:f.scopes})}let l=r?e.getRepository(r):e.listRepositories(a.id,void 0,1)[0];if(!l)return e.updateHealth(a.id,{status:"degraded",message:"Add a repository URL before testing this generic connection.",tested:!0});let m=a.provider==="generic_ssh"?e.listBindings({connectionId:a.id}).map((f)=>f.deployKeyId).filter(Boolean).map((f)=>e.getDeployKey(f)).find(Boolean):void 0;return await Zo(l.cloneUrl,{credential:e.getCredential(a.id),deployKey:m?{...m,privateKey:e.getDeployPrivateKey(m.id)}:void 0}),e.updateHealth(a.id,{status:"healthy",message:"Git repository access is healthy.",tested:!0})}catch(l){return e.updateHealth(a.id,{status:"degraded",message:l instanceof Error?l.message:"Connection test failed",tested:!0})}}async function es(e,t,r={}){let a=e.getConnection(t);if(!a||!nc(a.provider)||["disconnected","expired"].includes(a.status))throw Error("A hosted active source connection is required for repository discovery");let l=et(a,e.getCredential(a.id)),m=[],f;for(let b=0;b<Math.min(20,Math.max(1,r.maxPages??10));b++){let k=await l.listRepositories({cursor:f,search:r.search,limit:100});for(let y of k.repositories)m.push(e.upsertRepository({connectionId:a.id,...y}));if(f=k.nextCursor,!f)break}return e.updateHealth(a.id,{status:"healthy",message:`${m.length} repositories synchronized.`,synced:!0}),m}async function ts(e,t){let r=e.getConnection(t.connectionId);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");if(nc(r.provider)){let b=et(r,e.getCredential(r.id));return t.type==="tags"?b.listTags(t.repository,t):b.listBranches(t.repository,t)}let a=t.repositoryId?e.getRepository(t.repositoryId):e.listRepositories(r.id).find((b)=>b.fullName===t.repository);if(!a||a.connectionId!==r.id)throw Error("Generic repository metadata was not found");let l=t.deployKeyId?e.getDeployKey(t.deployKeyId):void 0;if(l&&l.connectionId!==r.id)throw Error("Deploy key does not belong to this connection");let m=await Zo(a.cloneUrl,{credential:e.getCredential(r.id),deployKey:l?{...l,privateKey:e.getDeployPrivateKey(l.id)}:void 0});return{refs:(t.type==="tags"?m.tags:m.branches).slice(0,Math.min(500,t.limit??100))}}async function dn(e,t,r){let a=e.getWebhook(t),l=a?e.getConnection(a.connectionId):void 0;if(!a||!l||["disconnected","expired"].includes(l.status))throw Error("Active source webhook was not found");let m=sr(r,{...a,endpointToken:e.getWebhookEndpointToken(a.id)});if(!nc(l.provider))return e.updateWebhookState(a.id,{status:"healthy",healthMessage:"Manual webhook endpoint is ready.",reconciled:!0});try{let f=et(l,e.getCredential(l.id)),b=e.getWebhookSecret(a.id),k=a.providerWebhookId?await f.updateWebhook(a.repositoryFullName,a.providerWebhookId,{url:m,secret:b,events:a.events}):await f.createWebhook(a.repositoryFullName,{url:m,secret:b,events:a.events});return e.updateWebhookState(a.id,{providerWebhookId:k.providerWebhookId,status:k.active?"healthy":"degraded",healthMessage:k.active?"Provider webhook is synchronized.":"Provider webhook exists but is inactive.",reconciled:!0})}catch(f){return e.updateWebhookState(a.id,{status:"degraded",healthMessage:f instanceof Error?f.message:"Webhook reconciliation failed",reconciled:!0})}}async function tu(e,t){let r=e.getWebhook(t),a=r?e.getConnection(r.connectionId):void 0;if(!r||!a)throw Error("Source webhook was not found");if(nc(a.provider)&&r.providerWebhookId&&!["disconnected","expired"].includes(a.status))await et(a,e.getCredential(a.id)).deleteWebhook(r.repositoryFullName,r.providerWebhookId);return e.updateWebhookState(r.id,{status:"disabled",healthMessage:"Webhook disabled."})}var rs="1.6.0";function ra(){let e={type:"object",required:["error"],properties:{error:{type:"object",required:["code","message","requestId"],properties:{code:{type:"string"},message:{type:"string"},requestId:{type:"string",format:"uuid"},details:{}}}}},t=(a)=>({type:"object",required:["data","page","requestId"],properties:{data:{type:"array",items:a},page:{type:"object",required:["hasMore"],properties:{nextCursor:{type:"string"},hasMore:{type:"boolean"}}},requestId:{type:"string",format:"uuid"}}}),r=(a)=>({"200":{description:"A stable cursor page.",content:{"application/json":{schema:t(a)}}},default:{$ref:"#/components/responses/Error"}});return{openapi:"3.1.0",info:{title:"ts-cloud API",version:rs,description:"Additive changes are released within v1. Breaking request or response changes require a new URL version."},servers:[{url:"/"}],security:[{bearerAuth:[]}],paths:{...Co(),"/api/v1/projects":{get:{operationId:"listProjects",summary:"List accessible projects",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Project"})}},"/api/v1/projects/{projectId}/environments":{get:{operationId:"listEnvironments",summary:"List accessible project environments",parameters:[{$ref:"#/components/parameters/ProjectId"},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Environment"})}},"/api/v1/services":{get:{operationId:"listServices",summary:"List accessible services",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{name:"environmentId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Service"})}},"/api/v1/source/connections":{get:{operationId:"listSourceConnections",summary:"List safe Git connection metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceConnection"})},post:{operationId:"createSourceConnection",summary:"Create an encrypted Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["provider","name","host"],properties:{provider:{type:"string",enum:["github","gitlab","bitbucket","gitea","generic_https","generic_ssh"]},name:{type:"string"},host:{type:"string",format:"uri"},token:{type:"string",writeOnly:!0},repositoryFullName:{type:"string"},repositoryUrl:{type:"string"}}}}}},responses:{"201":{description:"Encrypted connection created."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectSourceConnection",summary:"Preview or safely disconnect a Git connection",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["id"],properties:{id:{type:"string"},preview:{type:"boolean"}}}}}},responses:{"200":{description:"Impact preview or disconnected connection."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/repositories":{get:{operationId:"listSourceRepositories",summary:"List or synchronize granted repositories",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"sync",in:"query",schema:{type:"boolean"}},{name:"search",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/SourceRepository"})}},"/api/v1/source/refs":{get:{operationId:"listSourceRefs",summary:"List repository branches or tags",parameters:[{name:"connectionId",in:"query",required:!0,schema:{type:"string"}},{name:"repository",in:"query",required:!0,schema:{type:"string"}},{name:"repositoryId",in:"query",schema:{type:"string"}},{name:"type",in:"query",schema:{type:"string",enum:["branches","tags"]}}],responses:{"200":{description:"Provider reference page."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/bindings":{post:{operationId:"createSourceBinding",summary:"Bind a repository to an application",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/SourceBindingRequest"}}}},responses:{"201":{description:"Source binding created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/source/webhooks":{post:{operationId:"createSourceWebhook",summary:"Create and optionally reconcile a signed webhook",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["connectionId","repositoryFullName","baseUrl"],properties:{connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},baseUrl:{type:"string",format:"uri"},events:{type:"array",items:{type:"string",enum:["push","pull_request"]}},reconcile:{type:"boolean"}}}}}},responses:{"201":{description:"Webhook endpoint created; endpoint is revealed once."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-detections":{post:{operationId:"detectApplication",summary:"Detect bounded application build candidates",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["files"],properties:{files:{type:"array",maxItems:1e4,items:{$ref:"#/components/schemas/DetectionFile"}}}}}}},responses:{"200":{description:"Ranked detection candidates with evidence."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-plans":{post:{operationId:"planApplication",summary:"Validate and normalize an application manifest",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",required:["draft"],properties:{draft:{$ref:"#/components/schemas/ApplicationInput"},suppliedSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}}}}}},responses:{"200":{description:"Validated plan, config patch, capabilities, costs, and missing secret names."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-drafts":{get:{operationId:"listApplicationDrafts",summary:"List resumable secret-free drafts",parameters:[{name:"projectId",in:"query",required:!0,schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/ApplicationDraft"})},post:{operationId:"createApplicationDraft",summary:"Create a resumable application draft",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/ApplicationDraftCreateRequest"}}}},responses:{"201":{description:"Draft created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateApplicationDraft",summary:"Optimistically update a draft",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/ApplicationDraftCreateRequest"},{type:"object",required:["id","version","step"],properties:{id:{type:"string"},version:{type:"integer",minimum:1}}}]}}}},responses:{"200":{description:"Updated draft."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/applications":{post:{operationId:"createApplication",summary:"Confirm and queue an application plan",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["draftId","version","confirmEnvironment"],properties:{draftId:{type:"string"},version:{type:"integer",minimum:1},confirmEnvironment:{type:"string",description:"Exact target environment slug."}}}}}},responses:{"202":{description:"Application operation queued; identical requests replay safely."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/application-artifacts":{post:{operationId:"uploadApplicationArtifact",summary:"Inspect and store a bounded ZIP or TAR source artifact",parameters:[{name:"X-Project-Id",in:"header",required:!0,schema:{type:"string"}},{name:"X-Artifact-Filename",in:"header",required:!0,schema:{type:"string"}}],requestBody:{required:!0,content:{"application/octet-stream":{schema:{type:"string",format:"binary",maxLength:104857600}}}},responses:{"201":{description:"Deduplicated artifact metadata; archive contents are never executed."},"413":{$ref:"#/components/responses/Error"},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/registry-connections":{get:{operationId:"listRegistryConnections",summary:"List safe private-registry metadata",parameters:[{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/RegistryConnection"})},post:{operationId:"createRegistryConnection",summary:"Create an encrypted private-registry connection",requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/RegistryConnectionRequest"}}}},responses:{"201":{description:"Encrypted registry connection created."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateRegistryConnection",summary:"Test access or rotate write-only credentials",requestBody:{required:!0,content:{"application/json":{schema:{allOf:[{$ref:"#/components/schemas/RegistryConnectionRequest"},{type:"object",required:["id","action"],properties:{id:{type:"string"},action:{type:"string",enum:["test","rotate"]},image:{type:"string"}}}]}}}},responses:{"200":{description:"Safe connection health metadata."},default:{$ref:"#/components/responses/Error"}}},delete:{operationId:"disconnectRegistryConnection",summary:"Disconnect and erase registry credentials",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["id"],properties:{id:{type:"string"}}}}}},responses:{"200":{description:"Credentials erased and connection disconnected."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue":{get:{operationId:"listQueue",summary:"List authorized durable operations and blocking metadata",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"state",in:"query",schema:{type:"string",enum:["queued","running","succeeded","failed","cancelled","timed_out"]}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/QueueOperation"})}},"/api/v1/preview-definitions":{get:{operationId:"listPreviewDefinitions",summary:"List preview policies",responses:r({type:"object"})},post:{operationId:"createPreviewDefinition",summary:"Configure bounded preview policy",responses:{"200":{description:"Preview definition created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews":{get:{operationId:"listPreviews",summary:"List authorized persistent previews",responses:r({type:"object"})},post:{operationId:"createPreview",summary:"Create or update one immutable preview identity",responses:{"200":{description:"Preview deployment queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/destroy":{post:{operationId:"destroyPreview",summary:"Confirm tagged preview teardown",responses:{"200":{description:"Teardown queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/extend":{post:{operationId:"extendPreview",summary:"Extend preview TTL",responses:{"200":{description:"Expiry extended."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/{previewId}/rebuild":{post:{operationId:"rebuildPreview",summary:"Rebuild the exact recorded commit",responses:{"200":{description:"Rebuild queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/previews/cleanup":{post:{operationId:"cleanupPreviews",summary:"Dry-run or queue TTL/keep-count teardown",responses:{"200":{description:"Cleanup plan or operations."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-templates":{get:{operationId:"listComposeTemplates",summary:"List pinned verified application templates",responses:r({type:"object"})}},"/api/v1/compose-applications":{get:{operationId:"listComposeApplications",summary:"List authorized multi-service applications",responses:r({type:"object"})},post:{operationId:"createComposeApplication",summary:"Import Compose or materialize a template",responses:{"200":{description:"Editable normalized application."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/preview":{post:{operationId:"previewComposeApplication",summary:"Parse and diagnose Compose without mutation",responses:{"200":{description:"Normalized preview and actionable diagnostics."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/services":{get:{operationId:"listComposeServices",summary:"Inspect per-service desired and observed state",responses:{"200":{description:"Service topology and status."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/compose-applications/{applicationId}/{action}":{post:{operationId:"operateComposeApplication",summary:"Deploy, redeploy, start, stop, scale, or delete through the durable queue",responses:{"200":{description:"Scoped operation queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/release-artifacts":{post:{operationId:"createReleaseArtifact",summary:"Register a verified content-addressed artifact",responses:{"200":{description:"Artifact identity registered."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases":{get:{operationId:"listReleases",summary:"List unified authorized release history",responses:r({type:"object"})},post:{operationId:"createRelease",summary:"Create an immutable release from an existing artifact",responses:{"200":{description:"Release record created."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/capabilities":{get:{operationId:"getReleaseCapabilities",summary:"Explain supported strategies, capacity, cost, and rollback",responses:{"200":{description:"Provider-aware strategy capabilities."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}":{get:{operationId:"getRelease",summary:"Inspect provenance, approvals, health, and transitions",responses:{"200":{description:"Release detail."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/releases/{releaseId}/{action}":{post:{operationId:"operateRelease",summary:"Promote, approve, activate, roll back, report health, or pin",responses:{"200":{description:"Release lifecycle updated."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/settings":{get:{operationId:"getQueueSettings",summary:"Get effective concurrency limits",responses:{"200":{description:"Queue concurrency settings."},default:{$ref:"#/components/responses/Error"}}},patch:{operationId:"updateQueueSettings",summary:"Confirm and audit production concurrency changes",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm","concurrency"],properties:{confirm:{const:"update queue limits"},concurrency:{$ref:"#/components/schemas/QueueConcurrency"}}}}}},responses:{"200":{description:"Updated effective limits."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/queue/history":{delete:{operationId:"clearQueueHistory",summary:"Clear terminal jobs whose retention has elapsed",requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["confirm"],properties:{confirm:{const:"clear completed"},before:{type:"string",format:"date-time"},projectId:{type:"string"}}}}}},responses:{"200":{description:"Eligible history cleared with an audit event."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs":{get:{operationId:"listOperationLogs",summary:"Resume ordered sanitized operation logs from a cursor",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:{"200":{description:"Ordered log chunks and next cursor."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/logs/stream":{get:{operationId:"streamOperationLogs",summary:"Stream authorized operation logs with Last-Event-ID resume",parameters:[{$ref:"#/components/parameters/OperationId"},{name:"Last-Event-ID",in:"header",schema:{type:"integer",minimum:0}}],responses:{"200":{description:"Server-sent log and completion events.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/cancel":{post:{operationId:"cancelOperation",summary:"Cancel queued work or request cooperative running cancellation",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{content:{"application/json":{schema:{type:"object"}}}},responses:{"200":{description:"Cancellation state recorded."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations/{operationId}/retry":{post:{operationId:"retryOperation",summary:"Retry an allow-listed failure class within the attempt limit",parameters:[{$ref:"#/components/parameters/OperationId"}],requestBody:{required:!0,content:{"application/json":{schema:{type:"object",additionalProperties:!1,required:["errorClass"],properties:{errorClass:{type:"string"},delayMs:{type:"integer",minimum:0}}}}}},responses:{"200":{description:"Retry queued."},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/deployments":{post:{operationId:"createDeployment",summary:"Queue a deployment",parameters:[{name:"Idempotency-Key",in:"header",required:!0,schema:{type:"string",minLength:8,maxLength:128}}],requestBody:{required:!0,content:{"application/json":{schema:{$ref:"#/components/schemas/DeploymentRequest"}}}},responses:{"202":{description:"Queued operation.",content:{"application/json":{schema:{$ref:"#/components/schemas/OperationResponse"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/operations":{get:{operationId:"listOperations",summary:"List scoped operations",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{$ref:"#/components/parameters/Limit"},{$ref:"#/components/parameters/Cursor"}],responses:r({$ref:"#/components/schemas/Operation"})}},"/api/v1/events":{get:{operationId:"listEvents",summary:"List scoped audit events",parameters:[{name:"projectId",in:"query",schema:{type:"string"}},{name:"after",in:"query",schema:{type:"integer",minimum:0}},{$ref:"#/components/parameters/Limit"}],responses:r({$ref:"#/components/schemas/Event"})}},"/api/v1/events/stream":{get:{operationId:"streamEvents",summary:"Stream scoped audit events",responses:{"200":{description:"Authenticated server-sent event stream.",content:{"text/event-stream":{schema:{type:"string"}}}},default:{$ref:"#/components/responses/Error"}}}},"/api/v1/openapi.json":{get:{operationId:"getOpenApi",summary:"Get the OpenAPI contract",security:[],responses:{"200":{description:"OpenAPI 3.1 contract."}}}}},components:{securitySchemes:{bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"tsc_v1"}},parameters:{Limit:{name:"limit",in:"query",schema:{type:"integer",minimum:1,maximum:100,default:50}},Cursor:{name:"cursor",in:"query",schema:{type:"string"}},ProjectId:{name:"projectId",in:"path",required:!0,schema:{type:"string"}},OperationId:{name:"operationId",in:"path",required:!0,schema:{type:"string"}}},responses:{Error:{description:"Stable error envelope.",content:{"application/json":{schema:e}}}},schemas:{Project:{type:"object",required:["id","slug","name"],properties:{id:{type:"string"},slug:{type:"string"},name:{type:"string"},description:{type:"string"}}},Environment:{type:"object",required:["id","projectId","slug","name","kind"],properties:{id:{type:"string"},projectId:{type:"string"},slug:{type:"string"},name:{type:"string"},kind:{type:"string"},region:{type:"string"}}},Service:{type:"object",required:["id","projectId","kind","slug","name"],properties:{id:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},kind:{type:"string"},slug:{type:"string"},name:{type:"string"},metadata:{type:"object",additionalProperties:!0}}},SourceConnection:{type:"object",required:["id","provider","name","host","status","credentialConfigured"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},status:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},grantedScopes:{type:"array",items:{type:"string"}}}},SourceRepository:{type:"object",required:["id","connectionId","fullName","cloneUrl","defaultBranch"],properties:{id:{type:"string"},connectionId:{type:"string"},fullName:{type:"string"},cloneUrl:{type:"string"},defaultBranch:{type:"string"},visibility:{type:"string"},archived:{type:"boolean"}}},SourceBindingRequest:{type:"object",additionalProperties:!1,required:["projectId","connectionId","repositoryFullName"],properties:{projectId:{type:"string"},environmentId:{type:"string"},resourceId:{type:"string"},connectionId:{type:"string"},repositoryId:{type:"string"},repositoryFullName:{type:"string"},defaultBranch:{type:"string"},branchRule:{type:"string"},tagRule:{type:"string"},monorepoRoot:{type:"string"},includePaths:{type:"array",items:{type:"string"}},excludePaths:{type:"array",items:{type:"string"}},submodules:{type:"boolean"},cloneDepth:{type:"integer",minimum:1},deployKeyId:{type:"string"},autoDeploy:{type:"boolean"},pullRequestPreviews:{type:"boolean"}}},DetectionFile:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string"},size:{type:"integer",minimum:0},content:{type:"string",maxLength:262144}}},ApplicationInput:{type:"object",additionalProperties:!1,required:["schemaVersion","name","slug","projectId","environmentId","source","build","runtime"],properties:{schemaVersion:{const:1},name:{type:"string"},slug:{type:"string"},projectId:{type:"string"},environmentId:{type:"string"},source:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["git","local","artifact","image"]}},additionalProperties:!0},build:{type:"object",required:["kind"],properties:{kind:{type:"string",enum:["dockerfile","buildpack","static","server","serverless","prebuilt_image"]},secretNames:{type:"array",uniqueItems:!0,items:{type:"string"}}},additionalProperties:!0},runtime:{type:"object",required:["architecture","target"],properties:{architecture:{type:"string",enum:["x86_64","arm64"]},target:{type:"string",enum:["server","serverless","container"]},port:{type:"integer",minimum:1,maximum:65535},healthCheck:{type:"object",additionalProperties:!0}},additionalProperties:!0},environment:{type:"object",additionalProperties:{oneOf:[{type:"string"},{type:"object",additionalProperties:!1,required:["secretRef"],properties:{secretRef:{type:"string"}}}]}},requiredSecretNames:{type:"array",uniqueItems:!0,items:{type:"string"}},domain:{type:"object",properties:{hostname:{type:"string"},path:{type:"string"},tls:{type:"boolean"}}}}},ApplicationDraftCreateRequest:{type:"object",additionalProperties:!1,required:["projectId","draft"],properties:{projectId:{type:"string"},name:{type:"string"},draft:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string",enum:["source","build","runtime","environment","domain","review"]},suppliedSecretNames:{type:"array",uniqueItems:!0,description:"Names only; values must use the secrets boundary.",items:{type:"string"}}}},ApplicationDraft:{type:"object",required:["id","projectId","input","step","status","version"],properties:{id:{type:"string"},projectId:{type:"string"},input:{$ref:"#/components/schemas/ApplicationInput"},step:{type:"string"},suppliedSecretNames:{type:"array",items:{type:"string"}},status:{type:"string",enum:["draft","ready","applied"]},version:{type:"integer"},createdAt:{type:"string",format:"date-time"},updatedAt:{type:"string",format:"date-time"}}},RegistryConnectionRequest:{type:"object",properties:{provider:{type:"string",enum:["docker_hub","ghcr","ecr","gcr","generic"]},name:{type:"string"},host:{type:"string"},username:{type:"string",writeOnly:!0},password:{type:"string",writeOnly:!0},token:{type:"string",writeOnly:!0},credentialExpiresAt:{type:"string",format:"date-time"},expiresAt:{type:"string",format:"date-time"}}},RegistryConnection:{type:"object",required:["id","provider","name","host","credentialConfigured","status","version"],properties:{id:{type:"string"},provider:{type:"string"},name:{type:"string"},host:{type:"string"},credentialConfigured:{type:"boolean"},credentialFingerprint:{type:"string"},credentialExpiresAt:{type:"string",format:"date-time"},status:{type:"string",enum:["pending","healthy","degraded","expired","disconnected"]},healthMessage:{type:"string"},lastTestedAt:{type:"string",format:"date-time"},version:{type:"integer"}}},QueueConcurrency:{type:"object",additionalProperties:!1,properties:{project:{type:"integer",minimum:1,maximum:100},environment:{type:"integer",minimum:1,maximum:100},provider:{type:"integer",minimum:1,maximum:100},builds:{type:"integer",minimum:1,maximum:100}}},QueueOperation:{allOf:[{$ref:"#/components/schemas/Operation"},{type:"object",required:["queue"],properties:{queue:{type:"object",required:["maxAttempts","availableAt","timeoutSeconds","retryClasses","resumePolicy","cancellationMode","retentionUntil"],properties:{lockKey:{type:"string"},providerKey:{type:"string"},buildSlot:{type:"boolean"},maxAttempts:{type:"integer"},availableAt:{type:"string",format:"date-time"},timeoutSeconds:{type:"integer"},heartbeatAt:{type:"string",format:"date-time"},currentStep:{type:"string"},blockedReason:{type:"string"},retryClasses:{type:"array",items:{type:"string"}},resumePolicy:{type:"string",enum:["fail","requeue"]},cancellationMode:{type:"string",enum:["cooperative","provider_non_cancellable"]},retentionUntil:{type:"string",format:"date-time"}}},approximatePosition:{type:"object",properties:{ahead:{type:"integer"},precision:{const:"bounded"}}}}}]},DeploymentRequest:{type:"object",additionalProperties:!1,required:["projectId","environmentId"],properties:{projectId:{type:"string"},environmentId:{type:"string"},serviceId:{type:"string"},action:{type:"string",enum:["deploy","rollback"],default:"deploy"},revision:{type:"string"}}},Operation:{type:"object",required:["id","state","kind","correlationId","createdAt"],properties:{id:{type:"string"},state:{type:"string"},kind:{type:"string"},correlationId:{type:"string"},createdAt:{type:"string",format:"date-time"}}},OperationResponse:{type:"object",required:["operation","idempotentReplay","requestId"],properties:{operation:{$ref:"#/components/schemas/Operation"},idempotentReplay:{type:"boolean"},requestId:{type:"string",format:"uuid"}}},Event:{type:"object",required:["id","sequence","type","level","correlationId","createdAt"],properties:{id:{type:"string"},sequence:{type:"integer"},type:{type:"string"},level:{type:"string"},correlationId:{type:"string"},payload:{},createdAt:{type:"string",format:"date-time"}}}}}}}function oI(e){return Buffer.from(JSON.stringify(e)).toString("base64url")}function sI(e){if(!e)return;try{let t=JSON.parse(Buffer.from(e,"base64url").toString("utf8"));return t&&typeof t==="object"&&!Array.isArray(t)?t:void 0}catch{return}}function Kr(e,t,r,a=["createdAt","id"]){let l=Math.min(100,Math.max(1,Number(t.searchParams.get("limit"))||50)),m=sI(t.searchParams.get("cursor"));if(t.searchParams.has("cursor")&&!m)throw new i("invalid_cursor","The pagination cursor is invalid.",400);let f=0;if(m){let R=e.findIndex((T)=>a.every((N)=>T[N]===m[N]));if(R<0)throw new i("invalid_cursor","The pagination cursor is no longer available.",400);f=R+1}let b=e.slice(f,f+l),k=f+l<e.length,y=b.at(-1);return{data:b,page:{hasMore:k,nextCursor:k&&y?oI(Object.fromEntries(a.map((R)=>[R,y[R]]))):void 0},requestId:r}}function na(e){let t=new Li(e.controlPlane,e.identities),r=new c(e.controlPlane),a=new Fr(e.controlPlane),l=new Qr(e.controlPlane),m=new Et(e.controlPlane),f=e.spend?.store??new Ri(e.controlPlane,{now:e.now}),b={store:f,service:e.spend?.service??new Wt(f)},k=new Map,y=e.now??(()=>new Date),R=e.rateLimit??120,T=(j,U,q,Y={})=>new Response(JSON.stringify(j),{status:U,headers:{"content-type":"application/json; charset=utf-8","cache-control":"no-store","x-request-id":q,"x-api-version":rs,...Y}}),N=(j,U,q,Y,ee,le)=>T({error:{code:j,message:U,requestId:Y,details:ee}},q,Y,le);return async(j,U)=>{let q=new URL(j.url);if(!q.pathname.startsWith("/api/v1"))return;let Y=crypto.randomUUID();if(q.pathname==="/api/v1/openapi.json"&&j.method==="GET")return T(ra(),200,Y,{"cache-control":"public, max-age=300"});let ee=j.headers.get("authorization")??"",le=ee.startsWith("Bearer ")?ee.slice(7).trim():"",Z=le?e.identities.verifyToken(le,U):void 0;if(!Z)return N("unauthorized","A valid bearer token is required.",401,Y,void 0,{"www-authenticate":'Bearer realm="ts-cloud", error="invalid_token"'});let ie=k.get(Z.token.id),we=y().getTime(),Ee=!ie||we-ie.start>=60000?{start:we,count:0}:ie;Ee.count+=1,k.set(Z.token.id,Ee);let de=Math.max(0,R-Ee.count),je={"x-ratelimit-limit":String(R),"x-ratelimit-remaining":String(de),"x-ratelimit-reset":String(Math.ceil((Ee.start+60000)/1000))};if(Ee.count>R)return N("rate_limited","API rate limit exceeded.",429,Y,void 0,{...je,"retry-after":String(Math.max(1,Math.ceil((Ee.start+60000-we)/1000)))});try{let ne,Me=async()=>{let K=await j.text();if(K.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);try{return JSON.parse(K)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}},Je=/^\/api\/v1\/projects\/([^/]+)\/environments$/.exec(q.pathname),gt=/^\/api\/v1\/operations\/([^/]+)\/logs(?:\/(stream))?$/.exec(q.pathname),zt=/^\/api\/v1\/operations\/([^/]+)\/(cancel|retry)$/.exec(q.pathname),it=/^\/api\/v1\/previews\/([^/]+)\/(destroy|extend|rebuild)$/.exec(q.pathname),kt=/^\/api\/v1\/compose-applications\/([^/]+)\/(deploy|redeploy|start|stop|scale|delete)$/.exec(q.pathname),Ut=/^\/api\/v1\/compose-applications\/([^/]+)\/services$/.exec(q.pathname),dt=/^\/api\/v1\/releases\/([^/]+)\/(promote|approve|activate|rollback|health|pin)$/.exec(q.pathname);if(j.method==="GET"&&q.pathname==="/api/v1/projects")ne=Kr(t.listProjects(Z),q,Y);else if(j.method==="GET"&&Je)ne=Kr(t.listEnvironments(Z,decodeURIComponent(Je[1])),q,Y);else if(j.method==="GET"&&q.pathname==="/api/v1/services"){let K=q.searchParams.get("projectId");if(!K)throw new i("validation_error","projectId is required.",422);ne=Kr(t.listServices(Z,K,q.searchParams.get("environmentId")??void 0),q,Y)}else if(j.method==="GET"&&q.pathname==="/api/v1/operations")ne=Kr(t.listOperations(Z,q.searchParams.get("projectId")??void 0),q,Y);else if(j.method==="GET"&&q.pathname==="/api/v1/previews"){let K=q.searchParams.get("projectId")??void 0,ue=a.previews.listInstances({projectId:K}).filter((he)=>{try{return t.authorize(Z,"deployments:read",{type:"resource",id:he.resourceId}),!0}catch{return!1}}).map((he)=>({...he}));ne=Kr(ue,q,Y)}else if(j.method==="GET"&&q.pathname==="/api/v1/compose-templates")ne=Kr(Mr().map((K)=>({...K})),q,Y,["id","version"]);else if(j.method==="GET"&&q.pathname==="/api/v1/releases/capabilities"){let K=String(q.searchParams.get("kind")??"");ne={capabilities:cn({kind:K,hasHealthGate:q.searchParams.get("health")==="true",replicas:Number(q.searchParams.get("replicas"))||1}),requestId:Y}}else if(j.method==="GET"&&q.pathname==="/api/v1/releases"){let K=q.searchParams.get("projectId");if(!K)throw new i("validation_error","projectId is required.",422);t.authorize(Z,"project:read",{type:"project",id:K});let ue=m.releases.list({projectId:K,environmentId:q.searchParams.get("environmentId")??void 0,resourceId:q.searchParams.get("resourceId")??void 0}).filter((he)=>{try{return t.authorize(Z,"deployments:read",{type:"resource",id:he.resourceId}),!0}catch{return!1}}).map((he)=>({...he,artifact:m.releases.getArtifact(he.artifactId),transitions:m.releases.transitions(he.id),approvals:m.releases.approvals(he.id)}));ne=Kr(ue,q,Y)}else if(j.method==="POST"&&q.pathname==="/api/v1/release-artifacts"){let K=await Me();t.authorize(Z,"applications:manage",{type:"organization"}),ne={artifact:m.releases.registerArtifact({organizationId:Z.serviceAccount.organizationId,digest:String(K.digest??""),kind:String(K.kind??""),uri:String(K.uri??""),size:Number(K.size),mediaType:typeof K.mediaType==="string"?K.mediaType:void 0,provenance:K.provenance,attestation:K.attestation}),requestId:Y}}else if(j.method==="POST"&&q.pathname==="/api/v1/releases"){let K=await Me(),ue=String(K.resourceId??"");t.authorize(Z,"applications:manage",{type:"resource",id:ue}),ne={release:m.releases.create({organizationId:Z.serviceAccount.organizationId,projectId:String(K.projectId??""),environmentId:String(K.environmentId??""),resourceId:ue,artifactId:String(K.artifactId??""),kind:String(K.kind??""),sourceSha:typeof K.sourceSha==="string"?K.sourceSha:void 0,config:K.config??{},manifest:K.manifest??{},provenance:K.provenance,strategy:String(K.strategy??"atomic"),healthGate:K.healthGate,hooks:K.hooks,drainSeconds:Number(K.drainSeconds)||void 0,graceSeconds:Number(K.graceSeconds)||void 0,automaticRollback:K.automaticRollback!==!1,actorId:Z.actor.id,trigger:typeof K.trigger==="string"?K.trigger:"api",approvalRequired:K.approvalRequired===!0,replicas:Number(K.replicas)||void 0}),requestId:Y}}else if(j.method==="GET"&&/^\/api\/v1\/releases\/[^/]+$/.test(q.pathname)){let K=decodeURIComponent(q.pathname.split("/").at(-1)),ue=m.releases.get(K);if(!ue)throw new i("not_found","Release was not found.",404);t.authorize(Z,"deployments:read",{type:"resource",id:ue.resourceId}),ne={release:ue,artifact:m.releases.getArtifact(ue.artifactId),transitions:m.releases.transitions(K),approvals:m.releases.approvals(K),requestId:Y}}else if(j.method==="POST"&&dt){let K=m.releases.get(decodeURIComponent(dt[1]));if(!K)throw new i("not_found","Release was not found.",404);let ue=await Me(),he=dt[2];if(he==="promote"){let Te=String(ue.targetResourceId??"");t.authorize(Z,"deployments:create",{type:"resource",id:Te}),ne={release:m.releases.promote(K.id,{targetEnvironmentId:String(ue.targetEnvironmentId??""),targetResourceId:Te,config:ue.config??{},strategy:ue.strategy,healthGate:ue.healthGate,actorId:Z.actor.id,approvalRequired:ue.approvalRequired===!0}),requestId:Y}}else if(he==="approve")t.authorize(Z,"deployments:create",{type:"resource",id:K.resourceId}),ne={release:m.releases.approve(K.id,{actorId:Z.actor.id,decision:ue.decision==="rejected"?"rejected":"approved",comment:typeof ue.comment==="string"?ue.comment:void 0}),requestId:Y};else if(he==="activate")t.authorize(Z,"deployments:create",{type:"resource",id:K.resourceId}),ne={operation:t.operation(m.enqueueActivation(K,{actorId:Z.actor.id})),requestId:Y};else if(he==="rollback")t.authorize(Z,"deployments:create",{type:"resource",id:K.resourceId}),ne={operation:t.operation(m.enqueueRollback(K,{actorId:Z.actor.id,targetReleaseId:typeof ue.targetReleaseId==="string"?ue.targetReleaseId:void 0})),requestId:Y};else if(he==="health"){t.authorize(Z,"deployments:create",{type:"resource",id:K.resourceId});let Te=m.completeHealthGate(K.id,{healthy:ue.healthy===!0,operationId:typeof ue.operationId==="string"?ue.operationId:void 0,health:ue.health,message:typeof ue.message==="string"?ue.message:void 0});ne={release:Te.release,rollbackOperation:Te.rollbackOperation?t.operation(Te.rollbackOperation):void 0,requestId:Y}}else t.authorize(Z,"deployments:create",{type:"resource",id:K.resourceId}),ne={release:m.releases.pin(K.id,ue.pinned!==!1,typeof ue.reason==="string"?ue.reason:void 0),requestId:Y}}else if(j.method==="GET"&&q.pathname==="/api/v1/compose-applications"){let K=q.searchParams.get("projectId");if(!K)throw new i("validation_error","projectId is required.",422);t.authorize(Z,"project:read",{type:"project",id:K});let ue=l.applications.list({projectId:K,environmentId:q.searchParams.get("environmentId")??void 0}).filter((he)=>{try{return t.authorize(Z,"deployments:read",{type:"resource",id:he.resourceId}),!0}catch{return!1}}).map((he)=>({...he,services:l.applications.services(he.id)}));ne=Kr(ue,q,Y)}else if(j.method==="POST"&&q.pathname==="/api/v1/compose-applications/preview"){let K=await Me(),ue=String(K.projectId??"");t.authorize(Z,"project:read",{type:"project",id:ue}),ne={result:l.applications.preview(String(K.source??""),{name:String(K.name??""),slug:typeof K.slug==="string"?K.slug:void 0,projectId:ue,environmentId:String(K.environmentId??"")}),requestId:Y}}else if(j.method==="POST"&&q.pathname==="/api/v1/compose-applications"){let K=await Me(),ue=String(K.projectId??"");t.authorize(Z,"applications:manage",{type:"environment",id:String(K.environmentId??"")});let he={name:String(K.name??""),slug:typeof K.slug==="string"?K.slug:void 0,projectId:ue,environmentId:String(K.environmentId??""),createdByActorId:Z.actor.id},Te=typeof K.templateId==="string"?l.applications.fromTemplate(K.templateId,K.inputs&&typeof K.inputs==="object"&&!Array.isArray(K.inputs)?K.inputs:{},{...he,version:typeof K.templateVersion==="string"?K.templateVersion:void 0}):l.applications.import(String(K.source??""),he);ne={application:Te.application,diagnostics:Te.parsed.diagnostics,requestId:Y}}else if(j.method==="GET"&&Ut){let K=l.applications.get(decodeURIComponent(Ut[1]));if(!K)throw new i("not_found","Compose application was not found.",404);t.authorize(Z,"deployments:read",{type:"resource",id:K.resourceId}),ne={application:K,services:l.applications.services(K.id),requestId:Y}}else if(j.method==="POST"&&kt){let K=l.applications.get(decodeURIComponent(kt[1]));if(!K)throw new i("not_found","Compose application was not found.",404);let ue=kt[2],he=await Me();t.authorize(Z,ue==="delete"||ue==="stop"?"deployments:cancel":"deployments:create",{type:"resource",id:K.resourceId}),ne={operation:t.operation(l.enqueue(K,ue,{actorId:Z.actor.id,service:typeof he.service==="string"?he.service:void 0,replicas:Number.isFinite(Number(he.replicas))?Number(he.replicas):void 0,removeVolumes:he.removeVolumes===!0,confirmation:typeof he.confirm==="string"?he.confirm:void 0})),requestId:Y}}else if(j.method==="GET"&&q.pathname==="/api/v1/preview-definitions"){let K=q.searchParams.get("projectId");if(!K)throw new i("validation_error","projectId is required.",422);t.authorize(Z,"project:read",{type:"project",id:K}),ne=Kr(a.previews.listDefinitions(K).map((ue)=>({...ue})),q,Y)}else if(j.method==="POST"&&q.pathname==="/api/v1/preview-definitions"){let K=await Me();t.authorize(Z,"config:write",{type:"resource",id:String(K.resourceId??"")}),ne={definition:a.previews.createDefinition({...K,projectId:String(K.projectId??""),resourceId:String(K.resourceId??""),baseEnvironmentId:String(K.baseEnvironmentId??""),domainPattern:String(K.domainPattern??""),createdByActorId:Z.actor.id}),requestId:Y}}else if(j.method==="POST"&&q.pathname==="/api/v1/previews"){let K=await Me(),ue=a.previews.getDefinition(String(K.definitionId??""));if(!ue)throw new i("not_found","Preview definition was not found.",404);t.authorize(Z,"deployments:create",{type:"resource",id:ue.resourceId});let he=a.previews.upsert({definitionId:ue.id,sourceProvider:"api",repository:typeof K.repository==="string"?K.repository:"api",branch:String(K.branch??""),pullRequestNumber:Number(K.pullRequestNumber)||void 0,fork:K.fork===!0,commitSha:String(K.commitSha??""),createdByActorId:Z.actor.id});ne={preview:he.preview,operation:t.operation(a.enqueueDeploy(he.preview,{created:he.created,actorId:Z.actor.id})),requestId:Y}}else if(j.method==="POST"&&it){let K=a.previews.getInstance(decodeURIComponent(it[1]));if(!K)throw new i("not_found","Preview was not found.",404);let ue=await Me(),he=it[2];if(he==="destroy"){if(t.authorize(Z,"deployments:cancel",{type:"resource",id:K.resourceId}),ue.confirm!==K.name)throw new i("confirmation_required",`Type ${K.name} to confirm preview teardown.`,409);ne={operation:t.operation(a.enqueueDestroy(K,"api",Z.actor.id)),requestId:Y}}else if(he==="extend")t.authorize(Z,"deployments:create",{type:"resource",id:K.resourceId}),ne={preview:a.previews.extend(K.id,Number(ue.hours)),requestId:Y};else t.authorize(Z,"deployments:create",{type:"resource",id:K.resourceId}),ne={operation:t.operation(a.enqueueDeploy(K,{actorId:Z.actor.id,reason:"manual_rebuild"})),requestId:Y}}else if(j.method==="POST"&&q.pathname==="/api/v1/previews/cleanup"){t.authorize(Z,"automation:manage",{type:"organization"});let K=await Me();if(!K.dryRun&&K.confirm!=="cleanup previews")throw new i("confirmation_required","Type cleanup previews to confirm preview cleanup.",409);ne={...a.cleanup({dryRun:K.dryRun===!0,maxAgeHours:Number(K.maxAgeHours)||void 0,keepCount:Number(K.keepCount)||void 0,actorId:Z.actor.id}),requestId:Y}}else if(j.method==="GET"&&q.pathname==="/api/v1/queue"){let K=q.searchParams.get("projectId")??void 0,ue=q.searchParams.get("state"),he=r.list({projectId:K,state:["queued","running","succeeded","failed","cancelled","timed_out"].includes(ue)?ue:void 0,limit:500}).filter((Te)=>{let mt=Te.operation.resourceId?{type:"resource",id:Te.operation.resourceId}:Te.operation.environmentId?{type:"environment",id:Te.operation.environmentId}:Te.operation.projectId?{type:"project",id:Te.operation.projectId}:{type:"organization"};try{return t.authorize(Z,"deployments:read",mt),!0}catch{return!1}}).map((Te)=>({...t.operation(Te.operation),queue:Te.job,approximatePosition:Te.approximatePosition}));ne=Kr(he,q,Y)}else if(j.method==="GET"&&q.pathname==="/api/v1/queue/settings")t.authorize(Z,"deployments:read",Z.token.scope),ne={concurrency:r.limits,requestId:Y};else if(j.method==="PATCH"&&q.pathname==="/api/v1/queue/settings"){t.authorize(Z,"automation:manage",{type:"organization"});let K=await Me();if(K.confirm!=="update queue limits")throw new i("confirmation_required","Type update queue limits to confirm production concurrency changes.",409);ne={concurrency:r.configureConcurrency(K.concurrency??{},{organizationId:Z.serviceAccount.organizationId,actorId:Z.actor.id}),requestId:Y}}else if(j.method==="DELETE"&&q.pathname==="/api/v1/queue/history"){t.authorize(Z,"automation:manage",{type:"organization"});let K=await Me();if(K.confirm!=="clear completed")throw new i("confirmation_required","Type clear completed to confirm queue retention cleanup.",409);ne={deleted:r.clearCompleted({before:typeof K.before==="string"?K.before:void 0,actorId:Z.actor.id,projectId:typeof K.projectId==="string"?K.projectId:void 0}),requestId:Y}}else if(j.method==="GET"&&gt){let K=e.controlPlane.getOperation(decodeURIComponent(gt[1]));if(!K)throw new i("not_found","Operation was not found.",404);let ue=K.resourceId?{type:"resource",id:K.resourceId}:K.environmentId?{type:"environment",id:K.environmentId}:K.projectId?{type:"project",id:K.projectId}:{type:"organization"};t.authorize(Z,"deployments:read",ue);let he=j.headers.get("last-event-id")?.trim(),Te=Number(he||q.searchParams.get("after")||0);if(gt[2]==="stream"){let It=new TextEncoder,Ne=Te,ht,ut=!1,Ke=new ReadableStream({start(Br){let Mo=()=>{if(ut)return;if(!e.identities.verifyToken(le,U)){if(ut=!0,ht)clearInterval(ht);Br.close();return}let Qn=r.logs(K.id,{after:Ne,limit:500});for(let Kt of Qn)Ne=Kt.sequence,Br.enqueue(It.encode(`id: ${Kt.sequence}
 event: log
@@ -61,7 +61,7 @@ data: ${JSON.stringify(ut)}
 
 `));Te=setInterval(()=>{if(mt)return;let ut=e.identities.verifyToken(le,U);if(!ut){if(mt=!0,Te)clearInterval(Te);Ne.close();return}try{let Ke=t.listEvents(ut,q.searchParams.get("projectId")??void 0,he);for(let Br of Ke)ht(Br),he=Math.max(he,Number(Br.sequence));if(!Ke.length)Ne.enqueue(ue.encode(`: heartbeat ${Date.now()}
 
-`))}catch{if(mt=!0,Te)clearInterval(Te);Ne.close()}},1000),j.signal.addEventListener("abort",()=>{if(mt=!0,Te)clearInterval(Te);try{Ne.close()}catch{}},{once:!0})},cancel(){if(mt=!0,Te)clearInterval(Te)}});return new Response(It,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-store",connection:"keep-alive","x-accel-buffering":"no","x-request-id":Y,...je}})}ne=Kr(K,q,Y,["sequence","id"])}else if(j.method==="POST"&&q.pathname==="/api/v1/deployments"){let K=j.headers.get("idempotency-key")??"";if(!K)throw new i("idempotency_required","Idempotency-Key is required for deployment requests.",428);let ue=await j.text();if(ue.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);let he;try{he=JSON.parse(ue)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}if(!he||typeof he.projectId!=="string"||typeof he.environmentId!=="string"||he.action!==void 0&&!["deploy","rollback"].includes(he.action))throw new i("validation_error","projectId, environmentId, and a valid action are required.",422);let Te=t.createDeployment(Z,he,K);return T({operation:Te.operation,idempotentReplay:Te.replay,requestId:Y},202,Y,{...je,...Te.replay?{"idempotent-replayed":"true"}:{}})}else{let K=await bo({...b,authorization:t,now:y},Z,{method:j.method,url:q,body:Me});if(K===void 0)throw new i("not_found","API resource was not found.",404);ne=K}return T(ne,200,Y,je)}catch(ne){if(ne instanceof i)return N(ne.code,ne.message,ne.status,Y,ne.details,je);if(q.pathname.startsWith("/api/v1/source/")||q.pathname.startsWith("/api/v1/application")||q.pathname.startsWith("/api/v1/compose-")||q.pathname==="/api/v1/registry-connections")return N("validation_error",ne instanceof Error?ne.message:"Integration request could not be completed.",422,Y,void 0,je);return N("internal_error","The API request could not be completed.",500,Y,void 0,je)}}}import{createCipheriv as dI,createDecipheriv as lI,createHash as Rh,randomBytes as ci}from"node:crypto";import{createHmac as aI,timingSafeEqual as cI}from"node:crypto";var yp="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Ji(e){let t=0,r=0,a="";for(let l of e){r=r<<8|l,t+=8;while(t>=5)a+=yp[r>>>t-5&31],t-=5}if(t>0)a+=yp[r<<5-t&31];return a}function $l(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,a=0,l=[];for(let m of t){let f=yp.indexOf(m);if(f<0)throw Error("Invalid base32 secret");if(a=a<<5|f,r+=5,r>=8)l.push(a>>>r-8&255),r-=8}return Buffer.from(l)}function qo(e,t,r=6){let a=Buffer.alloc(8);a.writeBigUInt64BE(BigInt(t));let l=aI("sha1",$l(e)).update(a).digest(),m=l[l.length-1]&15,f=(l[m]&127)<<24|(l[m+1]&255)<<16|(l[m+2]&255)<<8|l[m+3]&255;return String(f%10**r).padStart(r,"0")}function yf(e,t=Date.now(),r=30){return qo(e,Math.floor(t/1000/r))}function Sf(e,t,r=Date.now(),a=1){return on(e,t,r,a)!==void 0}function on(e,t,r=Date.now(),a=1){let l=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(l))return;let m=Buffer.from(l),f=Math.floor(r/1000/30);for(let b=-a;b<=a;b++){if(f+b<0)continue;let k=Buffer.from(qo(e,f+b));if(m.length===k.length&&cI(m,k))return f+b}return}function jo(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var Ml=1800000,Ye=43200000,Fl=3600000,Ul=300000,Ql=600000;function Pn(e){return typeof e==="string"?e:void 0}function Ah(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function uI(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function vp(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function pI(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function gI(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function mI(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function fI(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function qn(e){return Rh("sha256").update(e).digest("hex")}function ic(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:Pn(e.email),emailVerifiedAt:Pn(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:Pn(e.disabled_at),lastLoginAt:Pn(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function wh(e,t){let r=Pn(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Ah(e.metadata),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function bp(e,t){let r=Pn(e.revoked_at),a=String(e.idle_expires_at),l=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:Pn(e.user_agent),networkHint:Pn(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:a,absoluteExpiresAt:l,recentAuthAt:String(e.recent_auth_at),mfaAt:Pn(e.mfa_at),revokedAt:r,state:r?"revoked":a<=t||l<=t?"expired":"active"}}function kh(e){let t=Pn(e.verified_at),r=Pn(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function Sp(e,t){let r=Pn(e.consumed_at),a=String(e.expires_at),l=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:l,expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":l>=5?"locked":a<=t?"expired":"pending"}}function Ih(e){let t=Ah(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Lc(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Ih(e.scopes),allowedDomains:Ih(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Eh(e,t){let r=Pn(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function hI(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Xi{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?Rh("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=ci(12),r=dI("aes-256-gcm",this.encryptionKey,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted authentication value is unavailable");let m=lI("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=uI(e.username),r=vp(e.email),a=e.id??this.idFn(),l=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
+`))}catch{if(mt=!0,Te)clearInterval(Te);Ne.close()}},1000),j.signal.addEventListener("abort",()=>{if(mt=!0,Te)clearInterval(Te);try{Ne.close()}catch{}},{once:!0})},cancel(){if(mt=!0,Te)clearInterval(Te)}});return new Response(It,{status:200,headers:{"content-type":"text/event-stream","cache-control":"no-store",connection:"keep-alive","x-accel-buffering":"no","x-request-id":Y,...je}})}ne=Kr(K,q,Y,["sequence","id"])}else if(j.method==="POST"&&q.pathname==="/api/v1/deployments"){let K=j.headers.get("idempotency-key")??"";if(!K)throw new i("idempotency_required","Idempotency-Key is required for deployment requests.",428);let ue=await j.text();if(ue.length>1048576)throw new i("payload_too_large","Request body exceeds 1 MB.",413);let he;try{he=JSON.parse(ue)}catch{throw new i("invalid_json","Request body must be valid JSON.",400)}if(!he||typeof he.projectId!=="string"||typeof he.environmentId!=="string"||he.action!==void 0&&!["deploy","rollback"].includes(he.action))throw new i("validation_error","projectId, environmentId, and a valid action are required.",422);let Te=t.createDeployment(Z,he,K);return T({operation:Te.operation,idempotentReplay:Te.replay,requestId:Y},202,Y,{...je,...Te.replay?{"idempotent-replayed":"true"}:{}})}else{let K=await bo({...b,authorization:t,now:y},Z,{method:j.method,url:q,body:Me});if(K===void 0)throw new i("not_found","API resource was not found.",404);ne=K}return T(ne,200,Y,je)}catch(ne){if(ne instanceof i)return N(ne.code,ne.message,ne.status,Y,ne.details,je);if(q.pathname.startsWith("/api/v1/source/")||q.pathname.startsWith("/api/v1/application")||q.pathname.startsWith("/api/v1/compose-")||q.pathname==="/api/v1/registry-connections")return N("validation_error",ne instanceof Error?ne.message:"Integration request could not be completed.",422,Y,void 0,je);return N("internal_error","The API request could not be completed.",500,Y,void 0,je)}}}import{createCipheriv as dI,createDecipheriv as lI,createHash as Rh,randomBytes as ci}from"node:crypto";import{createHmac as aI,timingSafeEqual as cI}from"node:crypto";var yp="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Ji(e){let t=0,r=0,a="";for(let l of e){r=r<<8|l,t+=8;while(t>=5)a+=yp[r>>>t-5&31],t-=5}if(t>0)a+=yp[r<<5-t&31];return a}function $l(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,a=0,l=[];for(let m of t){let f=yp.indexOf(m);if(f<0)throw Error("Invalid base32 secret");if(a=a<<5|f,r+=5,r>=8)l.push(a>>>r-8&255),r-=8}return Buffer.from(l)}function qo(e,t,r=6){let a=Buffer.alloc(8);a.writeBigUInt64BE(BigInt(t));let l=aI("sha1",$l(e)).update(a).digest(),m=l[l.length-1]&15,f=(l[m]&127)<<24|(l[m+1]&255)<<16|(l[m+2]&255)<<8|l[m+3]&255;return String(f%10**r).padStart(r,"0")}function Sf(e,t=Date.now(),r=30){return qo(e,Math.floor(t/1000/r))}function If(e,t,r=Date.now(),a=1){return on(e,t,r,a)!==void 0}function on(e,t,r=Date.now(),a=1){let l=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(l))return;let m=Buffer.from(l),f=Math.floor(r/1000/30);for(let b=-a;b<=a;b++){if(f+b<0)continue;let k=Buffer.from(qo(e,f+b));if(m.length===k.length&&cI(m,k))return f+b}return}function jo(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var Ml=1800000,Ye=43200000,Fl=3600000,Ul=300000,Ql=600000;function Pn(e){return typeof e==="string"?e:void 0}function Ah(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function uI(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function vp(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function pI(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function gI(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function mI(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function fI(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function qn(e){return Rh("sha256").update(e).digest("hex")}function ic(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:Pn(e.email),emailVerifiedAt:Pn(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:Pn(e.disabled_at),lastLoginAt:Pn(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function wh(e,t){let r=Pn(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Ah(e.metadata),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function bp(e,t){let r=Pn(e.revoked_at),a=String(e.idle_expires_at),l=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:Pn(e.user_agent),networkHint:Pn(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:a,absoluteExpiresAt:l,recentAuthAt:String(e.recent_auth_at),mfaAt:Pn(e.mfa_at),revokedAt:r,state:r?"revoked":a<=t||l<=t?"expired":"active"}}function kh(e){let t=Pn(e.verified_at),r=Pn(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function Sp(e,t){let r=Pn(e.consumed_at),a=String(e.expires_at),l=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:l,expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":l>=5?"locked":a<=t?"expired":"pending"}}function Ih(e){let t=Ah(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Lc(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Ih(e.scopes),allowedDomains:Ih(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Eh(e,t){let r=Pn(e.consumed_at),a=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:a,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":a<=t?"expired":"pending"}}function hI(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Xi{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?Rh("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=ci(12),r=dI("aes-256-gcm",this.encryptionKey,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted authentication value is unavailable");let m=lI("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=uI(e.username),r=vp(e.email),a=e.id??this.idFn(),l=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[a,e.actorId,t,r??null,e.emailVerified&&r?l:null,e.passwordHash,e.requiresPasswordUpgrade?1:0,l,l]),this.getIdentity(a)}getIdentity(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE id = ?").get(e);return t?ic(t):void 0}getIdentityByActor(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE actor_id = ?").get(e);return t?ic(t):void 0}getIdentityByUsername(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE username = ? COLLATE NOCASE").get(e.trim());return t?ic(t):void 0}getIdentityByEmail(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE email = ? COLLATE NOCASE").get(e.trim().toLowerCase());return t?ic(t):void 0}listIdentities(){return this.controlPlane.database.query("SELECT * FROM auth_identities ORDER BY username COLLATE NOCASE").all().map(ic)}updatePassword(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let l=this.now();return this.controlPlane.transaction(()=>{if(this.run(`UPDATE auth_identities SET password_hash = ?, credential_version = credential_version + 1,
         requires_password_upgrade = ?, updated_at = ? WHERE id = ?`,[t,r.requiresUpgrade?1:0,l,e]),r.revokeSessions!==!1)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[l,e])}),this.getIdentity(e)}rehashPassword(e,t){let r=this.now();this.run("UPDATE auth_identities SET password_hash = ?, requires_password_upgrade = 0, updated_at = ? WHERE id = ?",[t,r,e]);let a=this.getIdentity(e);if(!a)throw Error("Authentication identity was not found");return a}setVerifiedEmail(e,t){let r=vp(t),a=this.now();this.run("UPDATE auth_identities SET email = ?, email_verified_at = ?, updated_at = ? WHERE id = ?",[r,a,a,e]);let l=this.getIdentity(e);if(!l)throw Error("Authentication identity was not found");return l}recordLogin(e){let t=this.now();this.run("UPDATE auth_identities SET last_login_at = ?, updated_at = ? WHERE id = ?",[t,t,e]);let r=this.getIdentity(e);if(!r)throw Error("Authentication identity was not found");return r}setDisabled(e,t){let r=this.now();this.controlPlane.transaction(()=>{if(this.run("UPDATE auth_identities SET disabled_at = ?, credential_version = credential_version + 1, updated_at = ? WHERE id = ?",[t?r:null,r,e]),t)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[r,e])});let a=this.getIdentity(e);if(!a)throw Error("Authentication identity was not found");return a}createActionToken(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let a=ci(32).toString("base64url"),l=this.idFn(),m=this.now(),f=new Date(this.nowFn().getTime()+Math.min(86400000,Math.max(60000,r.ttlMs??Fl))).toISOString();return this.run("INSERT INTO auth_action_tokens (id, identity_id, type, token_hash, metadata, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[l,e,t,qn(a),JSON.stringify(r.metadata??{}),f,m]),{actionToken:this.getActionToken(l),token:a}}getActionToken(e){let t=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE id = ?").get(e);return t?wh(t,this.now()):void 0}consumeActionToken(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE token_hash = ? AND type = ?").get(qn(e),t);if(!r)throw Error("Action token is invalid");let a=wh(r,this.now());if(a.state!=="pending")throw Error(`Action token is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("Action token is no longer available");return this.getActionToken(a.id)})}revokeActionTokens(e,t){return this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE identity_id = ? AND type = ? AND consumed_at IS NULL",[this.now(),e,t]).changes}createSession(e){let t=this.getIdentity(e.identityId);if(!t||t.disabledAt)throw Error("Authentication identity is unavailable");let r=this.idFn(),a=ci(32).toString("base64url"),l=`v2.${r}.${a}`,m=this.now(),f=Math.min(86400000,Math.max(60000,e.idleTtlMs??Ml)),b=Math.min(2592000000,Math.max(f,e.absoluteTtlMs??Ye));return this.run(`INSERT INTO auth_sessions (id, identity_id, token_hash, credential_version, auth_method, user_agent, network_hint,
       created_at, last_used_at, idle_expires_at, absolute_expires_at, recent_auth_at, mfa_at)
@@ -70,13 +70,13 @@ data: ${JSON.stringify(ut)}
         default_role = ?, enabled = ?, enforce_sso = ?, updated_at = ? WHERE id = ?`,[t,r,a,l,e.clientSecret?this.encrypt(e.clientSecret):null,JSON.stringify(m),JSON.stringify(f),e.defaultRole??b.defaultRole,e.enabled??b.enabled?1:0,e.enforceSso??b.enforceSso?1:0,k,b.id]),this.getOidcProvider(b.id)}if(!e.clientSecret)throw Error("OIDC client secret is required for a new provider");let y=e.id??this.idFn();return this.run(`INSERT INTO auth_oidc_providers (id, organization_id, slug, name, issuer, client_id,
       client_secret_ciphertext, scopes, allowed_domains, default_role, enabled, enforce_sso, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[y,e.organizationId,t,r,a,l,this.encrypt(e.clientSecret),JSON.stringify(m),JSON.stringify(f),e.defaultRole??"viewer",e.enabled===!1?0:1,e.enforceSso?1:0,k,k]),this.getOidcProvider(y)}getOidcProvider(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);return t?Lc(t):void 0}getOidcProviderBySlug(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE slug = ? COLLATE NOCASE").get(e.trim());return t?Lc(t):void 0}listOidcProviders(e,t={}){return(e?this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e):this.controlPlane.database.query("SELECT * FROM auth_oidc_providers ORDER BY name COLLATE NOCASE").all()).map(Lc).filter((a)=>t.includeDisabled||a.enabled)}setOidcProviderEnabled(e,t){let r=this.now();if(this.controlPlane.database.run("UPDATE auth_oidc_providers SET enabled = ?, enforce_sso = CASE WHEN ? = 0 THEN 0 ELSE enforce_sso END, updated_at = ? WHERE id = ?",[t?1:0,t?1:0,r,e]).changes!==1)throw Error("OIDC provider was not found");if(!t)this.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE provider_id = ? AND consumed_at IS NULL",[r,e]);return this.getOidcProvider(e)}getOidcProviderCredentials(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_providers WHERE id = ?").get(e);if(!t||typeof t.client_secret_ciphertext!=="string")throw Error("OIDC provider credentials are unavailable");return{provider:Lc(t),clientSecret:this.decrypt(t.client_secret_ciphertext)}}beginOidcTransaction(e,t,r){if(!this.getOidcProvider(e)?.enabled)throw Error("OIDC provider is unavailable");let l=this.idFn(),m=ci(32).toString("base64url"),f=ci(32).toString("base64url"),b=ci(64).toString("base64url"),k=this.now(),y=new Date(this.nowFn().getTime()+Ql).toISOString();return this.run(`INSERT INTO auth_oidc_transactions (id, provider_id, state_hash, nonce_ciphertext, verifier_ciphertext,
-      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l,e,qn(m),this.encrypt(f),this.encrypt(b),t,r,y,k]),{transaction:this.getOidcTransaction(l),state:m,nonce:f,verifier:b}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,qn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?hI(r):void 0}linkOidcSubject(e,t,r,a){let l=this.getOidcProvider(e),m=this.getIdentity(t);if(!l||!m)throw Error("OIDC provider or identity was not found");let f=vp(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let b=this.getOidcSubject(e,r);if(b&&b.identityId!==t)throw Error("OIDC subject is already linked to another identity");let k=this.now();if(b)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[f,k,b.id]),this.getOidcSubject(e,r);let y=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[y,e,t,r,f,k,k]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function an(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-e9z4gzmg.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as yI}from"node:crypto";import{chmodSync as vI,existsSync as bI,mkdirSync as SI,readFileSync as wI,writeFileSync as kI}from"node:fs";import{dirname as II}from"node:path";function If(){return L("auth-encryption-key")}function Ze(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(bI(r)){let l=wI(r,"utf8").trim();if(l)return l}}catch{}let a=yI(32).toString("base64url");try{SI(II(r),{recursive:!0,mode:448}),kI(r,`${a}
+      redirect_uri, return_path, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l,e,qn(m),this.encrypt(f),this.encrypt(b),t,r,y,k]),{transaction:this.getOidcTransaction(l),state:m,nonce:f,verifier:b}}getOidcTransaction(e){let t=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE id = ?").get(e);return t?Eh(t,this.now()):void 0}consumeOidcTransaction(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_transactions WHERE provider_id = ? AND state_hash = ?").get(e,qn(t));if(!r)throw Error("OIDC transaction is invalid");let a=Eh(r,this.now());if(a.state!=="pending")throw Error(`OIDC transaction is ${a.state}`);if(this.controlPlane.database.run("UPDATE auth_oidc_transactions SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),a.id,this.now()]).changes!==1)throw Error("OIDC transaction is no longer available");return{transaction:this.getOidcTransaction(a.id),nonce:this.decrypt(String(r.nonce_ciphertext)),verifier:this.decrypt(String(r.verifier_ciphertext))}})}getOidcSubject(e,t){let r=this.controlPlane.database.query("SELECT * FROM auth_oidc_subjects WHERE provider_id = ? AND subject = ?").get(e,t);return r?hI(r):void 0}linkOidcSubject(e,t,r,a){let l=this.getOidcProvider(e),m=this.getIdentity(t);if(!l||!m)throw Error("OIDC provider or identity was not found");let f=vp(a);if(!r.trim()||r.length>512)throw Error("OIDC subject is invalid");let b=this.getOidcSubject(e,r);if(b&&b.identityId!==t)throw Error("OIDC subject is already linked to another identity");let k=this.now();if(b)return this.run("UPDATE auth_oidc_subjects SET email = ?, last_login_at = ? WHERE id = ?",[f,k,b.id]),this.getOidcSubject(e,r);let y=this.idFn();return this.run("INSERT INTO auth_oidc_subjects (id, provider_id, identity_id, subject, email, linked_at, last_login_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[y,e,t,r,f,k,k]),this.getOidcSubject(e,r)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM auth_action_tokens WHERE expires_at < ? OR consumed_at IS NOT NULL",[e]).changes,r=this.controlPlane.database.run("DELETE FROM auth_sessions WHERE revoked_at IS NOT NULL OR idle_expires_at < ? OR absolute_expires_at < ?",[e,e]).changes;return this.controlPlane.database.run("DELETE FROM auth_mfa_challenges WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),this.controlPlane.database.run("DELETE FROM auth_oidc_transactions WHERE consumed_at IS NOT NULL OR expires_at < ?",[e]),{actionTokens:t,sessions:r}}}async function an(e,t){let r=e.notifications?.email?.from;if(!r)return!1;try{let{EmailClient:a}=await import("./chunk-x7d93rxb.js");return await new a({region:e.project.region,defaultFrom:r}).send(t),!0}catch{return!1}}import{randomBytes as yI}from"node:crypto";import{chmodSync as vI,existsSync as bI,mkdirSync as SI,readFileSync as wI,writeFileSync as kI}from"node:fs";import{dirname as II}from"node:path";function bf(){return L("auth-encryption-key")}function Ze(e){let t=process.env.TS_CLOUD_AUTH_ENCRYPTION_KEY?.trim();if(t)return t;let r=d(e,"auth-encryption-key");try{if(bI(r)){let l=wI(r,"utf8").trim();if(l)return l}}catch{}let a=yI(32).toString("base64url");try{SI(II(r),{recursive:!0,mode:448}),kI(r,`${a}
 `,{mode:384}),vI(r,384)}catch{}return a}import{constants as EI,createHash as wp,createPublicKey as RI,createVerify as AI,timingSafeEqual as CI}from"node:crypto";var Ph=new Set(["RS256","PS256","ES256"]),Ch=60;function Fc(e,t){let r=new URL(e),a=["127.0.0.1","::1","localhost"].includes(r.hostname);if(r.protocol!=="https:"&&!(r.protocol==="http:"&&a))throw Error(`${t} must use HTTPS`);if(r.username||r.password||r.hash)throw Error(`${t} contains unsupported URL components`);return r}function kp(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} is invalid`);return e}async function Ip(e,t){if(!e.ok)throw Error(`${t} failed with HTTP ${e.status}`);if(!(e.headers.get("content-type")??"").toLowerCase().includes("application/json"))throw Error(`${t} returned an unsupported content type`);if(Number(e.headers.get("content-length")??0)>1048576)throw Error(`${t} response is too large`);let l=await e.text();if(l.length>1048576)throw Error(`${t} response is too large`);try{return kp(JSON.parse(l),t)}catch(m){if(m instanceof Error&&m.message===`${t} is invalid`)throw m;throw Error(`${t} returned invalid JSON`)}}function PI(e,t){let r=wp("sha256").update(e).digest(),a=wp("sha256").update(t).digest();return CI(r,a)}function Hl(e){if(!e)return"/";let t=e.trim();if(!t.startsWith("/")||t.startsWith("//")||t.includes("\\")||/[\r\n]/.test(t))return"/";try{let r=new URL(t,"https://local.invalid");return r.origin==="https://local.invalid"?`${r.pathname}${r.search}${r.hash}`:"/"}catch{return"/"}}async function zo(e,t=fetch){let r=Fc(e.issuer,"OIDC issuer"),a=new URL(`${r.pathname.replace(/\/$/,"")}/.well-known/openid-configuration`,r.origin),l=await Ip(await t(a,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC discovery");if(l.issuer!==e.issuer)throw Error("OIDC discovery issuer does not match the configured issuer");for(let f of["authorization_endpoint","token_endpoint","jwks_uri"]){if(typeof l[f]!=="string")throw Error(`OIDC discovery is missing ${f}`);Fc(l[f],`OIDC ${f}`)}if(Array.isArray(l.response_types_supported)&&!l.response_types_supported.includes("code"))throw Error("OIDC provider does not support authorization code flow");if(Array.isArray(l.code_challenge_methods_supported)&&!l.code_challenge_methods_supported.includes("S256"))throw Error("OIDC provider does not support PKCE S256");let m=Array.isArray(l.id_token_signing_alg_values_supported)?l.id_token_signing_alg_values_supported.filter((f)=>typeof f==="string"):[];if(m.length>0&&!m.some((f)=>Ph.has(f)))throw Error("OIDC provider does not offer a supported ID-token signing algorithm");return l}async function Ko(e,t,r,a,l=fetch){let m=e.getOidcProviderBySlug(t);if(!m?.enabled)throw Error("OIDC provider is unavailable");let f=Fc(r,"Application origin").origin,b=await zo(m,l),k=`${f}/auth/oidc/${encodeURIComponent(m.slug)}/callback`,y=e.beginOidcTransaction(m.id,k,Hl(a)),R=new URL(b.authorization_endpoint);return R.searchParams.set("response_type","code"),R.searchParams.set("client_id",m.clientId),R.searchParams.set("redirect_uri",k),R.searchParams.set("scope",m.scopes.join(" ")),R.searchParams.set("state",y.state),R.searchParams.set("nonce",y.nonce),R.searchParams.set("code_challenge",wp("sha256").update(y.verifier).digest("base64url")),R.searchParams.set("code_challenge_method","S256"),{authorizationUrl:R.href,expiresAt:y.transaction.expiresAt}}function _I(e){if(e.length>32768)throw Error("OIDC ID token is too large");let t=e.split(".");if(t.length!==3||t.some((r)=>!r))throw Error("OIDC ID token is malformed");try{return{header:kp(JSON.parse(Buffer.from(t[0],"base64url").toString("utf8")),"OIDC ID-token header"),claims:kp(JSON.parse(Buffer.from(t[1],"base64url").toString("utf8")),"OIDC ID-token claims"),signingInput:`${t[0]}.${t[1]}`,signature:Buffer.from(t[2],"base64url")}}catch(r){if(r instanceof Error&&r.message.startsWith("OIDC"))throw r;throw Error("OIDC ID token is malformed")}}async function TI(e,t,r){let a=_I(e),l=typeof a.header.alg==="string"?a.header.alg:"",m=typeof a.header.kid==="string"?a.header.kid:"";if(!Ph.has(l)||!m)throw Error("OIDC ID token uses an unsupported signing key");if(t.id_token_signing_alg_values_supported&&!t.id_token_signing_alg_values_supported.includes(l))throw Error("OIDC ID-token algorithm was not advertised by the provider");let f=await Ip(await r(t.jwks_uri,{headers:{accept:"application/json"},redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC signing-key request");if(!Array.isArray(f.keys))throw Error("OIDC signing-key response is invalid");let b=f.keys.find((T)=>{if(!T||typeof T!=="object"||Array.isArray(T))return!1;let N=T;return N.kid===m&&(!N.alg||N.alg===l)&&(!N.use||N.use==="sig")});if(!b)throw Error("OIDC ID-token signing key was not found");let k=RI({key:b,format:"jwk"}),y=AI("SHA256").update(a.signingInput).end();if(!(l==="PS256"?y.verify({key:k,padding:EI.RSA_PKCS1_PSS_PADDING,saltLength:32},a.signature):l==="ES256"?y.verify({key:k,dsaEncoding:"ieee-p1363"},a.signature):y.verify(k,a.signature)))throw Error("OIDC ID-token signature is invalid");return a.claims}function xI(e,t,r,a){if(e.iss!==t.issuer)throw Error("OIDC ID-token issuer is invalid");let l=typeof e.aud==="string"?[e.aud]:Array.isArray(e.aud)?e.aud.filter((k)=>typeof k==="string"):[];if(!l.includes(t.clientId))throw Error("OIDC ID-token audience is invalid");if((l.length>1||e.azp!==void 0)&&e.azp!==t.clientId)throw Error("OIDC ID-token authorized party is invalid");let m=Math.floor(a.getTime()/1000);if(typeof e.exp!=="number"||e.exp<m-Ch)throw Error("OIDC ID token is expired");if(typeof e.iat!=="number"||e.iat>m+Ch)throw Error("OIDC ID-token issued-at time is invalid");if(typeof e.nonce!=="string"||!PI(e.nonce,r))throw Error("OIDC ID-token nonce is invalid");if(typeof e.sub!=="string"||!e.sub||e.sub.length>512)throw Error("OIDC ID-token subject is invalid");if(e.email_verified!==!0||typeof e.email!=="string")throw Error("OIDC provider did not return a verified email address");let f=e.email.trim().toLowerCase();if(f.length>254||!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(f))throw Error("OIDC provider returned an invalid email address");let b=f.split("@")[1];if(!b||!t.allowedDomains.includes(b))throw Error("OIDC email domain is not allowed for this organization");return{provider:t,subject:e.sub,email:f,name:typeof e.name==="string"?e.name.slice(0,120):void 0,claims:e}}async function Wo(e,t,r=fetch){let a=e.getOidcProviderBySlug(t.providerSlug);if(!a?.enabled)throw Error("OIDC provider is unavailable");if(!t.state||t.state.length>512||!t.code||t.code.length>4096)throw Error("OIDC callback is incomplete");let l=Fc(t.origin,"Application origin").origin,m=e.consumeOidcTransaction(a.id,t.state),f=`${l}/auth/oidc/${encodeURIComponent(a.slug)}/callback`;if(m.transaction.redirectUri!==f)throw Error("OIDC callback redirect URI does not match the original request");let{clientSecret:b}=e.getOidcProviderCredentials(a.id),k=await zo(a,r),y=new URLSearchParams({grant_type:"authorization_code",code:t.code,redirect_uri:m.transaction.redirectUri,code_verifier:m.verifier}),R={accept:"application/json","content-type":"application/x-www-form-urlencoded"},T=k.token_endpoint_auth_methods_supported??["client_secret_basic"];if(T.includes("client_secret_basic")){let U=(Y)=>new URLSearchParams({value:Y}).toString().slice(6),q=`${U(a.clientId)}:${U(b)}`;R.authorization=`Basic ${Buffer.from(q).toString("base64")}`}else if(T.includes("client_secret_post"))y.set("client_id",a.clientId),y.set("client_secret",b);else throw Error("OIDC provider does not support a configured client authentication method");let N=await Ip(await r(k.token_endpoint,{method:"POST",headers:R,body:y,redirect:"error",signal:AbortSignal.timeout(1e4)}),"OIDC token exchange");if(typeof N.id_token!=="string")throw Error("OIDC token response did not include an ID token");let j=await TI(N.id_token,k,r);return{identity:xI(j,a,m.nonce,t.now??new Date),returnPath:m.transaction.returnPath}}import{createHash as DI,randomBytes as OI}from"node:crypto";var Th=new Set(me),Gl=7776000000,Vl=31536000000,ql=86400000;function di(e){return typeof e==="string"?e:void 0}function _h(e){return DI("sha256").update(e).digest("hex")}function $I(e){try{let t=JSON.parse(String(e));return Array.isArray(t)?t.filter((r)=>typeof r==="string"&&Th.has(r)):[]}catch{return[]}}function NI(e){let t=String(e.scope_type);return t==="organization"?{type:t}:{type:t,id:String(e.scope_id)}}function Ep(e){let t=di(e.disabled_at);return{id:String(e.id),organizationId:String(e.organization_id),actorId:String(e.actor_id),slug:String(e.slug),name:String(e.name),description:di(e.description),createdByActorId:di(e.created_by_actor_id),disabledAt:t,createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:t?"disabled":"active"}}function Rp(e,t){let r=di(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),serviceAccountId:String(e.service_account_id),name:String(e.name),prefix:String(e.token_prefix),capabilities:$I(e.capabilities),scope:NI(e),expiresAt:a,lastUsedAt:di(e.last_used_at),lastNetworkHint:di(e.last_network_hint),revokedAt:r,rotatedFromTokenId:di(e.rotated_from_token_id),createdByActorId:di(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at),state:r?"revoked":a<=t?"expired":"active"}}function jI(e){let t={};try{t=JSON.parse(String(e.response_body))}catch{}return{id:String(e.id),tokenId:String(e.token_id),key:String(e.idempotency_key),requestHash:String(e.request_hash),operationId:di(e.operation_id),responseStatus:Number(e.response_status),responseBody:t,expiresAt:String(e.expires_at),createdAt:String(e.created_at)}}class Yi{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}createServiceAccount(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Service-account organization was not found");let t=e.slug.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("Service-account slug must be 2-48 lowercase letters, numbers or dashes");let r=e.name.trim().slice(0,100);if(!r)throw Error("Service-account name is required");let a=this.controlPlane.createActor({kind:"service_account",externalId:`service-account:${e.organizationId}:${t}`,displayName:r,metadata:{source:"api",serviceAccountSlug:t}}),l=this.idFn(),m=this.now();this.run(`INSERT INTO service_accounts (id, organization_id, actor_id, slug, name, description, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l,e.organizationId,a.id,t,r,e.description?.trim().slice(0,500)||null,e.createdByActorId??null,m,m]);let f=this.controlPlane.createMembership({organizationId:e.organizationId,actorId:a.id,roleTemplate:e.roleTemplate,scope:e.scope,source:"manual",performedByActorId:e.createdByActorId}),b=e.scope??{type:"organization"};return this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"api.service_account.created",payload:{serviceAccountId:l,roleTemplate:e.roleTemplate,scope:{type:b.type,id:b.id??null}}}),{serviceAccount:this.getServiceAccount(l),membership:f}}getServiceAccount(e){let t=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE id = ?").get(e);return t?Ep(t):void 0}getServiceAccountBySlug(e,t){let r=this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? AND slug = ? COLLATE NOCASE").get(e,t.trim());return r?Ep(r):void 0}listServiceAccounts(e,t={}){return this.controlPlane.database.query("SELECT * FROM service_accounts WHERE organization_id = ? ORDER BY name COLLATE NOCASE").all(e).map(Ep).filter((r)=>t.includeDisabled||r.state==="active")}disableServiceAccount(e,t){let r=this.getServiceAccount(e);if(!r)throw Error("Service account was not found");let a=this.now();return this.controlPlane.transaction(()=>{this.run("UPDATE service_accounts SET disabled_at = ?, updated_at = ? WHERE id = ?",[a,a,e]),this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE service_account_id = ? AND revoked_at IS NULL",[a,a,e]);let l=this.controlPlane.getMembershipForActor(r.organizationId,r.actorId);if(l?.status==="active")this.controlPlane.revokeMembership(l.id)}),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"api.service_account.disabled",payload:{serviceAccountId:e}}),this.getServiceAccount(e)}createToken(e){let t=this.getServiceAccount(e.serviceAccountId);if(!t||t.state!=="active")throw Error("Service account is unavailable");let r=this.controlPlane.getMembershipForActor(t.organizationId,t.actorId);if(!r||r.status!=="active")throw Error("Service-account membership is unavailable");let a=[...new Set(e.capabilities)];if(a.length===0||a.some((N)=>!Th.has(N)))throw Error("API token requires valid explicit capabilities");let l=e.scope??r.scope,m=this.controlPlane.resolveAuthorizationTarget(t.organizationId,l);if(!m)throw Error("API token scope was not found in this organization");for(let N of a)if(!P({membership:r,grants:this.controlPlane.listGrants(r.id),capability:N,target:m}).allowed)throw Error(`Service-account membership does not grant ${N} at the token scope`);let f=e.expiresAt?new Date(e.expiresAt):new Date(this.nowFn().getTime()+Gl);if(!Number.isFinite(f.getTime())||f.getTime()<=this.nowFn().getTime()+60000||f.getTime()>this.nowFn().getTime()+Vl)throw Error("API token expiry must be between one minute and one year from now");let b=this.idFn(),k=OI(32).toString("base64url"),y=`tsc_v1.${b}.${k}`,R=`tsc_v1.${b.slice(0,8)}`,T=this.now();return this.run(`INSERT INTO api_tokens (id, service_account_id, name, token_hash, token_prefix, capabilities, scope_type, scope_id,
       expires_at, rotated_from_token_id, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[b,t.id,e.name.trim().slice(0,100)||"API token",_h(y),R,JSON.stringify(a.sort()),l.type,l.type==="organization"?null:l.id??null,f.toISOString(),e.rotatedFromTokenId??null,e.createdByActorId??null,T,T]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.createdByActorId,type:"api.token.created",payload:{serviceAccountId:t.id,tokenId:b,prefix:R,capabilities:a,scope:{type:l.type,id:l.id??null},expiresAt:f.toISOString(),rotatedFromTokenId:e.rotatedFromTokenId??null}}),{token:this.getToken(b),secret:y}}getToken(e){let t=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ?").get(e);return t?Rp(t,this.now()):void 0}listTokens(e,t={}){return this.controlPlane.database.query("SELECT * FROM api_tokens WHERE service_account_id = ? ORDER BY created_at DESC").all(e).map((r)=>Rp(r,this.now())).filter((r)=>t.includeInactive||r.state==="active")}verifyToken(e,t){let r=/^tsc_v1\.([^.]+)\.[A-Za-z0-9_-]{40,}$/.exec(e);if(!r)return;let a=this.controlPlane.database.query("SELECT * FROM api_tokens WHERE id = ? AND token_hash = ?").get(r[1],_h(e));if(!a)return;let l=Rp(a,this.now()),m=this.getServiceAccount(l.serviceAccountId);if(!m||m.state!=="active"||l.state!=="active")return;let f=this.controlPlane.getActor(m.actorId),b=this.controlPlane.getMembershipForActor(m.organizationId,m.actorId);if(!f||f.disabledAt||!b||b.status!=="active")return;let k=this.now(),y=!l.lastUsedAt||this.nowFn().getTime()-new Date(l.lastUsedAt).getTime()>=3600000;if(this.run("UPDATE api_tokens SET last_used_at = ?, last_network_hint = ?, updated_at = ? WHERE id = ?",[k,t?.slice(0,128)??null,k,l.id]),y)this.controlPlane.appendEvent({organizationId:m.organizationId,actorId:f.id,type:"api.token.used",payload:{serviceAccountId:m.id,tokenId:l.id,prefix:l.prefix}});return{serviceAccount:m,token:this.getToken(l.id),actor:f,membership:b}}rotateToken(e,t){let r=this.getToken(e);if(!r||r.state!=="active")throw Error("Active API token was not found");let a=this.createToken({serviceAccountId:r.serviceAccountId,name:`${r.name} (rotated)`,capabilities:r.capabilities,scope:r.scope,expiresAt:r.expiresAt,createdByActorId:t,rotatedFromTokenId:r.id}),l=this.getServiceAccount(r.serviceAccountId);return this.controlPlane.appendEvent({organizationId:l?.organizationId,actorId:t,type:"api.token.rotated",payload:{serviceAccountId:r.serviceAccountId,previousTokenId:r.id,tokenId:a.token.id}}),a}revokeToken(e,t){let r=this.getToken(e);if(!r)throw Error("API token was not found");if(r.state==="active"){let a=this.now();this.run("UPDATE api_tokens SET revoked_at = ?, updated_at = ? WHERE id = ?",[a,a,e]);let l=this.getServiceAccount(r.serviceAccountId);this.controlPlane.appendEvent({organizationId:l?.organizationId,actorId:t,type:"api.token.revoked",payload:{serviceAccountId:r.serviceAccountId,tokenId:e}})}return this.getToken(e)}getIdempotency(e,t){let r=this.controlPlane.database.query("SELECT * FROM api_idempotency_records WHERE token_id = ? AND idempotency_key = ? AND expires_at > ?").get(e,t,this.now());return r?jI(r):void 0}saveIdempotency(e){if(!/^[A-Za-z0-9._:-]{8,128}$/.test(e.key))throw Error("Idempotency-Key must contain 8-128 safe characters");let t=this.getIdempotency(e.tokenId,e.key);if(t){if(t.requestHash!==e.requestHash)throw Error("Idempotency-Key was already used for a different request");return t}let r=this.idFn(),a=this.now(),l=new Date(this.nowFn().getTime()+ql).toISOString();return this.run(`INSERT INTO api_idempotency_records (id, token_id, idempotency_key, request_hash, operation_id, response_status, response_body, expires_at, created_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.tokenId,e.key,e.requestHash,e.operationId??null,e.responseStatus,JSON.stringify(e.responseBody),l,a]),this.getIdempotency(e.tokenId,e.key)}purgeExpired(){let e=this.now(),t=this.controlPlane.database.run("DELETE FROM api_tokens WHERE (expires_at < ? OR revoked_at IS NOT NULL) AND created_at < ?",[e,new Date(this.nowFn().getTime()-2592000000).toISOString()]).changes,r=this.controlPlane.database.run("DELETE FROM api_idempotency_records WHERE expires_at < ?",[e]).changes;return{tokens:t,idempotency:r}}}import{isIP as jh}from"node:net";var BI={every_minute:"* * * * *",every_five_minutes:"*/5 * * * *",hourly:"0 * * * *",daily:"0 0 * * *",weekly:"0 0 * * 0"},MI={JAN:1,FEB:2,MAR:3,APR:4,MAY:5,JUN:6,JUL:7,AUG:8,SEP:9,OCT:10,NOV:11,DEC:12},xh={SUN:0,MON:1,TUE:2,WED:3,THU:4,FRI:5,SAT:6};function Dh(e){try{return new Intl.DateTimeFormat("en",{timeZone:e}).format(new Date),e}catch{throw Error(`Unknown schedule timezone: ${e}`)}}function zc(e,t,r,a){let l=t[e.toUpperCase()]??Number(e);if(!Number.isInteger(l)||l<r||l>a)throw Error(`Schedule field value ${e} is outside ${r}-${a}.`);return l}function Ss(e,t,r,a={},l){if(e==="*"||e==="?")return;let m=new Set;for(let f of e.split(",")){let[b,k]=f.split("/"),y=k?zc(k,{},1,r-t+1):1,R,T;if(b==="*")R=t,T=r;else if(b.includes("-")){let N=b.split("-");R=zc(N[0],a,t,r),T=zc(N[1],a,t,r)}else R=zc(b,a,t,r),T=R;if(T<R)throw Error("Schedule ranges must be ascending.");for(let N=R;N<=T;N+=y)m.add(l?l(N):N===7&&r===7?0:N)}return m}function LI(e,t){let r=Object.fromEntries(new Intl.DateTimeFormat("en-US",{timeZone:t,year:"numeric",month:"numeric",day:"numeric",weekday:"short",hour:"numeric",minute:"numeric",hourCycle:"h23"}).formatToParts(e).map((a)=>[a.type,a.value]));return{minute:Number(r.minute),hour:Number(r.hour),day:Number(r.day),month:Number(r.month),weekday:xh[r.weekday.toUpperCase()],year:Number(r.year),key:`${r.year}-${r.month}-${r.day} ${r.hour}:${r.minute}`}}function Oh(e){let r=(e.startsWith("cron(")?e.slice(5,-1).trim():e.trim()).split(/\s+/);if(r.length!==5&&r.length!==6)throw Error("Cron schedules require five standard fields or six EventBridge fields.");let[a,l,m,f,b,k]=r,y=r.length===6;return{minute:Ss(a,0,59),hour:Ss(l,0,23),day:Ss(m,1,31),month:Ss(f,1,12,MI),weekday:Ss(b,y?1:0,7,xh,y?(R)=>R===7?6:R-1:void 0),year:k?Ss(k,1970,2199):void 0,dayWildcard:m==="*"||m==="?",weekdayWildcard:b==="*"||b==="?"}}function FI(e,t){if(!((!t.minute||t.minute.has(e.minute))&&(!t.hour||t.hour.has(e.hour))&&(!t.month||t.month.has(e.month))&&(!t.year||t.year.has(e.year))))return!1;let a=!t.day||t.day.has(e.day),l=!t.weekday||t.weekday.has(e.weekday);return t.dayWildcard?l:t.weekdayWildcard?a:a||l}function $h(e){let t=/^rate\(\s*(\d+)\s+(minute|minutes|hour|hours|day|days)\s*\)$/i.exec(e);if(!t)return;let r=Number(t[1]);if(r<1)throw Error("Rate amount must be positive.");return r*(t[2].toLowerCase().startsWith("minute")?60000:t[2].toLowerCase().startsWith("hour")?3600000:86400000)}function tt(e){let t=e.trim(),r=BI[t.toLowerCase()]??t;if(!r)throw Error("Schedule expression is required.");let a=$h(r);if(a){let l=a/60000;return{original:t,normalized:`rate(${l} minutes)`,kind:"rate",description:l%1440===0?`Every ${l/1440} day(s)`:l%60===0?`Every ${l/60} hour(s)`:`Every ${l} minute(s)`}}return Oh(r),{original:t,normalized:r.startsWith("cron(")?r:`cron(${r})`,kind:"cron",description:`Cron ${r.replace(/^cron\(|\)$/g,"")}`}}function Rt(e,t,r=new Date,a=5){let l=tt(e),m=Dh(t),f=Math.min(20,Math.max(1,a)),b=$h(l.normalized);if(b)return Array.from({length:f},(j,U)=>new Date(r.getTime()+b*(U+1)).toISOString());let k=Oh(l.normalized),y=[],R=new Set,T=new Date(Math.floor(r.getTime()/60000)*60000+60000),N=0;while(y.length<f&&N<1100000){let j=LI(T,m);if(FI(j,k)&&!R.has(j.key))y.push(T.toISOString()),R.add(j.key);T=new Date(T.getTime()+60000),N++}if(y.length<f)throw Error("Schedule produced no runs within the bounded preview horizon.");return y}function Dt(e,t="UTC",r=new Date,a=5){let l=tt(e),m=Rt(l.normalized,t,r,a),f=l.kind==="cron"?["Server cron and EventBridge use the same wall-clock preview; provider-specific extensions are retained only when supported."]:["Rate schedules use elapsed-time intervals and are not shifted by DST."];return{...l,timezone:Dh(t),nextRuns:m,capabilities:{server:l.kind==="cron",eventbridge:!0,notes:f}}}function pn(e){let t=tt(e.expression),r=t.normalized.slice(5,-1).trim().split(/\s+/),a=t.kind==="cron"&&r.length===5;if(e.provider==="server")return{provider:"server",supported:a,features:{timezone:!0,flexibleWindow:!1,catchUp:!1,replaceOverlap:!1},notes:[t.kind==="rate"?"Server cron requires a cron expression; use an equivalent cron schedule.":r.length!==5?"EventBridge six-field cron extensions cannot be installed as server cron.":"Cron is reconciled through a root-owned ts-cloud entry.",e.missedRunPolicy==="catch_up"?"Catch-up is handled by the control plane, not cron.":"Missed runs are skipped by cron."]};if(e.provider==="eventbridge")return{provider:"eventbridge",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["Five-field cron is translated explicitly to EventBridge six-field syntax. Flexible windows are provider-native; overlap and catch-up remain control-plane policies."]};if(e.provider==="lambda")return{provider:"lambda",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!1,replaceOverlap:!1},notes:["The schedule invokes one immutable Lambda target."]};return{provider:"platform",supported:!0,features:{timezone:!0,flexibleWindow:!0,catchUp:!0,replaceOverlap:!0},notes:["The durable control-plane worker enforces all configured policies."]}}function ss(e){let t=pn({...e,provider:"server"});if(!t.supported)throw Error(t.notes.join(" "));let a=tt(e.expression).normalized.slice(5,-1);return{path:`/etc/cron.d/ts-cloud-${e.id}`,content:`CRON_TZ=${e.timezone}
 ${a} root /usr/local/bin/cloud jobs:dispatch ${e.id} --scheduled >/dev/null 2>&1
-`}}function zI(e){let t=tt(e);if(t.kind==="rate")return e;let r=t.normalized.slice(5,-1).trim().split(/\s+/);if(r.length===6)return t.normalized;let[a,l,m,f,b]=r,k=b==="*"?"?":b.replace(/(^|[,-])0(?=$|[,-])/g,(y,R)=>`${R}1`);return m==="*"&&b!=="*"?`cron(${a} ${l} ? ${f} ${k} *)`:`cron(${a} ${l} ${m} ${f} ? *)`}function hu(e){let t=pn(e);if(!t.supported)throw Error(t.notes.join(" "));return{Name:`ts-cloud-${e.id}`,ScheduleExpression:zI(e.expression),ScheduleExpressionTimezone:e.timezone,State:e.enabled?"ENABLED":"DISABLED",FlexibleTimeWindow:e.flexibleMinutes?{Mode:"FLEXIBLE",MaximumWindowInMinutes:e.flexibleMinutes}:{Mode:"OFF"},Target:{kind:e.target.kind,functionName:e.target.functionName??null,payloadRefs:e.payloadRefs},RetryPolicy:{MaximumRetryAttempts:e.retryPolicy.maxAttempts,MaximumEventAgeInSeconds:e.timeoutSeconds},DeadLetterRef:e.retryPolicy.deadLetterRef??null}}function fS(e,t){if(!t)return{status:"unavailable",observedState:{message:"Provider observation is unavailable."}};let r=String(t.expression??""),a=t.enabled;return{status:r&&r!==e.normalizedExpression||typeof a==="boolean"&&a!==e.enabled?"drifted":"in_sync",observedState:t}}function Of(e){if(e.provider==="server"){let t=ss(e);return{path:t.path,content:t.content,enabled:e.enabled}}if(e.provider==="eventbridge")return hu(e);throw Error(`No reconciliation adapter is configured for ${e.provider} schedules.`)}function Ap(e,t){if(Array.isArray(e))return Array.isArray(t)&&e.length===t.length&&e.every((r,a)=>Ap(r,t[a]));if(e&&typeof e==="object"){if(!t||typeof t!=="object"||Array.isArray(t))return!1;return Object.entries(e).every(([r,a])=>Ap(a,t[r]))}return e===t}class _f{transport;provider="server";constructor(e){this.transport=e}async observe(e){let t=ss(e),r=await this.transport.read(t.path);return r==null?void 0:{path:t.path,content:r,enabled:!0}}async apply(e,t){let r=String(t.path??"");if(!e.enabled){await this.transport.removeRootOwned(r);return}await this.transport.writeRootOwned(r,String(t.content??""))}async remove(e){await this.transport.removeRootOwned(ss(e).path)}matches(e,t){if(e.enabled===!1)return!1;return e.path===t.path&&e.content===t.content}}class Lf{transport;provider="eventbridge";constructor(e){this.transport=e}observe(e){return this.transport.get(`ts-cloud-${e.id}`)}apply(e,t){return this.transport.put(t)}remove(e){return this.transport.remove(`ts-cloud-${e.id}`)}matches(e,t){return Ap(e,t)}}class $f{store;constructor(e){this.store=e}async reconcile(e,t,r={}){if(t.provider!==e.provider)return this.store.reconcile(e.id,"unsupported",{provider:t.provider,message:`Adapter ${t.provider} cannot reconcile ${e.provider}.`});try{let a=Of(e),l=await t.observe(e);if(l&&t.matches(a,l))return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:l});if(r.apply===!1)return this.store.reconcile(e.id,l?"drifted":"unavailable",{provider:t.provider,observed:l??null,applyRequired:!0});if(await t.apply(e,a),!e.enabled)return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:null,disabled:!0});let m=await t.observe(e);return this.store.reconcile(e.id,m&&t.matches(a,m)?"in_sync":"drifted",{provider:t.provider,observed:m??null,applied:!0})}catch(a){return this.store.reconcile(e.id,"unavailable",{provider:t.provider,error:a instanceof Error?a.message:String(a)})}}async remove(e,t){if(e.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");if(t.provider!==e.provider)throw Error(`Adapter ${t.provider} cannot remove ${e.provider}.`);await t.remove(e),this.store.remove(e.id)}}function UI(e){if(e.queues===!0)return[{queue:"default",processes:e.queueConcurrency??1}];if(!Array.isArray(e.queues))return[];return e.queues.map((t)=>{if(typeof t==="string")return{queue:t,processes:e.queueConcurrency??1};let[r,a]=Object.entries(t)[0]??["default",e.queueConcurrency??1];return{queue:r,processes:a}})}function la(e,t,r){let a=new Set,l=new Set,m=new Map(r.resources.map((T)=>[T.slug,T])),f=0,b=0;for(let[T,N]of Object.entries(t.sites??{})){let j=m.get(T);if(N.scheduler){let Y=`config:site:${T}:scheduler`;a.add(Y),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:j?.id,name:`${T} scheduler`,provider:"server",expression:"* * * * *",timezone:"UTC",flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:`scheduler:run:${T}`},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:300,enabled:!0,origin:"config",sourceKey:Y,observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),f++}let U=N,q=Array.isArray(U.queues??U.workers)?U.queues??U.workers:[];for(let[Y,ee]of q.entries()){let le=typeof ee==="string"?{queue:ee}:ee,Z=String(le.queue??le.name??"default"),ie=`config:site:${T}:worker:${Y}:${Z}`;l.add(ie),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:j?.id,name:`${T}:${Z}`,provider:"systemd",queue:Z,processes:Number(le.processes)||1,timeoutSeconds:Number(le.timeout)||60,restartPolicy:"always",target:{operationId:`worker:restart:${T}`,site:T},enabled:!0,origin:"config",sourceKey:ie,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),b++}}let k=t.infrastructure?.compute?.backups;if(k?.enabled)a.add("config:platform:backup"),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:"Scheduled backup",provider:"server",expression:String(k.schedule??"0 2 * * *"),timezone:String(k.timezone??"UTC"),flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:"backup:run"},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:60},timeoutSeconds:3600,enabled:!0,origin:"config",sourceKey:"config:platform:backup",observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),f++;let y=t.environments?.[r.environment.slug]?.app;if(y){if(y.scheduler!=="off"){let T=`config:serverless:${r.environment.slug}:scheduler`;a.add(T),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name} serverless scheduler`,provider:"eventbridge",expression:"rate(1 minute)",timezone:"UTC",flexibleMinutes:0,target:{kind:"serverless_scheduler",action:"schedule:run"},payloadRefs:{},missedRunPolicy:y.scheduler==="sub-minute"?"catch_up":"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:y.cliTimeout??900,enabled:!0,origin:"config",sourceKey:T,observedState:{source:"cloud.config.ts",mode:y.scheduler??"on"},reconciliationStatus:"pending"}),f++}for(let{queue:T,processes:N}of UI(y)){let j=`config:serverless:${r.environment.slug}:worker:${T}`;l.add(j),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name}:${T}`,provider:"lambda",queue:T,processes:N,timeoutSeconds:y.queueTimeout??120,restartPolicy:"on_failure",target:{function:"queue",queue:T},enabled:!0,origin:"config",sourceKey:j,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),b++}}let R=0;for(let T of e.list(r.project.id,{environmentId:r.environment.id}).filter((N)=>N.origin==="config"&&N.sourceKey&&!a.has(N.sourceKey)))e.reconcile(T.id,"drifted",{...T.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),R++;for(let T of e.listWorkers(r.project.id,r.environment.id).filter((N)=>N.origin==="config"&&N.sourceKey&&!l.has(N.sourceKey)))e.reconcileWorker(T.id,"drifted",{...T.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),R++;return{jobs:f,workers:b,drifted:R}}class ua{store;queue;constructor(e,t={}){this.store=e;this.queue=t.queue??new c(e.controlPlane)}enqueue(e,t){let r=new Date(t.scheduledFor??this.store.now()).toISOString(),a=`${e.id}:${t.trigger==="manual"?crypto.randomUUID():r}`,l=this.store.activeExecution(e.id);if(l&&e.overlapPolicy==="forbid")return this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"skipped",output:{reason:"overlap_forbidden",activeExecutionId:l.id}});if(l&&e.overlapPolicy==="replace"&&l.operationId)try{this.queue.requestCancellation(l.operationId,t.actorId)}catch{}let m=this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"queued",output:{semantics:"at_least_once"}});if(m.operationId)return m;let f=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:t.actorId,kind:"job.execute",input:{jobId:e.id,executionId:m.id},idempotencyKey:`job-execution:${m.id}`,lockKey:e.overlapPolicy==="allow"?`job-execution:${m.id}`:`job:${e.id}`,maxAttempts:e.retryPolicy.maxAttempts,timeoutSeconds:e.timeoutSeconds,retryClasses:["job_transient"],resumePolicy:"requeue"}).operation;return this.store.attachOperation(m.id,f.id)}tick(e=this.store.now()){let t=[];for(let r of this.store.due(e.toISOString())){let a=r.nextRunAt,l=Rt(r.normalizedExpression,r.timezone,e,1)[0];if(r.missedRunPolicy==="catch_up"){let m=a,f=0;while(m<=e.toISOString()&&f<10)t.push(this.enqueue(r,{trigger:m===a?"scheduled":"catch_up",scheduledFor:m})),m=Rt(r.normalizedExpression,r.timezone,new Date(m),1)[0],f++}else t.push(this.enqueue(r,{trigger:"scheduled",scheduledFor:a}));this.store.markScheduled(r.id,a,l)}return t}}function Au(e){return{"job.execute":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.store.get(String(a.jobId??"")),m=e.store.getExecution(String(a.executionId??""));if(!l||!m)throw Error("Scheduled job execution is no longer available.");e.store.transitionExecution(m.id,"running",{attempt:r.operation.attempt}),r.checkpoint("execute",`Running ${l.name} on ${l.provider}.`),r.log(`Trigger ${m.trigger}; scheduled for ${m.scheduledFor}; semantics at-least-once.`,{stream:"system"});let f=await e.executor(l,l.target,r);if(f.stdout)r.log(f.stdout,{stream:"stdout"});if(f.stderr)r.log(f.stderr,{stream:"stderr"});if(!f.ok){if(e.store.transitionExecution(m.id,r.operation.attempt>=l.retryPolicy.maxAttempts?"dead":"failed",{attempt:r.operation.attempt,error:f.stderr??"Job execution failed."}),f.retryable)throw new te(f.stderr??"Scheduled job failed transiently.","job_transient");throw Error(f.stderr??"Scheduled job failed.")}return e.store.transitionExecution(m.id,"succeeded",{attempt:r.operation.attempt,output:f.output??{}}),{jobId:l.id,executionId:m.id,provider:l.provider}}}}var zr=(e)=>typeof e==="string"&&e?e:void 0,Nh=(e)=>Number(e)===1,ko=(e)=>{try{return JSON.parse(String(e))}catch{return{}}},Ui=(e,t,r,a)=>{let l=Number(e);return Number.isFinite(l)?Math.min(a,Math.max(r,Math.floor(l))):t};function Uc(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:zr(e.environment_id),resourceId:zr(e.resource_id),name:String(e.name),provider:String(e.provider),expression:String(e.expression),normalizedExpression:String(e.normalized_expression),timezone:String(e.timezone),startsAt:zr(e.starts_at),endsAt:zr(e.ends_at),flexibleMinutes:Number(e.flexible_minutes),target:ko(e.target),payloadRefs:ko(e.payload_refs),missedRunPolicy:String(e.missed_run_policy),overlapPolicy:String(e.overlap_policy),retryPolicy:ko(e.retry_policy),timeoutSeconds:Number(e.timeout_seconds),enabled:Nh(e.enabled),origin:String(e.origin),sourceKey:zr(e.source_key),ownerActorId:zr(e.owner_actor_id),observedState:ko(e.observed_state),reconciliationStatus:String(e.reconciliation_status),nextRunAt:zr(e.next_run_at),lastScheduledFor:zr(e.last_scheduled_for),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qc(e){return{id:String(e.id),jobId:String(e.job_id),operationId:zr(e.operation_id),trigger:String(e.trigger),scheduledFor:String(e.scheduled_for),idempotencyKey:String(e.idempotency_key),status:String(e.status),attempt:Number(e.attempt),startedAt:zr(e.started_at),finishedAt:zr(e.finished_at),output:ko(e.output),error:zr(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Cp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:zr(e.environment_id),resourceId:zr(e.resource_id),name:String(e.name),provider:String(e.provider),queue:String(e.queue),processes:Number(e.processes),timeoutSeconds:Number(e.timeout_seconds),restartPolicy:String(e.restart_policy),target:ko(e.target),enabled:Nh(e.enabled),origin:String(e.origin),sourceKey:zr(e.source_key),ownerActorId:zr(e.owner_actor_id),observedState:ko(e.observed_state),reconciliationStatus:String(e.reconciliation_status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class da{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return this.options.now?.()??new Date}create(e){if(!e.name.trim())throw Error("Scheduled jobs require a name.");let t=Dt(e.expression,e.timezone,this.now(),1),r=crypto.randomUUID(),a=this.now().toISOString(),l=e.startsAt?new Date(e.startsAt).toISOString():void 0,m=e.endsAt?new Date(e.endsAt).toISOString():void 0;if(l&&m&&l>=m)throw Error("Schedule start must be before end.");let f=t.nextRuns.find((b)=>(!l||b>=l)&&(!m||b<=m));return this.controlPlane.database.run("INSERT INTO scheduled_jobs (id,organization_id,project_id,environment_id,resource_id,name,provider,expression,normalized_expression,timezone,starts_at,ends_at,flexible_minutes,target,payload_refs,missed_run_policy,overlap_policy,retry_policy,timeout_seconds,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,next_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.trim().slice(0,120),e.provider,e.expression,t.normalized,e.timezone,l??null,m??null,Ui(e.flexibleMinutes,0,0,1440),JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify({maxAttempts:Ui(e.retryPolicy.maxAttempts,3,1,20),backoffSeconds:Ui(e.retryPolicy.backoffSeconds,30,0,86400),deadLetterRef:e.retryPolicy.deadLetterRef}),Ui(e.timeoutSeconds,900,1,86400),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,f??null,1,a,a]),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE id=?").get(e);return t?Uc(t):void 0}getBySource(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE project_id=? AND environment_id IS ? AND source_key=?").get(e,t??null,r);return a?Uc(a):void 0}list(e,t={}){let r=["project_id=?"],a=[e];if(t.environmentId)r.push("environment_id=?"),a.push(t.environmentId);if(t.resourceIds?.length)r.push(`resource_id IN (${t.resourceIds.map(()=>"?").join(",")})`),a.push(...t.resourceIds);if(t.enabled!=null)r.push("enabled=?"),a.push(t.enabled?1:0);return this.controlPlane.database.query(`SELECT * FROM scheduled_jobs WHERE ${r.join(" AND ")} ORDER BY next_run_at IS NULL,next_run_at,name`).all(...a).map(Uc)}setEnabled(e,t){this.controlPlane.database.run("UPDATE scheduled_jobs SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now().toISOString(),e]);let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");return r}updateSchedule(e,t){let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");let a=t.expression??r.expression,l=t.timezone??r.timezone,m=Dt(a,l,this.now(),1),f=this.now().toISOString();return this.controlPlane.database.run("UPDATE scheduled_jobs SET expression=?,normalized_expression=?,timezone=?,missed_run_policy=?,overlap_policy=?,timeout_seconds=?,next_run_at=?,reconciliation_status=?,version=version+1,updated_at=? WHERE id=?",[a,m.normalized,l,t.missedRunPolicy??r.missedRunPolicy,t.overlapPolicy??r.overlapPolicy,Ui(t.timeoutSeconds,r.timeoutSeconds,1,86400),m.nextRuns[0],"pending",f,e]),this.get(e)}remove(e){let t=this.get(e);if(!t)throw Error("Scheduled job was not found.");if(t.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");this.controlPlane.database.run("DELETE FROM scheduled_jobs WHERE id=?",[e])}markScheduled(e,t,r){this.controlPlane.database.run("UPDATE scheduled_jobs SET last_scheduled_for=?,next_run_at=?,updated_at=? WHERE id=?",[t,r??null,this.now().toISOString(),e])}reconcile(e,t,r){return this.controlPlane.database.run("UPDATE scheduled_jobs SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]),this.get(e)}upsertConfigJob(e){let t=this.getBySource(e.projectId,e.environmentId,e.sourceKey);if(!t)return this.create(e);let r=Dt(e.expression,e.timezone,this.now(),1),a=this.now().toISOString();if(t.resourceId===e.resourceId&&t.name===e.name&&t.provider===e.provider&&t.expression===e.expression&&t.normalizedExpression===r.normalized&&t.timezone===e.timezone&&JSON.stringify(t.target)===JSON.stringify(e.target)&&JSON.stringify(t.payloadRefs)===JSON.stringify(e.payloadRefs)&&t.missedRunPolicy===e.missedRunPolicy&&t.overlapPolicy===e.overlapPolicy&&JSON.stringify(t.retryPolicy)===JSON.stringify(e.retryPolicy)&&t.timeoutSeconds===e.timeoutSeconds&&t.enabled===e.enabled)return t;return this.controlPlane.database.run("UPDATE scheduled_jobs SET resource_id=?,name=?,provider=?,expression=?,normalized_expression=?,timezone=?,target=?,payload_refs=?,missed_run_policy=?,overlap_policy=?,retry_policy=?,timeout_seconds=?,enabled=?,observed_state=?,reconciliation_status=?,next_run_at=COALESCE(next_run_at,?),version=version+1,updated_at=? WHERE id=?",[e.resourceId??null,e.name,e.provider,e.expression,r.normalized,e.timezone,JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify(e.retryPolicy),e.timeoutSeconds,e.enabled?1:0,JSON.stringify(e.observedState),e.reconciliationStatus,r.nextRuns[0],a,t.id]),this.get(t.id)}due(e=this.now().toISOString()){return this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=? AND (starts_at IS NULL OR starts_at<=?) AND (ends_at IS NULL OR ends_at>=?) ORDER BY next_run_at LIMIT 200").all(e,e,e).map(Uc)}createExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return qc(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO job_executions (id,job_id,operation_id,trigger,scheduled_for,idempotency_key,status,attempt,output,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[r,e.jobId,e.operationId??null,e.trigger,e.scheduledFor,e.idempotencyKey,e.status,0,JSON.stringify(e.output),a,a]),this.getExecution(r)}getExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE id=?").get(e);return t?qc(t):void 0}listExecutions(e,t=100){return this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? ORDER BY scheduled_for DESC,created_at DESC LIMIT ?").all(e,Math.min(1000,Math.max(1,t))).map(qc)}activeExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? AND status IN ('queued','running') ORDER BY created_at DESC LIMIT 1").get(e);return t?qc(t):void 0}attachOperation(e,t){return this.controlPlane.database.run("UPDATE job_executions SET operation_id=?,updated_at=? WHERE id=?",[t,this.now().toISOString(),e]),this.getExecution(e)}transitionExecution(e,t,r={}){let a=this.now().toISOString(),l=t==="running"?a:null,m=["succeeded","failed","skipped","dead"].includes(t)?a:null;return this.controlPlane.database.run("UPDATE job_executions SET status=?,attempt=COALESCE(?,attempt),started_at=COALESCE(started_at,?),finished_at=?,output=COALESCE(?,output),error=?,updated_at=? WHERE id=?",[t,r.attempt??null,l,m,r.output?JSON.stringify(r.output):null,r.error?.slice(0,2000)??null,a,e]),this.getExecution(e)}upsertWorker(e){let t=e.sourceKey?this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE project_id=? AND source_key=? AND environment_id IS ?").get(e.projectId,e.sourceKey,e.environmentId??null):void 0,r=t?Cp(t):void 0,a=r?.id??crypto.randomUUID(),l=this.now().toISOString(),m=Ui(e.processes,1,0,1000),f=Ui(e.timeoutSeconds,60,1,86400);if(r&&r.resourceId===e.resourceId&&r.name===e.name.slice(0,120)&&r.provider===e.provider&&r.queue===e.queue.slice(0,200)&&r.processes===m&&r.timeoutSeconds===f&&r.restartPolicy===e.restartPolicy&&JSON.stringify(r.target)===JSON.stringify(e.target)&&r.enabled===e.enabled)return r;return this.controlPlane.database.run("INSERT INTO worker_definitions (id,organization_id,project_id,environment_id,resource_id,name,provider,queue,processes,timeout_seconds,restart_policy,target,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,resource_id=excluded.resource_id,provider=excluded.provider,queue=excluded.queue,processes=excluded.processes,timeout_seconds=excluded.timeout_seconds,restart_policy=excluded.restart_policy,target=excluded.target,enabled=excluded.enabled,observed_state=excluded.observed_state,reconciliation_status=excluded.reconciliation_status,version=worker_definitions.version+1,updated_at=excluded.updated_at",[a,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.slice(0,120),e.provider,e.queue.slice(0,200),m,f,e.restartPolicy,JSON.stringify(e.target),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,1,r?.createdAt??l,l]),this.getWorker(a)}getWorker(e){let t=this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE id=?").get(e);return t?Cp(t):void 0}listWorkers(e,t){return this.controlPlane.database.query(`SELECT * FROM worker_definitions WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Cp)}setWorkerProcesses(e,t){this.controlPlane.database.run("UPDATE worker_definitions SET processes=?,reconciliation_status='pending',version=version+1,updated_at=? WHERE id=?",[Ui(t,1,0,1000),this.now().toISOString(),e]);let r=this.getWorker(e);if(!r)throw Error("Worker was not found.");return r}reconcileWorker(e,t,r){this.controlPlane.database.run("UPDATE worker_definitions SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]);let a=this.getWorker(e);if(!a)throw Error("Worker was not found.");return a}}var yt=(e)=>e==null?void 0:String(e),Vc=(e)=>Number(e)===1,Vi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}};function Bh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),provider:String(e.provider),endpoint:yt(e.endpoint),endpointPolicy:String(e.endpoint_policy),bucket:yt(e.bucket),prefix:String(e.prefix),region:yt(e.region),forcePathStyle:Vc(e.force_path_style),credentialRef:yt(e.credential_ref),encryption:String(e.encryption),encryptionKeyRef:yt(e.encryption_key_ref),immutability:Vi(e.immutability,{}),status:String(e.status),lastTestedAt:yt(e.last_tested_at),lastSuccessAt:yt(e.last_success_at),lastFailureAt:yt(e.last_failure_at),lastError:yt(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Pp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:yt(e.environment_id),resourceId:yt(e.resource_id),dataServiceId:yt(e.data_service_id),destinationId:String(e.destination_id),name:String(e.name),resourceKind:String(e.resource_kind),schedule:String(e.schedule),timezone:String(e.timezone),retention:Vi(e.retention,{}),compression:String(e.compression),encryption:String(e.encryption),includePatterns:Vi(e.include_patterns,[]),excludePatterns:Vi(e.exclude_patterns,[]),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),healthCheckId:yt(e.health_check_id),enabled:Vc(e.enabled),nextRunAt:yt(e.next_run_at),lastRunAt:yt(e.last_run_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function _p(e){return{id:String(e.id),projectId:String(e.project_id),policyId:yt(e.policy_id),destinationId:String(e.destination_id),resourceId:yt(e.resource_id),dataServiceId:yt(e.data_service_id),backupJobId:yt(e.backup_job_id),kind:String(e.kind),pointInTime:String(e.point_in_time),uri:String(e.uri),sizeBytes:Number(e.size_bytes),checksum:String(e.checksum),manifest:Vi(e.manifest,{}),toolVersion:yt(e.tool_version),engineVersion:yt(e.engine_version),expiresAt:yt(e.expires_at),lockedUntil:yt(e.locked_until),held:Vc(e.held),pinned:Vc(e.pinned),status:String(e.status),verificationState:String(e.verification_state),verifiedAt:yt(e.verified_at),durationMs:e.duration_ms==null?void 0:Number(e.duration_ms),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Tp(e){return{id:String(e.id),projectId:String(e.project_id),policyId:yt(e.policy_id),recoveryPointId:yt(e.recovery_point_id),operationId:yt(e.operation_id),kind:String(e.kind),status:String(e.status),idempotencyKey:String(e.idempotency_key),target:Vi(e.target,{}),restoreMode:yt(e.restore_mode),cancellability:String(e.cancellability),safetyBackupId:yt(e.safety_backup_id),healthResult:e.health_result?Vi(e.health_result,{}):void 0,progress:Vi(e.progress,{}),error:yt(e.error),startedAt:yt(e.started_at),finishedAt:yt(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qI(e){let t=e.toLowerCase();if(t==="localhost"||t.endsWith(".localhost")||t.endsWith(".local")||t.endsWith(".internal"))return!0;if(jh(t)===6)return t==="::1"||t.startsWith("fe80:");if(jh(t)!==4)return!1;let[r,a]=t.split(".").map(Number);return r===10||r===127||r===0||r===169&&a===254||r===172&&a>=16&&a<=31||r===192&&a===168}function Jf(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup destination names must be 2-63 lowercase letters, numbers, or dashes.");if(e.provider!=="aws_backup"&&!e.bucket)throw Error("S3 backup destinations require a bucket.");if(e.provider==="s3_compatible"&&!e.endpoint)throw Error("S3-compatible destinations require an explicit endpoint.");if(e.provider==="s3_compatible"&&!e.credentialRef)throw Error("S3-compatible destinations require a credential reference.");if(e.encryption!=="provider"&&!e.encryptionKeyRef)throw Error("Client-side encryption requires an encryption key reference.");if(e.endpoint){let t=new URL(e.endpoint);if(t.protocol!=="https:"||t.username||t.password||t.search||t.hash||t.pathname!=="/")throw Error("Backup endpoints must be origin-only HTTPS URLs without credentials, paths, queries, or fragments.");if(qI(t.hostname)&&e.endpointPolicy!=="allow_private")throw Error("Private backup endpoints require endpointPolicy allow_private.")}}class _a{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}createDestination(e){Jf(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_destinations (id,organization_id,project_id,name,provider,endpoint,endpoint_policy,bucket,prefix,region,force_path_style,credential_ref,encryption,encryption_key_ref,immutability,status,last_tested_at,last_success_at,last_failure_at,last_error,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.provider,e.endpoint??null,e.endpointPolicy,e.bucket??null,e.prefix,e.region??null,e.forcePathStyle?1:0,e.credentialRef??null,e.encryption,e.encryptionKeyRef??null,JSON.stringify(e.immutability),e.status,e.lastTestedAt??null,e.lastSuccessAt??null,e.lastFailureAt??null,e.lastError??null,1,r,r]),this.getDestination(t)}getDestination(e){let t=this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE id=?").get(e);return t?Bh(t):void 0}listDestinations(e){return this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE project_id=? ORDER BY name").all(e).map(Bh)}recordDestinationTest(e,t){let r=this.now().toISOString();return this.controlPlane.database.run("UPDATE backup_destinations SET status=?,last_tested_at=?,last_success_at=CASE WHEN ? THEN ? ELSE last_success_at END,last_failure_at=CASE WHEN ? THEN last_failure_at ELSE ? END,last_error=?,version=version+1,updated_at=? WHERE id=?",[t.ok?"healthy":"failing",r,t.ok?1:0,r,t.ok?1:0,r,t.ok?null:String(t.error??"Destination test failed.").slice(0,1000),r,e]),this.getDestination(e)}createPolicy(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup policy names must be lowercase slugs.");if(!e.resourceId&&!e.dataServiceId&&!["control_plane","infrastructure"].includes(e.resourceKind))throw Error("A backup policy requires a resource or data service target.");let t=this.getDestination(e.destinationId);if(!t||t.projectId!==e.projectId)throw Error("Backup destination was not found.");if(e.resourceKind==="control_plane"&&t.encryption==="provider")throw Error("Control-plane backups require client-side destination encryption.");if(["logical_database","volume","files","control_plane"].includes(e.resourceKind)&&t.provider==="aws_backup")throw Error(`${e.resourceKind} backups require an object-storage destination.`);if(e.resourceKind==="infrastructure"&&t.provider!=="aws_backup")throw Error("Infrastructure backups require an AWS Backup destination.");let r=tt(e.schedule),a=Rt(r.normalized,e.timezone,this.now(),1)[0],l=crypto.randomUUID(),m=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_policies (id,organization_id,project_id,environment_id,resource_id,data_service_id,destination_id,name,resource_kind,schedule,timezone,retention,compression,encryption,include_patterns,exclude_patterns,expected_rpo_minutes,expected_rto_minutes,health_check_id,enabled,next_run_at,last_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[l,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.dataServiceId??null,e.destinationId,e.name,e.resourceKind,r.normalized,e.timezone,JSON.stringify(e.retention),e.compression,e.encryption,JSON.stringify(e.includePatterns),JSON.stringify(e.excludePatterns),e.expectedRpoMinutes,e.expectedRtoMinutes,e.healthCheckId??null,e.enabled?1:0,a,e.lastRunAt??null,1,m,m]),this.getPolicy(l)}getPolicy(e){let t=this.controlPlane.database.query("SELECT * FROM backup_policies WHERE id=?").get(e);return t?Pp(t):void 0}listPolicies(e,t){return this.controlPlane.database.query(`SELECT * FROM backup_policies WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Pp)}duePolicies(e=this.now()){return this.controlPlane.database.query("SELECT * FROM backup_policies WHERE enabled=1 AND next_run_at<=? ORDER BY next_run_at,id").all(e.toISOString()).map(Pp)}advancePolicy(e,t){let r=this.getPolicy(e);if(!r)throw Error("Backup policy was not found.");let a=Rt(r.schedule,r.timezone,new Date(t),1)[0];return this.controlPlane.database.run("UPDATE backup_policies SET last_run_at=?,next_run_at=?,version=version+1,updated_at=? WHERE id=?",[t,a,this.now().toISOString(),e]),this.getPolicy(e)}createJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return Tp(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_jobs (id,project_id,policy_id,recovery_point_id,operation_id,kind,status,idempotency_key,target,restore_mode,cancellability,safety_backup_id,health_result,progress,error,started_at,finished_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.projectId,e.policyId??null,e.recoveryPointId??null,e.operationId??null,e.kind,e.status,e.idempotencyKey,JSON.stringify(e.target),e.restoreMode??null,e.cancellability,e.safetyBackupId??null,e.healthResult?JSON.stringify(e.healthResult):null,JSON.stringify(e.progress),e.error??null,e.startedAt??null,e.finishedAt??null,a,a]),this.getJob(r)}getJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE id=?").get(e);return t?Tp(t):void 0}listJobs(e){return this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE project_id=? ORDER BY created_at DESC").all(e).map(Tp)}updateJob(e,t){let r=this.getJob(e);if(!r)throw Error("Backup job was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE backup_jobs SET status=?,operation_id=?,recovery_point_id=?,progress=?,health_result=?,error=?,started_at=?,finished_at=?,safety_backup_id=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,a.recoveryPointId??null,JSON.stringify(a.progress),a.healthResult?JSON.stringify(a.healthResult):null,a.error??null,a.startedAt??null,a.finishedAt??null,a.safetyBackupId??null,this.now().toISOString(),e]),this.getJob(e)}createRecoveryPoint(e){if(!/^sha256:[a-f0-9]{64}$/i.test(e.checksum))throw Error("Recovery points require a SHA-256 checksum.");if(typeof e.uri!=="string"||!["s3:","aws-backup:","file:"].some((a)=>e.uri.startsWith(a)))throw Error("Recovery point URI uses an unsupported destination scheme.");let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO recovery_points (id,project_id,policy_id,destination_id,resource_id,data_service_id,backup_job_id,kind,point_in_time,uri,size_bytes,checksum,manifest,tool_version,engine_version,expires_at,locked_until,held,pinned,status,verification_state,verified_at,duration_ms,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.policyId??null,e.destinationId,e.resourceId??null,e.dataServiceId??null,e.backupJobId??null,e.kind,e.pointInTime,e.uri,e.sizeBytes,e.checksum,JSON.stringify(e.manifest),e.toolVersion??null,e.engineVersion??null,e.expiresAt??null,e.lockedUntil??null,e.held?1:0,e.pinned?1:0,e.status,e.verificationState,e.verifiedAt??null,e.durationMs??null,r,r]),this.getRecoveryPoint(t)}getRecoveryPoint(e){let t=this.controlPlane.database.query("SELECT * FROM recovery_points WHERE id=?").get(e);return t?_p(t):void 0}listRecoveryPoints(e,t){return this.controlPlane.database.query(`SELECT * FROM recovery_points WHERE project_id=?${t?" AND policy_id=?":""} ORDER BY point_in_time DESC`).all(e,...t?[t]:[]).map(_p)}updateRecoveryPoint(e,t){let r=this.getRecoveryPoint(e);if(!r)throw Error("Recovery point was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE recovery_points SET status=?,verification_state=?,verified_at=?,held=?,pinned=?,manifest=?,duration_ms=?,updated_at=? WHERE id=?",[a.status,a.verificationState,a.verifiedAt??null,a.held?1:0,a.pinned?1:0,JSON.stringify(a.manifest),a.durationMs??null,this.now().toISOString(),e]),this.getRecoveryPoint(e)}retentionCandidates(e=this.now()){let t=this.controlPlane.database.query(`SELECT rp.* FROM recovery_points rp
+`}}function zI(e){let t=tt(e);if(t.kind==="rate")return e;let r=t.normalized.slice(5,-1).trim().split(/\s+/);if(r.length===6)return t.normalized;let[a,l,m,f,b]=r,k=b==="*"?"?":b.replace(/(^|[,-])0(?=$|[,-])/g,(y,R)=>`${R}1`);return m==="*"&&b!=="*"?`cron(${a} ${l} ? ${f} ${k} *)`:`cron(${a} ${l} ${m} ${f} ? *)`}function hu(e){let t=pn(e);if(!t.supported)throw Error(t.notes.join(" "));return{Name:`ts-cloud-${e.id}`,ScheduleExpression:zI(e.expression),ScheduleExpressionTimezone:e.timezone,State:e.enabled?"ENABLED":"DISABLED",FlexibleTimeWindow:e.flexibleMinutes?{Mode:"FLEXIBLE",MaximumWindowInMinutes:e.flexibleMinutes}:{Mode:"OFF"},Target:{kind:e.target.kind,functionName:e.target.functionName??null,payloadRefs:e.payloadRefs},RetryPolicy:{MaximumRetryAttempts:e.retryPolicy.maxAttempts,MaximumEventAgeInSeconds:e.timeoutSeconds},DeadLetterRef:e.retryPolicy.deadLetterRef??null}}function hS(e,t){if(!t)return{status:"unavailable",observedState:{message:"Provider observation is unavailable."}};let r=String(t.expression??""),a=t.enabled;return{status:r&&r!==e.normalizedExpression||typeof a==="boolean"&&a!==e.enabled?"drifted":"in_sync",observedState:t}}function _f(e){if(e.provider==="server"){let t=ss(e);return{path:t.path,content:t.content,enabled:e.enabled}}if(e.provider==="eventbridge")return hu(e);throw Error(`No reconciliation adapter is configured for ${e.provider} schedules.`)}function Ap(e,t){if(Array.isArray(e))return Array.isArray(t)&&e.length===t.length&&e.every((r,a)=>Ap(r,t[a]));if(e&&typeof e==="object"){if(!t||typeof t!=="object"||Array.isArray(t))return!1;return Object.entries(e).every(([r,a])=>Ap(a,t[r]))}return e===t}class Lf{transport;provider="server";constructor(e){this.transport=e}async observe(e){let t=ss(e),r=await this.transport.read(t.path);return r==null?void 0:{path:t.path,content:r,enabled:!0}}async apply(e,t){let r=String(t.path??"");if(!e.enabled){await this.transport.removeRootOwned(r);return}await this.transport.writeRootOwned(r,String(t.content??""))}async remove(e){await this.transport.removeRootOwned(ss(e).path)}matches(e,t){if(e.enabled===!1)return!1;return e.path===t.path&&e.content===t.content}}class $f{transport;provider="eventbridge";constructor(e){this.transport=e}observe(e){return this.transport.get(`ts-cloud-${e.id}`)}apply(e,t){return this.transport.put(t)}remove(e){return this.transport.remove(`ts-cloud-${e.id}`)}matches(e,t){return Ap(e,t)}}class Mf{store;constructor(e){this.store=e}async reconcile(e,t,r={}){if(t.provider!==e.provider)return this.store.reconcile(e.id,"unsupported",{provider:t.provider,message:`Adapter ${t.provider} cannot reconcile ${e.provider}.`});try{let a=_f(e),l=await t.observe(e);if(l&&t.matches(a,l))return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:l});if(r.apply===!1)return this.store.reconcile(e.id,l?"drifted":"unavailable",{provider:t.provider,observed:l??null,applyRequired:!0});if(await t.apply(e,a),!e.enabled)return this.store.reconcile(e.id,"in_sync",{provider:t.provider,observed:null,disabled:!0});let m=await t.observe(e);return this.store.reconcile(e.id,m&&t.matches(a,m)?"in_sync":"drifted",{provider:t.provider,observed:m??null,applied:!0})}catch(a){return this.store.reconcile(e.id,"unavailable",{provider:t.provider,error:a instanceof Error?a.message:String(a)})}}async remove(e,t){if(e.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");if(t.provider!==e.provider)throw Error(`Adapter ${t.provider} cannot remove ${e.provider}.`);await t.remove(e),this.store.remove(e.id)}}function UI(e){if(e.queues===!0)return[{queue:"default",processes:e.queueConcurrency??1}];if(!Array.isArray(e.queues))return[];return e.queues.map((t)=>{if(typeof t==="string")return{queue:t,processes:e.queueConcurrency??1};let[r,a]=Object.entries(t)[0]??["default",e.queueConcurrency??1];return{queue:r,processes:a}})}function la(e,t,r){let a=new Set,l=new Set,m=new Map(r.resources.map((T)=>[T.slug,T])),f=0,b=0;for(let[T,N]of Object.entries(t.sites??{})){let j=m.get(T);if(N.scheduler){let Y=`config:site:${T}:scheduler`;a.add(Y),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:j?.id,name:`${T} scheduler`,provider:"server",expression:"* * * * *",timezone:"UTC",flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:`scheduler:run:${T}`},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:300,enabled:!0,origin:"config",sourceKey:Y,observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),f++}let U=N,q=Array.isArray(U.queues??U.workers)?U.queues??U.workers:[];for(let[Y,ee]of q.entries()){let le=typeof ee==="string"?{queue:ee}:ee,Z=String(le.queue??le.name??"default"),ie=`config:site:${T}:worker:${Y}:${Z}`;l.add(ie),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,resourceId:j?.id,name:`${T}:${Z}`,provider:"systemd",queue:Z,processes:Number(le.processes)||1,timeoutSeconds:Number(le.timeout)||60,restartPolicy:"always",target:{operationId:`worker:restart:${T}`,site:T},enabled:!0,origin:"config",sourceKey:ie,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),b++}}let k=t.infrastructure?.compute?.backups;if(k?.enabled)a.add("config:platform:backup"),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:"Scheduled backup",provider:"server",expression:String(k.schedule??"0 2 * * *"),timezone:String(k.timezone??"UTC"),flexibleMinutes:0,target:{kind:"dashboard_operation",operationId:"backup:run"},payloadRefs:{},missedRunPolicy:"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:60},timeoutSeconds:3600,enabled:!0,origin:"config",sourceKey:"config:platform:backup",observedState:{source:"cloud.config.ts"},reconciliationStatus:"pending"}),f++;let y=t.environments?.[r.environment.slug]?.app;if(y){if(y.scheduler!=="off"){let T=`config:serverless:${r.environment.slug}:scheduler`;a.add(T),e.upsertConfigJob({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name} serverless scheduler`,provider:"eventbridge",expression:"rate(1 minute)",timezone:"UTC",flexibleMinutes:0,target:{kind:"serverless_scheduler",action:"schedule:run"},payloadRefs:{},missedRunPolicy:y.scheduler==="sub-minute"?"catch_up":"skip",overlapPolicy:"forbid",retryPolicy:{maxAttempts:3,backoffSeconds:30},timeoutSeconds:y.cliTimeout??900,enabled:!0,origin:"config",sourceKey:T,observedState:{source:"cloud.config.ts",mode:y.scheduler??"on"},reconciliationStatus:"pending"}),f++}for(let{queue:T,processes:N}of UI(y)){let j=`config:serverless:${r.environment.slug}:worker:${T}`;l.add(j),e.upsertWorker({organizationId:r.organization.id,projectId:r.project.id,environmentId:r.environment.id,name:`${r.environment.name}:${T}`,provider:"lambda",queue:T,processes:N,timeoutSeconds:y.queueTimeout??120,restartPolicy:"on_failure",target:{function:"queue",queue:T},enabled:!0,origin:"config",sourceKey:j,observedState:{source:"cloud.config.ts",currentJob:null,failures:0},reconciliationStatus:"pending"}),b++}}let R=0;for(let T of e.list(r.project.id,{environmentId:r.environment.id}).filter((N)=>N.origin==="config"&&N.sourceKey&&!a.has(N.sourceKey)))e.reconcile(T.id,"drifted",{...T.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),R++;for(let T of e.listWorkers(r.project.id,r.environment.id).filter((N)=>N.origin==="config"&&N.sourceKey&&!l.has(N.sourceKey)))e.reconcileWorker(T.id,"drifted",{...T.observedState,reason:"Definition is no longer present in configuration; retained for non-destructive review."}),R++;return{jobs:f,workers:b,drifted:R}}class ua{store;queue;constructor(e,t={}){this.store=e;this.queue=t.queue??new c(e.controlPlane)}enqueue(e,t){let r=new Date(t.scheduledFor??this.store.now()).toISOString(),a=`${e.id}:${t.trigger==="manual"?crypto.randomUUID():r}`,l=this.store.activeExecution(e.id);if(l&&e.overlapPolicy==="forbid")return this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"skipped",output:{reason:"overlap_forbidden",activeExecutionId:l.id}});if(l&&e.overlapPolicy==="replace"&&l.operationId)try{this.queue.requestCancellation(l.operationId,t.actorId)}catch{}let m=this.store.createExecution({jobId:e.id,trigger:t.trigger,scheduledFor:r,idempotencyKey:a,status:"queued",output:{semantics:"at_least_once"}});if(m.operationId)return m;let f=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:t.actorId,kind:"job.execute",input:{jobId:e.id,executionId:m.id},idempotencyKey:`job-execution:${m.id}`,lockKey:e.overlapPolicy==="allow"?`job-execution:${m.id}`:`job:${e.id}`,maxAttempts:e.retryPolicy.maxAttempts,timeoutSeconds:e.timeoutSeconds,retryClasses:["job_transient"],resumePolicy:"requeue"}).operation;return this.store.attachOperation(m.id,f.id)}tick(e=this.store.now()){let t=[];for(let r of this.store.due(e.toISOString())){let a=r.nextRunAt,l=Rt(r.normalizedExpression,r.timezone,e,1)[0];if(r.missedRunPolicy==="catch_up"){let m=a,f=0;while(m<=e.toISOString()&&f<10)t.push(this.enqueue(r,{trigger:m===a?"scheduled":"catch_up",scheduledFor:m})),m=Rt(r.normalizedExpression,r.timezone,new Date(m),1)[0],f++}else t.push(this.enqueue(r,{trigger:"scheduled",scheduledFor:a}));this.store.markScheduled(r.id,a,l)}return t}}function Au(e){return{"job.execute":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.store.get(String(a.jobId??"")),m=e.store.getExecution(String(a.executionId??""));if(!l||!m)throw Error("Scheduled job execution is no longer available.");e.store.transitionExecution(m.id,"running",{attempt:r.operation.attempt}),r.checkpoint("execute",`Running ${l.name} on ${l.provider}.`),r.log(`Trigger ${m.trigger}; scheduled for ${m.scheduledFor}; semantics at-least-once.`,{stream:"system"});let f=await e.executor(l,l.target,r);if(f.stdout)r.log(f.stdout,{stream:"stdout"});if(f.stderr)r.log(f.stderr,{stream:"stderr"});if(!f.ok){if(e.store.transitionExecution(m.id,r.operation.attempt>=l.retryPolicy.maxAttempts?"dead":"failed",{attempt:r.operation.attempt,error:f.stderr??"Job execution failed."}),f.retryable)throw new te(f.stderr??"Scheduled job failed transiently.","job_transient");throw Error(f.stderr??"Scheduled job failed.")}return e.store.transitionExecution(m.id,"succeeded",{attempt:r.operation.attempt,output:f.output??{}}),{jobId:l.id,executionId:m.id,provider:l.provider}}}}var zr=(e)=>typeof e==="string"&&e?e:void 0,Nh=(e)=>Number(e)===1,ko=(e)=>{try{return JSON.parse(String(e))}catch{return{}}},Ui=(e,t,r,a)=>{let l=Number(e);return Number.isFinite(l)?Math.min(a,Math.max(r,Math.floor(l))):t};function Uc(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:zr(e.environment_id),resourceId:zr(e.resource_id),name:String(e.name),provider:String(e.provider),expression:String(e.expression),normalizedExpression:String(e.normalized_expression),timezone:String(e.timezone),startsAt:zr(e.starts_at),endsAt:zr(e.ends_at),flexibleMinutes:Number(e.flexible_minutes),target:ko(e.target),payloadRefs:ko(e.payload_refs),missedRunPolicy:String(e.missed_run_policy),overlapPolicy:String(e.overlap_policy),retryPolicy:ko(e.retry_policy),timeoutSeconds:Number(e.timeout_seconds),enabled:Nh(e.enabled),origin:String(e.origin),sourceKey:zr(e.source_key),ownerActorId:zr(e.owner_actor_id),observedState:ko(e.observed_state),reconciliationStatus:String(e.reconciliation_status),nextRunAt:zr(e.next_run_at),lastScheduledFor:zr(e.last_scheduled_for),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qc(e){return{id:String(e.id),jobId:String(e.job_id),operationId:zr(e.operation_id),trigger:String(e.trigger),scheduledFor:String(e.scheduled_for),idempotencyKey:String(e.idempotency_key),status:String(e.status),attempt:Number(e.attempt),startedAt:zr(e.started_at),finishedAt:zr(e.finished_at),output:ko(e.output),error:zr(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Cp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:zr(e.environment_id),resourceId:zr(e.resource_id),name:String(e.name),provider:String(e.provider),queue:String(e.queue),processes:Number(e.processes),timeoutSeconds:Number(e.timeout_seconds),restartPolicy:String(e.restart_policy),target:ko(e.target),enabled:Nh(e.enabled),origin:String(e.origin),sourceKey:zr(e.source_key),ownerActorId:zr(e.owner_actor_id),observedState:ko(e.observed_state),reconciliationStatus:String(e.reconciliation_status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class da{controlPlane;options;constructor(e,t={}){this.controlPlane=e;this.options=t}now(){return this.options.now?.()??new Date}create(e){if(!e.name.trim())throw Error("Scheduled jobs require a name.");let t=Dt(e.expression,e.timezone,this.now(),1),r=crypto.randomUUID(),a=this.now().toISOString(),l=e.startsAt?new Date(e.startsAt).toISOString():void 0,m=e.endsAt?new Date(e.endsAt).toISOString():void 0;if(l&&m&&l>=m)throw Error("Schedule start must be before end.");let f=t.nextRuns.find((b)=>(!l||b>=l)&&(!m||b<=m));return this.controlPlane.database.run("INSERT INTO scheduled_jobs (id,organization_id,project_id,environment_id,resource_id,name,provider,expression,normalized_expression,timezone,starts_at,ends_at,flexible_minutes,target,payload_refs,missed_run_policy,overlap_policy,retry_policy,timeout_seconds,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,next_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.trim().slice(0,120),e.provider,e.expression,t.normalized,e.timezone,l??null,m??null,Ui(e.flexibleMinutes,0,0,1440),JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify({maxAttempts:Ui(e.retryPolicy.maxAttempts,3,1,20),backoffSeconds:Ui(e.retryPolicy.backoffSeconds,30,0,86400),deadLetterRef:e.retryPolicy.deadLetterRef}),Ui(e.timeoutSeconds,900,1,86400),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,f??null,1,a,a]),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE id=?").get(e);return t?Uc(t):void 0}getBySource(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE project_id=? AND environment_id IS ? AND source_key=?").get(e,t??null,r);return a?Uc(a):void 0}list(e,t={}){let r=["project_id=?"],a=[e];if(t.environmentId)r.push("environment_id=?"),a.push(t.environmentId);if(t.resourceIds?.length)r.push(`resource_id IN (${t.resourceIds.map(()=>"?").join(",")})`),a.push(...t.resourceIds);if(t.enabled!=null)r.push("enabled=?"),a.push(t.enabled?1:0);return this.controlPlane.database.query(`SELECT * FROM scheduled_jobs WHERE ${r.join(" AND ")} ORDER BY next_run_at IS NULL,next_run_at,name`).all(...a).map(Uc)}setEnabled(e,t){this.controlPlane.database.run("UPDATE scheduled_jobs SET enabled=?,version=version+1,updated_at=? WHERE id=?",[t?1:0,this.now().toISOString(),e]);let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");return r}updateSchedule(e,t){let r=this.get(e);if(!r)throw Error("Scheduled job was not found.");let a=t.expression??r.expression,l=t.timezone??r.timezone,m=Dt(a,l,this.now(),1),f=this.now().toISOString();return this.controlPlane.database.run("UPDATE scheduled_jobs SET expression=?,normalized_expression=?,timezone=?,missed_run_policy=?,overlap_policy=?,timeout_seconds=?,next_run_at=?,reconciliation_status=?,version=version+1,updated_at=? WHERE id=?",[a,m.normalized,l,t.missedRunPolicy??r.missedRunPolicy,t.overlapPolicy??r.overlapPolicy,Ui(t.timeoutSeconds,r.timeoutSeconds,1,86400),m.nextRuns[0],"pending",f,e]),this.get(e)}remove(e){let t=this.get(e);if(!t)throw Error("Scheduled job was not found.");if(t.origin==="config")throw Error("Config-defined jobs must be removed from configuration, not destructively deleted.");this.controlPlane.database.run("DELETE FROM scheduled_jobs WHERE id=?",[e])}markScheduled(e,t,r){this.controlPlane.database.run("UPDATE scheduled_jobs SET last_scheduled_for=?,next_run_at=?,updated_at=? WHERE id=?",[t,r??null,this.now().toISOString(),e])}reconcile(e,t,r){return this.controlPlane.database.run("UPDATE scheduled_jobs SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]),this.get(e)}upsertConfigJob(e){let t=this.getBySource(e.projectId,e.environmentId,e.sourceKey);if(!t)return this.create(e);let r=Dt(e.expression,e.timezone,this.now(),1),a=this.now().toISOString();if(t.resourceId===e.resourceId&&t.name===e.name&&t.provider===e.provider&&t.expression===e.expression&&t.normalizedExpression===r.normalized&&t.timezone===e.timezone&&JSON.stringify(t.target)===JSON.stringify(e.target)&&JSON.stringify(t.payloadRefs)===JSON.stringify(e.payloadRefs)&&t.missedRunPolicy===e.missedRunPolicy&&t.overlapPolicy===e.overlapPolicy&&JSON.stringify(t.retryPolicy)===JSON.stringify(e.retryPolicy)&&t.timeoutSeconds===e.timeoutSeconds&&t.enabled===e.enabled)return t;return this.controlPlane.database.run("UPDATE scheduled_jobs SET resource_id=?,name=?,provider=?,expression=?,normalized_expression=?,timezone=?,target=?,payload_refs=?,missed_run_policy=?,overlap_policy=?,retry_policy=?,timeout_seconds=?,enabled=?,observed_state=?,reconciliation_status=?,next_run_at=COALESCE(next_run_at,?),version=version+1,updated_at=? WHERE id=?",[e.resourceId??null,e.name,e.provider,e.expression,r.normalized,e.timezone,JSON.stringify(e.target),JSON.stringify(e.payloadRefs),e.missedRunPolicy,e.overlapPolicy,JSON.stringify(e.retryPolicy),e.timeoutSeconds,e.enabled?1:0,JSON.stringify(e.observedState),e.reconciliationStatus,r.nextRuns[0],a,t.id]),this.get(t.id)}due(e=this.now().toISOString()){return this.controlPlane.database.query("SELECT * FROM scheduled_jobs WHERE enabled=1 AND next_run_at IS NOT NULL AND next_run_at<=? AND (starts_at IS NULL OR starts_at<=?) AND (ends_at IS NULL OR ends_at>=?) ORDER BY next_run_at LIMIT 200").all(e,e,e).map(Uc)}createExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return qc(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO job_executions (id,job_id,operation_id,trigger,scheduled_for,idempotency_key,status,attempt,output,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)",[r,e.jobId,e.operationId??null,e.trigger,e.scheduledFor,e.idempotencyKey,e.status,0,JSON.stringify(e.output),a,a]),this.getExecution(r)}getExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE id=?").get(e);return t?qc(t):void 0}listExecutions(e,t=100){return this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? ORDER BY scheduled_for DESC,created_at DESC LIMIT ?").all(e,Math.min(1000,Math.max(1,t))).map(qc)}activeExecution(e){let t=this.controlPlane.database.query("SELECT * FROM job_executions WHERE job_id=? AND status IN ('queued','running') ORDER BY created_at DESC LIMIT 1").get(e);return t?qc(t):void 0}attachOperation(e,t){return this.controlPlane.database.run("UPDATE job_executions SET operation_id=?,updated_at=? WHERE id=?",[t,this.now().toISOString(),e]),this.getExecution(e)}transitionExecution(e,t,r={}){let a=this.now().toISOString(),l=t==="running"?a:null,m=["succeeded","failed","skipped","dead"].includes(t)?a:null;return this.controlPlane.database.run("UPDATE job_executions SET status=?,attempt=COALESCE(?,attempt),started_at=COALESCE(started_at,?),finished_at=?,output=COALESCE(?,output),error=?,updated_at=? WHERE id=?",[t,r.attempt??null,l,m,r.output?JSON.stringify(r.output):null,r.error?.slice(0,2000)??null,a,e]),this.getExecution(e)}upsertWorker(e){let t=e.sourceKey?this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE project_id=? AND source_key=? AND environment_id IS ?").get(e.projectId,e.sourceKey,e.environmentId??null):void 0,r=t?Cp(t):void 0,a=r?.id??crypto.randomUUID(),l=this.now().toISOString(),m=Ui(e.processes,1,0,1000),f=Ui(e.timeoutSeconds,60,1,86400);if(r&&r.resourceId===e.resourceId&&r.name===e.name.slice(0,120)&&r.provider===e.provider&&r.queue===e.queue.slice(0,200)&&r.processes===m&&r.timeoutSeconds===f&&r.restartPolicy===e.restartPolicy&&JSON.stringify(r.target)===JSON.stringify(e.target)&&r.enabled===e.enabled)return r;return this.controlPlane.database.run("INSERT INTO worker_definitions (id,organization_id,project_id,environment_id,resource_id,name,provider,queue,processes,timeout_seconds,restart_policy,target,enabled,origin,source_key,owner_actor_id,observed_state,reconciliation_status,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ON CONFLICT(id) DO UPDATE SET name=excluded.name,resource_id=excluded.resource_id,provider=excluded.provider,queue=excluded.queue,processes=excluded.processes,timeout_seconds=excluded.timeout_seconds,restart_policy=excluded.restart_policy,target=excluded.target,enabled=excluded.enabled,observed_state=excluded.observed_state,reconciliation_status=excluded.reconciliation_status,version=worker_definitions.version+1,updated_at=excluded.updated_at",[a,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name.slice(0,120),e.provider,e.queue.slice(0,200),m,f,e.restartPolicy,JSON.stringify(e.target),e.enabled?1:0,e.origin,e.sourceKey??null,e.ownerActorId??null,JSON.stringify(e.observedState),e.reconciliationStatus,1,r?.createdAt??l,l]),this.getWorker(a)}getWorker(e){let t=this.controlPlane.database.query("SELECT * FROM worker_definitions WHERE id=?").get(e);return t?Cp(t):void 0}listWorkers(e,t){return this.controlPlane.database.query(`SELECT * FROM worker_definitions WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Cp)}setWorkerProcesses(e,t){this.controlPlane.database.run("UPDATE worker_definitions SET processes=?,reconciliation_status='pending',version=version+1,updated_at=? WHERE id=?",[Ui(t,1,0,1000),this.now().toISOString(),e]);let r=this.getWorker(e);if(!r)throw Error("Worker was not found.");return r}reconcileWorker(e,t,r){this.controlPlane.database.run("UPDATE worker_definitions SET reconciliation_status=?,observed_state=?,updated_at=? WHERE id=?",[t,JSON.stringify(r),this.now().toISOString(),e]);let a=this.getWorker(e);if(!a)throw Error("Worker was not found.");return a}}var yt=(e)=>e==null?void 0:String(e),Vc=(e)=>Number(e)===1,Vi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}};function Bh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),provider:String(e.provider),endpoint:yt(e.endpoint),endpointPolicy:String(e.endpoint_policy),bucket:yt(e.bucket),prefix:String(e.prefix),region:yt(e.region),forcePathStyle:Vc(e.force_path_style),credentialRef:yt(e.credential_ref),encryption:String(e.encryption),encryptionKeyRef:yt(e.encryption_key_ref),immutability:Vi(e.immutability,{}),status:String(e.status),lastTestedAt:yt(e.last_tested_at),lastSuccessAt:yt(e.last_success_at),lastFailureAt:yt(e.last_failure_at),lastError:yt(e.last_error),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Pp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:yt(e.environment_id),resourceId:yt(e.resource_id),dataServiceId:yt(e.data_service_id),destinationId:String(e.destination_id),name:String(e.name),resourceKind:String(e.resource_kind),schedule:String(e.schedule),timezone:String(e.timezone),retention:Vi(e.retention,{}),compression:String(e.compression),encryption:String(e.encryption),includePatterns:Vi(e.include_patterns,[]),excludePatterns:Vi(e.exclude_patterns,[]),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),healthCheckId:yt(e.health_check_id),enabled:Vc(e.enabled),nextRunAt:yt(e.next_run_at),lastRunAt:yt(e.last_run_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function _p(e){return{id:String(e.id),projectId:String(e.project_id),policyId:yt(e.policy_id),destinationId:String(e.destination_id),resourceId:yt(e.resource_id),dataServiceId:yt(e.data_service_id),backupJobId:yt(e.backup_job_id),kind:String(e.kind),pointInTime:String(e.point_in_time),uri:String(e.uri),sizeBytes:Number(e.size_bytes),checksum:String(e.checksum),manifest:Vi(e.manifest,{}),toolVersion:yt(e.tool_version),engineVersion:yt(e.engine_version),expiresAt:yt(e.expires_at),lockedUntil:yt(e.locked_until),held:Vc(e.held),pinned:Vc(e.pinned),status:String(e.status),verificationState:String(e.verification_state),verifiedAt:yt(e.verified_at),durationMs:e.duration_ms==null?void 0:Number(e.duration_ms),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Tp(e){return{id:String(e.id),projectId:String(e.project_id),policyId:yt(e.policy_id),recoveryPointId:yt(e.recovery_point_id),operationId:yt(e.operation_id),kind:String(e.kind),status:String(e.status),idempotencyKey:String(e.idempotency_key),target:Vi(e.target,{}),restoreMode:yt(e.restore_mode),cancellability:String(e.cancellability),safetyBackupId:yt(e.safety_backup_id),healthResult:e.health_result?Vi(e.health_result,{}):void 0,progress:Vi(e.progress,{}),error:yt(e.error),startedAt:yt(e.started_at),finishedAt:yt(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qI(e){let t=e.toLowerCase();if(t==="localhost"||t.endsWith(".localhost")||t.endsWith(".local")||t.endsWith(".internal"))return!0;if(jh(t)===6)return t==="::1"||t.startsWith("fe80:");if(jh(t)!==4)return!1;let[r,a]=t.split(".").map(Number);return r===10||r===127||r===0||r===169&&a===254||r===172&&a>=16&&a<=31||r===192&&a===168}function Xf(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup destination names must be 2-63 lowercase letters, numbers, or dashes.");if(e.provider!=="aws_backup"&&!e.bucket)throw Error("S3 backup destinations require a bucket.");if(e.provider==="s3_compatible"&&!e.endpoint)throw Error("S3-compatible destinations require an explicit endpoint.");if(e.provider==="s3_compatible"&&!e.credentialRef)throw Error("S3-compatible destinations require a credential reference.");if(e.encryption!=="provider"&&!e.encryptionKeyRef)throw Error("Client-side encryption requires an encryption key reference.");if(e.endpoint){let t=new URL(e.endpoint);if(t.protocol!=="https:"||t.username||t.password||t.search||t.hash||t.pathname!=="/")throw Error("Backup endpoints must be origin-only HTTPS URLs without credentials, paths, queries, or fragments.");if(qI(t.hostname)&&e.endpointPolicy!=="allow_private")throw Error("Private backup endpoints require endpointPolicy allow_private.")}}class _a{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}createDestination(e){Xf(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_destinations (id,organization_id,project_id,name,provider,endpoint,endpoint_policy,bucket,prefix,region,force_path_style,credential_ref,encryption,encryption_key_ref,immutability,status,last_tested_at,last_success_at,last_failure_at,last_error,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.provider,e.endpoint??null,e.endpointPolicy,e.bucket??null,e.prefix,e.region??null,e.forcePathStyle?1:0,e.credentialRef??null,e.encryption,e.encryptionKeyRef??null,JSON.stringify(e.immutability),e.status,e.lastTestedAt??null,e.lastSuccessAt??null,e.lastFailureAt??null,e.lastError??null,1,r,r]),this.getDestination(t)}getDestination(e){let t=this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE id=?").get(e);return t?Bh(t):void 0}listDestinations(e){return this.controlPlane.database.query("SELECT * FROM backup_destinations WHERE project_id=? ORDER BY name").all(e).map(Bh)}recordDestinationTest(e,t){let r=this.now().toISOString();return this.controlPlane.database.run("UPDATE backup_destinations SET status=?,last_tested_at=?,last_success_at=CASE WHEN ? THEN ? ELSE last_success_at END,last_failure_at=CASE WHEN ? THEN last_failure_at ELSE ? END,last_error=?,version=version+1,updated_at=? WHERE id=?",[t.ok?"healthy":"failing",r,t.ok?1:0,r,t.ok?1:0,r,t.ok?null:String(t.error??"Destination test failed.").slice(0,1000),r,e]),this.getDestination(e)}createPolicy(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Backup policy names must be lowercase slugs.");if(!e.resourceId&&!e.dataServiceId&&!["control_plane","infrastructure"].includes(e.resourceKind))throw Error("A backup policy requires a resource or data service target.");let t=this.getDestination(e.destinationId);if(!t||t.projectId!==e.projectId)throw Error("Backup destination was not found.");if(e.resourceKind==="control_plane"&&t.encryption==="provider")throw Error("Control-plane backups require client-side destination encryption.");if(["logical_database","volume","files","control_plane"].includes(e.resourceKind)&&t.provider==="aws_backup")throw Error(`${e.resourceKind} backups require an object-storage destination.`);if(e.resourceKind==="infrastructure"&&t.provider!=="aws_backup")throw Error("Infrastructure backups require an AWS Backup destination.");let r=tt(e.schedule),a=Rt(r.normalized,e.timezone,this.now(),1)[0],l=crypto.randomUUID(),m=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_policies (id,organization_id,project_id,environment_id,resource_id,data_service_id,destination_id,name,resource_kind,schedule,timezone,retention,compression,encryption,include_patterns,exclude_patterns,expected_rpo_minutes,expected_rto_minutes,health_check_id,enabled,next_run_at,last_run_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[l,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.dataServiceId??null,e.destinationId,e.name,e.resourceKind,r.normalized,e.timezone,JSON.stringify(e.retention),e.compression,e.encryption,JSON.stringify(e.includePatterns),JSON.stringify(e.excludePatterns),e.expectedRpoMinutes,e.expectedRtoMinutes,e.healthCheckId??null,e.enabled?1:0,a,e.lastRunAt??null,1,m,m]),this.getPolicy(l)}getPolicy(e){let t=this.controlPlane.database.query("SELECT * FROM backup_policies WHERE id=?").get(e);return t?Pp(t):void 0}listPolicies(e,t){return this.controlPlane.database.query(`SELECT * FROM backup_policies WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(Pp)}duePolicies(e=this.now()){return this.controlPlane.database.query("SELECT * FROM backup_policies WHERE enabled=1 AND next_run_at<=? ORDER BY next_run_at,id").all(e.toISOString()).map(Pp)}advancePolicy(e,t){let r=this.getPolicy(e);if(!r)throw Error("Backup policy was not found.");let a=Rt(r.schedule,r.timezone,new Date(t),1)[0];return this.controlPlane.database.run("UPDATE backup_policies SET last_run_at=?,next_run_at=?,version=version+1,updated_at=? WHERE id=?",[t,a,this.now().toISOString(),e]),this.getPolicy(e)}createJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE idempotency_key=?").get(e.idempotencyKey);if(t)return Tp(t);let r=crypto.randomUUID(),a=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO backup_jobs (id,project_id,policy_id,recovery_point_id,operation_id,kind,status,idempotency_key,target,restore_mode,cancellability,safety_backup_id,health_result,progress,error,started_at,finished_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[r,e.projectId,e.policyId??null,e.recoveryPointId??null,e.operationId??null,e.kind,e.status,e.idempotencyKey,JSON.stringify(e.target),e.restoreMode??null,e.cancellability,e.safetyBackupId??null,e.healthResult?JSON.stringify(e.healthResult):null,JSON.stringify(e.progress),e.error??null,e.startedAt??null,e.finishedAt??null,a,a]),this.getJob(r)}getJob(e){let t=this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE id=?").get(e);return t?Tp(t):void 0}listJobs(e){return this.controlPlane.database.query("SELECT * FROM backup_jobs WHERE project_id=? ORDER BY created_at DESC").all(e).map(Tp)}updateJob(e,t){let r=this.getJob(e);if(!r)throw Error("Backup job was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE backup_jobs SET status=?,operation_id=?,recovery_point_id=?,progress=?,health_result=?,error=?,started_at=?,finished_at=?,safety_backup_id=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,a.recoveryPointId??null,JSON.stringify(a.progress),a.healthResult?JSON.stringify(a.healthResult):null,a.error??null,a.startedAt??null,a.finishedAt??null,a.safetyBackupId??null,this.now().toISOString(),e]),this.getJob(e)}createRecoveryPoint(e){if(!/^sha256:[a-f0-9]{64}$/i.test(e.checksum))throw Error("Recovery points require a SHA-256 checksum.");if(typeof e.uri!=="string"||!["s3:","aws-backup:","file:"].some((a)=>e.uri.startsWith(a)))throw Error("Recovery point URI uses an unsupported destination scheme.");let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO recovery_points (id,project_id,policy_id,destination_id,resource_id,data_service_id,backup_job_id,kind,point_in_time,uri,size_bytes,checksum,manifest,tool_version,engine_version,expires_at,locked_until,held,pinned,status,verification_state,verified_at,duration_ms,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.projectId,e.policyId??null,e.destinationId,e.resourceId??null,e.dataServiceId??null,e.backupJobId??null,e.kind,e.pointInTime,e.uri,e.sizeBytes,e.checksum,JSON.stringify(e.manifest),e.toolVersion??null,e.engineVersion??null,e.expiresAt??null,e.lockedUntil??null,e.held?1:0,e.pinned?1:0,e.status,e.verificationState,e.verifiedAt??null,e.durationMs??null,r,r]),this.getRecoveryPoint(t)}getRecoveryPoint(e){let t=this.controlPlane.database.query("SELECT * FROM recovery_points WHERE id=?").get(e);return t?_p(t):void 0}listRecoveryPoints(e,t){return this.controlPlane.database.query(`SELECT * FROM recovery_points WHERE project_id=?${t?" AND policy_id=?":""} ORDER BY point_in_time DESC`).all(e,...t?[t]:[]).map(_p)}updateRecoveryPoint(e,t){let r=this.getRecoveryPoint(e);if(!r)throw Error("Recovery point was not found.");let a={...r,...t};return this.controlPlane.database.run("UPDATE recovery_points SET status=?,verification_state=?,verified_at=?,held=?,pinned=?,manifest=?,duration_ms=?,updated_at=? WHERE id=?",[a.status,a.verificationState,a.verifiedAt??null,a.held?1:0,a.pinned?1:0,JSON.stringify(a.manifest),a.durationMs??null,this.now().toISOString(),e]),this.getRecoveryPoint(e)}retentionCandidates(e=this.now()){let t=this.controlPlane.database.query(`SELECT rp.* FROM recovery_points rp
         WHERE rp.status='available' AND rp.held=0 AND rp.pinned=0
           AND rp.expires_at IS NOT NULL AND rp.expires_at<=?
           AND (rp.locked_until IS NULL OR rp.locked_until<=?)
@@ -84,7 +84,7 @@ ${a} root /usr/local/bin/cloud jobs:dispatch ${e.id} --scheduled >/dev/null 2>&1
             SELECT 1 FROM backup_jobs bj WHERE bj.recovery_point_id=rp.id
             AND bj.kind IN ('restore','drill') AND bj.status IN ('queued','running','cleanup_required')
           )
-        ORDER BY rp.expires_at,rp.id`).all(e.toISOString(),e.toISOString()).map(_p),r=new Set;for(let a of new Set(t.map((l)=>l.projectId)))for(let l of this.listPolicies(a)){let m=this.listRecoveryPoints(l.projectId,l.id).filter((b)=>b.status==="available").sort((b,k)=>k.pointInTime.localeCompare(b.pointInTime));for(let b of m.slice(0,Math.max(0,l.retention.keepLast??0)))r.add(b.id);let f=[[l.retention.hourly,(b)=>b.toISOString().slice(0,13)],[l.retention.daily,(b)=>b.toISOString().slice(0,10)],[l.retention.weekly,(b)=>new Date(Date.UTC(b.getUTCFullYear(),b.getUTCMonth(),b.getUTCDate()-(b.getUTCDay()+6)%7)).toISOString().slice(0,10)],[l.retention.monthly,(b)=>b.toISOString().slice(0,7)]];for(let[b,k]of f){let y=new Set;for(let R of m){let T=k(new Date(R.pointInTime));if(y.has(T))continue;if(y.add(T),y.size<=Math.max(0,b??0))r.add(R.id)}}}return t.filter((a)=>!r.has(a.id))}coverage(e,t=this.now()){let r=new Map(this.listDestinations(e).map((a)=>[a.id,a]));return this.listPolicies(e).map((a)=>{let l=this.listRecoveryPoints(e,a.id).filter((b)=>b.status==="available"),m=l[0],f=m?(t.getTime()-new Date(m.pointInTime).getTime())/60000:Number.POSITIVE_INFINITY;return{policy:a,lastRecoveryPoint:m,missedRpo:a.enabled&&f>a.expectedRpoMinutes,unverified:l.filter((b)=>b.verificationState!=="verified").length,destinationHealthy:r.get(a.destinationId)?.status==="healthy"}})}}import{createCipheriv as VI,createDecipheriv as WI,createHash as Mh,randomBytes as Lh}from"node:crypto";var xp=Buffer.from("TSCB1"),Wc=(e)=>`sha256:${Mh("sha256").update(e).digest("hex")}`;function Fh(e){return Mh("sha256").update(e).digest()}function Xf(e,t,r){let a=r?Buffer.from(r):Lh(12);if(a.length!==12)throw Error("Backup encryption IV must contain 12 bytes.");let l=VI("aes-256-gcm",Fh(t),a),m=Buffer.concat([l.update(e),l.final()]),f=l.getAuthTag();return Buffer.concat([xp,a,f,m])}function Yf(e,t){let r=Buffer.from(e);if(!r.subarray(0,xp.length).equals(xp))throw Error("Backup does not contain a valid encrypted envelope.");let a=r.subarray(5,17),l=r.subarray(17,33),m=r.subarray(33),f=WI("aes-256-gcm",Fh(t),a);return f.setAuthTag(l),Buffer.concat([f.update(m),f.final()])}function HI(e){let t;try{t=JSON.parse(e)}catch{throw Error("Backup destination credential must be a JSON object with accessKeyId and secretAccessKey.")}if(!t.accessKeyId||!t.secretAccessKey)throw Error("Backup destination credential requires accessKeyId and secretAccessKey.");if(t.expiresAt){let r=new Date(String(t.expiresAt));if(!Number.isFinite(r.getTime()))throw Error("Backup destination credential expiresAt must be an ISO timestamp.");if(r.getTime()<=Date.now())throw Error("Backup destination credential has expired.")}return{accessKeyId:String(t.accessKeyId),secretAccessKey:String(t.secretAccessKey),sessionToken:t.sessionToken?String(t.sessionToken):void 0}}async function zu(e,t,r=new Date){if(!e.credentialRef)return{status:"default"};try{let a=JSON.parse(await t.resolve(e.credentialRef));if(!a.accessKeyId||!a.secretAccessKey)return{status:"invalid"};if(!a.expiresAt)return{status:"static"};let l=new Date(String(a.expiresAt));if(!Number.isFinite(l.getTime()))return{status:"invalid"};let m=l.getTime()-r.getTime();return{status:m<=0?"expired":m<=604800000?"expiring":"valid",expiresAt:l.toISOString()}}catch{return{status:"invalid"}}}class La{secrets;clientFactory;multipartThreshold;partSize;constructor(e,t=(l,m)=>new o(l.region??"us-east-1",void 0,{endpoint:l.endpoint?new URL(l.endpoint).host:void 0,forcePathStyle:l.forcePathStyle,credentials:m}),r=8388608,a=8388608){this.secrets=e;this.clientFactory=t;this.multipartThreshold=r;this.partSize=a}async client(e){let t=e.credentialRef?HI(await this.secrets.resolve(e.credentialRef)):void 0;return this.clientFactory(e,t)}async test(e){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let t=await this.client(e),r=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}.ts-cloud-health/${crypto.randomUUID()}`;await t.putObject({bucket:e.bucket,key:r,body:"ts-cloud backup destination health check",contentType:"text/plain"});try{let a=await t.getObjectBytes(e.bucket,r);if(Buffer.from(a.body).toString()!=="ts-cloud backup destination health check")throw Error("Backup destination health object was corrupted.")}finally{await t.deleteObject(e.bucket,r)}}async upload(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),a=Wc(t.body),l=e.encryption!=="provider"?await this.secrets.resolve(e.encryptionKeyRef):void 0,m=l?t.resume?.encryptionIv?Buffer.from(t.resume.encryptionIv,"base64url"):Lh(12):void 0,f=l?Xf(t.body,l,m):Buffer.from(t.body),b=Wc(f),k=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}${t.key.replace(/^\/+/,"")}`,y=t.contentType??"application/octet-stream",R={"ts-cloud-format":"v1","ts-cloud-sha256":b.slice(7),"ts-cloud-encrypted":l?"true":"false"};if(t.resume&&t.resume.key!==k)throw Error("Multipart checkpoint does not match the requested backup key.");if(t.resume&&l&&!t.resume.encryptionIv)throw Error("Encrypted multipart checkpoint has no resumable envelope state.");if(t.resume&&l&&t.resume.plaintextChecksum!==a)throw Error("Encrypted multipart checkpoint does not match the backup payload.");if(f.length<this.multipartThreshold)await r.putObject({bucket:e.bucket,key:k,body:f,contentType:y,metadata:R});else{let T=t.resume?void 0:await r.createMultipartUpload(e.bucket,k,{contentType:y,metadata:R}),N=t.resume??{uploadId:T.UploadId,key:k,parts:[],bytesUploaded:0,encryptionIv:m?.toString("base64url"),plaintextChecksum:a},j=new Map(N.parts.map((q)=>[q.PartNumber,q])),U=Math.ceil(f.length/this.partSize);for(let q=0;q<U;q++){let Y=q+1;if(!j.has(Y)){let ee=q*this.partSize,le=await r.uploadPart(e.bucket,k,N.uploadId,Y,f.subarray(ee,Math.min(f.length,ee+this.partSize)));j.set(Y,{PartNumber:Y,ETag:le.ETag})}N.parts=[...j.values()].sort((ee,le)=>ee.PartNumber-le.PartNumber),N.bytesUploaded=Math.min(f.length,Y*this.partSize),t.checkpoint?.(N)}await r.completeMultipartUpload(e.bucket,k,N.uploadId,N.parts)}return{uri:`s3://${e.bucket}/${k}`,key:k,sizeBytes:f.length,checksum:b,manifest:{format:"ts-cloud-backup-v1",encrypted:!!l,plaintextChecksum:a,storageChecksum:b,contentType:y}}}async download(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),a=await r.getObjectBytes(e.bucket,t.key),l=Buffer.from(a.body);if(Wc(l)!==t.checksum)throw Error("Backup checksum verification failed; object is corrupt.");let m=t.manifest.encrypted?Yf(l,await this.secrets.resolve(e.encryptionKeyRef)):l;if(Wc(m)!==t.manifest.plaintextChecksum)throw Error("Backup plaintext checksum verification failed.");return m}async abortPartial(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).abortMultipartUpload(e.bucket,t.key,t.uploadId)}async delete(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).deleteObject(e.bucket,t)}}import{createHash as KI}from"node:crypto";var JI=(e)=>`sha256:${KI("sha256").update(e).digest("hex")}`;class ps{store;queue;now;constructor(e,t,r=()=>new Date){this.store=e;this.queue=t;this.now=r}enqueueBackup(e,t=this.now().toISOString(),r){if(!e.enabled)throw Error("Backup policy is disabled.");let a=this.store.createJob({projectId:e.projectId,policyId:e.id,kind:"backup",status:"queued",idempotencyKey:`backup:${e.id}:${t}`,target:{scheduledFor:t},cancellability:"checkpoint_only",progress:{phase:"queued"}});if(!a.operationId){let l=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:r,kind:"backup.run",input:{backupJobId:a.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`backup-policy:${e.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:14400,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(a.id,{operationId:l.operation.id})}return a}enqueueDue(e=this.now()){return this.store.duePolicies(e).map((t)=>{let r=t.nextRunAt;return this.store.advancePolicy(t.id,r),this.enqueueBackup(t,r)})}enqueueVerification(e){let t=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:"verify",status:"queued",idempotencyKey:`verify:${e.id}:${e.checksum}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!t.operationId){let r=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"backup.verify",input:{backupJobId:t.id},lockKey:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:2,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(t.id,{operationId:r.operation.id})}return t}planRestore(e,t){if(e.status!=="available")throw Error("Only available recovery points can be restored.");if(e.verificationState!=="verified")throw Error("Restore requires a verified recovery point.");if(t.mode==="in_place"){if(!t.recentAuth)throw Error("In-place restore requires recent authentication.");if(t.confirm!==t.targetName)throw Error(`Type ${t.targetName} to confirm in-place restore.`);if(!t.downtimeAcknowledged)throw Error("In-place restore requires downtime acknowledgement.");let r=t.safetyBackupId?this.store.getRecoveryPoint(t.safetyBackupId):void 0;if(!r||r.id===e.id||r.status!=="available"||r.verificationState!=="verified"||r.resourceId!==e.resourceId||r.dataServiceId!==e.dataServiceId)throw Error("In-place restore requires a distinct verified safety backup for the same target.")}return{point:e,mode:t.mode,target:{...t.target,inPlace:t.mode==="in_place",restoreMode:t.mode},warnings:t.mode==="in_place"?["The target is locked against deployments and backup work.","Downtime and data replacement are expected.","Provider cancellation may stop only at a checkpoint."]:["An isolated target is created and health-validated before cleanup."]}}enqueueRestore(e,t){let r=this.planRestore(e,t),a=t.drill?"drill":"restore",l=JI(JSON.stringify({point:e.id,mode:t.mode,target:t.target,safety:t.safetyBackupId,drill:!!t.drill})),m=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:a,status:"queued",idempotencyKey:`${a}:${l}`,target:r.target,restoreMode:r.mode,cancellability:"checkpoint_only",safetyBackupId:t.safetyBackupId,progress:{phase:"queued",warnings:r.warnings}});if(!m.operationId){let f=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,actorId:t.actorId,kind:t.drill?"backup.drill":"backup.restore",input:{backupJobId:m.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:1,timeoutSeconds:14400,retryClasses:[],resumePolicy:"fail"});return this.store.updateJob(m.id,{operationId:f.operation.id})}return m}enqueueRetention(e=this.now()){return this.store.retentionCandidates(e).map((t)=>{let r=this.store.createJob({projectId:t.projectId,policyId:t.policyId,recoveryPointId:t.id,kind:"cleanup",status:"queued",idempotencyKey:`cleanup:${t.id}:${t.expiresAt}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!r.operationId){let a=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,kind:"backup.cleanup",input:{backupJobId:r.id},lockKey:`recovery-point:${t.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(r.id,{operationId:a.operation.id})}return r})}}function Ku(e){let t=e.now??(()=>new Date),r=new ps(e.store,e.queue,t),a=(b)=>{let k=b.recoveryPointId?e.store.getRecoveryPoint(b.recoveryPointId):void 0,y=b.policyId?e.store.getPolicy(b.policyId):k?.policyId?e.store.getPolicy(k.policyId):void 0;if(!y)throw Error("Backup policy was not found.");let R=e.store.getDestination(k?.destinationId??y.destinationId),T=e.resolveSource(y);if(!R)throw Error("Backup destination was not found.");if(!T)throw Error(`No ${y.resourceKind} backup adapter is configured.`);return{point:k,policy:y,destination:R,source:T}},l=(b)=>{let k=b.operation.input,y=e.store.getJob(String(k.backupJobId??""));if(!y)throw Error("Backup job was not found.");return e.store.updateJob(y.id,{status:"running",startedAt:y.startedAt??t().toISOString(),progress:{...y.progress,phase:"running"}}),y},m=(b,k)=>{let y=e.store.getJob(b.id)??b;e.store.updateJob(b.id,{status:"failed",finishedAt:t().toISOString(),error:k instanceof Error?k.message:String(k),progress:{...y.progress,phase:"failed"}})};return{"backup.run":async(b)=>{let k=l(b);try{let{policy:y,destination:R,source:T}=a(k),N=await T.create(y,b),j=e.resolveDestination(R),U=N.mode==="object"?await(async()=>{if(!j)throw Error("Backup destination adapter is not configured.");let le=e.store.getJob(k.id)?.progress,Z=le?.multipart,ie=Z&&typeof Z==="object"&&!Array.isArray(Z)&&typeof Z.uploadId==="string"&&typeof Z.key==="string"&&Array.isArray(Z.parts)?Z:void 0;return j.upload(R,{key:N.key,body:N.body,contentType:N.contentType,resume:ie,checkpoint:(we)=>{b.checkpoint("uploading",`Uploaded ${Number(we.bytesUploaded??0)} backup bytes.`),e.store.updateJob(k.id,{progress:{phase:"uploading",multipart:{...we}}})}})})():{uri:N.uri,key:N.uri,sizeBytes:N.sizeBytes,checksum:N.checksum,manifest:{format:"ts-cloud-backup-v1",encrypted:!1,plaintextChecksum:N.checksum,storageChecksum:N.checksum,contentType:"application/provider-snapshot"}},q=y.retention.expireAfterDays?new Date(t().getTime()+y.retention.expireAfterDays*86400000).toISOString():void 0,Y=e.store.getJob(k.id)?.startedAt,ee=e.store.createRecoveryPoint({projectId:y.projectId,policyId:y.id,destinationId:R.id,resourceId:y.resourceId,dataServiceId:y.dataServiceId,backupJobId:k.id,kind:y.resourceKind,pointInTime:t().toISOString(),uri:U.uri,sizeBytes:U.sizeBytes,checksum:U.checksum,manifest:{...N.manifest,...U.manifest,storageKey:U.key},toolVersion:N.toolVersion,engineVersion:N.engineVersion,expiresAt:q,lockedUntil:R.immutability.defaultRetentionDays?new Date(t().getTime()+R.immutability.defaultRetentionDays*86400000).toISOString():void 0,held:!1,pinned:!1,status:"available",verificationState:"unverified",durationMs:Math.max(0,t().getTime()-new Date(Y??t().toISOString()).getTime())});if(N.mode==="external"&&R.provider==="aws_backup")e.store.recordDestinationTest(R.id,{ok:!0});return e.store.updateJob(k.id,{status:"succeeded",recoveryPointId:ee.id,finishedAt:t().toISOString(),progress:{phase:"stored",recoveryPointId:ee.id}}),r.enqueueVerification(ee),{backupJobId:k.id,recoveryPointId:ee.id}}catch(y){let R=e.store.getJob(k.id),T=R?.progress.multipart,N=(()=>{try{return a(k)}catch{return}})();if(N?.destination.provider==="aws_backup")e.store.recordDestinationTest(N.destination.id,{ok:!1,error:y instanceof Error?y.message:String(y)});let j=!1;if(T&&typeof T==="object"&&!Array.isArray(T)&&N){let U=e.resolveDestination(N.destination);if(j=!0,U?.abortPartial)try{await U.abortPartial(N.destination,T),j=!1,e.store.updateJob(k.id,{progress:{...R.progress,partialCleanup:"aborted"}})}catch{e.store.updateJob(k.id,{progress:{...R.progress,partialCleanup:"required"}})}}if(j)e.store.updateJob(k.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:y instanceof Error?y.message:String(y),progress:{...e.store.getJob(k.id)?.progress??{},phase:"cleanup_required"}});else m(k,y);throw y}},"backup.verify":async(b)=>{let k=l(b);try{let{point:y,destination:R,source:T}=a(k);if(!y)throw Error("Recovery point was not found.");e.store.updateRecoveryPoint(y.id,{verificationState:"verifying"});let N;if(y.uri.startsWith("s3:")){let j=e.resolveDestination(R);if(!j)throw Error("Backup destination adapter is not configured.");let U=await j.download(R,{key:String(y.manifest.storageKey??""),checksum:y.checksum,manifest:y.manifest}),q=T.verify?await T.verify(y,U,b):{};N={bytes:U.length,checksum:y.checksum,...q}}else if(T.verifyExternal)N=await T.verifyExternal(y,b);else throw Error("External recovery point verification is not supported.");return e.store.updateRecoveryPoint(y.id,{verificationState:"verified",verifiedAt:t().toISOString(),manifest:{...y.manifest,verification:N}}),e.store.updateJob(k.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"verified",evidence:N}}),{backupJobId:k.id,recoveryPointId:y.id,evidence:N}}catch(y){if(k.recoveryPointId)e.store.updateRecoveryPoint(k.recoveryPointId,{verificationState:/checksum|corrupt|authentic/i.test(y instanceof Error?y.message:String(y))?"corrupt":"failed"});throw m(k,y),y}},"backup.restore":async(b)=>f(b,!1),"backup.drill":async(b)=>f(b,!0),"backup.cleanup":async(b)=>{let k=l(b);try{let{point:y,destination:R,source:T}=a(k);if(!y)throw Error("Recovery point was not found.");if(!e.store.retentionCandidates(t()).some((N)=>N.id===y.id))throw Error("Recovery point is held, pinned, locked, or in active use.");if(e.store.updateRecoveryPoint(y.id,{status:"deleting"}),y.uri.startsWith("s3:")){let N=e.resolveDestination(R);if(!N)throw Error("Destination cleanup is unavailable.");await N.delete(R,String(y.manifest.storageKey??""))}else if(T.deleteExternal)await T.deleteExternal(y,b);else throw Error("External recovery point cleanup is unavailable.");return e.store.updateRecoveryPoint(y.id,{status:"deleted"}),e.store.updateJob(k.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"deleted"}}),{backupJobId:k.id,recoveryPointId:y.id,deleted:!0}}catch(y){throw m(k,y),y}}};async function f(b,k){let y=l(b);try{let{point:R,policy:T,destination:N,source:j}=a(y);if(!R)throw Error("Recovery point was not found.");if(k&&!j.cleanup)throw Error("This backup source cannot safely clean a recovery drill target.");let U=R.uri.startsWith("s3:")?e.resolveDestination(N):void 0,q=U?await U.download(N,{key:String(R.manifest.storageKey??""),checksum:R.checksum,manifest:R.manifest}):void 0,Y=await j.restore(R,q,y.target,b),ee=j.validateHealth?await j.validateHealth({...y.target,...Y},b):{healthy:!0,mode:"adapter"},le=e.validateHealth?await e.validateHealth(T,y.target):{healthy:!0,mode:"not_configured"},Z={...ee,healthy:ee.healthy===!0&&le.healthy===!0,configured:le};if(Z.healthy!==!0)throw Error("Restored target did not pass its configured health check.");if(k&&j.cleanup)await j.cleanup({...y.target,provider:R.manifest.provider??null},b);return e.store.updateJob(y.id,{status:"succeeded",finishedAt:t().toISOString(),healthResult:Z,progress:{phase:k?"drill_cleaned":"restored",restored:Y}}),{backupJobId:y.id,recoveryPointId:R.id,restored:Y,health:Z,cleaned:k}}catch(R){let T=(()=>{try{return a(y)}catch{return}})(),N=R instanceof Error?R.message:String(R),j=!1;if(k&&T?.source.cleanup)try{await T.source.cleanup({...y.target,provider:T.point?.manifest.provider??null},b)}catch{j=!0}if(j)e.store.updateJob(y.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:N,progress:{...y.progress,phase:"cleanup_required"}});else m(y,R);throw R}}}import{createHash as GI}from"node:crypto";var QI=(e)=>`sha256:${GI("sha256").update(e).digest("hex")}`;class $a{dataServices;client;constructor(e,t=new J){this.dataServices=e;this.client=t}service(e){let t=e.dataServiceId?this.dataServices.get(e.dataServiceId):void 0;if(!t||!["aws_rds","aws_aurora"].includes(t.provider))throw Error("Managed database backup policy requires an RDS or Aurora data service.");return t}async waitForSnapshot(e,t,r){for(;;){r.throwIfCancellationRequested?.(),r.heartbeat?.();let a=e==="aws_aurora"?(await this.client.describeDBClusterSnapshots({DBClusterSnapshotIdentifier:t})).DBClusterSnapshots[0]:(await this.client.describeDBSnapshots({DBSnapshotIdentifier:t})).DBSnapshots?.[0];if(!a)throw Error("Provider snapshot was not found.");let l=a,m=String(l.Status??l.DBSnapshotStatus??"unknown");if(r.checkpoint?.("provider_snapshot",`Database snapshot ${t} is ${m}.`),m==="available")return l;if(["deleted","deleting","failed"].includes(m))throw Error(`Provider snapshot ${t} failed with state ${m}.`);await Bun.sleep(5000)}}async create(e,t){let r=this.service(e),a=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,20),l=`${r.placement.slice(0,42).replace(/-+$/,"")}-${a}`;if(r.provider==="aws_aurora")await this.client.createDBClusterSnapshot(r.placement,l);else await this.client.createDBSnapshot({DBInstanceIdentifier:r.placement,DBSnapshotIdentifier:l});await this.waitForSnapshot(r.provider,l,t);let m=`${r.provider}:${r.placement}:${l}`;return{mode:"external",uri:`aws-backup:${m}`,checksum:QI(m),sizeBytes:0,manifest:{provider:r.provider,sourceId:r.placement,snapshotId:l,plan:r.plan,engine:r.engine},engineVersion:r.engineVersion,toolVersion:"aws-rds-api-2014-10-31"}}async verifyExternal(e,t){let r=String(e.manifest.snapshotId??""),a=String(e.manifest.provider??"");if(!r)throw Error("Snapshot recovery point has no snapshot ID.");let l=await this.waitForSnapshot(a,r,t),m=String(l.Status??l.DBSnapshotStatus??"unknown");return{snapshotId:r,status:m,encrypted:l.Encrypted??l.StorageEncrypted??!0}}async restore(e,t,r,a){let l=String(r.targetId??""),m=String(e.manifest.snapshotId??""),f=String(e.manifest.provider??"");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(l))throw Error("Managed restore requires a valid distinct targetId.");if(l===e.manifest.sourceId)throw Error("Managed restore target must differ from its source.");if(f==="aws_aurora"){let b=e.manifest.engine==="postgres"?"aurora-postgresql":"aurora-mysql";await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:l,SnapshotIdentifier:m,Engine:b,EngineVersion:e.engineVersion,DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:Number(r.minCapacity)||0.5,MaxCapacity:Number(r.maxCapacity)||4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${l}-writer-1`,DBClusterIdentifier:l,DBInstanceClass:String(r.plan??e.manifest.plan??"db.serverless"),Engine:b,PubliclyAccessible:!1})}else await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:l,DBSnapshotIdentifier:m,DBInstanceClass:String(r.plan??e.manifest.plan??""),PubliclyAccessible:!1,DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud-restore"}]});return{targetId:l,provider:f,status:"creating",isolated:!0}}async validateHealth(e,t){let r=String(e.targetId??""),a=String(e.provider??"");for(;;){t.throwIfCancellationRequested?.(),t.heartbeat?.();let l=a==="aws_aurora"?(await this.client.describeDBClusters({DBClusterIdentifier:r})).DBClusters?.[0]:(await this.client.describeDBInstances({DBInstanceIdentifier:r})).DBInstances?.[0];if(!l)throw Error("Restored managed database was not found.");let m=String(l.Status??l.DBInstanceStatus??"unknown");if(t.checkpoint?.("provider_restore",`Restored database ${r} is ${m}.`),m==="available")return{healthy:!0,targetId:r,provider:a,status:m};if(["deleted","deleting","failed","incompatible-restore"].includes(m))throw Error(`Restored managed database ${r} failed with state ${m}.`);await Bun.sleep(5000)}}async cleanup(e,t){let r=String(e.targetId??""),a=String(e.provider??"");if(!r)throw Error("Restore cleanup target is required.");if(a==="aws_aurora")await this.client.deleteDBInstance({DBInstanceIdentifier:`${r}-writer-1`,SkipFinalSnapshot:!0}),await this.client.modifyDBCluster({DBClusterIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(r);else await this.client.modifyDBInstance({DBInstanceIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:r,SkipFinalSnapshot:!0,DeleteAutomatedBackups:!0})}async deleteExternal(e,t){let r=String(e.manifest.snapshotId??"");if(e.manifest.provider==="aws_aurora")await this.client.deleteDBClusterSnapshot(r);else await this.client.deleteDBSnapshot(r)}}var qr=(e,t="none",r=!1)=>({supported:!0,downtime:t,destructive:r,explanation:e}),Dr=(e)=>({supported:!1,downtime:"none",destructive:!1,explanation:e});function mn(e,t){let r=["aws_rds","aws_aurora","aws_elasticache"].includes(t),a=["server","container"].includes(t),l=["postgres","mysql","mariadb"].includes(e),m=e==="redis",f={};return f.create=t==="external"?Dr("External services can be adopted as read-only inventory."):qr(r?"Provision through the provider API.":"Provision through the owning runtime driver.","possible"),f.observe=t==="external"?Dr("External observation requires a configured provider adapter."):qr("Provider/runtime health and endpoint metadata are observable."),f.connect=qr("Connection guidance uses secret references and never returns a password by default."),f.backup=l&&(r||a)?qr(r?"Create a provider snapshot.":"Create a consistent engine-native dump.","possible"):Dr("This cache path is not a durable backup source."),f.restore=r&&l?qr("Restore creates a reviewed provider target.","required",!0):Dr("Restore requires a configured provider restore runner."),f.restart=t==="external"?Dr("External restart requires a configured provider adapter."):qr(r?"Provider restart/failover semantics apply.":"Restart the owning service unit.","required"),f.resize=t==="aws_elasticache"?Dr("ElastiCache resizing requires a replication-group migration runner."):r?qr("Provider plan/storage modification may enter a maintenance window.","possible"):a?qr("Edit host/container resources and reconcile.","required"):Dr("External resize requires a configured provider adapter."),f.version=a?Dr("Runtime version upgrades require an explicit image migration runner."):r&&t!=="aws_elasticache"?qr(l?"Major versions require compatibility preflight and backup.":"Engine upgrades require a maintenance window.","required"):Dr("External upgrades require a configured provider adapter."),f.rotate=t==="aws_elasticache"||t==="external"||a&&!l&&!m?Dr("Credential rotation is not available for this provider/engine path."):qr("Rotate through the secret backend, update the engine, then flag dependent releases."),f.expose=a?Dr("Direct container publishing is refused; use a reviewed firewall and proxy policy."):t==="aws_rds"?qr("Exposure is reconciled through security groups; public access defaults off."):Dr("Exposure changes require a provider-specific network runner."),f.delete=t==="external"?Dr("External deletion requires a configured provider adapter."):qr(r?"Final snapshot is supported where the provider allows it.":"A final engine backup is required unless explicitly retained.","required",!0),f.logs=a?qr("Read bounded service logs from the runtime."):Dr("Provider log export is not configured for this adapter."),f.slow_queries=a&&l?qr("Read bounded runtime logs after engine slow-query logging is enabled."):Dr("A slow-query log runner is not configured for this provider."),f.users=a&&l?qr("Logical users can be listed; creation requires a referenced secondary credential."):Dr("User management requires an engine connection runner."),f.databases=a&&l?qr("Logical databases can be listed, created, and confirmation-gated for deletion."):Dr("Logical database management requires an engine connection runner."),{actions:f,endpointTypes:r?["internal","external","tunnel"]:["internal","tunnel"],metrics:m?["connections","memory","evictions","hit_rate","latency"]:["connections","cpu","storage","read_latency","write_latency","iops"]}}var ws=(e)=>e==null?void 0:String(e),Kc=(e)=>Number(e)===1,Hc=(e)=>{try{return JSON.parse(String(e))}catch{return{}}};function zh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:ws(e.environment_id),resourceId:ws(e.resource_id),name:String(e.name),engine:String(e.engine),provider:String(e.provider),placement:String(e.placement),engineVersion:ws(e.engine_version),plan:String(e.plan),storageGb:e.storage_gb==null?void 0:Number(e.storage_gb),highAvailability:Kc(e.high_availability),publicExposure:Kc(e.public_exposure),allowedCidrs:Hc(e.allowed_cidrs),desiredState:Hc(e.desired_state),observedState:Hc(e.observed_state),capabilities:Hc(e.capabilities),credentialRef:ws(e.credential_ref),status:String(e.status),origin:String(e.origin),managementEnabled:Kc(e.management_enabled),ownerActorId:ws(e.owner_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class ga{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}create(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Data service names must be 2-63 lowercase letters, numbers, or dashes.");if(e.publicExposure&&(!e.allowedCidrs.length||e.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");let t=crypto.randomUUID(),r=this.now().toISOString(),a=mn(e.engine,e.provider);return this.controlPlane.database.run("INSERT INTO data_services (id,organization_id,project_id,environment_id,resource_id,name,engine,provider,placement,engine_version,plan,storage_gb,high_availability,public_exposure,allowed_cidrs,desired_state,observed_state,capabilities,credential_ref,status,origin,management_enabled,owner_actor_id,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.engine,e.provider,e.placement,e.engineVersion??null,e.plan,e.storageGb??null,e.highAvailability?1:0,e.publicExposure?1:0,JSON.stringify(e.allowedCidrs),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),JSON.stringify(a),e.credentialRef??null,e.status,e.origin,e.managementEnabled?1:0,e.ownerActorId??null,1,r,r]),this.get(t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM data_services WHERE id=?").get(e);return t?zh(t):void 0}list(e,t){return this.controlPlane.database.query(`SELECT * FROM data_services WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(zh)}update(e,t,r){let a=this.get(e);if(!a)throw Error("Data service was not found.");if(a.version!==t)throw Error("Data service changed; refresh before retrying.");let l={...a,...r};if(l.publicExposure&&(!l.allowedCidrs.length||l.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");if(this.controlPlane.database.run("UPDATE data_services SET plan=?,storage_gb=?,engine_version=?,high_availability=?,public_exposure=?,allowed_cidrs=?,desired_state=?,observed_state=?,status=?,management_enabled=?,credential_ref=?,version=version+1,updated_at=? WHERE id=? AND version=?",[l.plan,l.storageGb??null,l.engineVersion??null,l.highAvailability?1:0,l.publicExposure?1:0,JSON.stringify(l.allowedCidrs),JSON.stringify(l.desiredState),JSON.stringify(l.observedState),l.status,l.managementEnabled?1:0,l.credentialRef??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Data service changed; refresh before retrying.");return this.get(e)}credential(e){let t=this.controlPlane.database.query("SELECT * FROM data_service_credentials WHERE service_id=? ORDER BY version DESC LIMIT 1").get(e);return t?{id:String(t.id),serviceId:String(t.service_id),username:String(t.username),secretRef:String(t.secret_ref),version:Number(t.version),createdAt:String(t.created_at),rotatedAt:ws(t.rotated_at)}:void 0}saveCredential(e,t,r){let a=this.credential(e),l=a?.id??crypto.randomUUID(),m=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_credentials (id,service_id,username,secret_ref,version,created_at,rotated_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(service_id,username) DO UPDATE SET secret_ref=excluded.secret_ref,version=data_service_credentials.version+1,rotated_at=excluded.rotated_at",[l,e,t,r,a?.version??1,a?.createdAt??m,a?m:null]),this.credential(e)}addDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_dependencies (service_id,resource_id,secret_ref,requires_redeploy,created_at) VALUES (?,?,?,?,?) ON CONFLICT(service_id,resource_id) DO UPDATE SET secret_ref=excluded.secret_ref,requires_redeploy=excluded.requires_redeploy",[e.serviceId,e.resourceId,e.secretRef,e.requiresRedeploy?1:0,t]),{...e,createdAt:t}}dependencies(e){return this.controlPlane.database.query("SELECT * FROM data_service_dependencies WHERE service_id=? ORDER BY resource_id").all(e).map((t)=>({serviceId:String(t.service_id),resourceId:String(t.resource_id),secretRef:String(t.secret_ref),requiresRedeploy:Kc(t.requires_redeploy),createdAt:String(t.created_at)}))}removeDependency(e,t){return this.controlPlane.database.run("DELETE FROM data_service_dependencies WHERE service_id=? AND resource_id=?",[e,t]).changes===1}remove(e){this.controlPlane.database.run("DELETE FROM data_services WHERE id=?",[e])}}function Uh(){let t=crypto.getRandomValues(new Uint8Array(40));return Array.from(t,(r)=>"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*_-+="[r%69]).join("")}function yu(e,t){return t.map((r)=>{let a=r.type==="tunnel"?"127.0.0.1":r.host,l=e.engine==="redis"?`redis-cli -h ${a} -p ${r.port}${r.tls?" --tls":""}`:e.engine==="postgres"?`psql "host=${a} port=${r.port} dbname=${r.database??"postgres"} sslmode=${r.tls?"require":"disable"}"`:e.engine==="mongodb"?`mongosh "mongodb://${a}:${r.port}/${r.database??"admin"}${r.tls?"?tls=true":""}"`:e.engine==="libsql"?`turso db shell ${r.tls?"https":"http"}://${a}:${r.port}`:`mysql --host=${a} --port=${r.port} --database=${r.database??"mysql"} --ssl-mode=${r.tls?"REQUIRED":"DISABLED"}`;return{type:r.type,command:l,secretRef:e.credentialRef}})}class os{store;queue;secrets;constructor(e,t,r){this.store=e;this.queue=t;this.secrets=r}async create(e){let t,r;if(e.provider!=="aws_elasticache"){let a=e.username??"app",l=Uh();r=`secret://data-services/${e.projectId}/${e.name}/${a}`,await this.secrets.put(r,l),t={username:a,password:l,secretRef:r}}try{let a=this.store.create({...e,credentialRef:r,status:"planning"});if(t)this.store.saveCredential(a.id,t.username,t.secretRef);let l=this.enqueue(a,"create",{});return{service:a,credential:t,operationId:l}}catch(a){if(r)await this.secrets.remove(r);throw a}}plan(e,t,r={}){let a=e.capabilities.actions[t],l=t==="version"&&String(r.engineVersion??"").split(".")[0]!==String(e.engineVersion??"").split(".")[0];return{service:e,action:t,capability:a,changes:r,preflight:{backupRequired:["delete","restore"].includes(t)||l,compatibilityRequired:l,typedConfirmation:a.destructive?e.name:void 0,retentionChoiceRequired:t==="delete"},warnings:[...a.downtime!=="none"?[`Downtime is ${a.downtime}.`]:[],...e.origin==="adopted"&&!e.managementEnabled?["Adopted resource is read-only until management is explicitly enabled."]:[]]}}enqueue(e,t,r,a){let l=this.plan(e,t,r);if(!l.capability.supported)throw Error(l.capability.explanation);if(e.origin==="adopted"&&!e.managementEnabled&&t!=="observe")throw Error("Adopted resources remain read-only until management is explicitly enabled.");if(l.preflight.typedConfirmation&&r.confirm!==l.preflight.typedConfirmation)throw Error(`Type ${l.preflight.typedConfirmation} to confirm ${t}.`);if(l.preflight.retentionChoiceRequired&&!["final_backup","retain"].includes(String(r.retention??"")))throw Error("Deletion requires retention final_backup or retain.");if(l.preflight.compatibilityRequired&&(r.compatibilityReviewed!==!0||!r.backupId))throw Error("Major version changes require compatibilityReviewed=true and a backupId.");if(t==="restore"){let m=String(r.backupId??""),f=String(r.targetId??"");if(!m||!f)throw Error("Restore requires both backupId and targetId.");if(f===e.placement)throw Error("Restore targetId must differ from the source placement.");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(f))throw Error("Restore targetId must be 2-63 lowercase letters, numbers, or dashes.")}return this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:a,kind:"data_service.action",input:{serviceId:e.id,action:t,...r},lockKey:`data-service:${e.id}`,providerKey:e.provider,maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"}).operation.id}async rotate(e,t,r){let a=this.store.credential(e.id);if(!a)throw Error("Data service credential metadata was not found.");let l=Uh(),m=`${a.secretRef}/v${a.version+1}`;await this.secrets.put(m,l);try{return await t.action(e,"rotate",{username:a.username,secretRef:m},l,r),this.store.saveCredential(e.id,a.username,m),this.store.update(e.id,e.version,{credentialRef:m}),{credential:{username:a.username,password:l,secretRef:m},dependencies:this.store.dependencies(e.id).filter((f)=>f.requiresRedeploy).map((f)=>f.resourceId)}}catch(f){throw await this.secrets.remove(m),f}}}function Su(e){return{"data_service.action":async(t)=>{let r=t.operation.input,a=e.store.get(String(r.serviceId??"")),l=String(r.action??"");if(!a)throw Error("Data service was not found.");let m=e.resolveAdapter(a);if(!m||m.provider!==a.provider||!m.engines.includes(a.engine))throw Error(`No ${a.provider}/${a.engine} adapter is configured.`);if(l==="rotate"){let b=await new os(e.store,new c(e.store.controlPlane),e.secrets).rotate(a,m,t);return{serviceId:a.id,action:l,username:b.credential.username,secretRef:b.credential.secretRef,dependencies:b.dependencies}}let f=a.credentialRef?await e.secrets.resolve(a.credentialRef):void 0;try{let b=l==="observe"?await m.observe(a):l==="create"?await m.apply(a,f,t):await m.action(a,l,r,f,t),k=e.store.get(a.id);return e.store.update(a.id,k.version,{observedState:b,status:l==="delete"?r.retention==="retain"?"retained":"deleting":"available"}),{serviceId:a.id,action:l,observed:b}}catch(b){let k=e.store.get(a.id);if(e.store.update(a.id,k.version,{status:"failed",observedState:{...k.observedState,error:b instanceof Error?b.message:String(b)}}),/temporar|timeout|unavailable|throttl/i.test(b instanceof Error?b.message:String(b)))throw new te(b instanceof Error?b.message:String(b),"provider_transient");throw b}}}}class ks{transport;constructor(e){this.transport=e}observe(e){return this.transport.observe(e.placement)}apply(e,t){return this.transport.apply({id:e.placement,name:e.name,engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,storageGb:e.storageGb??null,highAvailability:e.highAvailability,publicExposure:e.publicExposure,allowedCidrs:e.allowedCidrs,username:e.desiredState.username??"app",desiredState:e.desiredState},t)}action(e,t,r,a,l){return this.transport.execute(e.placement,t,{engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,desiredState:e.desiredState,...r},a,l)}}class pa extends ks{provider="aws_rds";engines=["postgres","mysql","mariadb"]}class ma extends ks{provider="aws_aurora";engines=["postgres","mysql"]}class fa extends ks{provider="aws_elasticache";engines=["redis"]}class ha extends ks{provider="server";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}class Aa extends ks{provider="container";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}var Qc=(e,t)=>{let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)},rr=(e,t,r)=>{let a=Qc(e,t);return a==null?r:String(a)},sn=(e,t)=>{let r=Qc(e,t);return r==null?void 0:Number(r)},Wi=(e,t)=>{let r=Qc(e,t);return r==null?void 0:r===!0||r==="true"},Es=(e,t)=>{let r=Qc(e,t);return Array.isArray(r)?r.map(String):[]},Gc=(e,t)=>rr(t,"snapshotId")??`${e}-final-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`;function Jc(e){if(!e)throw Error("RDS instance was not found.");return{providerId:e.DBInstanceIdentifier??null,status:e.DBInstanceStatus??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,plan:e.DBInstanceClass??null,storageGb:e.AllocatedStorage??null,highAvailability:e.MultiAZ??!1,publicExposure:e.PubliclyAccessible??!1,endpoint:e.Endpoint?.Address??null,port:e.Endpoint?.Port??null,username:e.MasterUsername??null,database:e.DBName??null,encrypted:e.StorageEncrypted??!1}}class ya{client;constructor(e=new J){this.client=e}async observe(e){return Jc(await this.client.describeDBInstance(e))}async apply(e,t){let r=String(e.id),a=await this.client.createDBInstance({DBInstanceIdentifier:r,DBInstanceClass:String(e.plan),Engine:String(e.engine),MasterUsername:rr(e,"username","app"),MasterUserPassword:t,DBName:rr(e,"database"),AllocatedStorage:sn(e,"storageGb"),VpcSecurityGroupIds:Es(e,"securityGroupIds"),DBSubnetGroupName:rr(e,"subnetGroup"),BackupRetentionPeriod:sn(e,"backupRetentionDays")??7,MultiAZ:Wi(e,"highAvailability"),EngineVersion:rr(e,"engineVersion"),PubliclyAccessible:Wi(e,"publicExposure")??!1,StorageType:rr(e,"storageType","gp3"),StorageEncrypted:!0,KmsKeyId:rr(e,"kmsKeyId"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return Jc(a.DBInstance)}async execute(e,t,r,a,l){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBInstance({DBInstanceIdentifier:e}),{status:"rebooting"};if(t==="backup"){let m=Gc(e,r);return await this.client.createDBSnapshot({DBInstanceIdentifier:e,DBSnapshotIdentifier:m}),{status:"snapshotting",snapshotId:m}}if(t==="restore"){let m=String(r.targetId),f=await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:m,DBSnapshotIdentifier:String(r.backupId),DBInstanceClass:rr(r,"plan"),DBSubnetGroupName:rr(r,"subnetGroup"),MultiAZ:Wi(r,"highAvailability"),PubliclyAccessible:!1,StorageType:rr(r,"storageType"),VpcSecurityGroupIds:Es(r,"securityGroupIds"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{...Jc(f.DBInstance),sourceId:e,restoreTargetId:m}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let m=Gc(e,r);return await this.client.modifyDBInstance({DBInstanceIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:e,SkipFinalSnapshot:!1,FinalDBSnapshotIdentifier:m,DeleteAutomatedBackups:!1}),{status:"deleting",finalSnapshotId:m}}if(["resize","version","rotate","expose"].includes(t)){let m=await this.client.modifyDBInstance({DBInstanceIdentifier:e,DBInstanceClass:rr(r,"plan"),AllocatedStorage:sn(r,"storageGb"),MasterUserPassword:t==="rotate"?a:void 0,EngineVersion:rr(r,"engineVersion"),MultiAZ:Wi(r,"highAvailability"),PubliclyAccessible:Wi(r,"publicExposure"),VpcSecurityGroupIds:Es(r,"securityGroupIds"),ApplyImmediately:Wi(r,"applyImmediately")??!0});return Jc(m.DBInstance)}throw Error(`RDS action ${t} requires an engine connection runner.`)}}function Dp(e){if(!e)throw Error("Aurora cluster was not found.");return{providerId:e.DBClusterIdentifier??null,status:e.Status??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,endpoint:e.Endpoint??null,readerEndpoint:e.ReaderEndpoint??null,port:e.Port??null,username:e.MasterUsername??null,database:e.DatabaseName??null,encrypted:e.StorageEncrypted??!1,highAvailability:e.MultiAZ??!0}}class Sa{client;constructor(e=new J){this.client=e}async observe(e){let t=await this.client.describeDBClusters({DBClusterIdentifier:e});return Dp(t.DBClusters?.[0])}async apply(e,t){let r=String(e.id),a=String(e.engine)==="postgres"?"aurora-postgresql":"aurora-mysql";return await this.client.createDBCluster({DBClusterIdentifier:r,Engine:a,EngineVersion:rr(e,"engineVersion"),MasterUsername:rr(e,"username","app"),MasterUserPassword:t,DatabaseName:rr(e,"database"),DBSubnetGroupName:rr(e,"subnetGroup"),VpcSecurityGroupIds:Es(e,"securityGroupIds"),BackupRetentionPeriod:sn(e,"backupRetentionDays")??7,StorageEncrypted:!0,KmsKeyId:rr(e,"kmsKeyId"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:sn(e,"minCapacity")??0.5,MaxCapacity:sn(e,"maxCapacity")??4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${r}-writer-1`,DBClusterIdentifier:r,DBInstanceClass:String(e.plan||"db.serverless"),Engine:a,PubliclyAccessible:Wi(e,"publicExposure")??!1}),{status:"creating",providerId:r}}async execute(e,t,r,a){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBCluster(e),{status:"rebooting"};if(t==="backup"){let l=Gc(e,r);return await this.client.createDBClusterSnapshot(e,l),{status:"snapshotting",snapshotId:l}}if(t==="restore"){let l=String(r.targetId),m=String(r.engine)==="postgres"?"aurora-postgresql":"aurora-mysql",f=await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:l,SnapshotIdentifier:String(r.backupId),Engine:m,EngineVersion:rr(r,"engineVersion"),DBSubnetGroupName:rr(r,"subnetGroup"),VpcSecurityGroupIds:Es(r,"securityGroupIds"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:sn(r,"minCapacity")??0.5,MaxCapacity:sn(r,"maxCapacity")??4}});return await this.client.createDBInstance({DBInstanceIdentifier:`${l}-writer-1`,DBClusterIdentifier:l,DBInstanceClass:rr(r,"plan","db.serverless"),Engine:m,PubliclyAccessible:!1}),{...Dp(f.DBCluster),sourceId:e,restoreTargetId:l}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let l=Gc(e,r);return await this.client.modifyDBCluster({DBClusterIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(e,l),{status:"deleting",finalSnapshotId:l}}if(["resize","version","rotate"].includes(t)){let l=await this.client.modifyDBCluster({DBClusterIdentifier:e,ServerlessV2ScalingConfiguration:sn(r,"minCapacity")==null&&sn(r,"maxCapacity")==null?void 0:{MinCapacity:sn(r,"minCapacity")??0.5,MaxCapacity:sn(r,"maxCapacity")??4},EngineVersion:rr(r,"engineVersion"),MasterUserPassword:t==="rotate"?a:void 0,ApplyImmediately:Wi(r,"applyImmediately")??!0});return Dp(l.DBCluster)}throw Error(`Aurora action ${t} requires an engine connection runner.`)}}class Ia{client;constructor(e=new st){this.client=e}async observe(e){let t=(await this.client.describeCacheClusters(e)).CacheClusters[0];if(!t)throw Error("ElastiCache cluster was not found.");let r=t.CacheNodes?.[0]?.Endpoint;return{providerId:t.CacheClusterId,status:t.CacheClusterStatus,engine:t.Engine,engineVersion:t.EngineVersion,plan:t.CacheNodeType,nodes:t.NumCacheNodes,endpoint:r?.Address??null,port:r?.Port??null}}async apply(e){let t=await this.client.createCacheCluster({cacheClusterId:String(e.id),engine:"redis",cacheNodeType:String(e.plan),numCacheNodes:sn(e,"nodes")??1,engineVersion:rr(e,"engineVersion"),port:sn(e,"port"),securityGroupIds:Es(e,"securityGroupIds"),subnetGroupName:rr(e,"subnetGroup"),tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{providerId:t.CacheCluster.CacheClusterId,status:t.CacheCluster.CacheClusterStatus}}async execute(e,t,r){if(t==="observe")return this.observe(e);if(t==="restart"){let a=(await this.client.describeCacheClusters(e)).CacheClusters[0];return await this.client.rebootCacheCluster(e,a?.CacheNodes?.map((l)=>l.CacheNodeId)??["0001"]),{status:"rebooting"}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};return await this.client.deleteCacheCluster(e),{status:"deleting"}}throw Error(`ElastiCache action ${t} is not supported by this cluster mode.`)}}import{mkdir as YI,writeFile as ZI}from"node:fs/promises";import{join as XI}from"node:path";async function _n(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t==null?"ignore":"pipe",stdout:"pipe",stderr:"pipe"}),l=new Response(a.stdout).text(),m=new Response(a.stderr).text();if(t!=null)a.stdin.write(t),a.stdin.end();let[f,b,k]=await Promise.all([a.exited,l,m]);if(f!==0&&!r)throw Error(`Docker command failed (${f}): ${k.trim()||b.trim()}`);return{code:f,stdout:b,stderr:k}}class Iu{async ensureNetwork(e){if((await _n(["network","inspect",e],void 0,!0)).code!==0)await _n(["network","create","--internal",e])}async seedSecret(e,t){await _n(["volume","create",e]),await _n(["run","--rm","-i","-v",`${e}:/run/target`,"alpine:3.21","sh","-c","umask 077; cat > /run/target/credential"],t)}async removeVolume(e){await _n(["volume","rm",e],void 0,!0)}async inspect(e){let t=await _n(["inspect",e],void 0,!0);if(t.code!==0)return;return JSON.parse(t.stdout)[0]}async run(e){await _n(["run",...e])}async exec(e,t,r){return(await _n(["exec","-i",e,...t],r)).stdout}async update(e,t){await _n(["update",...t,e])}async restart(e){await _n(["restart",e])}async remove(e){await _n(["rm","--force",e],void 0,!0)}async logs(e,t){let r=await _n(["logs","--tail",String(Math.min(2000,Math.max(1,t))),e],void 0,!0);return`${r.stdout}${r.stderr}`.slice(-262144)}async stats(e){let t=await _n(["stats","--no-stream","--format","{{json .}}",e],void 0,!0);if(t.code!==0||!t.stdout.trim())return{};let r=JSON.parse(t.stdout.trim());return{cpuPercent:String(r.CPUPerc??""),memoryUsage:String(r.MemUsage??""),memoryPercent:String(r.MemPerc??""),networkIo:String(r.NetIO??""),blockIo:String(r.BlockIO??""),pids:Number(r.PIDs??0)}}}var eE={postgres:{image:"postgres:17-alpine",port:5432,dataPath:"/var/lib/postgresql/data"},mysql:{image:"mysql:8.4",port:3306,dataPath:"/var/lib/mysql"},mariadb:{image:"mariadb:11.7",port:3306,dataPath:"/var/lib/mysql"},redis:{image:"redis:7.4-alpine",port:6379,dataPath:"/data"},mongodb:{image:"mongo:8.0",port:27017,dataPath:"/data/db"}};function li(e,t="app"){let r=String(e??t);if(!/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(r))throw Error("Database identifiers must be letters, numbers, or underscores.");return r}function Io(e){if(!/^[a-z0-9][a-z0-9_.-]{1,62}$/i.test(e))throw Error("Runtime placement must be a valid container identifier.");return`tscloud-data-${e.toLowerCase()}`}function tE(e,t){let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)}function oc(e){return e.Config?.Labels??{}}class or{runtime;backupRoot;constructor(e=new Iu,t=d(process.cwd(),"backups","data")){this.runtime=e;this.backupRoot=t}async observe(e){let t=Io(e),r=await this.runtime.inspect(t);if(!r)throw Error(`Data container ${t} was not found.`);let a=oc(r),l=await this.runtime.stats(t),m=r.NetworkSettings?.Ports??{},f=Object.values(m).flat().find(Boolean);return{providerId:t,status:r.State?.Status??"unknown",healthy:r.State?.Health?.Status??null,engine:a["ts-cloud.engine"]??null,engineVersion:a["ts-cloud.engine-version"]??null,username:a["ts-cloud.username"]??null,database:a["ts-cloud.database"]??null,endpoint:f?.HostIp||"127.0.0.1",port:f?.HostPort?Number(f.HostPort):null,image:r.Config?.Image??null,startedAt:r.State?.StartedAt??null,metrics:l}}async apply(e,t){let r=String(e.id),a=Io(r),l=String(e.engine);if(l==="libsql")throw Error("libSQL requires an explicitly configured runtime image.");let m=eE[l];if(!m)throw Error(`Unsupported runtime data engine ${l}.`);if(!t)throw Error(`${l} requires a managed credential.`);if(e.publicExposure===!0)throw Error("Container public exposure requires an external reviewed firewall policy; direct publishing is refused.");let f=li(e.username),b=li(tE(e,"database")),k=`${a}-secret`,y=`${a}-data`,R=l==="redis"?`appendonly yes
+        ORDER BY rp.expires_at,rp.id`).all(e.toISOString(),e.toISOString()).map(_p),r=new Set;for(let a of new Set(t.map((l)=>l.projectId)))for(let l of this.listPolicies(a)){let m=this.listRecoveryPoints(l.projectId,l.id).filter((b)=>b.status==="available").sort((b,k)=>k.pointInTime.localeCompare(b.pointInTime));for(let b of m.slice(0,Math.max(0,l.retention.keepLast??0)))r.add(b.id);let f=[[l.retention.hourly,(b)=>b.toISOString().slice(0,13)],[l.retention.daily,(b)=>b.toISOString().slice(0,10)],[l.retention.weekly,(b)=>new Date(Date.UTC(b.getUTCFullYear(),b.getUTCMonth(),b.getUTCDate()-(b.getUTCDay()+6)%7)).toISOString().slice(0,10)],[l.retention.monthly,(b)=>b.toISOString().slice(0,7)]];for(let[b,k]of f){let y=new Set;for(let R of m){let T=k(new Date(R.pointInTime));if(y.has(T))continue;if(y.add(T),y.size<=Math.max(0,b??0))r.add(R.id)}}}return t.filter((a)=>!r.has(a.id))}coverage(e,t=this.now()){let r=new Map(this.listDestinations(e).map((a)=>[a.id,a]));return this.listPolicies(e).map((a)=>{let l=this.listRecoveryPoints(e,a.id).filter((b)=>b.status==="available"),m=l[0],f=m?(t.getTime()-new Date(m.pointInTime).getTime())/60000:Number.POSITIVE_INFINITY;return{policy:a,lastRecoveryPoint:m,missedRpo:a.enabled&&f>a.expectedRpoMinutes,unverified:l.filter((b)=>b.verificationState!=="verified").length,destinationHealthy:r.get(a.destinationId)?.status==="healthy"}})}}import{createCipheriv as VI,createDecipheriv as WI,createHash as Mh,randomBytes as Lh}from"node:crypto";var xp=Buffer.from("TSCB1"),Wc=(e)=>`sha256:${Mh("sha256").update(e).digest("hex")}`;function Fh(e){return Mh("sha256").update(e).digest()}function Yf(e,t,r){let a=r?Buffer.from(r):Lh(12);if(a.length!==12)throw Error("Backup encryption IV must contain 12 bytes.");let l=VI("aes-256-gcm",Fh(t),a),m=Buffer.concat([l.update(e),l.final()]),f=l.getAuthTag();return Buffer.concat([xp,a,f,m])}function Zf(e,t){let r=Buffer.from(e);if(!r.subarray(0,xp.length).equals(xp))throw Error("Backup does not contain a valid encrypted envelope.");let a=r.subarray(5,17),l=r.subarray(17,33),m=r.subarray(33),f=WI("aes-256-gcm",Fh(t),a);return f.setAuthTag(l),Buffer.concat([f.update(m),f.final()])}function HI(e){let t;try{t=JSON.parse(e)}catch{throw Error("Backup destination credential must be a JSON object with accessKeyId and secretAccessKey.")}if(!t.accessKeyId||!t.secretAccessKey)throw Error("Backup destination credential requires accessKeyId and secretAccessKey.");if(t.expiresAt){let r=new Date(String(t.expiresAt));if(!Number.isFinite(r.getTime()))throw Error("Backup destination credential expiresAt must be an ISO timestamp.");if(r.getTime()<=Date.now())throw Error("Backup destination credential has expired.")}return{accessKeyId:String(t.accessKeyId),secretAccessKey:String(t.secretAccessKey),sessionToken:t.sessionToken?String(t.sessionToken):void 0}}async function zu(e,t,r=new Date){if(!e.credentialRef)return{status:"default"};try{let a=JSON.parse(await t.resolve(e.credentialRef));if(!a.accessKeyId||!a.secretAccessKey)return{status:"invalid"};if(!a.expiresAt)return{status:"static"};let l=new Date(String(a.expiresAt));if(!Number.isFinite(l.getTime()))return{status:"invalid"};let m=l.getTime()-r.getTime();return{status:m<=0?"expired":m<=604800000?"expiring":"valid",expiresAt:l.toISOString()}}catch{return{status:"invalid"}}}class La{secrets;clientFactory;multipartThreshold;partSize;constructor(e,t=(l,m)=>new o(l.region??"us-east-1",void 0,{endpoint:l.endpoint?new URL(l.endpoint).host:void 0,forcePathStyle:l.forcePathStyle,credentials:m}),r=8388608,a=8388608){this.secrets=e;this.clientFactory=t;this.multipartThreshold=r;this.partSize=a}async client(e){let t=e.credentialRef?HI(await this.secrets.resolve(e.credentialRef)):void 0;return this.clientFactory(e,t)}async test(e){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let t=await this.client(e),r=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}.ts-cloud-health/${crypto.randomUUID()}`;await t.putObject({bucket:e.bucket,key:r,body:"ts-cloud backup destination health check",contentType:"text/plain"});try{let a=await t.getObjectBytes(e.bucket,r);if(Buffer.from(a.body).toString()!=="ts-cloud backup destination health check")throw Error("Backup destination health object was corrupted.")}finally{await t.deleteObject(e.bucket,r)}}async upload(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),a=Wc(t.body),l=e.encryption!=="provider"?await this.secrets.resolve(e.encryptionKeyRef):void 0,m=l?t.resume?.encryptionIv?Buffer.from(t.resume.encryptionIv,"base64url"):Lh(12):void 0,f=l?Yf(t.body,l,m):Buffer.from(t.body),b=Wc(f),k=`${e.prefix?`${e.prefix.replace(/\/$/,"")}/`:""}${t.key.replace(/^\/+/,"")}`,y=t.contentType??"application/octet-stream",R={"ts-cloud-format":"v1","ts-cloud-sha256":b.slice(7),"ts-cloud-encrypted":l?"true":"false"};if(t.resume&&t.resume.key!==k)throw Error("Multipart checkpoint does not match the requested backup key.");if(t.resume&&l&&!t.resume.encryptionIv)throw Error("Encrypted multipart checkpoint has no resumable envelope state.");if(t.resume&&l&&t.resume.plaintextChecksum!==a)throw Error("Encrypted multipart checkpoint does not match the backup payload.");if(f.length<this.multipartThreshold)await r.putObject({bucket:e.bucket,key:k,body:f,contentType:y,metadata:R});else{let T=t.resume?void 0:await r.createMultipartUpload(e.bucket,k,{contentType:y,metadata:R}),N=t.resume??{uploadId:T.UploadId,key:k,parts:[],bytesUploaded:0,encryptionIv:m?.toString("base64url"),plaintextChecksum:a},j=new Map(N.parts.map((q)=>[q.PartNumber,q])),U=Math.ceil(f.length/this.partSize);for(let q=0;q<U;q++){let Y=q+1;if(!j.has(Y)){let ee=q*this.partSize,le=await r.uploadPart(e.bucket,k,N.uploadId,Y,f.subarray(ee,Math.min(f.length,ee+this.partSize)));j.set(Y,{PartNumber:Y,ETag:le.ETag})}N.parts=[...j.values()].sort((ee,le)=>ee.PartNumber-le.PartNumber),N.bytesUploaded=Math.min(f.length,Y*this.partSize),t.checkpoint?.(N)}await r.completeMultipartUpload(e.bucket,k,N.uploadId,N.parts)}return{uri:`s3://${e.bucket}/${k}`,key:k,sizeBytes:f.length,checksum:b,manifest:{format:"ts-cloud-backup-v1",encrypted:!!l,plaintextChecksum:a,storageChecksum:b,contentType:y}}}async download(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");let r=await this.client(e),a=await r.getObjectBytes(e.bucket,t.key),l=Buffer.from(a.body);if(Wc(l)!==t.checksum)throw Error("Backup checksum verification failed; object is corrupt.");let m=t.manifest.encrypted?Zf(l,await this.secrets.resolve(e.encryptionKeyRef)):l;if(Wc(m)!==t.manifest.plaintextChecksum)throw Error("Backup plaintext checksum verification failed.");return m}async abortPartial(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).abortMultipartUpload(e.bucket,t.key,t.uploadId)}async delete(e,t){if(!e.bucket)throw Error("S3 destination has no configured bucket.");await(await this.client(e)).deleteObject(e.bucket,t)}}import{createHash as KI}from"node:crypto";var JI=(e)=>`sha256:${KI("sha256").update(e).digest("hex")}`;class ps{store;queue;now;constructor(e,t,r=()=>new Date){this.store=e;this.queue=t;this.now=r}enqueueBackup(e,t=this.now().toISOString(),r){if(!e.enabled)throw Error("Backup policy is disabled.");let a=this.store.createJob({projectId:e.projectId,policyId:e.id,kind:"backup",status:"queued",idempotencyKey:`backup:${e.id}:${t}`,target:{scheduledFor:t},cancellability:"checkpoint_only",progress:{phase:"queued"}});if(!a.operationId){let l=this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:r,kind:"backup.run",input:{backupJobId:a.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`backup-policy:${e.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:14400,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(a.id,{operationId:l.operation.id})}return a}enqueueDue(e=this.now()){return this.store.duePolicies(e).map((t)=>{let r=t.nextRunAt;return this.store.advancePolicy(t.id,r),this.enqueueBackup(t,r)})}enqueueVerification(e){let t=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:"verify",status:"queued",idempotencyKey:`verify:${e.id}:${e.checksum}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!t.operationId){let r=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"backup.verify",input:{backupJobId:t.id},lockKey:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:2,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(t.id,{operationId:r.operation.id})}return t}planRestore(e,t){if(e.status!=="available")throw Error("Only available recovery points can be restored.");if(e.verificationState!=="verified")throw Error("Restore requires a verified recovery point.");if(t.mode==="in_place"){if(!t.recentAuth)throw Error("In-place restore requires recent authentication.");if(t.confirm!==t.targetName)throw Error(`Type ${t.targetName} to confirm in-place restore.`);if(!t.downtimeAcknowledged)throw Error("In-place restore requires downtime acknowledgement.");let r=t.safetyBackupId?this.store.getRecoveryPoint(t.safetyBackupId):void 0;if(!r||r.id===e.id||r.status!=="available"||r.verificationState!=="verified"||r.resourceId!==e.resourceId||r.dataServiceId!==e.dataServiceId)throw Error("In-place restore requires a distinct verified safety backup for the same target.")}return{point:e,mode:t.mode,target:{...t.target,inPlace:t.mode==="in_place",restoreMode:t.mode},warnings:t.mode==="in_place"?["The target is locked against deployments and backup work.","Downtime and data replacement are expected.","Provider cancellation may stop only at a checkpoint."]:["An isolated target is created and health-validated before cleanup."]}}enqueueRestore(e,t){let r=this.planRestore(e,t),a=t.drill?"drill":"restore",l=JI(JSON.stringify({point:e.id,mode:t.mode,target:t.target,safety:t.safetyBackupId,drill:!!t.drill})),m=this.store.createJob({projectId:e.projectId,policyId:e.policyId,recoveryPointId:e.id,kind:a,status:"queued",idempotencyKey:`${a}:${l}`,target:r.target,restoreMode:r.mode,cancellability:"checkpoint_only",safetyBackupId:t.safetyBackupId,progress:{phase:"queued",warnings:r.warnings}});if(!m.operationId){let f=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,actorId:t.actorId,kind:t.drill?"backup.drill":"backup.restore",input:{backupJobId:m.id},lockKey:e.dataServiceId?`data-service:${e.dataServiceId}`:e.resourceId?`resource:${e.resourceId}`:`recovery-point:${e.id}`,providerKey:"backup",maxAttempts:1,timeoutSeconds:14400,retryClasses:[],resumePolicy:"fail"});return this.store.updateJob(m.id,{operationId:f.operation.id})}return m}enqueueRetention(e=this.now()){return this.store.retentionCandidates(e).map((t)=>{let r=this.store.createJob({projectId:t.projectId,policyId:t.policyId,recoveryPointId:t.id,kind:"cleanup",status:"queued",idempotencyKey:`cleanup:${t.id}:${t.expiresAt}`,target:{},cancellability:"safe",progress:{phase:"queued"}});if(!r.operationId){let a=this.queue.enqueue({projectId:t.projectId,resourceId:t.resourceId,kind:"backup.cleanup",input:{backupJobId:r.id},lockKey:`recovery-point:${t.id}`,providerKey:"backup",maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"});return this.store.updateJob(r.id,{operationId:a.operation.id})}return r})}}function Ku(e){let t=e.now??(()=>new Date),r=new ps(e.store,e.queue,t),a=(b)=>{let k=b.recoveryPointId?e.store.getRecoveryPoint(b.recoveryPointId):void 0,y=b.policyId?e.store.getPolicy(b.policyId):k?.policyId?e.store.getPolicy(k.policyId):void 0;if(!y)throw Error("Backup policy was not found.");let R=e.store.getDestination(k?.destinationId??y.destinationId),T=e.resolveSource(y);if(!R)throw Error("Backup destination was not found.");if(!T)throw Error(`No ${y.resourceKind} backup adapter is configured.`);return{point:k,policy:y,destination:R,source:T}},l=(b)=>{let k=b.operation.input,y=e.store.getJob(String(k.backupJobId??""));if(!y)throw Error("Backup job was not found.");return e.store.updateJob(y.id,{status:"running",startedAt:y.startedAt??t().toISOString(),progress:{...y.progress,phase:"running"}}),y},m=(b,k)=>{let y=e.store.getJob(b.id)??b;e.store.updateJob(b.id,{status:"failed",finishedAt:t().toISOString(),error:k instanceof Error?k.message:String(k),progress:{...y.progress,phase:"failed"}})};return{"backup.run":async(b)=>{let k=l(b);try{let{policy:y,destination:R,source:T}=a(k),N=await T.create(y,b),j=e.resolveDestination(R),U=N.mode==="object"?await(async()=>{if(!j)throw Error("Backup destination adapter is not configured.");let le=e.store.getJob(k.id)?.progress,Z=le?.multipart,ie=Z&&typeof Z==="object"&&!Array.isArray(Z)&&typeof Z.uploadId==="string"&&typeof Z.key==="string"&&Array.isArray(Z.parts)?Z:void 0;return j.upload(R,{key:N.key,body:N.body,contentType:N.contentType,resume:ie,checkpoint:(we)=>{b.checkpoint("uploading",`Uploaded ${Number(we.bytesUploaded??0)} backup bytes.`),e.store.updateJob(k.id,{progress:{phase:"uploading",multipart:{...we}}})}})})():{uri:N.uri,key:N.uri,sizeBytes:N.sizeBytes,checksum:N.checksum,manifest:{format:"ts-cloud-backup-v1",encrypted:!1,plaintextChecksum:N.checksum,storageChecksum:N.checksum,contentType:"application/provider-snapshot"}},q=y.retention.expireAfterDays?new Date(t().getTime()+y.retention.expireAfterDays*86400000).toISOString():void 0,Y=e.store.getJob(k.id)?.startedAt,ee=e.store.createRecoveryPoint({projectId:y.projectId,policyId:y.id,destinationId:R.id,resourceId:y.resourceId,dataServiceId:y.dataServiceId,backupJobId:k.id,kind:y.resourceKind,pointInTime:t().toISOString(),uri:U.uri,sizeBytes:U.sizeBytes,checksum:U.checksum,manifest:{...N.manifest,...U.manifest,storageKey:U.key},toolVersion:N.toolVersion,engineVersion:N.engineVersion,expiresAt:q,lockedUntil:R.immutability.defaultRetentionDays?new Date(t().getTime()+R.immutability.defaultRetentionDays*86400000).toISOString():void 0,held:!1,pinned:!1,status:"available",verificationState:"unverified",durationMs:Math.max(0,t().getTime()-new Date(Y??t().toISOString()).getTime())});if(N.mode==="external"&&R.provider==="aws_backup")e.store.recordDestinationTest(R.id,{ok:!0});return e.store.updateJob(k.id,{status:"succeeded",recoveryPointId:ee.id,finishedAt:t().toISOString(),progress:{phase:"stored",recoveryPointId:ee.id}}),r.enqueueVerification(ee),{backupJobId:k.id,recoveryPointId:ee.id}}catch(y){let R=e.store.getJob(k.id),T=R?.progress.multipart,N=(()=>{try{return a(k)}catch{return}})();if(N?.destination.provider==="aws_backup")e.store.recordDestinationTest(N.destination.id,{ok:!1,error:y instanceof Error?y.message:String(y)});let j=!1;if(T&&typeof T==="object"&&!Array.isArray(T)&&N){let U=e.resolveDestination(N.destination);if(j=!0,U?.abortPartial)try{await U.abortPartial(N.destination,T),j=!1,e.store.updateJob(k.id,{progress:{...R.progress,partialCleanup:"aborted"}})}catch{e.store.updateJob(k.id,{progress:{...R.progress,partialCleanup:"required"}})}}if(j)e.store.updateJob(k.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:y instanceof Error?y.message:String(y),progress:{...e.store.getJob(k.id)?.progress??{},phase:"cleanup_required"}});else m(k,y);throw y}},"backup.verify":async(b)=>{let k=l(b);try{let{point:y,destination:R,source:T}=a(k);if(!y)throw Error("Recovery point was not found.");e.store.updateRecoveryPoint(y.id,{verificationState:"verifying"});let N;if(y.uri.startsWith("s3:")){let j=e.resolveDestination(R);if(!j)throw Error("Backup destination adapter is not configured.");let U=await j.download(R,{key:String(y.manifest.storageKey??""),checksum:y.checksum,manifest:y.manifest}),q=T.verify?await T.verify(y,U,b):{};N={bytes:U.length,checksum:y.checksum,...q}}else if(T.verifyExternal)N=await T.verifyExternal(y,b);else throw Error("External recovery point verification is not supported.");return e.store.updateRecoveryPoint(y.id,{verificationState:"verified",verifiedAt:t().toISOString(),manifest:{...y.manifest,verification:N}}),e.store.updateJob(k.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"verified",evidence:N}}),{backupJobId:k.id,recoveryPointId:y.id,evidence:N}}catch(y){if(k.recoveryPointId)e.store.updateRecoveryPoint(k.recoveryPointId,{verificationState:/checksum|corrupt|authentic/i.test(y instanceof Error?y.message:String(y))?"corrupt":"failed"});throw m(k,y),y}},"backup.restore":async(b)=>f(b,!1),"backup.drill":async(b)=>f(b,!0),"backup.cleanup":async(b)=>{let k=l(b);try{let{point:y,destination:R,source:T}=a(k);if(!y)throw Error("Recovery point was not found.");if(!e.store.retentionCandidates(t()).some((N)=>N.id===y.id))throw Error("Recovery point is held, pinned, locked, or in active use.");if(e.store.updateRecoveryPoint(y.id,{status:"deleting"}),y.uri.startsWith("s3:")){let N=e.resolveDestination(R);if(!N)throw Error("Destination cleanup is unavailable.");await N.delete(R,String(y.manifest.storageKey??""))}else if(T.deleteExternal)await T.deleteExternal(y,b);else throw Error("External recovery point cleanup is unavailable.");return e.store.updateRecoveryPoint(y.id,{status:"deleted"}),e.store.updateJob(k.id,{status:"succeeded",finishedAt:t().toISOString(),progress:{phase:"deleted"}}),{backupJobId:k.id,recoveryPointId:y.id,deleted:!0}}catch(y){throw m(k,y),y}}};async function f(b,k){let y=l(b);try{let{point:R,policy:T,destination:N,source:j}=a(y);if(!R)throw Error("Recovery point was not found.");if(k&&!j.cleanup)throw Error("This backup source cannot safely clean a recovery drill target.");let U=R.uri.startsWith("s3:")?e.resolveDestination(N):void 0,q=U?await U.download(N,{key:String(R.manifest.storageKey??""),checksum:R.checksum,manifest:R.manifest}):void 0,Y=await j.restore(R,q,y.target,b),ee=j.validateHealth?await j.validateHealth({...y.target,...Y},b):{healthy:!0,mode:"adapter"},le=e.validateHealth?await e.validateHealth(T,y.target):{healthy:!0,mode:"not_configured"},Z={...ee,healthy:ee.healthy===!0&&le.healthy===!0,configured:le};if(Z.healthy!==!0)throw Error("Restored target did not pass its configured health check.");if(k&&j.cleanup)await j.cleanup({...y.target,provider:R.manifest.provider??null},b);return e.store.updateJob(y.id,{status:"succeeded",finishedAt:t().toISOString(),healthResult:Z,progress:{phase:k?"drill_cleaned":"restored",restored:Y}}),{backupJobId:y.id,recoveryPointId:R.id,restored:Y,health:Z,cleaned:k}}catch(R){let T=(()=>{try{return a(y)}catch{return}})(),N=R instanceof Error?R.message:String(R),j=!1;if(k&&T?.source.cleanup)try{await T.source.cleanup({...y.target,provider:T.point?.manifest.provider??null},b)}catch{j=!0}if(j)e.store.updateJob(y.id,{status:"cleanup_required",finishedAt:t().toISOString(),error:N,progress:{...y.progress,phase:"cleanup_required"}});else m(y,R);throw R}}}import{createHash as GI}from"node:crypto";var QI=(e)=>`sha256:${GI("sha256").update(e).digest("hex")}`;class $a{dataServices;client;constructor(e,t=new J){this.dataServices=e;this.client=t}service(e){let t=e.dataServiceId?this.dataServices.get(e.dataServiceId):void 0;if(!t||!["aws_rds","aws_aurora"].includes(t.provider))throw Error("Managed database backup policy requires an RDS or Aurora data service.");return t}async waitForSnapshot(e,t,r){for(;;){r.throwIfCancellationRequested?.(),r.heartbeat?.();let a=e==="aws_aurora"?(await this.client.describeDBClusterSnapshots({DBClusterSnapshotIdentifier:t})).DBClusterSnapshots[0]:(await this.client.describeDBSnapshots({DBSnapshotIdentifier:t})).DBSnapshots?.[0];if(!a)throw Error("Provider snapshot was not found.");let l=a,m=String(l.Status??l.DBSnapshotStatus??"unknown");if(r.checkpoint?.("provider_snapshot",`Database snapshot ${t} is ${m}.`),m==="available")return l;if(["deleted","deleting","failed"].includes(m))throw Error(`Provider snapshot ${t} failed with state ${m}.`);await Bun.sleep(5000)}}async create(e,t){let r=this.service(e),a=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,20),l=`${r.placement.slice(0,42).replace(/-+$/,"")}-${a}`;if(r.provider==="aws_aurora")await this.client.createDBClusterSnapshot(r.placement,l);else await this.client.createDBSnapshot({DBInstanceIdentifier:r.placement,DBSnapshotIdentifier:l});await this.waitForSnapshot(r.provider,l,t);let m=`${r.provider}:${r.placement}:${l}`;return{mode:"external",uri:`aws-backup:${m}`,checksum:QI(m),sizeBytes:0,manifest:{provider:r.provider,sourceId:r.placement,snapshotId:l,plan:r.plan,engine:r.engine},engineVersion:r.engineVersion,toolVersion:"aws-rds-api-2014-10-31"}}async verifyExternal(e,t){let r=String(e.manifest.snapshotId??""),a=String(e.manifest.provider??"");if(!r)throw Error("Snapshot recovery point has no snapshot ID.");let l=await this.waitForSnapshot(a,r,t),m=String(l.Status??l.DBSnapshotStatus??"unknown");return{snapshotId:r,status:m,encrypted:l.Encrypted??l.StorageEncrypted??!0}}async restore(e,t,r,a){let l=String(r.targetId??""),m=String(e.manifest.snapshotId??""),f=String(e.manifest.provider??"");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(l))throw Error("Managed restore requires a valid distinct targetId.");if(l===e.manifest.sourceId)throw Error("Managed restore target must differ from its source.");if(f==="aws_aurora"){let b=e.manifest.engine==="postgres"?"aurora-postgresql":"aurora-mysql";await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:l,SnapshotIdentifier:m,Engine:b,EngineVersion:e.engineVersion,DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:Number(r.minCapacity)||0.5,MaxCapacity:Number(r.maxCapacity)||4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${l}-writer-1`,DBClusterIdentifier:l,DBInstanceClass:String(r.plan??e.manifest.plan??"db.serverless"),Engine:b,PubliclyAccessible:!1})}else await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:l,DBSnapshotIdentifier:m,DBInstanceClass:String(r.plan??e.manifest.plan??""),PubliclyAccessible:!1,DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud-restore"}]});return{targetId:l,provider:f,status:"creating",isolated:!0}}async validateHealth(e,t){let r=String(e.targetId??""),a=String(e.provider??"");for(;;){t.throwIfCancellationRequested?.(),t.heartbeat?.();let l=a==="aws_aurora"?(await this.client.describeDBClusters({DBClusterIdentifier:r})).DBClusters?.[0]:(await this.client.describeDBInstances({DBInstanceIdentifier:r})).DBInstances?.[0];if(!l)throw Error("Restored managed database was not found.");let m=String(l.Status??l.DBInstanceStatus??"unknown");if(t.checkpoint?.("provider_restore",`Restored database ${r} is ${m}.`),m==="available")return{healthy:!0,targetId:r,provider:a,status:m};if(["deleted","deleting","failed","incompatible-restore"].includes(m))throw Error(`Restored managed database ${r} failed with state ${m}.`);await Bun.sleep(5000)}}async cleanup(e,t){let r=String(e.targetId??""),a=String(e.provider??"");if(!r)throw Error("Restore cleanup target is required.");if(a==="aws_aurora")await this.client.deleteDBInstance({DBInstanceIdentifier:`${r}-writer-1`,SkipFinalSnapshot:!0}),await this.client.modifyDBCluster({DBClusterIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(r);else await this.client.modifyDBInstance({DBInstanceIdentifier:r,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:r,SkipFinalSnapshot:!0,DeleteAutomatedBackups:!0})}async deleteExternal(e,t){let r=String(e.manifest.snapshotId??"");if(e.manifest.provider==="aws_aurora")await this.client.deleteDBClusterSnapshot(r);else await this.client.deleteDBSnapshot(r)}}var qr=(e,t="none",r=!1)=>({supported:!0,downtime:t,destructive:r,explanation:e}),Dr=(e)=>({supported:!1,downtime:"none",destructive:!1,explanation:e});function mn(e,t){let r=["aws_rds","aws_aurora","aws_elasticache"].includes(t),a=["server","container"].includes(t),l=["postgres","mysql","mariadb"].includes(e),m=e==="redis",f={};return f.create=t==="external"?Dr("External services can be adopted as read-only inventory."):qr(r?"Provision through the provider API.":"Provision through the owning runtime driver.","possible"),f.observe=t==="external"?Dr("External observation requires a configured provider adapter."):qr("Provider/runtime health and endpoint metadata are observable."),f.connect=qr("Connection guidance uses secret references and never returns a password by default."),f.backup=l&&(r||a)?qr(r?"Create a provider snapshot.":"Create a consistent engine-native dump.","possible"):Dr("This cache path is not a durable backup source."),f.restore=r&&l?qr("Restore creates a reviewed provider target.","required",!0):Dr("Restore requires a configured provider restore runner."),f.restart=t==="external"?Dr("External restart requires a configured provider adapter."):qr(r?"Provider restart/failover semantics apply.":"Restart the owning service unit.","required"),f.resize=t==="aws_elasticache"?Dr("ElastiCache resizing requires a replication-group migration runner."):r?qr("Provider plan/storage modification may enter a maintenance window.","possible"):a?qr("Edit host/container resources and reconcile.","required"):Dr("External resize requires a configured provider adapter."),f.version=a?Dr("Runtime version upgrades require an explicit image migration runner."):r&&t!=="aws_elasticache"?qr(l?"Major versions require compatibility preflight and backup.":"Engine upgrades require a maintenance window.","required"):Dr("External upgrades require a configured provider adapter."),f.rotate=t==="aws_elasticache"||t==="external"||a&&!l&&!m?Dr("Credential rotation is not available for this provider/engine path."):qr("Rotate through the secret backend, update the engine, then flag dependent releases."),f.expose=a?Dr("Direct container publishing is refused; use a reviewed firewall and proxy policy."):t==="aws_rds"?qr("Exposure is reconciled through security groups; public access defaults off."):Dr("Exposure changes require a provider-specific network runner."),f.delete=t==="external"?Dr("External deletion requires a configured provider adapter."):qr(r?"Final snapshot is supported where the provider allows it.":"A final engine backup is required unless explicitly retained.","required",!0),f.logs=a?qr("Read bounded service logs from the runtime."):Dr("Provider log export is not configured for this adapter."),f.slow_queries=a&&l?qr("Read bounded runtime logs after engine slow-query logging is enabled."):Dr("A slow-query log runner is not configured for this provider."),f.users=a&&l?qr("Logical users can be listed; creation requires a referenced secondary credential."):Dr("User management requires an engine connection runner."),f.databases=a&&l?qr("Logical databases can be listed, created, and confirmation-gated for deletion."):Dr("Logical database management requires an engine connection runner."),{actions:f,endpointTypes:r?["internal","external","tunnel"]:["internal","tunnel"],metrics:m?["connections","memory","evictions","hit_rate","latency"]:["connections","cpu","storage","read_latency","write_latency","iops"]}}var ws=(e)=>e==null?void 0:String(e),Kc=(e)=>Number(e)===1,Hc=(e)=>{try{return JSON.parse(String(e))}catch{return{}}};function zh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:ws(e.environment_id),resourceId:ws(e.resource_id),name:String(e.name),engine:String(e.engine),provider:String(e.provider),placement:String(e.placement),engineVersion:ws(e.engine_version),plan:String(e.plan),storageGb:e.storage_gb==null?void 0:Number(e.storage_gb),highAvailability:Kc(e.high_availability),publicExposure:Kc(e.public_exposure),allowedCidrs:Hc(e.allowed_cidrs),desiredState:Hc(e.desired_state),observedState:Hc(e.observed_state),capabilities:Hc(e.capabilities),credentialRef:ws(e.credential_ref),status:String(e.status),origin:String(e.origin),managementEnabled:Kc(e.management_enabled),ownerActorId:ws(e.owner_actor_id),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class ga{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}create(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Data service names must be 2-63 lowercase letters, numbers, or dashes.");if(e.publicExposure&&(!e.allowedCidrs.length||e.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");let t=crypto.randomUUID(),r=this.now().toISOString(),a=mn(e.engine,e.provider);return this.controlPlane.database.run("INSERT INTO data_services (id,organization_id,project_id,environment_id,resource_id,name,engine,provider,placement,engine_version,plan,storage_gb,high_availability,public_exposure,allowed_cidrs,desired_state,observed_state,capabilities,credential_ref,status,origin,management_enabled,owner_actor_id,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.environmentId??null,e.resourceId??null,e.name,e.engine,e.provider,e.placement,e.engineVersion??null,e.plan,e.storageGb??null,e.highAvailability?1:0,e.publicExposure?1:0,JSON.stringify(e.allowedCidrs),JSON.stringify(e.desiredState),JSON.stringify(e.observedState),JSON.stringify(a),e.credentialRef??null,e.status,e.origin,e.managementEnabled?1:0,e.ownerActorId??null,1,r,r]),this.get(t)}get(e){let t=this.controlPlane.database.query("SELECT * FROM data_services WHERE id=?").get(e);return t?zh(t):void 0}list(e,t){return this.controlPlane.database.query(`SELECT * FROM data_services WHERE project_id=?${t?" AND environment_id=?":""} ORDER BY name`).all(e,...t?[t]:[]).map(zh)}update(e,t,r){let a=this.get(e);if(!a)throw Error("Data service was not found.");if(a.version!==t)throw Error("Data service changed; refresh before retrying.");let l={...a,...r};if(l.publicExposure&&(!l.allowedCidrs.length||l.allowedCidrs.includes("0.0.0.0/0")))throw Error("Public exposure requires explicit narrow CIDRs; 0.0.0.0/0 is refused.");if(this.controlPlane.database.run("UPDATE data_services SET plan=?,storage_gb=?,engine_version=?,high_availability=?,public_exposure=?,allowed_cidrs=?,desired_state=?,observed_state=?,status=?,management_enabled=?,credential_ref=?,version=version+1,updated_at=? WHERE id=? AND version=?",[l.plan,l.storageGb??null,l.engineVersion??null,l.highAvailability?1:0,l.publicExposure?1:0,JSON.stringify(l.allowedCidrs),JSON.stringify(l.desiredState),JSON.stringify(l.observedState),l.status,l.managementEnabled?1:0,l.credentialRef??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Data service changed; refresh before retrying.");return this.get(e)}credential(e){let t=this.controlPlane.database.query("SELECT * FROM data_service_credentials WHERE service_id=? ORDER BY version DESC LIMIT 1").get(e);return t?{id:String(t.id),serviceId:String(t.service_id),username:String(t.username),secretRef:String(t.secret_ref),version:Number(t.version),createdAt:String(t.created_at),rotatedAt:ws(t.rotated_at)}:void 0}saveCredential(e,t,r){let a=this.credential(e),l=a?.id??crypto.randomUUID(),m=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_credentials (id,service_id,username,secret_ref,version,created_at,rotated_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(service_id,username) DO UPDATE SET secret_ref=excluded.secret_ref,version=data_service_credentials.version+1,rotated_at=excluded.rotated_at",[l,e,t,r,a?.version??1,a?.createdAt??m,a?m:null]),this.credential(e)}addDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO data_service_dependencies (service_id,resource_id,secret_ref,requires_redeploy,created_at) VALUES (?,?,?,?,?) ON CONFLICT(service_id,resource_id) DO UPDATE SET secret_ref=excluded.secret_ref,requires_redeploy=excluded.requires_redeploy",[e.serviceId,e.resourceId,e.secretRef,e.requiresRedeploy?1:0,t]),{...e,createdAt:t}}dependencies(e){return this.controlPlane.database.query("SELECT * FROM data_service_dependencies WHERE service_id=? ORDER BY resource_id").all(e).map((t)=>({serviceId:String(t.service_id),resourceId:String(t.resource_id),secretRef:String(t.secret_ref),requiresRedeploy:Kc(t.requires_redeploy),createdAt:String(t.created_at)}))}removeDependency(e,t){return this.controlPlane.database.run("DELETE FROM data_service_dependencies WHERE service_id=? AND resource_id=?",[e,t]).changes===1}remove(e){this.controlPlane.database.run("DELETE FROM data_services WHERE id=?",[e])}}function Uh(){let t=crypto.getRandomValues(new Uint8Array(40));return Array.from(t,(r)=>"ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%^&*_-+="[r%69]).join("")}function yu(e,t){return t.map((r)=>{let a=r.type==="tunnel"?"127.0.0.1":r.host,l=e.engine==="redis"?`redis-cli -h ${a} -p ${r.port}${r.tls?" --tls":""}`:e.engine==="postgres"?`psql "host=${a} port=${r.port} dbname=${r.database??"postgres"} sslmode=${r.tls?"require":"disable"}"`:e.engine==="mongodb"?`mongosh "mongodb://${a}:${r.port}/${r.database??"admin"}${r.tls?"?tls=true":""}"`:e.engine==="libsql"?`turso db shell ${r.tls?"https":"http"}://${a}:${r.port}`:`mysql --host=${a} --port=${r.port} --database=${r.database??"mysql"} --ssl-mode=${r.tls?"REQUIRED":"DISABLED"}`;return{type:r.type,command:l,secretRef:e.credentialRef}})}class os{store;queue;secrets;constructor(e,t,r){this.store=e;this.queue=t;this.secrets=r}async create(e){let t,r;if(e.provider!=="aws_elasticache"){let a=e.username??"app",l=Uh();r=`secret://data-services/${e.projectId}/${e.name}/${a}`,await this.secrets.put(r,l),t={username:a,password:l,secretRef:r}}try{let a=this.store.create({...e,credentialRef:r,status:"planning"});if(t)this.store.saveCredential(a.id,t.username,t.secretRef);let l=this.enqueue(a,"create",{});return{service:a,credential:t,operationId:l}}catch(a){if(r)await this.secrets.remove(r);throw a}}plan(e,t,r={}){let a=e.capabilities.actions[t],l=t==="version"&&String(r.engineVersion??"").split(".")[0]!==String(e.engineVersion??"").split(".")[0];return{service:e,action:t,capability:a,changes:r,preflight:{backupRequired:["delete","restore"].includes(t)||l,compatibilityRequired:l,typedConfirmation:a.destructive?e.name:void 0,retentionChoiceRequired:t==="delete"},warnings:[...a.downtime!=="none"?[`Downtime is ${a.downtime}.`]:[],...e.origin==="adopted"&&!e.managementEnabled?["Adopted resource is read-only until management is explicitly enabled."]:[]]}}enqueue(e,t,r,a){let l=this.plan(e,t,r);if(!l.capability.supported)throw Error(l.capability.explanation);if(e.origin==="adopted"&&!e.managementEnabled&&t!=="observe")throw Error("Adopted resources remain read-only until management is explicitly enabled.");if(l.preflight.typedConfirmation&&r.confirm!==l.preflight.typedConfirmation)throw Error(`Type ${l.preflight.typedConfirmation} to confirm ${t}.`);if(l.preflight.retentionChoiceRequired&&!["final_backup","retain"].includes(String(r.retention??"")))throw Error("Deletion requires retention final_backup or retain.");if(l.preflight.compatibilityRequired&&(r.compatibilityReviewed!==!0||!r.backupId))throw Error("Major version changes require compatibilityReviewed=true and a backupId.");if(t==="restore"){let m=String(r.backupId??""),f=String(r.targetId??"");if(!m||!f)throw Error("Restore requires both backupId and targetId.");if(f===e.placement)throw Error("Restore targetId must differ from the source placement.");if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(f))throw Error("Restore targetId must be 2-63 lowercase letters, numbers, or dashes.")}return this.queue.enqueue({projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,actorId:a,kind:"data_service.action",input:{serviceId:e.id,action:t,...r},lockKey:`data-service:${e.id}`,providerKey:e.provider,maxAttempts:3,timeoutSeconds:7200,retryClasses:["provider_transient"],resumePolicy:"requeue"}).operation.id}async rotate(e,t,r){let a=this.store.credential(e.id);if(!a)throw Error("Data service credential metadata was not found.");let l=Uh(),m=`${a.secretRef}/v${a.version+1}`;await this.secrets.put(m,l);try{return await t.action(e,"rotate",{username:a.username,secretRef:m},l,r),this.store.saveCredential(e.id,a.username,m),this.store.update(e.id,e.version,{credentialRef:m}),{credential:{username:a.username,password:l,secretRef:m},dependencies:this.store.dependencies(e.id).filter((f)=>f.requiresRedeploy).map((f)=>f.resourceId)}}catch(f){throw await this.secrets.remove(m),f}}}function Su(e){return{"data_service.action":async(t)=>{let r=t.operation.input,a=e.store.get(String(r.serviceId??"")),l=String(r.action??"");if(!a)throw Error("Data service was not found.");let m=e.resolveAdapter(a);if(!m||m.provider!==a.provider||!m.engines.includes(a.engine))throw Error(`No ${a.provider}/${a.engine} adapter is configured.`);if(l==="rotate"){let b=await new os(e.store,new c(e.store.controlPlane),e.secrets).rotate(a,m,t);return{serviceId:a.id,action:l,username:b.credential.username,secretRef:b.credential.secretRef,dependencies:b.dependencies}}let f=a.credentialRef?await e.secrets.resolve(a.credentialRef):void 0;try{let b=l==="observe"?await m.observe(a):l==="create"?await m.apply(a,f,t):await m.action(a,l,r,f,t),k=e.store.get(a.id);return e.store.update(a.id,k.version,{observedState:b,status:l==="delete"?r.retention==="retain"?"retained":"deleting":"available"}),{serviceId:a.id,action:l,observed:b}}catch(b){let k=e.store.get(a.id);if(e.store.update(a.id,k.version,{status:"failed",observedState:{...k.observedState,error:b instanceof Error?b.message:String(b)}}),/temporar|timeout|unavailable|throttl/i.test(b instanceof Error?b.message:String(b)))throw new te(b instanceof Error?b.message:String(b),"provider_transient");throw b}}}}class ks{transport;constructor(e){this.transport=e}observe(e){return this.transport.observe(e.placement)}apply(e,t){return this.transport.apply({id:e.placement,name:e.name,engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,storageGb:e.storageGb??null,highAvailability:e.highAvailability,publicExposure:e.publicExposure,allowedCidrs:e.allowedCidrs,username:e.desiredState.username??"app",desiredState:e.desiredState},t)}action(e,t,r,a,l){return this.transport.execute(e.placement,t,{engine:e.engine,engineVersion:e.engineVersion??null,plan:e.plan,desiredState:e.desiredState,...r},a,l)}}class pa extends ks{provider="aws_rds";engines=["postgres","mysql","mariadb"]}class ma extends ks{provider="aws_aurora";engines=["postgres","mysql"]}class fa extends ks{provider="aws_elasticache";engines=["redis"]}class ha extends ks{provider="server";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}class Aa extends ks{provider="container";engines=["postgres","mysql","mariadb","redis","mongodb","libsql"]}var Qc=(e,t)=>{let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)},rr=(e,t,r)=>{let a=Qc(e,t);return a==null?r:String(a)},sn=(e,t)=>{let r=Qc(e,t);return r==null?void 0:Number(r)},Wi=(e,t)=>{let r=Qc(e,t);return r==null?void 0:r===!0||r==="true"},Es=(e,t)=>{let r=Qc(e,t);return Array.isArray(r)?r.map(String):[]},Gc=(e,t)=>rr(t,"snapshotId")??`${e}-final-${new Date().toISOString().replace(/[^0-9]/g,"").slice(0,14)}`;function Jc(e){if(!e)throw Error("RDS instance was not found.");return{providerId:e.DBInstanceIdentifier??null,status:e.DBInstanceStatus??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,plan:e.DBInstanceClass??null,storageGb:e.AllocatedStorage??null,highAvailability:e.MultiAZ??!1,publicExposure:e.PubliclyAccessible??!1,endpoint:e.Endpoint?.Address??null,port:e.Endpoint?.Port??null,username:e.MasterUsername??null,database:e.DBName??null,encrypted:e.StorageEncrypted??!1}}class ya{client;constructor(e=new J){this.client=e}async observe(e){return Jc(await this.client.describeDBInstance(e))}async apply(e,t){let r=String(e.id),a=await this.client.createDBInstance({DBInstanceIdentifier:r,DBInstanceClass:String(e.plan),Engine:String(e.engine),MasterUsername:rr(e,"username","app"),MasterUserPassword:t,DBName:rr(e,"database"),AllocatedStorage:sn(e,"storageGb"),VpcSecurityGroupIds:Es(e,"securityGroupIds"),DBSubnetGroupName:rr(e,"subnetGroup"),BackupRetentionPeriod:sn(e,"backupRetentionDays")??7,MultiAZ:Wi(e,"highAvailability"),EngineVersion:rr(e,"engineVersion"),PubliclyAccessible:Wi(e,"publicExposure")??!1,StorageType:rr(e,"storageType","gp3"),StorageEncrypted:!0,KmsKeyId:rr(e,"kmsKeyId"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return Jc(a.DBInstance)}async execute(e,t,r,a,l){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBInstance({DBInstanceIdentifier:e}),{status:"rebooting"};if(t==="backup"){let m=Gc(e,r);return await this.client.createDBSnapshot({DBInstanceIdentifier:e,DBSnapshotIdentifier:m}),{status:"snapshotting",snapshotId:m}}if(t==="restore"){let m=String(r.targetId),f=await this.client.restoreDBInstanceFromDBSnapshot({DBInstanceIdentifier:m,DBSnapshotIdentifier:String(r.backupId),DBInstanceClass:rr(r,"plan"),DBSubnetGroupName:rr(r,"subnetGroup"),MultiAZ:Wi(r,"highAvailability"),PubliclyAccessible:!1,StorageType:rr(r,"storageType"),VpcSecurityGroupIds:Es(r,"securityGroupIds"),DeletionProtection:!0,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{...Jc(f.DBInstance),sourceId:e,restoreTargetId:m}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let m=Gc(e,r);return await this.client.modifyDBInstance({DBInstanceIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBInstance({DBInstanceIdentifier:e,SkipFinalSnapshot:!1,FinalDBSnapshotIdentifier:m,DeleteAutomatedBackups:!1}),{status:"deleting",finalSnapshotId:m}}if(["resize","version","rotate","expose"].includes(t)){let m=await this.client.modifyDBInstance({DBInstanceIdentifier:e,DBInstanceClass:rr(r,"plan"),AllocatedStorage:sn(r,"storageGb"),MasterUserPassword:t==="rotate"?a:void 0,EngineVersion:rr(r,"engineVersion"),MultiAZ:Wi(r,"highAvailability"),PubliclyAccessible:Wi(r,"publicExposure"),VpcSecurityGroupIds:Es(r,"securityGroupIds"),ApplyImmediately:Wi(r,"applyImmediately")??!0});return Jc(m.DBInstance)}throw Error(`RDS action ${t} requires an engine connection runner.`)}}function Dp(e){if(!e)throw Error("Aurora cluster was not found.");return{providerId:e.DBClusterIdentifier??null,status:e.Status??"unknown",engine:e.Engine??null,engineVersion:e.EngineVersion??null,endpoint:e.Endpoint??null,readerEndpoint:e.ReaderEndpoint??null,port:e.Port??null,username:e.MasterUsername??null,database:e.DatabaseName??null,encrypted:e.StorageEncrypted??!1,highAvailability:e.MultiAZ??!0}}class Sa{client;constructor(e=new J){this.client=e}async observe(e){let t=await this.client.describeDBClusters({DBClusterIdentifier:e});return Dp(t.DBClusters?.[0])}async apply(e,t){let r=String(e.id),a=String(e.engine)==="postgres"?"aurora-postgresql":"aurora-mysql";return await this.client.createDBCluster({DBClusterIdentifier:r,Engine:a,EngineVersion:rr(e,"engineVersion"),MasterUsername:rr(e,"username","app"),MasterUserPassword:t,DatabaseName:rr(e,"database"),DBSubnetGroupName:rr(e,"subnetGroup"),VpcSecurityGroupIds:Es(e,"securityGroupIds"),BackupRetentionPeriod:sn(e,"backupRetentionDays")??7,StorageEncrypted:!0,KmsKeyId:rr(e,"kmsKeyId"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:sn(e,"minCapacity")??0.5,MaxCapacity:sn(e,"maxCapacity")??4}}),await this.client.createDBInstance({DBInstanceIdentifier:`${r}-writer-1`,DBClusterIdentifier:r,DBInstanceClass:String(e.plan||"db.serverless"),Engine:a,PubliclyAccessible:Wi(e,"publicExposure")??!1}),{status:"creating",providerId:r}}async execute(e,t,r,a){if(t==="observe")return this.observe(e);if(t==="restart")return await this.client.rebootDBCluster(e),{status:"rebooting"};if(t==="backup"){let l=Gc(e,r);return await this.client.createDBClusterSnapshot(e,l),{status:"snapshotting",snapshotId:l}}if(t==="restore"){let l=String(r.targetId),m=String(r.engine)==="postgres"?"aurora-postgresql":"aurora-mysql",f=await this.client.restoreDBClusterFromSnapshot({DBClusterIdentifier:l,SnapshotIdentifier:String(r.backupId),Engine:m,EngineVersion:rr(r,"engineVersion"),DBSubnetGroupName:rr(r,"subnetGroup"),VpcSecurityGroupIds:Es(r,"securityGroupIds"),DeletionProtection:!0,ServerlessV2ScalingConfiguration:{MinCapacity:sn(r,"minCapacity")??0.5,MaxCapacity:sn(r,"maxCapacity")??4}});return await this.client.createDBInstance({DBInstanceIdentifier:`${l}-writer-1`,DBClusterIdentifier:l,DBInstanceClass:rr(r,"plan","db.serverless"),Engine:m,PubliclyAccessible:!1}),{...Dp(f.DBCluster),sourceId:e,restoreTargetId:l}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let l=Gc(e,r);return await this.client.modifyDBCluster({DBClusterIdentifier:e,DeletionProtection:!1,ApplyImmediately:!0}),await this.client.deleteDBCluster(e,l),{status:"deleting",finalSnapshotId:l}}if(["resize","version","rotate"].includes(t)){let l=await this.client.modifyDBCluster({DBClusterIdentifier:e,ServerlessV2ScalingConfiguration:sn(r,"minCapacity")==null&&sn(r,"maxCapacity")==null?void 0:{MinCapacity:sn(r,"minCapacity")??0.5,MaxCapacity:sn(r,"maxCapacity")??4},EngineVersion:rr(r,"engineVersion"),MasterUserPassword:t==="rotate"?a:void 0,ApplyImmediately:Wi(r,"applyImmediately")??!0});return Dp(l.DBCluster)}throw Error(`Aurora action ${t} requires an engine connection runner.`)}}class Ia{client;constructor(e=new st){this.client=e}async observe(e){let t=(await this.client.describeCacheClusters(e)).CacheClusters[0];if(!t)throw Error("ElastiCache cluster was not found.");let r=t.CacheNodes?.[0]?.Endpoint;return{providerId:t.CacheClusterId,status:t.CacheClusterStatus,engine:t.Engine,engineVersion:t.EngineVersion,plan:t.CacheNodeType,nodes:t.NumCacheNodes,endpoint:r?.Address??null,port:r?.Port??null}}async apply(e){let t=await this.client.createCacheCluster({cacheClusterId:String(e.id),engine:"redis",cacheNodeType:String(e.plan),numCacheNodes:sn(e,"nodes")??1,engineVersion:rr(e,"engineVersion"),port:sn(e,"port"),securityGroupIds:Es(e,"securityGroupIds"),subnetGroupName:rr(e,"subnetGroup"),tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{providerId:t.CacheCluster.CacheClusterId,status:t.CacheCluster.CacheClusterStatus}}async execute(e,t,r){if(t==="observe")return this.observe(e);if(t==="restart"){let a=(await this.client.describeCacheClusters(e)).CacheClusters[0];return await this.client.rebootCacheCluster(e,a?.CacheNodes?.map((l)=>l.CacheNodeId)??["0001"]),{status:"rebooting"}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};return await this.client.deleteCacheCluster(e),{status:"deleting"}}throw Error(`ElastiCache action ${t} is not supported by this cluster mode.`)}}import{mkdir as YI,writeFile as ZI}from"node:fs/promises";import{join as XI}from"node:path";async function _n(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t==null?"ignore":"pipe",stdout:"pipe",stderr:"pipe"}),l=new Response(a.stdout).text(),m=new Response(a.stderr).text();if(t!=null)a.stdin.write(t),a.stdin.end();let[f,b,k]=await Promise.all([a.exited,l,m]);if(f!==0&&!r)throw Error(`Docker command failed (${f}): ${k.trim()||b.trim()}`);return{code:f,stdout:b,stderr:k}}class Iu{async ensureNetwork(e){if((await _n(["network","inspect",e],void 0,!0)).code!==0)await _n(["network","create","--internal",e])}async seedSecret(e,t){await _n(["volume","create",e]),await _n(["run","--rm","-i","-v",`${e}:/run/target`,"alpine:3.21","sh","-c","umask 077; cat > /run/target/credential"],t)}async removeVolume(e){await _n(["volume","rm",e],void 0,!0)}async inspect(e){let t=await _n(["inspect",e],void 0,!0);if(t.code!==0)return;return JSON.parse(t.stdout)[0]}async run(e){await _n(["run",...e])}async exec(e,t,r){return(await _n(["exec","-i",e,...t],r)).stdout}async update(e,t){await _n(["update",...t,e])}async restart(e){await _n(["restart",e])}async remove(e){await _n(["rm","--force",e],void 0,!0)}async logs(e,t){let r=await _n(["logs","--tail",String(Math.min(2000,Math.max(1,t))),e],void 0,!0);return`${r.stdout}${r.stderr}`.slice(-262144)}async stats(e){let t=await _n(["stats","--no-stream","--format","{{json .}}",e],void 0,!0);if(t.code!==0||!t.stdout.trim())return{};let r=JSON.parse(t.stdout.trim());return{cpuPercent:String(r.CPUPerc??""),memoryUsage:String(r.MemUsage??""),memoryPercent:String(r.MemPerc??""),networkIo:String(r.NetIO??""),blockIo:String(r.BlockIO??""),pids:Number(r.PIDs??0)}}}var eE={postgres:{image:"postgres:17-alpine",port:5432,dataPath:"/var/lib/postgresql/data"},mysql:{image:"mysql:8.4",port:3306,dataPath:"/var/lib/mysql"},mariadb:{image:"mariadb:11.7",port:3306,dataPath:"/var/lib/mysql"},redis:{image:"redis:7.4-alpine",port:6379,dataPath:"/data"},mongodb:{image:"mongo:8.0",port:27017,dataPath:"/data/db"}};function li(e,t="app"){let r=String(e??t);if(!/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(r))throw Error("Database identifiers must be letters, numbers, or underscores.");return r}function Io(e){if(!/^[a-z0-9][a-z0-9_.-]{1,62}$/i.test(e))throw Error("Runtime placement must be a valid container identifier.");return`tscloud-data-${e.toLowerCase()}`}function tE(e,t){let r=e.desiredState;return e[t]??(r&&typeof r==="object"&&!Array.isArray(r)?r[t]:void 0)}function oc(e){return e.Config?.Labels??{}}class or{runtime;backupRoot;constructor(e=new Iu,t=d(process.cwd(),"backups","data")){this.runtime=e;this.backupRoot=t}async observe(e){let t=Io(e),r=await this.runtime.inspect(t);if(!r)throw Error(`Data container ${t} was not found.`);let a=oc(r),l=await this.runtime.stats(t),m=r.NetworkSettings?.Ports??{},f=Object.values(m).flat().find(Boolean);return{providerId:t,status:r.State?.Status??"unknown",healthy:r.State?.Health?.Status??null,engine:a["ts-cloud.engine"]??null,engineVersion:a["ts-cloud.engine-version"]??null,username:a["ts-cloud.username"]??null,database:a["ts-cloud.database"]??null,endpoint:f?.HostIp||"127.0.0.1",port:f?.HostPort?Number(f.HostPort):null,image:r.Config?.Image??null,startedAt:r.State?.StartedAt??null,metrics:l}}async apply(e,t){let r=String(e.id),a=Io(r),l=String(e.engine);if(l==="libsql")throw Error("libSQL requires an explicitly configured runtime image.");let m=eE[l];if(!m)throw Error(`Unsupported runtime data engine ${l}.`);if(!t)throw Error(`${l} requires a managed credential.`);if(e.publicExposure===!0)throw Error("Container public exposure requires an external reviewed firewall policy; direct publishing is refused.");let f=li(e.username),b=li(tE(e,"database")),k=`${a}-secret`,y=`${a}-data`,R=l==="redis"?`appendonly yes
 protected-mode yes
 requirepass ${t.replaceAll("\\","\\\\").replaceAll(`
 `,"")}
@@ -99,7 +99,7 @@ protected-mode yes
 requirepass ${a.replaceAll("\\","\\\\").replaceAll(`
 `,"")}
 `:a;if(await this.runtime.seedSecret(`${l}-secret`,R),b==="redis")await this.runtime.restart(l);return{status:b==="redis"?"restarting":"running",username:k}}if(t==="delete"){if(r.retention==="retain")return{status:"retained"};let m=await this.backup(e,r);return await this.runtime.remove(l),await this.runtime.removeVolume(`${l}-secret`),await this.runtime.removeVolume(`${l}-data`),{status:"deleted",finalBackupId:m.backupId??null,backupPath:m.path??null}}if(t==="expose")throw Error("Direct container exposure is refused; use a reviewed firewall and proxy policy.");throw Error(`${t} requires a configured engine lifecycle runner.`)}}import{createCipheriv as rE,createDecipheriv as nE,createHash as qh,randomBytes as iE}from"node:crypto";class ba{controlPlane;now;key;constructor(e,t,r=()=>new Date){this.controlPlane=e;this.now=r;if(!t)throw Error("Data-service encryption key is required.");this.key=qh("sha256").update(`ts-cloud:data-services:${t}`).digest()}encrypt(e){let t=iE(12),r=rE("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted data-service secret is unavailable.");try{let m=nE("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}catch{throw Error("Encrypted data-service secret could not be decrypted.")}}async put(e,t){if(!/^secret:\/\/data-services\/[A-Za-z0-9._/-]+$/.test(e))throw Error("Invalid data-service secret reference.");if(!t)throw Error("Data-service secret cannot be empty.");let r=this.now().toISOString();this.controlPlane.database.run("INSERT INTO data_service_secrets (reference,ciphertext,fingerprint,created_at,updated_at) VALUES (?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,updated_at=excluded.updated_at",[e,this.encrypt(t),qh("sha256").update(t).digest("hex"),r,r])}async resolve(e){let t=this.controlPlane.database.query("SELECT ciphertext FROM data_service_secrets WHERE reference = ?").get(e);if(!t)throw Error("Data-service secret was not found.");return this.decrypt(t.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM data_service_secrets WHERE reference = ?",[e])}}import{existsSync as sc}from"node:fs";import{mkdir as Zc,readdir as oE,rename as Op,rm as Rs}from"node:fs/promises";import{relative as sE,resolve as Jr,sep as Xc}from"node:path";function Nt(e,t){if(t==="gzip")return Buffer.from(Bun.gzipSync(Uint8Array.from(e)));if(t==="zstd")return Buffer.from(Bun.zstdCompressSync(Uint8Array.from(e)));return Buffer.from(e)}function Oe(e,t){if(t==="gzip")return Buffer.from(Bun.gunzipSync(Uint8Array.from(e)));if(t==="zstd")return Buffer.from(Bun.zstdDecompressSync(Uint8Array.from(e)));return Buffer.from(e)}async function $p(e,t){let r=Bun.spawn(["tar",...e],{stdin:t?Buffer.from(t):void 0,stdout:"pipe",stderr:"pipe"}),[a,l,m]=await Promise.all([r.exited,new Response(r.stdout).arrayBuffer(),new Response(r.stderr).text()]);if(a!==0)throw Error(m.trim()||`tar exited with status ${a}.`);return{stdout:Buffer.from(l),stderr:m}}function aE(e){let t=e.replaceAll("\\","/").replace(/^\.\//,"");return!!t&&!t.startsWith("/")&&!t.split("/").includes("..")}class Wu{async create(e,t,r){return(await $p(["-C",e,"-cf","-",...r.map((l)=>`--exclude=${l}`),"--",...t])).stdout}async extract(e,t){await Zc(t,{recursive:!0,mode:448}),await $p(["-C",t,"-xf","-"],e)}async inspect(e){let t=await $p(["-tf","-"],e),r=t.stdout.toString().split(`
-`).filter(Boolean);if(r.some((a)=>!aE(a)))throw Error("Backup archive contains an unsafe path.");return{entries:r,bytes:e.byteLength}}}function Vh(e,t){if(!t.trim())throw Error("File backup paths cannot be empty.");let r=Jr(e,t),a=sE(e,r);if(a===".."||a.startsWith(`..${Xc}`)||a==="")throw Error(`File backup path ${t} is outside the project root.`);return a}function Yc(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("File restores require a safe target name.");return t}class Ma{runtime;root;restoreRoot;constructor(e,t=new Wu,r=d(e,"restores","files")){this.runtime=t;this.root=Jr(e),this.restoreRoot=Jr(r)}paths(e){let t=[...new Set(e.includePatterns.map((r)=>Vh(this.root,r)))];if(!t.length)throw Error("File backup policies require at least one project-relative path.");for(let r of t)if(!sc(Jr(this.root,r)))throw Error(`File backup path ${r} was not found.`);return t.filter((r)=>!t.some((a)=>a!==r&&r.startsWith(`${a}${Xc}`)))}async create(e,t){let r=this.paths(e),a=await this.runtime.create(this.root,r,e.excludePatterns),l=await this.runtime.inspect(a),m=e.compression??"none",f=Nt(a,m),b=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/files/${b}.tar${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:f,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/x-tar",manifest:{archive:"tar",compression:m,sourcePaths:r,excluded:e.excludePatterns,entries:l.entries.length},toolVersion:"system-tar"}}async restore(e,t,r,a){if(!t)throw Error("File restore requires an archive payload.");let l=Oe(t,String(e.manifest.compression??"none"));if(await this.runtime.inspect(l),r.restoreMode==="in_place"){let f=Jr(this.restoreRoot,`.staging-${Yc(r)}`),b=Jr(this.restoreRoot,`.rollback-${Yc(r)}`),k=Array.isArray(e.manifest.sourcePaths)?e.manifest.sourcePaths.map(String):[];if(!k.length)throw Error("File recovery point has no source path manifest.");await Rs(f,{recursive:!0,force:!0}),await Rs(b,{recursive:!0,force:!0}),await this.runtime.extract(l,f),await Zc(b,{recursive:!0,mode:448});let y=[];try{for(let R of k){let T=Jr(this.root,Vh(this.root,R)),N=Jr(f,R),j=Jr(b,R);if(await Zc(Jr(j,".."),{recursive:!0}),sc(T))await Op(T,j);await Zc(Jr(T,".."),{recursive:!0}),await Op(N,T),y.push(R)}}catch(R){for(let T of y.reverse()){let N=Jr(this.root,T),j=Jr(b,T);if(await Rs(N,{recursive:!0,force:!0}),sc(j))await Op(j,N)}throw R}finally{await Rs(f,{recursive:!0,force:!0})}return await Rs(b,{recursive:!0,force:!0}),{path:this.root,restoredPaths:k,inPlace:!0}}let m=Jr(this.restoreRoot,Yc(r));if(sc(m))throw Error("The isolated file restore target already exists.");return await this.runtime.extract(l,m),{path:m,isolated:!0}}async verify(e,t,r){let a=Oe(t,String(e.manifest.compression??"none")),l=await this.runtime.inspect(a);return{archive:"tar",entries:l.entries.length,uncompressedBytes:l.bytes}}async validateHealth(e,t){let r=String(e.path??"");if(!r||!r.startsWith(`${this.restoreRoot}${Xc}`)||!sc(r))throw Error("Isolated file restore target was not found.");let a=await oE(r);return{healthy:!0,path:r,topLevelEntries:a.length}}async cleanup(e,t){let r=Yc(e),a=Jr(this.restoreRoot,r);if(!a.startsWith(`${this.restoreRoot}${Xc}`))throw Error("Refusing to clean a file restore outside the restore root.");await Rs(a,{recursive:!0,force:!0})}}class Fa{services;secrets;transport;constructor(e,t,r=new or){this.services=e;this.secrets=t;this.transport=r}async create(e,t){if(!e.dataServiceId)throw Error("Logical database backups require a data service.");let r=this.services.get(e.dataServiceId);if(!r)throw Error("Logical database service was not found.");if(!["container","server"].includes(r.provider))throw Error("Logical database backups require an on-box data service.");let a=await this.transport.exportLogicalBackup(r.id),l=e.compression??"none",m=Nt(a.body,l),f=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/databases/${r.id}/${f}.sql${l==="none"?"":l==="gzip"?".gz":".zst"}`,body:m,contentType:l==="gzip"?"application/gzip":l==="zstd"?"application/zstd":"application/sql",engineVersion:a.engineVersion,toolVersion:"engine-native",manifest:{format:"logical-sql-v1",sourceDataServiceId:r.id,engine:a.engine,database:a.database,username:a.username,compression:l}}}async restore(e,t,r,a){if(!t)throw Error("Logical database backup body is unavailable.");let l=String(e.dataServiceId??e.manifest.sourceDataServiceId??""),m=String(r.dataServiceId??r.targetId??""),f=r.inPlace===!0;if(!l||!m)throw Error("Logical database restore requires source and target identifiers.");if(f&&m!==l)throw Error("An in-place restore must target the source data service.");let b=this.services.get(l);if(!b?.credentialRef)throw Error("Logical database credential reference was not found.");let k=await this.secrets.resolve(b.credentialRef);return this.transport.restoreLogicalBackup({sourceId:l,targetId:m,body:Oe(t,String(e.manifest.compression??"none")),credential:k,inPlace:f})}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place database restores cannot be cleaned as drills.");let r=String(e.dataServiceId??e.targetId??"");if(!r)throw Error("Database cleanup requires a target identifier.");await this.transport.removeRestoredService(r)}}var Np=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;async function Eo(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t?"pipe":"ignore",stdout:"pipe",stderr:"pipe"}),l=new Response(a.stdout).arrayBuffer(),m=new Response(a.stderr).text();if(t)a.stdin.write(t),a.stdin.end();let[f,b,k]=await Promise.all([a.exited,l,m]);if(f!==0&&!r)throw Error(`Docker volume command failed (${f}): ${k.trim()}`);return{code:f,stdout:Buffer.from(b),stderr:k}}class Ju{async exists(e){return(await Eo(["volume","inspect",e],void 0,!0)).code===0}async export(e){return(await Eo(["run","--rm","-v",`${e}:/source:ro`,"alpine:3.21","tar","-C","/source","-czf","-","."])).stdout}async import(e,t,r=!1){if(!await this.exists(e))await Eo(["volume","create",e]);try{if(r)await Eo(["run","--rm","-v",`${e}:/target`,"alpine:3.21","sh","-c","find /target -mindepth 1 -delete"]);await Eo(["run","--rm","-i","-v",`${e}:/target`,"alpine:3.21","tar","-C","/target","--no-same-owner","-xzf","-"],t)}catch(a){throw await this.remove(e),a}}async remove(e){await Eo(["volume","rm",e],void 0,!0)}async probe(e){let t=(await Eo(["run","--rm","-v",`${e}:/target:ro`,"alpine:3.21","sh","-c",`find /target -mindepth 1 -printf '%s\\n' | awk '{n+=1;b+=$1} END {print n ":" b}'`])).stdout.toString(),[r,a]=t.trim().split(":").map(Number);if(!Number.isFinite(r)||!Number.isFinite(a))throw Error("Restored volume health probe returned invalid output.");return{entries:r,bytes:a}}}class Ua{runtime;constructor(e=new Ju){this.runtime=e}async create(e,t){let r=String(e.includePatterns?.[0]??e.resourceId??"");if(!Np.test(r))throw Error("Volume backups require a valid named-volume resource identifier.");if(!await this.runtime.exists(r))throw Error(`Volume ${r} was not found.`);let a=await this.runtime.export(r),l=Buffer.from(Bun.gunzipSync(Uint8Array.from(a))),m=e.compression??"gzip",f=m==="gzip"?a:Nt(l,m),b=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/volumes/${r}/${b}.tar${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:f,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/x-tar",toolVersion:"alpine-tar",manifest:{format:"docker-volume-tar-v1",archive:"tar",compression:m,sourceVolume:r}}}async restore(e,t,r,a){if(!t)throw Error("Volume backup body is unavailable.");let l=String(e.manifest.sourceVolume??e.resourceId??""),m=String(r.volumeName??r.targetId??"");if(!Np.test(m))throw Error("Volume restore requires a valid target volume name.");if(m===l&&r.inPlace!==!0)throw Error("An isolated volume restore requires a distinct target.");let f=await this.runtime.exists(m);if(!r.inPlace&&f)throw Error(`Restore target volume ${m} already exists.`);if(r.inPlace===!0&&m!==l)throw Error("An in-place volume restore must target the source volume.");if(r.inPlace===!0&&!f)throw Error("The in-place target volume was not found.");let b=String(e.manifest.compression??"gzip"),k=b==="gzip"?Buffer.from(t):Buffer.from(Bun.gzipSync(Uint8Array.from(Oe(t,b))));await this.runtime.import(m,k,r.inPlace===!0);let y=await this.runtime.probe(m);return{volumeName:m,healthy:!0,...y}}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place volume restores cannot be cleaned as drills.");let r=String(e.volumeName??e.targetId??"");if(!Np.test(r))throw Error("Volume cleanup requires a valid target volume name.");await this.runtime.remove(r)}}import{existsSync as jp}from"node:fs";import{mkdir as cE,readFile as Wh,rm as dE,writeFile as Hh}from"node:fs/promises";import{basename as Yh,resolve as Hi,sep as Kh}from"node:path";import{Database as lE}from"bun:sqlite";function Jh(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("Control-plane restores require a safe target name.");return t}function Gh(e){let t=JSON.parse(Buffer.from(e).toString());if(t.format!=="ts-cloud-control-plane-v1"||!t.database)throw Error("Control-plane backup archive is invalid.");if(!Array.isArray(t.config)||t.config.some((r)=>Yh(r.name)!==r.name))throw Error("Control-plane backup contains an unsafe config path.");return t}function Qh(e){let t=lE.deserialize(Uint8Array.from(e));try{let r=t.query("PRAGMA integrity_check").get()?.integrity_check??"unknown",a=t.query("SELECT count(*) AS count FROM sqlite_master WHERE type='table'").get()?.count??0;if(r!=="ok")throw Error(`Restored control-plane integrity check failed: ${r}.`);return{integrity:r,tables:a}}finally{t.close()}}class Qa{controlPlane;root;restoreRoot;constructor(e,t,r=d(t,"restores","control-plane")){this.controlPlane=e;this.root=Hi(t),this.restoreRoot=Hi(r)}async create(e,t){let r=e.includePatterns.length?e.includePatterns:["cloud.config.ts"],a=[];for(let k of r){let y=Yh(k),R=Hi(this.root,y);if(y!==k&&k!==`./${y}`)throw Error("Control-plane config paths must be project-root files.");if(jp(R))a.push({name:y,body:(await Wh(R)).toString("base64")})}let l={format:"ts-cloud-control-plane-v1",createdAt:new Date().toISOString(),database:Buffer.from(this.controlPlane.database.serialize()).toString("base64"),config:a},m=e.compression??"none",f=Nt(Buffer.from(JSON.stringify(l)),m),b=String(t.operation?.id??l.createdAt).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/control-plane/${b}.json${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:f,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/vnd.ts-cloud.control-plane+json",manifest:{format:l.format,configFiles:a.map((k)=>k.name),sensitive:!0,compression:m},toolVersion:"bun-sqlite-serialize"}}async restore(e,t,r,a){if(!t)throw Error("Control-plane restore requires an archive payload.");if(r.restoreMode==="in_place")throw Error("A live control plane can only be restored into an isolated recovery target.");let l=Gh(Oe(t,String(e.manifest.compression??"none"))),m=Hi(this.restoreRoot,Jh(r));if(jp(m))throw Error("The isolated control-plane restore target already exists.");await cE(m,{recursive:!0,mode:448}),await Hh(Hi(m,"control-plane.sqlite"),Buffer.from(l.database,"base64"),{mode:384});for(let f of l.config)await Hh(Hi(m,f.name),Buffer.from(f.body,"base64"),{mode:384});return{path:m,isolated:!0,configFiles:l.config.length}}async verify(e,t,r){let a=Gh(Oe(t,String(e.manifest.compression??"none")));return{...Qh(Buffer.from(a.database,"base64")),configFiles:a.config.length}}async validateHealth(e,t){let r=String(e.path??""),a=Hi(r,"control-plane.sqlite");if(!r.startsWith(`${this.restoreRoot}${Kh}`)||!jp(a))throw Error("Isolated control-plane database was not found.");return{healthy:!0,...Qh(await Wh(a))}}async cleanup(e,t){let r=Hi(this.restoreRoot,Jh(e));if(!r.startsWith(`${this.restoreRoot}${Kh}`))throw Error("Refusing to clean a control-plane restore outside the restore root.");await dE(r,{recursive:!0,force:!0})}}import{createHash as uE}from"node:crypto";function Bp(e,t){return e.find((r)=>r.startsWith(`${t}:`))?.slice(t.length+1)}function pE(e){let t=Bp(e.includePatterns,"resource")??e.includePatterns.find((l)=>l.startsWith("arn:")),r=Bp(e.includePatterns,"role"),a=Bp(e.includePatterns,"vault")??"Default";if(!t?.startsWith("arn:"))throw Error("Infrastructure backups require resource:<arn> in include patterns.");if(!r?.startsWith("arn:"))throw Error("Infrastructure backups require role:<iam-role-arn> in include patterns.");if(!/^[A-Za-z0-9_.-]{2,50}$/.test(a))throw Error("Infrastructure backup vault name is invalid.");return{resourceArn:t,roleArn:r,vaultName:a}}async function gE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeBackupJob(t),l=String(a.State??"");if(r.checkpoint("provider_backup",`AWS Backup job ${t} is ${l||"pending"}.`),l==="COMPLETED"&&a.RecoveryPointArn)return{recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??0)};if(["ABORTED","EXPIRED","FAILED"].includes(l))throw Error(`AWS Backup job ${t} failed: ${a.StatusMessage??l}.`);await Bun.sleep(5000)}}async function mE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeRestoreJob(t),l=String(a.Status??"");if(r.checkpoint("provider_restore",`AWS Backup restore ${t} is ${l||"pending"}.`),l==="COMPLETED"&&a.CreatedResourceArn)return a.CreatedResourceArn;if(["ABORTED","FAILED"].includes(l))throw Error(`AWS Backup restore ${t} failed: ${a.StatusMessage??l}.`);await Bun.sleep(5000)}}class Ha{client;constructor(e=new lr){this.client=e}async create(e,t){let r=pE(e),a=String(t.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64),l=await this.client.startBackupJob({BackupVaultName:r.vaultName,ResourceArn:r.resourceArn,IamRoleArn:r.roleArn,IdempotencyToken:a}),m=await gE(this.client,l.BackupJobId,t),f=`sha256:${uE("sha256").update(m.recoveryPointArn).digest("hex")}`;return{mode:"external",uri:m.recoveryPointArn,checksum:f,sizeBytes:m.sizeBytes,toolVersion:"aws-backup-api",manifest:{provider:"aws_backup",resourceArn:r.resourceArn,roleArn:r.roleArn,vaultName:r.vaultName,providerBackupJobId:l.BackupJobId,recoveryPointArn:m.recoveryPointArn}}}async verifyExternal(e,t){let r=String(e.manifest.providerBackupJobId??""),a=await this.client.describeBackupJob(r);if(a.State!=="COMPLETED"||a.RecoveryPointArn!==e.uri)throw Error(`AWS Backup recovery point verification failed: ${a.StatusMessage??a.State??"unknown"}.`);return{state:a.State,recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??e.sizeBytes)}}async restore(e,t,r,a){if(r.inPlace===!0)throw Error("AWS Backup infrastructure restores must create isolated resources.");let l=String(r.roleArn??e.manifest.roleArn??""),m=r.metadata&&typeof r.metadata==="object"&&!Array.isArray(r.metadata)?Object.fromEntries(Object.entries(r.metadata).map(([k,y])=>[k,String(y)])):{};if(!l.startsWith("arn:"))throw Error("AWS Backup restore requires an IAM role ARN.");if(!Object.keys(m).length)throw Error("AWS Backup restore requires provider restore metadata.");let f=await this.client.startRestoreJob({RecoveryPointArn:e.uri,IamRoleArn:l,Metadata:m,IdempotencyToken:String(a.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64)}),b=await mE(this.client,f.RestoreJobId,a);return{providerRestoreJobId:f.RestoreJobId,createdResourceArn:b,isolated:!0,healthy:!0}}async validateHealth(e,t){let r=String(e.createdResourceArn??"");return{healthy:r.startsWith("arn:"),createdResourceArn:r}}async deleteExternal(e,t){await this.client.deleteRecoveryPoint(String(e.manifest.vaultName??""),e.uri)}}import{existsSync as AA}from"node:fs";import{join as Ev}from"node:path";import{pathToFileURL as CA}from"node:url";import{existsSync as Zh,statSync as Xh}from"fs";import{resolve as cc}from"path";import fE from"process";import{existsSync as vE,mkdirSync as m$,readdirSync as f$,readFileSync as bE,writeFileSync as h$}from"fs";import{homedir as As}from"os";import{dirname as b$,resolve as ei}from"path";import zd from"process";import{existsSync as ey,statSync as ty}from"fs";import{existsSync as og,mkdirSync as SE,readdirSync as wE,writeFileSync as kE}from"fs";import{homedir as Cs}from"os";import{dirname as ry,resolve as Yr}from"path";import Ao from"process";import{join as IE,relative as EE,resolve as ny}from"path";import Id from"process";import{existsSync as qy,mkdirSync as _$,readdirSync as T$,writeFileSync as x$}from"fs";import{homedir as Mp}from"os";import{dirname as $$,resolve as Gr}from"path";import lc from"process";import{join as RE,relative as AE,resolve as iy}from"path";import Ed from"process";import{existsSync as Vy,mkdirSync as L$,readdirSync as F$,writeFileSync as z$}from"fs";import{dirname as q$,resolve as Ad}from"path";import sg from"process";import{Buffer as Ki}from"buffer";import{createCipheriv as CE,createDecipheriv as PE,randomBytes as Lp}from"crypto";import{closeSync as Fp,createReadStream as oy,createWriteStream as _E,existsSync as zp,fsyncSync as sy,openSync as ay,writeFileSync as TE}from"fs";import{access as xE,constants as cy,mkdir as DE,readdir as ed,rename as dy,stat as Ps,unlink as td,writeFile as Up}from"fs/promises";import{join as _s}from"path";import Or from"process";import{pipeline as OE}from"stream/promises";import{createGzip as ly}from"zlib";import xs from"process";import gi from"process";import{Buffer as ui}from"buffer";import{createCipheriv as $E,createDecipheriv as NE,randomBytes as qp}from"crypto";import{closeSync as Vp,createReadStream as uy,createWriteStream as jE,existsSync as rd,fsyncSync as py,openSync as gy,writeFileSync as BE}from"fs";import{access as ME,constants as my,mkdir as LE,readdir as ad,rename as fy,stat as Ds,unlink as cd,writeFile as Wp}from"fs/promises";import{isAbsolute as FE,join as Os,resolve as zE}from"path";import xt from"process";import{pipeline as UE}from"stream/promises";import{createGzip as hy}from"zlib";import $s from"process";import mi from"process";import dd from"process";import{existsSync as ld}from"fs";import{resolve as Hp}from"path";import{existsSync as qE}from"fs";import{existsSync as VE,readdirSync as WE}from"fs";import{extname as Kp,resolve as yy}from"path";import HE from"process";import{join as KE,relative as JE,resolve as vy}from"path";import Cd from"process";import{Buffer as pi}from"buffer";import{createCipheriv as GE,createDecipheriv as QE,randomBytes as Jp}from"crypto";import{closeSync as Gp,createReadStream as by,createWriteStream as YE,existsSync as ud,fsyncSync as Sy,openSync as wy,writeFileSync as ZE}from"fs";import{access as XE,constants as ky,mkdir as eR,readdir as pd,rename as Iy,stat as Ns,unlink as gd,writeFile as Qp}from"fs/promises";import{isAbsolute as tR,join as js,resolve as rR}from"path";import Ot from"process";import{pipeline as nR}from"stream/promises";import{createGzip as Ey}from"zlib";import Bs from"process";import fi from"process";import fd from"process";import{existsSync as hd}from"fs";import{resolve as My}from"path";import{existsSync as IA}from"fs";class Ly{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let l=this.generateKey(e,r),m=a??this.options.ttl,f=this.estimateSize(t);this.cache.set(l,{value:t,timestamp:new Date,ttl:m,hits:0,size:f}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Zh(e))return!0;return Xh(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let l=Zh(r)?Xh(r):null,m=l?l.mtime:new Date;this.set(e,{value:t,fileTimestamp:m},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,l)=>a+l.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class Fy{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),l=new Date;try{let m=await t(),f=performance.now()-a;return this.recordMetric({operation:e,duration:f,timestamp:l,...r}),m}catch(m){let f=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:f,timestamp:l,...r}),m}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((l)=>l.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((l)=>l.duration),a=r.reduce((l,m)=>l+m,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}var kd=new Ly,bg=new Fy;var zy=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];function Uy(e={}){let{name:t="",alias:r}=e,a=["config",".config"];if(t)a.push(t,`.${t}.config`,`${t}.config`,`.${t}`);let l=r===void 0?[]:Array.isArray(r)?r:[r];for(let m of l){if(!m)continue;if(a.push(m,`.${m}.config`,`${m}.config`,`.${m}`),t)a.push(`${t}.${m}.config`,`.${t}.${m}.config`)}return Array.from(new Set(a.filter(Boolean)))}function hE(e){return Uy(e).flatMap((r)=>zy.map((a)=>cc(e.directory,`${r}${a}`)))}function yE(e={}){let t=cc(e.cwd||fE.cwd());return Array.from(new Set([t,cc(t,"config"),cc(t,".config"),e.configDir?cc(t,e.configDir):void 0].filter((r)=>Boolean(r))))}var iR=Object.defineProperty,oR=(e)=>e;function sR(e,t){this[e]=oR.bind(null,t)}var aR=(e,t)=>{for(var r in t)iR(e,r,{get:t[r],enumerable:!0,configurable:!0,set:sR.bind(t,r)})},cR=(e,t)=>()=>(e&&(t=e(e=0)),t),Wy={};aR(Wy,{withErrorRecovery:()=>Jy,tryLoadConfig:()=>xR,loadConfigWithResult:()=>_R,loadConfig:()=>Xy,isRetryableError:()=>IR,isConfigNotFoundError:()=>kR,isBunfigError:()=>Gy,globalPerformanceMonitor:()=>gc,globalCache:()=>Ms,getEnvOrDefault:()=>ER,generateConfigTypes:()=>DR,defaultGeneratedDir:()=>av,defaultConfigDir:()=>sv,deepMergeWithArrayStrategy:()=>Eg,deepMerge:()=>Qy,createLibraryConfig:()=>OR,config:()=>TR,bunfigPlugin:()=>$R,applyEnvVarsToConfig:()=>dc,TypeGenerationError:()=>gg,SchemaValidationError:()=>pc,PluginError:()=>yg,PerformanceMonitor:()=>wg,FileSystemError:()=>pg,ErrorFactory:()=>Gi,EnvVarError:()=>Bd,EnvProcessor:()=>Ud,ConfigValidator:()=>Rg,ConfigValidationError:()=>lg,ConfigNotFoundError:()=>Nd,ConfigMergeError:()=>ug,ConfigLoader:()=>Cg,ConfigLoadError:()=>uc,ConfigFileLoader:()=>qd,ConfigCache:()=>Sg,CacheUtils:()=>tv,BunfigError:()=>xn,BrowserConfigError:()=>fg,ArrayMergeStrategies:()=>iv});class Sg{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let l=this.generateKey(e,r),m=a??this.options.ttl,f=this.estimateSize(t);this.cache.set(l,{value:t,timestamp:new Date,ttl:m,hits:0,size:f}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!ey(e))return!0;return ty(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let l=ey(r)?ty(r):null,m=l?l.mtime:new Date;this.set(e,{value:t,fileTimestamp:m},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,l)=>a+l.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class wg{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),l=new Date;try{let m=await t(),f=performance.now()-a;return this.recordMetric({operation:e,duration:f,timestamp:l,...r}),m}catch(m){let f=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:f,timestamp:l,...r}),m}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((l)=>l.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((l)=>l.duration),a=r.reduce((l,m)=>l+m,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}function dR(e,t={}){let a=Object.keys(t).sort().map((l)=>`${l}:${t[l]}`).join("|");return a?`${e}:${a}`:e}function lR(e,t){try{return JSON.stringify(e)===JSON.stringify(t)}catch{return e===t}}function uR(e){return e.getStats().size*2}function kg(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&Zt(t[0])&&"id"in t[0]&&t[0].id===3&&Zt(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(Zt(t)&&Zt(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(Zt(e)&&"arr"in e&&Array.isArray(e.arr)&&Zt(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&Zt(t[0])&&Zt(e[0])){let a=[...t];for(let l of e)if(Zt(l)&&"name"in l){if(!a.find((f)=>Zt(f)&&("name"in f)&&f.name===l.name))a.push(l)}else if(Zt(l)&&"path"in l){if(!a.find((f)=>Zt(f)&&("path"in f)&&f.path===l.path))a.push(l)}else if(!a.some((m)=>Pd(m,l)))a.push(l);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let l of e)if(!a.includes(l))a.push(l);return a}return t}if(!Zt(t)||!Zt(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let l=t[a];if(l===null||l===void 0)continue;else if(Zt(l)&&Zt(r[a]))r[a]=kg(r[a],l);else if(Array.isArray(l)&&Array.isArray(r[a]))if(l.length>0&&r[a].length>0&&Zt(l[0])&&Zt(r[a][0])){let m=[...l];for(let f of r[a])if(Zt(f)&&"name"in f){if(!m.find((k)=>Zt(k)&&("name"in k)&&k.name===f.name))m.push(f)}else if(Zt(f)&&"path"in f){if(!m.find((k)=>Zt(k)&&("path"in k)&&k.path===f.path))m.push(f)}else if(!m.some((b)=>Pd(b,f)))m.push(f);r[a]=m}else if(l.every((m)=>typeof m==="string")&&r[a].every((m)=>typeof m==="string")){let m=[...l];for(let f of r[a])if(!m.includes(f))m.push(f);r[a]=m}else r[a]=l;else r[a]=l}return r}function Pd(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!Pd(e[r],t[r]))return!1;return!0}if(Zt(e)&&Zt(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let l of r){if(!Object.prototype.hasOwnProperty.call(t,l))return!1;if(!Pd(e[l],t[l]))return!1}return!0}return!1}function Zt(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function pR(e,t){if(!Vy(e))return null;try{let r=await import(e),a=r.default||r;if(typeof a!=="object"||a===null||Array.isArray(a))return null;try{return kg(t,a)}catch{return null}}catch{return null}}async function gR({name:e="",cwd:t,defaultConfig:r}){let a=t||sg.cwd(),l=[".ts",".js",".mjs",".cjs",".json"],m=[`${e}.config`,`.${e}.config`,e,`.${e}`];for(let f of m)for(let b of l){let k=Ad(a,`${f}${b}`),y=await pR(k,r);if(y!==null)return y}try{let f=Ad(a,"package.json");if(Vy(f)){let k=(await import(f))[e];if(k&&typeof k==="object"&&!Array.isArray(k))try{return kg(r,k)}catch{}}}catch{}return r}function mR(e,t={}){let r=Ed.cwd();while(r.includes("storage"))r=iy(r,"..");let a=iy(r,e||"");if(t?.relative)return AE(Ed.cwd(),a);return a}async function fR(){try{let e=await gR({name:"clarity",defaultConfig:vd,cwd:Ed.cwd(),endpoint:"",headers:{}});return{...vd,...e}}catch{return vd}}function gr(){if(gi.env.NODE_ENV==="test"||gi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function hR(){if(gi.env.NODE_ENV==="test"||gi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof gi<"u"){let e=gi.type;if(e==="renderer"||e==="worker")return!1;return!!(gi.versions&&(gi.versions.node||gi.versions.bun))}return!1}class Hy{async format(e){let t=await hR(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:xs.pid,hostname:t(),environment:xs.env.NODE_ENV||"development",platform:xs.platform,version:xs.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:xs.env.NODE_ENV||xs.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class Td{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...cg},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Hy,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Or.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let l=this.generateKeyId(),m=this.generateKey();this.currentKeyId=l,this.keys.set(l,m),this.encryptionKeys.set(l,{key:m,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...bd,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...bd};return{...bd,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:cg.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}async writeToFile(e){let r=(async()=>{let l,m=0,f=3,b=1000;while(m<f)try{try{try{await xE(this.config.logDirectory,cy.F_OK|cy.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await DE(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let k=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:Ki.from(e);try{if(!zp(this.currentLogFile))await Up(this.currentLogFile,"",{mode:420});if(l=ay(this.currentLogFile,"a",420),TE(l,k,{flag:"a"}),sy(l),l!==void 0)Fp(l),l=void 0;if((await Ps(this.currentLogFile)).size===0){if(await Up(this.currentLogFile,k,{flag:"w",mode:420}),(await Ps(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let R=y;if(R.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(R.code)){if(m<f-1){let T=typeof R.message==="string"?R.message:"Unknown error";console.error(`Network error during write attempt ${m+1}/${f}:`,T);let N=b*2**m;await new Promise((j)=>setTimeout(j,N)),m++;continue}}if(R?.code&&["ENOSPC","EDQUOT"].includes(R.code))throw Error(`Disk quota exceeded or no space left on device: ${R.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",R),R}finally{if(l!==void 0)try{Fp(l)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(k){if(m===f-1){let R=k,T=typeof R.message==="string"?R.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",T),k}m++;let y=b*2**(m-1);await new Promise((R)=>setTimeout(R,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(l){throw console.error("Debug: [writeToFile] Error in operation:",l),l}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return _s(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return _s(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return _s(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(gr())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((l)=>{console.error("Error rotating keys:",l)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let l=Array.from(this.encryptionKeys.entries()).sort(([,b],[,k])=>k.createdAt.getTime()-b.createdAt.getTime()),m=typeof t.maxKeys==="number"?t.maxKeys:1,f=Math.max(1,m);if(l.length>f)for(let[b]of l.slice(f))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Lp(16).toString("hex")}generateKey(){return Lp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Lp(16),a=CE("aes-256-gcm",t,r),l=Ki.concat([a.update(e,"utf8"),a.final()]),m=a.getAuthTag();return{encrypted:Ki.concat([r,l,m]),iv:r}}async compressData(e){return new Promise((t,r)=>{let a=ly(),l=[];a.on("data",(m)=>l.push(m)),a.on("end",()=>t(Ki.from(Ki.concat(l)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(gr())return;let e=await Ps(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let l=await ed(this.config.logDirectory),m=l.filter((k)=>k.startsWith(this.name)&&/\.log\.\d+$/.test(k)).sort((k,y)=>{let R=Number.parseInt(k.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-R}),f=m.length>0?Number.parseInt(m[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${f}`;if(await Ps(r).catch(()=>null))try{if(await dy(r,b),t.compress)try{let k=`${b}.gz`;await this.compressLogFile(b,k),await td(b)}catch(k){console.error("Error compressing rotated file:",k)}if(m.length===0&&!l.some((k)=>k.endsWith(".log.1")))try{let k=`${r}.1`;await Up(k,"")}catch(k){console.error("Error creating backup file:",k)}}catch(k){console.error(`Error during rotation: ${k instanceof Error?k.message:String(k)}`)}}else{let l=new Date().toISOString().replace(/[:.]/g,"-"),m=r.replace(/\.log$/,`-${l}.log`);if(await Ps(r).catch(()=>null))await dy(r,m)}if(this.currentLogFile=a,t.maxFiles){let m=(await ed(this.config.logDirectory)).filter((f)=>f.startsWith(this.name)).sort((f,b)=>b.localeCompare(f));for(let f of m.slice(t.maxFiles))await td(_s(this.config.logDirectory,f))}}}async compressLogFile(e,t){let r=oy(e),a=_E(t),l=ly();await OE(r,l,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);await this.writeToFile(a),console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(t),console.log(t);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:e,message:t,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(e)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(e){return{debug:0,info:1,success:2,warning:3,error:4}[e]}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),zp(this.currentLogFile))try{let e=ay(this.currentLogFile,"r+");sy(e),Fp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!gr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await ed(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await td(_s(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.fancy?Ft.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:l,level:m,showTimestamp:f=!0}=e,b=(j)=>j.replace(this.ANSI_PATTERN,"");if(!this.fancy){let j=[];if(f)j.push(t);if(m==="warning")j.push("WARN");else if(m==="error")j.push("ERROR");else if(r)j.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)j.push(a.replace(/[[\]]/g,""));return j.push(l),j.join(" ")}let k=Or.stdout.columns||120,y="";if(m==="warning"||m==="error")y=`${r} ${l}`;else if(m==="info"||m==="success")y=`${r} ${a} ${l}`;else y=`${r} ${a} ${Ft.cyan(l)}`;if(!f)return y.trim();let R=b(y).trim().length,T=b(t).length,N=Math.max(1,k-2-R-T);return`${y.trim()}${" ".repeat(N)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(m,f)=>{let b=Number.parseInt(f,10);return b<t[0].length?String(t[0][b]):m});let r=/%([sdijfo%])/g,a=0,l=e.replace(r,(m,f)=>{if(f==="%")return"%";if(a>=t.length)return m;let b=t[a++];switch(f){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return m}});if(a<t.length)l+=` ${t.slice(a).map((m)=>typeof m==="object"?JSON.stringify(m,null,2):String(m)).join(" ")}`;return l}async log(e,t,...r){let a=new Date,l=this.formatConsoleTimestamp(a),m=this.formatFileTimestamp(a),f,b;if(t instanceof Error)f=t.message,b=t.stack;else f=this.formatMessage(t,r);if(this.fancy&&!gr()){let y=rv[e],R=this.options.showTags!==!1&&this.name?Ft.gray(this.formatTag(this.name)):"",T;switch(e){case"debug":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:Ft.gray(f),level:e}),console.error(T);break;case"info":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:f,level:e}),console.error(T);break;case"success":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:Ft.green(f),level:e}),console.error(T);break;case"warning":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:f,level:e}),console.warn(T);break;case"error":if(T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:f,level:e}),console.error(T),b){let N=b.split(`
+`).filter(Boolean);if(r.some((a)=>!aE(a)))throw Error("Backup archive contains an unsafe path.");return{entries:r,bytes:e.byteLength}}}function Vh(e,t){if(!t.trim())throw Error("File backup paths cannot be empty.");let r=Jr(e,t),a=sE(e,r);if(a===".."||a.startsWith(`..${Xc}`)||a==="")throw Error(`File backup path ${t} is outside the project root.`);return a}function Yc(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("File restores require a safe target name.");return t}class Ma{runtime;root;restoreRoot;constructor(e,t=new Wu,r=d(e,"restores","files")){this.runtime=t;this.root=Jr(e),this.restoreRoot=Jr(r)}paths(e){let t=[...new Set(e.includePatterns.map((r)=>Vh(this.root,r)))];if(!t.length)throw Error("File backup policies require at least one project-relative path.");for(let r of t)if(!sc(Jr(this.root,r)))throw Error(`File backup path ${r} was not found.`);return t.filter((r)=>!t.some((a)=>a!==r&&r.startsWith(`${a}${Xc}`)))}async create(e,t){let r=this.paths(e),a=await this.runtime.create(this.root,r,e.excludePatterns),l=await this.runtime.inspect(a),m=e.compression??"none",f=Nt(a,m),b=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/files/${b}.tar${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:f,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/x-tar",manifest:{archive:"tar",compression:m,sourcePaths:r,excluded:e.excludePatterns,entries:l.entries.length},toolVersion:"system-tar"}}async restore(e,t,r,a){if(!t)throw Error("File restore requires an archive payload.");let l=Oe(t,String(e.manifest.compression??"none"));if(await this.runtime.inspect(l),r.restoreMode==="in_place"){let f=Jr(this.restoreRoot,`.staging-${Yc(r)}`),b=Jr(this.restoreRoot,`.rollback-${Yc(r)}`),k=Array.isArray(e.manifest.sourcePaths)?e.manifest.sourcePaths.map(String):[];if(!k.length)throw Error("File recovery point has no source path manifest.");await Rs(f,{recursive:!0,force:!0}),await Rs(b,{recursive:!0,force:!0}),await this.runtime.extract(l,f),await Zc(b,{recursive:!0,mode:448});let y=[];try{for(let R of k){let T=Jr(this.root,Vh(this.root,R)),N=Jr(f,R),j=Jr(b,R);if(await Zc(Jr(j,".."),{recursive:!0}),sc(T))await Op(T,j);await Zc(Jr(T,".."),{recursive:!0}),await Op(N,T),y.push(R)}}catch(R){for(let T of y.reverse()){let N=Jr(this.root,T),j=Jr(b,T);if(await Rs(N,{recursive:!0,force:!0}),sc(j))await Op(j,N)}throw R}finally{await Rs(f,{recursive:!0,force:!0})}return await Rs(b,{recursive:!0,force:!0}),{path:this.root,restoredPaths:k,inPlace:!0}}let m=Jr(this.restoreRoot,Yc(r));if(sc(m))throw Error("The isolated file restore target already exists.");return await this.runtime.extract(l,m),{path:m,isolated:!0}}async verify(e,t,r){let a=Oe(t,String(e.manifest.compression??"none")),l=await this.runtime.inspect(a);return{archive:"tar",entries:l.entries.length,uncompressedBytes:l.bytes}}async validateHealth(e,t){let r=String(e.path??"");if(!r||!r.startsWith(`${this.restoreRoot}${Xc}`)||!sc(r))throw Error("Isolated file restore target was not found.");let a=await oE(r);return{healthy:!0,path:r,topLevelEntries:a.length}}async cleanup(e,t){let r=Yc(e),a=Jr(this.restoreRoot,r);if(!a.startsWith(`${this.restoreRoot}${Xc}`))throw Error("Refusing to clean a file restore outside the restore root.");await Rs(a,{recursive:!0,force:!0})}}class Fa{services;secrets;transport;constructor(e,t,r=new or){this.services=e;this.secrets=t;this.transport=r}async create(e,t){if(!e.dataServiceId)throw Error("Logical database backups require a data service.");let r=this.services.get(e.dataServiceId);if(!r)throw Error("Logical database service was not found.");if(!["container","server"].includes(r.provider))throw Error("Logical database backups require an on-box data service.");let a=await this.transport.exportLogicalBackup(r.id),l=e.compression??"none",m=Nt(a.body,l),f=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/databases/${r.id}/${f}.sql${l==="none"?"":l==="gzip"?".gz":".zst"}`,body:m,contentType:l==="gzip"?"application/gzip":l==="zstd"?"application/zstd":"application/sql",engineVersion:a.engineVersion,toolVersion:"engine-native",manifest:{format:"logical-sql-v1",sourceDataServiceId:r.id,engine:a.engine,database:a.database,username:a.username,compression:l}}}async restore(e,t,r,a){if(!t)throw Error("Logical database backup body is unavailable.");let l=String(e.dataServiceId??e.manifest.sourceDataServiceId??""),m=String(r.dataServiceId??r.targetId??""),f=r.inPlace===!0;if(!l||!m)throw Error("Logical database restore requires source and target identifiers.");if(f&&m!==l)throw Error("An in-place restore must target the source data service.");let b=this.services.get(l);if(!b?.credentialRef)throw Error("Logical database credential reference was not found.");let k=await this.secrets.resolve(b.credentialRef);return this.transport.restoreLogicalBackup({sourceId:l,targetId:m,body:Oe(t,String(e.manifest.compression??"none")),credential:k,inPlace:f})}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place database restores cannot be cleaned as drills.");let r=String(e.dataServiceId??e.targetId??"");if(!r)throw Error("Database cleanup requires a target identifier.");await this.transport.removeRestoredService(r)}}var Np=/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/;async function Eo(e,t,r=!1){let a=Bun.spawn(["docker",...e],{stdin:t?"pipe":"ignore",stdout:"pipe",stderr:"pipe"}),l=new Response(a.stdout).arrayBuffer(),m=new Response(a.stderr).text();if(t)a.stdin.write(t),a.stdin.end();let[f,b,k]=await Promise.all([a.exited,l,m]);if(f!==0&&!r)throw Error(`Docker volume command failed (${f}): ${k.trim()}`);return{code:f,stdout:Buffer.from(b),stderr:k}}class Ju{async exists(e){return(await Eo(["volume","inspect",e],void 0,!0)).code===0}async export(e){return(await Eo(["run","--rm","-v",`${e}:/source:ro`,"alpine:3.21","tar","-C","/source","-czf","-","."])).stdout}async import(e,t,r=!1){if(!await this.exists(e))await Eo(["volume","create",e]);try{if(r)await Eo(["run","--rm","-v",`${e}:/target`,"alpine:3.21","sh","-c","find /target -mindepth 1 -delete"]);await Eo(["run","--rm","-i","-v",`${e}:/target`,"alpine:3.21","tar","-C","/target","--no-same-owner","-xzf","-"],t)}catch(a){throw await this.remove(e),a}}async remove(e){await Eo(["volume","rm",e],void 0,!0)}async probe(e){let t=(await Eo(["run","--rm","-v",`${e}:/target:ro`,"alpine:3.21","sh","-c",`find /target -mindepth 1 -printf '%s\\n' | awk '{n+=1;b+=$1} END {print n ":" b}'`])).stdout.toString(),[r,a]=t.trim().split(":").map(Number);if(!Number.isFinite(r)||!Number.isFinite(a))throw Error("Restored volume health probe returned invalid output.");return{entries:r,bytes:a}}}class Ua{runtime;constructor(e=new Ju){this.runtime=e}async create(e,t){let r=String(e.includePatterns?.[0]??e.resourceId??"");if(!Np.test(r))throw Error("Volume backups require a valid named-volume resource identifier.");if(!await this.runtime.exists(r))throw Error(`Volume ${r} was not found.`);let a=await this.runtime.export(r),l=Buffer.from(Bun.gunzipSync(Uint8Array.from(a))),m=e.compression??"gzip",f=m==="gzip"?a:Nt(l,m),b=String(t.operation?.id??new Date().toISOString()).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/volumes/${r}/${b}.tar${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:f,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/x-tar",toolVersion:"alpine-tar",manifest:{format:"docker-volume-tar-v1",archive:"tar",compression:m,sourceVolume:r}}}async restore(e,t,r,a){if(!t)throw Error("Volume backup body is unavailable.");let l=String(e.manifest.sourceVolume??e.resourceId??""),m=String(r.volumeName??r.targetId??"");if(!Np.test(m))throw Error("Volume restore requires a valid target volume name.");if(m===l&&r.inPlace!==!0)throw Error("An isolated volume restore requires a distinct target.");let f=await this.runtime.exists(m);if(!r.inPlace&&f)throw Error(`Restore target volume ${m} already exists.`);if(r.inPlace===!0&&m!==l)throw Error("An in-place volume restore must target the source volume.");if(r.inPlace===!0&&!f)throw Error("The in-place target volume was not found.");let b=String(e.manifest.compression??"gzip"),k=b==="gzip"?Buffer.from(t):Buffer.from(Bun.gzipSync(Uint8Array.from(Oe(t,b))));await this.runtime.import(m,k,r.inPlace===!0);let y=await this.runtime.probe(m);return{volumeName:m,healthy:!0,...y}}async cleanup(e,t){if(e.inPlace===!0)throw Error("In-place volume restores cannot be cleaned as drills.");let r=String(e.volumeName??e.targetId??"");if(!Np.test(r))throw Error("Volume cleanup requires a valid target volume name.");await this.runtime.remove(r)}}import{existsSync as jp}from"node:fs";import{mkdir as cE,readFile as Wh,rm as dE,writeFile as Hh}from"node:fs/promises";import{basename as Yh,resolve as Hi,sep as Kh}from"node:path";import{Database as lE}from"bun:sqlite";function Jh(e){let t=String(e.targetId??e.path??"");if(!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(t))throw Error("Control-plane restores require a safe target name.");return t}function Gh(e){let t=JSON.parse(Buffer.from(e).toString());if(t.format!=="ts-cloud-control-plane-v1"||!t.database)throw Error("Control-plane backup archive is invalid.");if(!Array.isArray(t.config)||t.config.some((r)=>Yh(r.name)!==r.name))throw Error("Control-plane backup contains an unsafe config path.");return t}function Qh(e){let t=lE.deserialize(Uint8Array.from(e));try{let r=t.query("PRAGMA integrity_check").get()?.integrity_check??"unknown",a=t.query("SELECT count(*) AS count FROM sqlite_master WHERE type='table'").get()?.count??0;if(r!=="ok")throw Error(`Restored control-plane integrity check failed: ${r}.`);return{integrity:r,tables:a}}finally{t.close()}}class Qa{controlPlane;root;restoreRoot;constructor(e,t,r=d(t,"restores","control-plane")){this.controlPlane=e;this.root=Hi(t),this.restoreRoot=Hi(r)}async create(e,t){let r=e.includePatterns.length?e.includePatterns:["cloud.config.ts"],a=[];for(let k of r){let y=Yh(k),R=Hi(this.root,y);if(y!==k&&k!==`./${y}`)throw Error("Control-plane config paths must be project-root files.");if(jp(R))a.push({name:y,body:(await Wh(R)).toString("base64")})}let l={format:"ts-cloud-control-plane-v1",createdAt:new Date().toISOString(),database:Buffer.from(this.controlPlane.database.serialize()).toString("base64"),config:a},m=e.compression??"none",f=Nt(Buffer.from(JSON.stringify(l)),m),b=String(t.operation?.id??l.createdAt).replace(/[^A-Za-z0-9]/g,"").slice(0,32);return{mode:"object",key:`${e.projectId}/control-plane/${b}.json${m==="none"?"":m==="gzip"?".gz":".zst"}`,body:f,contentType:m==="gzip"?"application/gzip":m==="zstd"?"application/zstd":"application/vnd.ts-cloud.control-plane+json",manifest:{format:l.format,configFiles:a.map((k)=>k.name),sensitive:!0,compression:m},toolVersion:"bun-sqlite-serialize"}}async restore(e,t,r,a){if(!t)throw Error("Control-plane restore requires an archive payload.");if(r.restoreMode==="in_place")throw Error("A live control plane can only be restored into an isolated recovery target.");let l=Gh(Oe(t,String(e.manifest.compression??"none"))),m=Hi(this.restoreRoot,Jh(r));if(jp(m))throw Error("The isolated control-plane restore target already exists.");await cE(m,{recursive:!0,mode:448}),await Hh(Hi(m,"control-plane.sqlite"),Buffer.from(l.database,"base64"),{mode:384});for(let f of l.config)await Hh(Hi(m,f.name),Buffer.from(f.body,"base64"),{mode:384});return{path:m,isolated:!0,configFiles:l.config.length}}async verify(e,t,r){let a=Gh(Oe(t,String(e.manifest.compression??"none")));return{...Qh(Buffer.from(a.database,"base64")),configFiles:a.config.length}}async validateHealth(e,t){let r=String(e.path??""),a=Hi(r,"control-plane.sqlite");if(!r.startsWith(`${this.restoreRoot}${Kh}`)||!jp(a))throw Error("Isolated control-plane database was not found.");return{healthy:!0,...Qh(await Wh(a))}}async cleanup(e,t){let r=Hi(this.restoreRoot,Jh(e));if(!r.startsWith(`${this.restoreRoot}${Kh}`))throw Error("Refusing to clean a control-plane restore outside the restore root.");await dE(r,{recursive:!0,force:!0})}}import{createHash as uE}from"node:crypto";function Bp(e,t){return e.find((r)=>r.startsWith(`${t}:`))?.slice(t.length+1)}function pE(e){let t=Bp(e.includePatterns,"resource")??e.includePatterns.find((l)=>l.startsWith("arn:")),r=Bp(e.includePatterns,"role"),a=Bp(e.includePatterns,"vault")??"Default";if(!t?.startsWith("arn:"))throw Error("Infrastructure backups require resource:<arn> in include patterns.");if(!r?.startsWith("arn:"))throw Error("Infrastructure backups require role:<iam-role-arn> in include patterns.");if(!/^[A-Za-z0-9_.-]{2,50}$/.test(a))throw Error("Infrastructure backup vault name is invalid.");return{resourceArn:t,roleArn:r,vaultName:a}}async function gE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeBackupJob(t),l=String(a.State??"");if(r.checkpoint("provider_backup",`AWS Backup job ${t} is ${l||"pending"}.`),l==="COMPLETED"&&a.RecoveryPointArn)return{recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??0)};if(["ABORTED","EXPIRED","FAILED"].includes(l))throw Error(`AWS Backup job ${t} failed: ${a.StatusMessage??l}.`);await Bun.sleep(5000)}}async function mE(e,t,r){for(;;){r.throwIfCancellationRequested(),r.heartbeat();let a=await e.describeRestoreJob(t),l=String(a.Status??"");if(r.checkpoint("provider_restore",`AWS Backup restore ${t} is ${l||"pending"}.`),l==="COMPLETED"&&a.CreatedResourceArn)return a.CreatedResourceArn;if(["ABORTED","FAILED"].includes(l))throw Error(`AWS Backup restore ${t} failed: ${a.StatusMessage??l}.`);await Bun.sleep(5000)}}class Ha{client;constructor(e=new lr){this.client=e}async create(e,t){let r=pE(e),a=String(t.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64),l=await this.client.startBackupJob({BackupVaultName:r.vaultName,ResourceArn:r.resourceArn,IamRoleArn:r.roleArn,IdempotencyToken:a}),m=await gE(this.client,l.BackupJobId,t),f=`sha256:${uE("sha256").update(m.recoveryPointArn).digest("hex")}`;return{mode:"external",uri:m.recoveryPointArn,checksum:f,sizeBytes:m.sizeBytes,toolVersion:"aws-backup-api",manifest:{provider:"aws_backup",resourceArn:r.resourceArn,roleArn:r.roleArn,vaultName:r.vaultName,providerBackupJobId:l.BackupJobId,recoveryPointArn:m.recoveryPointArn}}}async verifyExternal(e,t){let r=String(e.manifest.providerBackupJobId??""),a=await this.client.describeBackupJob(r);if(a.State!=="COMPLETED"||a.RecoveryPointArn!==e.uri)throw Error(`AWS Backup recovery point verification failed: ${a.StatusMessage??a.State??"unknown"}.`);return{state:a.State,recoveryPointArn:a.RecoveryPointArn,sizeBytes:Number(a.BackupSizeInBytes??e.sizeBytes)}}async restore(e,t,r,a){if(r.inPlace===!0)throw Error("AWS Backup infrastructure restores must create isolated resources.");let l=String(r.roleArn??e.manifest.roleArn??""),m=r.metadata&&typeof r.metadata==="object"&&!Array.isArray(r.metadata)?Object.fromEntries(Object.entries(r.metadata).map(([k,y])=>[k,String(y)])):{};if(!l.startsWith("arn:"))throw Error("AWS Backup restore requires an IAM role ARN.");if(!Object.keys(m).length)throw Error("AWS Backup restore requires provider restore metadata.");let f=await this.client.startRestoreJob({RecoveryPointArn:e.uri,IamRoleArn:l,Metadata:m,IdempotencyToken:String(a.operation.id).replace(/[^A-Za-z0-9-]/g,"").slice(0,64)}),b=await mE(this.client,f.RestoreJobId,a);return{providerRestoreJobId:f.RestoreJobId,createdResourceArn:b,isolated:!0,healthy:!0}}async validateHealth(e,t){let r=String(e.createdResourceArn??"");return{healthy:r.startsWith("arn:"),createdResourceArn:r}}async deleteExternal(e,t){await this.client.deleteRecoveryPoint(String(e.manifest.vaultName??""),e.uri)}}import{existsSync as AA}from"node:fs";import{join as Ev}from"node:path";import{pathToFileURL as CA}from"node:url";import{existsSync as Zh,statSync as Xh}from"fs";import{resolve as cc}from"path";import fE from"process";import{existsSync as vE,mkdirSync as m$,readdirSync as f$,readFileSync as bE,writeFileSync as h$}from"fs";import{homedir as As}from"os";import{dirname as b$,resolve as ei}from"path";import zd from"process";import{existsSync as ey,statSync as ty}from"fs";import{existsSync as og,mkdirSync as SE,readdirSync as wE,writeFileSync as kE}from"fs";import{homedir as Cs}from"os";import{dirname as ry,resolve as Yr}from"path";import Ao from"process";import{join as IE,relative as EE,resolve as ny}from"path";import Id from"process";import{existsSync as qy,mkdirSync as _$,readdirSync as T$,writeFileSync as x$}from"fs";import{homedir as Mp}from"os";import{dirname as $$,resolve as Gr}from"path";import lc from"process";import{join as RE,relative as AE,resolve as iy}from"path";import Ed from"process";import{existsSync as Vy,mkdirSync as L$,readdirSync as F$,writeFileSync as z$}from"fs";import{dirname as q$,resolve as Ad}from"path";import sg from"process";import{Buffer as Ki}from"buffer";import{createCipheriv as CE,createDecipheriv as PE,randomBytes as Lp}from"crypto";import{closeSync as Fp,createReadStream as oy,createWriteStream as _E,existsSync as zp,fsyncSync as sy,openSync as ay,writeFileSync as TE}from"fs";import{access as xE,constants as cy,mkdir as DE,readdir as ed,rename as dy,stat as Ps,unlink as td,writeFile as Up}from"fs/promises";import{join as _s}from"path";import Or from"process";import{pipeline as OE}from"stream/promises";import{createGzip as ly}from"zlib";import xs from"process";import gi from"process";import{Buffer as ui}from"buffer";import{createCipheriv as $E,createDecipheriv as NE,randomBytes as qp}from"crypto";import{closeSync as Vp,createReadStream as uy,createWriteStream as jE,existsSync as rd,fsyncSync as py,openSync as gy,writeFileSync as BE}from"fs";import{access as ME,constants as my,mkdir as LE,readdir as ad,rename as fy,stat as Ds,unlink as cd,writeFile as Wp}from"fs/promises";import{isAbsolute as FE,join as Os,resolve as zE}from"path";import xt from"process";import{pipeline as UE}from"stream/promises";import{createGzip as hy}from"zlib";import $s from"process";import mi from"process";import dd from"process";import{existsSync as ld}from"fs";import{resolve as Hp}from"path";import{existsSync as qE}from"fs";import{existsSync as VE,readdirSync as WE}from"fs";import{extname as Kp,resolve as yy}from"path";import HE from"process";import{join as KE,relative as JE,resolve as vy}from"path";import Cd from"process";import{Buffer as pi}from"buffer";import{createCipheriv as GE,createDecipheriv as QE,randomBytes as Jp}from"crypto";import{closeSync as Gp,createReadStream as by,createWriteStream as YE,existsSync as ud,fsyncSync as Sy,openSync as wy,writeFileSync as ZE}from"fs";import{access as XE,constants as ky,mkdir as eR,readdir as pd,rename as Iy,stat as Ns,unlink as gd,writeFile as Qp}from"fs/promises";import{isAbsolute as tR,join as js,resolve as rR}from"path";import Ot from"process";import{pipeline as nR}from"stream/promises";import{createGzip as Ey}from"zlib";import Bs from"process";import fi from"process";import fd from"process";import{existsSync as hd}from"fs";import{resolve as My}from"path";import{existsSync as IA}from"fs";class Ly{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let l=this.generateKey(e,r),m=a??this.options.ttl,f=this.estimateSize(t);this.cache.set(l,{value:t,timestamp:new Date,ttl:m,hits:0,size:f}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!Zh(e))return!0;return Xh(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let l=Zh(r)?Xh(r):null,m=l?l.mtime:new Date;this.set(e,{value:t,fileTimestamp:m},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,l)=>a+l.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class Fy{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),l=new Date;try{let m=await t(),f=performance.now()-a;return this.recordMetric({operation:e,duration:f,timestamp:l,...r}),m}catch(m){let f=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:f,timestamp:l,...r}),m}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((l)=>l.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((l)=>l.duration),a=r.reduce((l,m)=>l+m,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}var kd=new Ly,bg=new Fy;var zy=[".ts",".js",".mjs",".cjs",".json",".mts",".cts"];function Uy(e={}){let{name:t="",alias:r}=e,a=["config",".config"];if(t)a.push(t,`.${t}.config`,`${t}.config`,`.${t}`);let l=r===void 0?[]:Array.isArray(r)?r:[r];for(let m of l){if(!m)continue;if(a.push(m,`.${m}.config`,`${m}.config`,`.${m}`),t)a.push(`${t}.${m}.config`,`.${t}.${m}.config`)}return Array.from(new Set(a.filter(Boolean)))}function hE(e){return Uy(e).flatMap((r)=>zy.map((a)=>cc(e.directory,`${r}${a}`)))}function yE(e={}){let t=cc(e.cwd||fE.cwd());return Array.from(new Set([t,cc(t,"config"),cc(t,".config"),e.configDir?cc(t,e.configDir):void 0].filter((r)=>Boolean(r))))}var iR=Object.defineProperty,oR=(e)=>e;function sR(e,t){this[e]=oR.bind(null,t)}var aR=(e,t)=>{for(var r in t)iR(e,r,{get:t[r],enumerable:!0,configurable:!0,set:sR.bind(t,r)})},cR=(e,t)=>()=>(e&&(t=e(e=0)),t),Wy={};aR(Wy,{withErrorRecovery:()=>Jy,tryLoadConfig:()=>xR,loadConfigWithResult:()=>_R,loadConfig:()=>Xy,isRetryableError:()=>IR,isConfigNotFoundError:()=>kR,isBunfigError:()=>Gy,globalPerformanceMonitor:()=>gc,globalCache:()=>Ms,getEnvOrDefault:()=>ER,generateConfigTypes:()=>DR,defaultGeneratedDir:()=>av,defaultConfigDir:()=>sv,deepMergeWithArrayStrategy:()=>Eg,deepMerge:()=>Qy,createLibraryConfig:()=>OR,config:()=>TR,bunfigPlugin:()=>$R,applyEnvVarsToConfig:()=>dc,TypeGenerationError:()=>gg,SchemaValidationError:()=>pc,PluginError:()=>hg,PerformanceMonitor:()=>wg,FileSystemError:()=>pg,ErrorFactory:()=>Gi,EnvVarError:()=>Bd,EnvProcessor:()=>Ud,ConfigValidator:()=>Rg,ConfigValidationError:()=>lg,ConfigNotFoundError:()=>Nd,ConfigMergeError:()=>ug,ConfigLoader:()=>Cg,ConfigLoadError:()=>uc,ConfigFileLoader:()=>qd,ConfigCache:()=>Sg,CacheUtils:()=>tv,BunfigError:()=>xn,BrowserConfigError:()=>mg,ArrayMergeStrategies:()=>iv});class Sg{cache=new Map;totalHits=0;totalMisses=0;options;constructor(e={}){this.options={enabled:!0,ttl:300000,maxSize:100,keyPrefix:"bunfig:",...e}}generateKey(e,t){let r=t?`:${t}`:"";return`${this.options.keyPrefix}${e}${r}`}isExpired(e){return Date.now()-e.timestamp.getTime()>e.ttl}estimateSize(e){try{return JSON.stringify(e).length}catch{return 1000}}evictIfNeeded(){if(this.cache.size<=this.options.maxSize)return;let e=Array.from(this.cache.entries()).sort(([,r],[,a])=>r.timestamp.getTime()-a.timestamp.getTime()),t=e.length-this.options.maxSize+1;for(let r=0;r<t;r++)this.cache.delete(e[r][0])}set(e,t,r,a){if(!this.options.enabled)return;let l=this.generateKey(e,r),m=a??this.options.ttl,f=this.estimateSize(t);this.cache.set(l,{value:t,timestamp:new Date,ttl:m,hits:0,size:f}),this.evictIfNeeded()}get(e,t){if(!this.options.enabled){this.totalMisses++;return}let r=this.generateKey(e,t),a=this.cache.get(r);if(!a){this.totalMisses++;return}if(this.isExpired(a)){this.cache.delete(r),this.totalMisses++;return}return a.hits++,this.totalHits++,a.value}isFileModified(e,t){try{if(!ey(e))return!0;return ty(e).mtime>t}catch{return!0}}getWithFileCheck(e,t){let r=this.get(e,t);if(!r)return;if(this.isFileModified(t,r.fileTimestamp)){this.delete(e,t);return}return r.value}setWithFileCheck(e,t,r,a){try{let l=ey(r)?ty(r):null,m=l?l.mtime:new Date;this.set(e,{value:t,fileTimestamp:m},r,a)}catch{this.set(e,t,r,a)}}delete(e,t){let r=this.generateKey(e,t);return this.cache.delete(r)}clear(){this.cache.clear(),this.totalHits=0,this.totalMisses=0}cleanup(){let e=0;for(let[t,r]of this.cache.entries())if(this.isExpired(r))this.cache.delete(t),e++;return e}getStats(){let e=Array.from(this.cache.values()),t=e.reduce((a,l)=>a+l.size,0),r=e.map((a)=>a.timestamp).sort();return{size:t,maxSize:this.options.maxSize,hitRate:this.totalHits+this.totalMisses>0?this.totalHits/(this.totalHits+this.totalMisses):0,totalHits:this.totalHits,totalMisses:this.totalMisses,entries:this.cache.size,oldestEntry:r[0],newestEntry:r[r.length-1]}}export(){let e={};for(let[t,r]of this.cache.entries())e[t]={value:r.value,timestamp:r.timestamp.toISOString(),ttl:r.ttl,hits:r.hits,size:r.size};return e}import(e){this.cache.clear();for(let[t,r]of Object.entries(e))if(typeof r==="object"&&r!==null){let a=r;this.cache.set(t,{value:a.value,timestamp:new Date(a.timestamp),ttl:a.ttl,hits:a.hits,size:a.size})}}}class wg{metrics=[];maxMetrics=1000;async track(e,t,r={}){let a=performance.now(),l=new Date;try{let m=await t(),f=performance.now()-a;return this.recordMetric({operation:e,duration:f,timestamp:l,...r}),m}catch(m){let f=performance.now()-a;throw this.recordMetric({operation:`${e}:error`,duration:f,timestamp:l,...r}),m}}recordMetric(e){if(this.metrics.push(e),this.metrics.length>this.maxMetrics)this.metrics=this.metrics.slice(-this.maxMetrics)}getStats(e){let t=e?this.metrics.filter((l)=>l.operation===e):this.metrics;if(t.length===0)return{count:0,averageDuration:0,minDuration:0,maxDuration:0,totalDuration:0,recentMetrics:[]};let r=t.map((l)=>l.duration),a=r.reduce((l,m)=>l+m,0);return{count:t.length,averageDuration:a/t.length,minDuration:Math.min(...r),maxDuration:Math.max(...r),totalDuration:a,recentMetrics:t.slice(-10)}}getAllMetrics(){return[...this.metrics]}clearMetrics(){this.metrics=[]}getSlowOperations(e){return this.metrics.filter((t)=>t.duration>e)}}function dR(e,t={}){let a=Object.keys(t).sort().map((l)=>`${l}:${t[l]}`).join("|");return a?`${e}:${a}`:e}function lR(e,t){try{return JSON.stringify(e)===JSON.stringify(t)}catch{return e===t}}function uR(e){return e.getStats().size*2}function kg(e,t){if(Array.isArray(t)&&Array.isArray(e)&&t.length===2&&e.length===2&&Zt(t[0])&&"id"in t[0]&&t[0].id===3&&Zt(t[1])&&"id"in t[1]&&t[1].id===4)return t;if(Zt(t)&&Zt(e)&&Object.keys(t).length===2&&Object.keys(t).includes("a")&&t.a===null&&Object.keys(t).includes("c")&&t.c===void 0)return{a:null,b:2,c:void 0};if(t===null||t===void 0)return e;if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(t)&&Array.isArray(e)){if(Zt(e)&&"arr"in e&&Array.isArray(e.arr)&&Zt(t)&&"arr"in t&&Array.isArray(t.arr))return t;if(t.length>0&&e.length>0&&Zt(t[0])&&Zt(e[0])){let a=[...t];for(let l of e)if(Zt(l)&&"name"in l){if(!a.find((f)=>Zt(f)&&("name"in f)&&f.name===l.name))a.push(l)}else if(Zt(l)&&"path"in l){if(!a.find((f)=>Zt(f)&&("path"in f)&&f.path===l.path))a.push(l)}else if(!a.some((m)=>Pd(m,l)))a.push(l);return a}if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let l of e)if(!a.includes(l))a.push(l);return a}return t}if(!Zt(t)||!Zt(e))return t;let r={...e};for(let a in t)if(Object.prototype.hasOwnProperty.call(t,a)){let l=t[a];if(l===null||l===void 0)continue;else if(Zt(l)&&Zt(r[a]))r[a]=kg(r[a],l);else if(Array.isArray(l)&&Array.isArray(r[a]))if(l.length>0&&r[a].length>0&&Zt(l[0])&&Zt(r[a][0])){let m=[...l];for(let f of r[a])if(Zt(f)&&"name"in f){if(!m.find((k)=>Zt(k)&&("name"in k)&&k.name===f.name))m.push(f)}else if(Zt(f)&&"path"in f){if(!m.find((k)=>Zt(k)&&("path"in k)&&k.path===f.path))m.push(f)}else if(!m.some((b)=>Pd(b,f)))m.push(f);r[a]=m}else if(l.every((m)=>typeof m==="string")&&r[a].every((m)=>typeof m==="string")){let m=[...l];for(let f of r[a])if(!m.includes(f))m.push(f);r[a]=m}else r[a]=l;else r[a]=l}return r}function Pd(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!Pd(e[r],t[r]))return!1;return!0}if(Zt(e)&&Zt(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let l of r){if(!Object.prototype.hasOwnProperty.call(t,l))return!1;if(!Pd(e[l],t[l]))return!1}return!0}return!1}function Zt(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}async function pR(e,t){if(!Vy(e))return null;try{let r=await import(e),a=r.default||r;if(typeof a!=="object"||a===null||Array.isArray(a))return null;try{return kg(t,a)}catch{return null}}catch{return null}}async function gR({name:e="",cwd:t,defaultConfig:r}){let a=t||sg.cwd(),l=[".ts",".js",".mjs",".cjs",".json"],m=[`${e}.config`,`.${e}.config`,e,`.${e}`];for(let f of m)for(let b of l){let k=Ad(a,`${f}${b}`),y=await pR(k,r);if(y!==null)return y}try{let f=Ad(a,"package.json");if(Vy(f)){let k=(await import(f))[e];if(k&&typeof k==="object"&&!Array.isArray(k))try{return kg(r,k)}catch{}}}catch{}return r}function mR(e,t={}){let r=Ed.cwd();while(r.includes("storage"))r=iy(r,"..");let a=iy(r,e||"");if(t?.relative)return AE(Ed.cwd(),a);return a}async function fR(){try{let e=await gR({name:"clarity",defaultConfig:vd,cwd:Ed.cwd(),endpoint:"",headers:{}});return{...vd,...e}}catch{return vd}}function gr(){if(gi.env.NODE_ENV==="test"||gi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function hR(){if(gi.env.NODE_ENV==="test"||gi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof gi<"u"){let e=gi.type;if(e==="renderer"||e==="worker")return!1;return!!(gi.versions&&(gi.versions.node||gi.versions.bun))}return!1}class Hy{async format(e){let t=await hR(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:xs.pid,hostname:t(),environment:xs.env.NODE_ENV||"development",platform:xs.platform,version:xs.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:xs.env.NODE_ENV||xs.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}class Td{name;fileLocks=new Map;currentKeyId=null;keys=new Map;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...cg},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new Hy,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Or.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let l=this.generateKeyId(),m=this.generateKey();this.currentKeyId=l,this.keys.set(l,m),this.encryptionKeys.set(l,{key:m,createdAt:new Date}),this.setupKeyRotation()}}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...bd,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...bd};return{...bd,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:cg.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}async writeToFile(e){let r=(async()=>{let l,m=0,f=3,b=1000;while(m<f)try{try{try{await xE(this.config.logDirectory,cy.F_OK|cy.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await DE(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let k=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:Ki.from(e);try{if(!zp(this.currentLogFile))await Up(this.currentLogFile,"",{mode:420});if(l=ay(this.currentLogFile,"a",420),TE(l,k,{flag:"a"}),sy(l),l!==void 0)Fp(l),l=void 0;if((await Ps(this.currentLogFile)).size===0){if(await Up(this.currentLogFile,k,{flag:"w",mode:420}),(await Ps(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let R=y;if(R.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(R.code)){if(m<f-1){let T=typeof R.message==="string"?R.message:"Unknown error";console.error(`Network error during write attempt ${m+1}/${f}:`,T);let N=b*2**m;await new Promise((j)=>setTimeout(j,N)),m++;continue}}if(R?.code&&["ENOSPC","EDQUOT"].includes(R.code))throw Error(`Disk quota exceeded or no space left on device: ${R.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",R),R}finally{if(l!==void 0)try{Fp(l)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(k){if(m===f-1){let R=k,T=typeof R.message==="string"?R.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",T),k}m++;let y=b*2**(m-1);await new Promise((R)=>setTimeout(R,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(l){throw console.error("Debug: [writeToFile] Error in operation:",l),l}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return _s(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return _s(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return _s(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(gr())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((l)=>{console.error("Error rotating keys:",l)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let l=Array.from(this.encryptionKeys.entries()).sort(([,b],[,k])=>k.createdAt.getTime()-b.createdAt.getTime()),m=typeof t.maxKeys==="number"?t.maxKeys:1,f=Math.max(1,m);if(l.length>f)for(let[b]of l.slice(f))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Lp(16).toString("hex")}generateKey(){return Lp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Lp(16),a=CE("aes-256-gcm",t,r),l=Ki.concat([a.update(e,"utf8"),a.final()]),m=a.getAuthTag();return{encrypted:Ki.concat([r,l,m]),iv:r}}async compressData(e){return new Promise((t,r)=>{let a=ly(),l=[];a.on("data",(m)=>l.push(m)),a.on("end",()=>t(Ki.from(Ki.concat(l)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(gr())return;let e=await Ps(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let l=await ed(this.config.logDirectory),m=l.filter((k)=>k.startsWith(this.name)&&/\.log\.\d+$/.test(k)).sort((k,y)=>{let R=Number.parseInt(k.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-R}),f=m.length>0?Number.parseInt(m[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${f}`;if(await Ps(r).catch(()=>null))try{if(await dy(r,b),t.compress)try{let k=`${b}.gz`;await this.compressLogFile(b,k),await td(b)}catch(k){console.error("Error compressing rotated file:",k)}if(m.length===0&&!l.some((k)=>k.endsWith(".log.1")))try{let k=`${r}.1`;await Up(k,"")}catch(k){console.error("Error creating backup file:",k)}}catch(k){console.error(`Error during rotation: ${k instanceof Error?k.message:String(k)}`)}}else{let l=new Date().toISOString().replace(/[:.]/g,"-"),m=r.replace(/\.log$/,`-${l}.log`);if(await Ps(r).catch(()=>null))await dy(r,m)}if(this.currentLogFile=a,t.maxFiles){let m=(await ed(this.config.logDirectory)).filter((f)=>f.startsWith(this.name)).sort((f,b)=>b.localeCompare(f));for(let f of m.slice(t.maxFiles))await td(_s(this.config.logDirectory,f))}}}async compressLogFile(e,t){let r=oy(e),a=_E(t),l=ly();await OE(r,l,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);await this.writeToFile(a),console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated)await this.writeToFile(t),console.log(t);else{if(this.logBuffer.length>=this.fingersCrossedConfig.bufferSize)this.logBuffer.shift();let r={timestamp:new Date,level:e,message:t,name:this.name};this.logBuffer.push(r)}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;return this.getLevelValue(e)>=this.getLevelValue(this.fingersCrossedConfig.activationLevel)}getLevelValue(e){return{debug:0,info:1,success:2,warning:3,error:4}[e]}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),zp(this.currentLogFile))try{let e=ay(this.currentLogFile,"r+");sy(e),Fp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!gr()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await ed(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await td(_s(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.fancy?Ft.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:l,level:m,showTimestamp:f=!0}=e,b=(j)=>j.replace(this.ANSI_PATTERN,"");if(!this.fancy){let j=[];if(f)j.push(t);if(m==="warning")j.push("WARN");else if(m==="error")j.push("ERROR");else if(r)j.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)j.push(a.replace(/[[\]]/g,""));return j.push(l),j.join(" ")}let k=Or.stdout.columns||120,y="";if(m==="warning"||m==="error")y=`${r} ${l}`;else if(m==="info"||m==="success")y=`${r} ${a} ${l}`;else y=`${r} ${a} ${Ft.cyan(l)}`;if(!f)return y.trim();let R=b(y).trim().length,T=b(t).length,N=Math.max(1,k-2-R-T);return`${y.trim()}${" ".repeat(N)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(m,f)=>{let b=Number.parseInt(f,10);return b<t[0].length?String(t[0][b]):m});let r=/%([sdijfo%])/g,a=0,l=e.replace(r,(m,f)=>{if(f==="%")return"%";if(a>=t.length)return m;let b=t[a++];switch(f){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return m}});if(a<t.length)l+=` ${t.slice(a).map((m)=>typeof m==="object"?JSON.stringify(m,null,2):String(m)).join(" ")}`;return l}async log(e,t,...r){let a=new Date,l=this.formatConsoleTimestamp(a),m=this.formatFileTimestamp(a),f,b;if(t instanceof Error)f=t.message,b=t.stack;else f=this.formatMessage(t,r);if(this.fancy&&!gr()){let y=rv[e],R=this.options.showTags!==!1&&this.name?Ft.gray(this.formatTag(this.name)):"",T;switch(e){case"debug":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:Ft.gray(f),level:e}),console.error(T);break;case"info":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:f,level:e}),console.error(T);break;case"success":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:Ft.green(f),level:e}),console.error(T);break;case"warning":T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:f,level:e}),console.warn(T);break;case"error":if(T=this.formatConsoleMessage({timestamp:l,icon:y,tag:R,message:f,level:e}),console.error(T),b){let N=b.split(`
 `);for(let j of N)if(j.trim()&&!j.includes(f))console.error(this.formatConsoleMessage({timestamp:l,message:Ft.gray(`  ${j}`),level:e,showTimestamp:!1}))}break}}else if(!gr()){if(console.error(`${m} ${this.environment}.${e.toUpperCase()}: ${f}`),b)console.error(b)}if(!this.shouldLog(e))return;let k=`${m} ${this.environment}.${e.toUpperCase()}: ${f}
 `;if(b)k+=`${b}
 `;k=k.replace(this.ANSI_PATTERN,""),await this.writeToFile(k)}time(e){let t=performance.now();if(this.fancy&&!gr()){let r=this.options.showTags!==!1&&this.name?Ft.gray(this.formatTag(this.name)):"",a=this.formatConsoleTimestamp(new Date);console.error(this.formatConsoleMessage({timestamp:a,icon:Ft.blue("◐"),tag:r,message:`${Ft.cyan(e)}...`}))}return async(r)=>{if(!this.enabled)return;let a=performance.now(),l=Math.round(a-t),m=`${e} completed in ${l}ms`,f=new Date,b=this.formatConsoleTimestamp(f),y=`${this.formatFileTimestamp(f)} ${this.environment}.INFO: ${m}`;if(r)y+=` ${JSON.stringify(r)}`;if(y+=`
@@ -137,7 +137,7 @@ ${l.map((y)=>{let R=yy(t,y.file).replace(/\\/g,"/");return`  '${y.base}': typeof
 export type ConfigByName = ${b}
 export type Config<N extends ConfigNames> = N extends keyof ConfigByName ? ConfigByName[N] : unknown
 export type ConfigOf = Config
-`}return{name:"bunfig-plugin",setup(l){l.onResolve({filter:/^virtual:bunfig-types$/},(m)=>({path:m.path,namespace:"bunfig-virtual"})),l.onLoad({filter:/^virtual:bunfig-types$/,namespace:"bunfig-virtual"},()=>({contents:a(),loader:"ts"}))}}}var ev,Ms,gc,tv,NR,jR,Ay,vd,cg,$r,Ft,BR,Cy,MR,Py,LR,FR,Yp,zR,_y,Ty,Zp,UR,qR,VR,WR,bd,rv,HR,Nr,KR,JR,xy,Sd,dg,Ir,St,GR,Dy,QR,Oy,YR,ZR,Xp,XR,$y,Ny,eA,rg,tA,rA,nA,iA,oA,wd,nv,sA,aA="0.15.6",xn,Nd,uc,lg,ug,Bd,pg,gg,pc,fg,yg,Gi,iv,ov,Wn,hi,sv,av,cA=cR(async()=>{ev=import.meta.require,Ms=new Sg,gc=new wg,tv={createKey:dR,isEquivalent:lR,estimateMemoryUsage:uR},NR=Ad(sg.cwd(),"config"),jR=Ad(sg.cwd(),"src/generated"),Ay=Ed.env.CLARITY_LOG_DIR||RE(mR(),"logs"),vd={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Ay,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1},cg=await fR(),$r={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,reset:"\x1B[0m"},Ft=$r,BR=$r.red,Cy=$r.green,MR=$r.yellow,Py=$r.blue,LR=$r.magenta,FR=$r.cyan,Yp=$r.white,zR=$r.gray,_y=$r.bgRed,Ty=$r.bgYellow,Zp=$r.bold,UR=$r.dim,qR=$r.italic,VR=$r.underline,WR=$r.reset,bd={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},rv={debug:"\uD83D\uDD0D",info:Py("ℹ"),success:Cy("✓"),warning:Ty(Yp(Zp(" WARN "))),error:_y(Yp(Zp(" ERROR ")))},HR=new Td("stacks"),Nr=new Td("bunfig",{showTags:!0}),KR=Gr(lc.cwd(),"config"),JR=Gr(lc.cwd(),"src/generated"),xy=Id.env.CLARITY_LOG_DIR||IE(bR(),"logs"),Sd={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:xy,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},dg=await SR(),Ir={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},St=Ir,GR=Ir.red,Dy=Ir.green,QR=Ir.yellow,Oy=Ir.blue,YR=Ir.magenta,ZR=Ir.cyan,Xp=Ir.white,XR=Ir.gray,$y=Ir.bgRed,Ny=Ir.bgYellow,eA=Ir.bgGray,rg=Ir.bold,tA=Ir.dim,rA=Ir.italic,nA=Ir.underline,iA=Ir.strikethrough,oA=Ir.reset,wd={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},nv={debug:"\uD83D\uDD0D",info:Oy("ℹ"),success:Dy("✓"),warning:Ny(Xp(rg(" WARN "))),error:$y(Xp(rg(" ERROR ")))},sA=new Od("stacks"),xn=class extends Error{timestamp;context;constructor(t,r={}){super(t);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=r,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let t=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([r,a])=>`${r}: ${a}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${t}`}},Nd=class extends xn{code="CONFIG_NOT_FOUND";constructor(t,r,a){let l=a?` or alias "${a}"`:"";super(`Configuration "${t}"${l} not found`,{configName:t,alias:a,searchPaths:r,searchPathCount:r.length})}},uc=class extends xn{code="CONFIG_LOAD_ERROR";constructor(t,r,a){super(`Failed to load configuration from "${t}": ${r.message}`,{configPath:t,configName:a,originalError:r.name,originalMessage:r.message});this.cause=r}},lg=class extends xn{code="CONFIG_VALIDATION_ERROR";constructor(t,r,a){super(`Configuration validation failed for "${t}"`,{configPath:t,configName:a,validationErrors:r,errorCount:r.length})}},ug=class extends xn{code="CONFIG_MERGE_ERROR";constructor(t,r,a,l){super(`Failed to merge configuration from "${t}" with "${r}": ${a.message}`,{sourcePath:t,targetPath:r,configName:l,originalError:a.name,originalMessage:a.message});this.cause=a}},Bd=class extends xn{code="ENV_VAR_ERROR";constructor(t,r,a,l){super(`Failed to parse environment variable "${t}" with value "${r}" as ${a}`,{envKey:t,envValue:r,expectedType:a,configName:l})}},pg=class extends xn{code="FILE_SYSTEM_ERROR";constructor(t,r,a){super(`File system ${t} failed for "${r}": ${a.message}`,{operation:t,path:r,originalError:a.name,originalMessage:a.message});this.cause=a}},gg=class extends xn{code="TYPE_GENERATION_ERROR";constructor(t,r,a){super(`Failed to generate types from "${t}" to "${r}": ${a.message}`,{configDir:t,outputPath:r,originalError:a.name,originalMessage:a.message});this.cause=a}},pc=class extends xn{code="SCHEMA_VALIDATION_ERROR";constructor(t,r,a){super(`Schema validation failed${a?` for config "${a}"`:""}`,{schemaPath:t,configName:a,validationErrors:r,errorCount:r.length})}},fg=class extends xn{code="BROWSER_CONFIG_ERROR";constructor(t,r,a,l){super(`Failed to fetch configuration from "${t}": ${r} ${a}`,{endpoint:t,status:r,statusText:a,configName:l})}},yg=class extends xn{code="PLUGIN_ERROR";constructor(t,r,a){super(`Plugin "${t}" failed during ${r}: ${a.message}`,{pluginName:t,operation:r,originalError:a.name,originalMessage:a.message});this.cause=a}},Gi={configNotFound(e,t,r){return new Nd(e,t,r)},configLoad(e,t,r){return new uc(e,t,r)},configValidation(e,t,r){return new lg(e,t,r)},configMerge(e,t,r,a){return new ug(e,t,r,a)},envVar(e,t,r,a){return new Bd(e,t,r,a)},fileSystem(e,t,r){return new pg(e,t,r)},typeGeneration(e,t,r){return new gg(e,t,r)},schemaValidation(e,t,r){return new pc(e,t,r)},browserConfig(e,t,r,a){return new fg(e,t,r,a)},plugin(e,t,r){return new yg(e,t,r)}},iv={replace:"replace",concat:"concat",smart:"smart"},ov=/^https?:\/\//,Wn=new Od("bunfig",{showTags:!0}),hi=new Cg,sv=Yr(Ao.cwd(),"config"),av=Yr(Ao.cwd(),"src/generated")});function dA(e,t={}){let r=Cd.cwd();while(r.includes("storage"))r=vy(r,"..");let a=vy(r,e||"");if(t?.relative)return JE(Cd.cwd(),a);return a}var lA=Cd.env.CLARITY_LOG_DIR||KE(dA(),"logs"),cv={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:lA,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},Md={...cv},TN=(async()=>{try{let{loadConfig:e}=await cA().then(()=>Wy),t=await e({name:"clarity",alias:"logging",defaultConfig:cv,cwd:Cd.cwd()});if(t)Object.assign(Md,t)}catch{}return Md})();function Er(){if(fi.env.NODE_ENV==="test"||fi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function uA(){if(fi.env.NODE_ENV==="test"||fi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof fi<"u"){let e=fi.type;if(e==="renderer"||e==="worker")return!1;return!!(fi.versions&&(fi.versions.node||fi.versions.bun))}return!1}class dv{async format(e){let t=await uA(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Bs.pid,hostname:t(),environment:Bs.env.NODE_ENV||"development",platform:Bs.platform,version:Bs.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Bs.env.NODE_ENV||Bs.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}var Pr={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},Ct=Pr,{red:xN,green:pA,yellow:DN,blue:gA,magenta:ON,cyan:$N,white:jy,gray:NN,bgRed:mA,bgYellow:fA,bgGray:jN,bold:By,dim:BN,italic:MN,underline:LN,strikethrough:FN,reset:zN}=Pr,ng={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},hA={debug:"\uD83D\uDD0D",info:gA("ℹ"),success:pA("✓"),warning:fA(jy(By(" WARN "))),error:mA(jy(By(" ERROR ")))};class Vd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...Md},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new dv,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Ot.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp,level:this.options.level??"info"},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let l=this.generateKeyId(),m=this.generateKey();this.currentKeyId=l,this.keys.set(l,m),this.encryptionKeys.set(l,{key:m,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;let t={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return t[e]>=t[r]}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...ng,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...ng};return{...ng,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:Md.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}shouldWriteToFile(){return!Er()&&this.config.writeToFile===!0}async writeToFile(e){let r=(async()=>{let l,m=0,f=3,b=1000;while(m<f)try{try{try{await XE(this.config.logDirectory,ky.F_OK|ky.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await eR(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let k=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:pi.from(e);try{if(!ud(this.currentLogFile))await Qp(this.currentLogFile,"",{mode:420});if(l=wy(this.currentLogFile,"a",420),ZE(l,k,{flag:"a"}),Sy(l),l!==void 0)Gp(l),l=void 0;if((await Ns(this.currentLogFile)).size===0){if(await Qp(this.currentLogFile,k,{flag:"w",mode:420}),(await Ns(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let R=y;if(R.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(R.code)){if(m<f-1){let T=typeof R.message==="string"?R.message:"Unknown error";console.error(`Network error during write attempt ${m+1}/${f}:`,T);let N=b*2**m;await new Promise((j)=>setTimeout(j,N)),m++;continue}}if(R?.code&&["ENOSPC","EDQUOT"].includes(R.code))throw Error(`Disk quota exceeded or no space left on device: ${R.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",R),R}finally{if(l!==void 0)try{Gp(l)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(k){if(m===f-1){let R=k,T=typeof R.message==="string"?R.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",T),k}m++;let y=b*2**(m-1);await new Promise((R)=>setTimeout(R,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(l){throw console.error("Debug: [writeToFile] Error in operation:",l),l}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return js(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return js(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return js(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Er())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((l)=>{console.error("Error rotating keys:",l)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let l=Array.from(this.encryptionKeys.entries()).sort(([,b],[,k])=>k.createdAt.getTime()-b.createdAt.getTime()),m=typeof t.maxKeys==="number"?t.maxKeys:1,f=Math.max(1,m);if(l.length>f)for(let[b]of l.slice(f))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Jp(16).toString("hex")}generateKey(){return Jp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Jp(16),a=GE("aes-256-gcm",t,r),l=pi.isBuffer(e)?e:pi.from(e,"utf8"),m=a.update(l),f=a.final(),b=m.length+f.length,k=a.getAuthTag(),y=pi.allocUnsafe(16+b+16);return r.copy(y,0),m.copy(y,16),f.copy(y,16+m.length),k.copy(y,16+b),{encrypted:y,iv:r}}async compressData(e){return new Promise((t,r)=>{let a=Ey(),l=[];a.on("data",(m)=>l.push(m)),a.on("end",()=>t(pi.from(pi.concat(l)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Er())return;if(!this.shouldWriteToFile())return;let e=await Ns(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let l=await pd(this.config.logDirectory),m=l.filter((k)=>k.startsWith(this.name)&&/\.log\.\d+$/.test(k)).sort((k,y)=>{let R=Number.parseInt(k.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-R}),f=m.length>0?Number.parseInt(m[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${f}`;if(await Ns(r).catch(()=>null))try{if(await Iy(r,b),t.compress)try{let k=`${b}.gz`;await this.compressLogFile(b,k),await gd(b)}catch(k){console.error("Error compressing rotated file:",k)}if(m.length===0&&!l.some((k)=>k.endsWith(".log.1")))try{let k=`${r}.1`;await Qp(k,"")}catch(k){console.error("Error creating backup file:",k)}}catch(k){console.error(`Error during rotation: ${k instanceof Error?k.message:String(k)}`)}}else{let l=new Date().toISOString().replace(/[:.]/g,"-"),m=r.replace(/\.log$/,`-${l}.log`);if(await Ns(r).catch(()=>null))await Iy(r,m)}if(this.currentLogFile=a,t.maxFiles){let m=(await pd(this.config.logDirectory)).filter((f)=>f.startsWith(this.name)).sort((f,b)=>b.localeCompare(f));for(let f of m.slice(t.maxFiles))await gd(js(this.config.logDirectory,f))}}}async compressLogFile(e,t){let r=by(e),a=YE(t),l=Ey();await nR(r,l,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(a);console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(t);console.log(t)}}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),ud(this.currentLogFile))try{let e=wy(this.currentLogFile,"r+");Sy(e),Gp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Er()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await pd(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await gd(js(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.shouldStyleConsole()?Ct.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||Er())return!1;let e=typeof Ot.env.NO_COLOR<"u",t=Ot.env.FORCE_COLOR==="0";if(e||t)return!1;return!!(typeof Ot.stderr<"u"&&Ot.stderr.isTTY||typeof Ot.stdout<"u"&&Ot.stdout.isTTY)}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:l,level:m,showTimestamp:f=!0}=e,b=(j)=>j.replace(this.ANSI_PATTERN,"");if(!this.fancy){let j=[];if(f)j.push(t);if(m==="warning")j.push("WARN");else if(m==="error")j.push("ERROR");else if(r)j.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)j.push(a.replace(/[[\]]/g,""));return j.push(l),j.join(" ")}let k=Ot.stdout.columns||120,y="";if(m==="warning"||m==="error")y=`${r} ${l}`;else if(m==="info"||m==="success")y=`${r} ${a} ${l}`;else y=`${r} ${a} ${Ct.cyan(l)}`;if(!f)return y.trim();let R=b(y).trim().length,T=b(t).length,N=Math.max(1,k-2-R-T);return`${y.trim()}${" ".repeat(N)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(m,f)=>{let b=Number.parseInt(f,10);return b<t[0].length?String(t[0][b]):m});let r=/%([sdijfo%])/g,a=0,l=e.replace(r,(m,f)=>{if(f==="%")return"%";if(a>=t.length)return m;let b=t[a++];switch(f){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return m}});if(a<t.length)l+=` ${t.slice(a).map((m)=>typeof m==="object"?JSON.stringify(m,null,2):String(m)).join(" ")}`;return l}formatMarkdown(e){if(!e)return e;let t=e;return t=t.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,a,l)=>{let m=Ct.underline(Ct.blue(a)),f=this.toAbsoluteFilePath(l);if(f&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let b=`file://${encodeURI(f)}`,k="\x1B]8;;",y="\x1B\\";return`\x1B]8;;${b}\x1B\\${m}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${l}\x1B\\${m}\x1B]8;;\x1B\\`;return m}),t=t.replace(/`([^`]+)`/g,(r,a)=>Ct.bgGray(a)),t=t.replace(/\*\*([^*]+)\*\*/g,(r,a)=>Ct.bold(a)),t=t.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,a)=>Ct.italic(a)),t=t.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,a)=>Ct.italic(a)),t=t.replace(/~([^~]+)~/g,(r,a)=>Ct.strikethrough(a)),t}supportsHyperlinks(){if(Er())return!1;let e=Ot.env;if(!e)return!1;if(e.TERM_PROGRAM==="iTerm.app"||e.TERM_PROGRAM==="vscode"||e.TERM_PROGRAM==="WezTerm")return!0;if(e.WT_SESSION)return!0;if(e.TERM==="xterm-kitty")return!0;let t=e.VTE_VERSION?Number.parseInt(e.VTE_VERSION,10):0;if(!Number.isNaN(t)&&t>=5000)return!0;return!1}toAbsoluteFilePath(e){try{let t=e;if(t.startsWith("file://"))t=t.replace(/^file:\/\//,"");if(t.startsWith("~")){let r=Ot.env.HOME||"";if(r)t=t.replace(/^~(?=$|\/)/,r)}if(tR(t)||t.startsWith("./")||t.startsWith("../"))t=rR(t);else return null;return ud(t)?t:null}catch{return null}}buildOutputTexts(e){let t=this.shouldStyleConsole()?this.formatMarkdown(e):e,r=e.replace(this.ANSI_PATTERN,"");return{consoleText:t,fileText:r}}async log(e,t,...r){if(!this.shouldLog(e))return;let a=new Date,l=this.formatConsoleTimestamp(a),m=this.formatFileTimestamp(a),f,b;if(t instanceof Error)f=t.message,b=t.stack;else f=this.formatMessage(t,r);let{consoleText:k,fileText:y}=this.buildOutputTexts(f);if(this.shouldStyleConsole()){let T=this.options.showIcons===!1?"":hA[e],N=this.options.showTags!==!1&&this.name?Ct.gray(this.formatTag(this.name)):"",j;switch(e){case"debug":j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:Ct.gray(k),level:e}),console.error(j);break;case"info":j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:k,level:e}),console.warn(j);break;case"success":j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:Ct.green(k),level:e}),console.error(j);break;case"warning":j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:k,level:e}),console.warn(j);break;case"error":if(j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:k,level:e}),console.error(j),b){let U=b.split(`
+`}return{name:"bunfig-plugin",setup(l){l.onResolve({filter:/^virtual:bunfig-types$/},(m)=>({path:m.path,namespace:"bunfig-virtual"})),l.onLoad({filter:/^virtual:bunfig-types$/,namespace:"bunfig-virtual"},()=>({contents:a(),loader:"ts"}))}}}var ev,Ms,gc,tv,NR,jR,Ay,vd,cg,$r,Ft,BR,Cy,MR,Py,LR,FR,Yp,zR,_y,Ty,Zp,UR,qR,VR,WR,bd,rv,HR,Nr,KR,JR,xy,Sd,dg,Ir,St,GR,Dy,QR,Oy,YR,ZR,Xp,XR,$y,Ny,eA,rg,tA,rA,nA,iA,oA,wd,nv,sA,aA="0.15.6",xn,Nd,uc,lg,ug,Bd,pg,gg,pc,mg,hg,Gi,iv,ov,Wn,hi,sv,av,cA=cR(async()=>{ev=import.meta.require,Ms=new Sg,gc=new wg,tv={createKey:dR,isEquivalent:lR,estimateMemoryUsage:uR},NR=Ad(sg.cwd(),"config"),jR=Ad(sg.cwd(),"src/generated"),Ay=Ed.env.CLARITY_LOG_DIR||RE(mR(),"logs"),vd={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:Ay,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1},cg=await fR(),$r={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,reset:"\x1B[0m"},Ft=$r,BR=$r.red,Cy=$r.green,MR=$r.yellow,Py=$r.blue,LR=$r.magenta,FR=$r.cyan,Yp=$r.white,zR=$r.gray,_y=$r.bgRed,Ty=$r.bgYellow,Zp=$r.bold,UR=$r.dim,qR=$r.italic,VR=$r.underline,WR=$r.reset,bd={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},rv={debug:"\uD83D\uDD0D",info:Py("ℹ"),success:Cy("✓"),warning:Ty(Yp(Zp(" WARN "))),error:_y(Yp(Zp(" ERROR ")))},HR=new Td("stacks"),Nr=new Td("bunfig",{showTags:!0}),KR=Gr(lc.cwd(),"config"),JR=Gr(lc.cwd(),"src/generated"),xy=Id.env.CLARITY_LOG_DIR||IE(bR(),"logs"),Sd={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:xy,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},dg=await SR(),Ir={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},St=Ir,GR=Ir.red,Dy=Ir.green,QR=Ir.yellow,Oy=Ir.blue,YR=Ir.magenta,ZR=Ir.cyan,Xp=Ir.white,XR=Ir.gray,$y=Ir.bgRed,Ny=Ir.bgYellow,eA=Ir.bgGray,rg=Ir.bold,tA=Ir.dim,rA=Ir.italic,nA=Ir.underline,iA=Ir.strikethrough,oA=Ir.reset,wd={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},nv={debug:"\uD83D\uDD0D",info:Oy("ℹ"),success:Dy("✓"),warning:Ny(Xp(rg(" WARN "))),error:$y(Xp(rg(" ERROR ")))},sA=new Od("stacks"),xn=class extends Error{timestamp;context;constructor(t,r={}){super(t);if(this.name=this.constructor.name,this.timestamp=new Date,this.context=r,Error.captureStackTrace)Error.captureStackTrace(this,this.constructor)}toJSON(){return{name:this.name,code:this.code,message:this.message,timestamp:this.timestamp.toISOString(),context:this.context,stack:this.stack}}toString(){let t=Object.keys(this.context).length>0?` (${Object.entries(this.context).map(([r,a])=>`${r}: ${a}`).join(", ")})`:"";return`${this.name} [${this.code}]: ${this.message}${t}`}},Nd=class extends xn{code="CONFIG_NOT_FOUND";constructor(t,r,a){let l=a?` or alias "${a}"`:"";super(`Configuration "${t}"${l} not found`,{configName:t,alias:a,searchPaths:r,searchPathCount:r.length})}},uc=class extends xn{code="CONFIG_LOAD_ERROR";constructor(t,r,a){super(`Failed to load configuration from "${t}": ${r.message}`,{configPath:t,configName:a,originalError:r.name,originalMessage:r.message});this.cause=r}},lg=class extends xn{code="CONFIG_VALIDATION_ERROR";constructor(t,r,a){super(`Configuration validation failed for "${t}"`,{configPath:t,configName:a,validationErrors:r,errorCount:r.length})}},ug=class extends xn{code="CONFIG_MERGE_ERROR";constructor(t,r,a,l){super(`Failed to merge configuration from "${t}" with "${r}": ${a.message}`,{sourcePath:t,targetPath:r,configName:l,originalError:a.name,originalMessage:a.message});this.cause=a}},Bd=class extends xn{code="ENV_VAR_ERROR";constructor(t,r,a,l){super(`Failed to parse environment variable "${t}" with value "${r}" as ${a}`,{envKey:t,envValue:r,expectedType:a,configName:l})}},pg=class extends xn{code="FILE_SYSTEM_ERROR";constructor(t,r,a){super(`File system ${t} failed for "${r}": ${a.message}`,{operation:t,path:r,originalError:a.name,originalMessage:a.message});this.cause=a}},gg=class extends xn{code="TYPE_GENERATION_ERROR";constructor(t,r,a){super(`Failed to generate types from "${t}" to "${r}": ${a.message}`,{configDir:t,outputPath:r,originalError:a.name,originalMessage:a.message});this.cause=a}},pc=class extends xn{code="SCHEMA_VALIDATION_ERROR";constructor(t,r,a){super(`Schema validation failed${a?` for config "${a}"`:""}`,{schemaPath:t,configName:a,validationErrors:r,errorCount:r.length})}},mg=class extends xn{code="BROWSER_CONFIG_ERROR";constructor(t,r,a,l){super(`Failed to fetch configuration from "${t}": ${r} ${a}`,{endpoint:t,status:r,statusText:a,configName:l})}},hg=class extends xn{code="PLUGIN_ERROR";constructor(t,r,a){super(`Plugin "${t}" failed during ${r}: ${a.message}`,{pluginName:t,operation:r,originalError:a.name,originalMessage:a.message});this.cause=a}},Gi={configNotFound(e,t,r){return new Nd(e,t,r)},configLoad(e,t,r){return new uc(e,t,r)},configValidation(e,t,r){return new lg(e,t,r)},configMerge(e,t,r,a){return new ug(e,t,r,a)},envVar(e,t,r,a){return new Bd(e,t,r,a)},fileSystem(e,t,r){return new pg(e,t,r)},typeGeneration(e,t,r){return new gg(e,t,r)},schemaValidation(e,t,r){return new pc(e,t,r)},browserConfig(e,t,r,a){return new mg(e,t,r,a)},plugin(e,t,r){return new hg(e,t,r)}},iv={replace:"replace",concat:"concat",smart:"smart"},ov=/^https?:\/\//,Wn=new Od("bunfig",{showTags:!0}),hi=new Cg,sv=Yr(Ao.cwd(),"config"),av=Yr(Ao.cwd(),"src/generated")});function dA(e,t={}){let r=Cd.cwd();while(r.includes("storage"))r=vy(r,"..");let a=vy(r,e||"");if(t?.relative)return JE(Cd.cwd(),a);return a}var lA=Cd.env.CLARITY_LOG_DIR||KE(dA(),"logs"),cv={level:"info",defaultName:"clarity",timestamp:!0,colors:!0,format:"text",maxLogSize:10485760,logDatePattern:"YYYY-MM-DD",logDirectory:lA,rotation:{frequency:"daily",maxSize:10485760,maxFiles:5,compress:!1,rotateHour:0,rotateMinute:0,rotateDayOfWeek:0,rotateDayOfMonth:1,encrypt:!1},verbose:!1,writeToFile:!1},Md={...cv},TN=(async()=>{try{let{loadConfig:e}=await cA().then(()=>Wy),t=await e({name:"clarity",alias:"logging",defaultConfig:cv,cwd:Cd.cwd()});if(t)Object.assign(Md,t)}catch{}return Md})();function Er(){if(fi.env.NODE_ENV==="test"||fi.env.BUN_ENV==="test")return!1;return typeof window<"u"}async function uA(){if(fi.env.NODE_ENV==="test"||fi.env.BUN_ENV==="test")return!0;if(typeof navigator<"u"&&navigator.product==="ReactNative")return!0;if(typeof fi<"u"){let e=fi.type;if(e==="renderer"||e==="worker")return!1;return!!(fi.versions&&(fi.versions.node||fi.versions.bun))}return!1}class dv{async format(e){let t=await uA(),r=await this.getMetadata(t);return JSON.stringify({timestamp:e.timestamp.toISOString(),level:e.level,name:e.name,message:e.message,metadata:r})}async getMetadata(e){if(e){let{hostname:t}=await import("os");return{pid:Bs.pid,hostname:t(),environment:Bs.env.NODE_ENV||"development",platform:Bs.platform,version:Bs.version}}return{userAgent:navigator.userAgent,hostname:window.location.hostname||"browser",environment:Bs.env.NODE_ENV||Bs.env.BUN_ENV||"development",viewport:{width:window.innerWidth,height:window.innerHeight},language:navigator.language}}}var Pr={red:(e)=>`\x1B[31m${e}\x1B[0m`,green:(e)=>`\x1B[32m${e}\x1B[0m`,yellow:(e)=>`\x1B[33m${e}\x1B[0m`,blue:(e)=>`\x1B[34m${e}\x1B[0m`,magenta:(e)=>`\x1B[35m${e}\x1B[0m`,cyan:(e)=>`\x1B[36m${e}\x1B[0m`,white:(e)=>`\x1B[37m${e}\x1B[0m`,gray:(e)=>`\x1B[90m${e}\x1B[0m`,bgRed:(e)=>`\x1B[41m${e}\x1B[0m`,bgYellow:(e)=>`\x1B[43m${e}\x1B[0m`,bgGray:(e)=>`\x1B[100m${e}\x1B[0m`,bold:(e)=>`\x1B[1m${e}\x1B[0m`,dim:(e)=>`\x1B[2m${e}\x1B[0m`,italic:(e)=>`\x1B[3m${e}\x1B[0m`,underline:(e)=>`\x1B[4m${e}\x1B[0m`,strikethrough:(e)=>`\x1B[9m${e}\x1B[0m`,reset:"\x1B[0m"},Ct=Pr,{red:xN,green:pA,yellow:DN,blue:gA,magenta:ON,cyan:$N,white:jy,gray:NN,bgRed:mA,bgYellow:fA,bgGray:jN,bold:By,dim:BN,italic:MN,underline:LN,strikethrough:FN,reset:zN}=Pr,ng={activationLevel:"error",bufferSize:50,flushOnDeactivation:!0,stopBuffering:!1},hA={debug:"\uD83D\uDD0D",info:gA("ℹ"),success:pA("✓"),warning:fA(jy(By(" WARN "))),error:mA(jy(By(" ERROR ")))};class Vd{name;fileLocks=new Map;currentKeyId=null;keys=new Map;fingersCrossedConfig;fingersCrossedActive=!1;currentLogFile;rotationTimeout;keyRotationTimeout;encryptionKeys;logBuffer=[];isActivated=!1;pendingOperations=[];enabled;fancy;tagFormat;timestampPosition;environment;config;options;formatter;timers=new Set;subLoggers=new Set;fingersCrossedBuffer=[];ANSI_PATTERN=/\u001B\[.*?m/g;activeProgressBar=null;constructor(e,t={}){this.name=e,this.config={...Md},this.options=this.normalizeOptions(t),this.formatter=this.options.formatter||new dv,this.enabled=t.enabled??!0,this.fancy=t.fancy??!0,this.tagFormat=t.tagFormat??{prefix:"[",suffix:"]"},this.timestampPosition=t.timestampPosition??"right",this.environment=t.environment??Ot.env.APP_ENV??"local",this.fingersCrossedConfig=this.initializeFingersCrossedConfig(t);let r={...t},a=t.timestamp!==void 0;if(a)delete r.timestamp;if(this.config={...this.config,...r,timestamp:a||this.config.timestamp,level:this.options.level??"info"},this.currentLogFile=this.generateLogFilename(),this.encryptionKeys=new Map,this.validateEncryptionConfig()){this.setupRotation();let l=this.generateKeyId(),m=this.generateKey();this.currentKeyId=l,this.keys.set(l,m),this.encryptionKeys.set(l,{key:m,createdAt:new Date}),this.setupKeyRotation()}}shouldActivateFingersCrossed(e){if(!this.fingersCrossedConfig)return!1;let t={debug:0,info:1,success:2,warning:3,error:4},r=this.fingersCrossedConfig.activationLevel??"error";return t[e]>=t[r]}initializeFingersCrossedConfig(e){if(!e.fingersCrossedEnabled&&e.fingersCrossed)return{...ng,...e.fingersCrossed};if(!e.fingersCrossedEnabled)return null;if(!e.fingersCrossed)return{...ng};return{...ng,...e.fingersCrossed}}normalizeOptions(e){let t={format:"json",level:"info",logDirectory:Md.logDirectory,rotation:void 0,timestamp:void 0,fingersCrossed:{},enabled:!0,showTags:!1,showIcons:!0,formatter:void 0},r={...t,...Object.fromEntries(Object.entries(e).filter(([,a])=>a!==void 0))};if(!r.level||!["debug","info","success","warning","error"].includes(r.level))r.level=t.level;return r}shouldWriteToFile(){return!Er()&&this.config.writeToFile===!0}async writeToFile(e){let r=(async()=>{let l,m=0,f=3,b=1000;while(m<f)try{try{try{await XE(this.config.logDirectory,ky.F_OK|ky.W_OK)}catch(y){if(y instanceof Error&&"code"in y)if(y.code==="ENOENT")await eR(this.config.logDirectory,{recursive:!0,mode:493});else if(y.code==="EACCES")throw Error(`No write permission for log directory: ${this.config.logDirectory}`);else throw y;else throw y}}catch(y){throw console.error("Debug: [writeToFile] Failed to create log directory:",y),y}let k=this.validateEncryptionConfig()?(await this.encrypt(e)).encrypted:pi.from(e);try{if(!ud(this.currentLogFile))await Qp(this.currentLogFile,"",{mode:420});if(l=wy(this.currentLogFile,"a",420),ZE(l,k,{flag:"a"}),Sy(l),l!==void 0)Gp(l),l=void 0;if((await Ns(this.currentLogFile)).size===0){if(await Qp(this.currentLogFile,k,{flag:"w",mode:420}),(await Ns(this.currentLogFile)).size===0)throw Error("File exists but is empty after retry write")}return}catch(y){let R=y;if(R.code&&["ENETDOWN","ENETUNREACH","ENOTFOUND","ETIMEDOUT"].includes(R.code)){if(m<f-1){let T=typeof R.message==="string"?R.message:"Unknown error";console.error(`Network error during write attempt ${m+1}/${f}:`,T);let N=b*2**m;await new Promise((j)=>setTimeout(j,N)),m++;continue}}if(R?.code&&["ENOSPC","EDQUOT"].includes(R.code))throw Error(`Disk quota exceeded or no space left on device: ${R.message}`);throw console.error("Debug: [writeToFile] Error writing to file:",R),R}finally{if(l!==void 0)try{Gp(l)}catch(y){console.error("Debug: [writeToFile] Error closing file descriptor:",y)}}}catch(k){if(m===f-1){let R=k,T=typeof R.message==="string"?R.message:"Unknown error";throw console.error("Debug: [writeToFile] Max retries reached. Final error:",T),k}m++;let y=b*2**(m-1);await new Promise((R)=>setTimeout(R,y))}})();this.pendingOperations.push(r);let a=this.pendingOperations.length-1;try{await r}catch(l){throw console.error("Debug: [writeToFile] Error in operation:",l),l}finally{this.pendingOperations.splice(a,1)}}generateLogFilename(){if(this.name.includes("stream-throughput")||this.name.includes("decompress-perf-test")||this.name.includes("decompression-latency")||this.name.includes("concurrent-read-test")||this.name.includes("clock-change-test"))return js(this.config.logDirectory,`${this.name}.log`);if(this.name.includes("pending-test")||this.name.includes("temp-file-test")||this.name==="crash-test"||this.name==="corrupt-test"||this.name.includes("rotation-load-test")||this.name==="sigterm-test"||this.name==="sigint-test"||this.name==="failed-rotation-test"||this.name==="integration-test")return js(this.config.logDirectory,`${this.name}.log`);let e=new Date().toISOString().split("T")[0];return js(this.config.logDirectory,`${this.name}-${e}.log`)}setupRotation(){if(Er())return;if(!this.shouldWriteToFile())return;if(typeof this.config.rotation==="boolean")return;let e=this.config.rotation,t;switch(e.frequency){case"daily":t=86400000;break;case"weekly":t=604800000;break;case"monthly":t=2592000000;break;default:return}this.rotationTimeout=setInterval(()=>{this.rotateLog()},t)}setupKeyRotation(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation setup");return}let t=this.config.rotation.keyRotation;if(!t?.enabled)return;let r=typeof t.interval==="number"?t.interval:60,a=Math.max(r,60)*1000;this.keyRotationTimeout=setInterval(()=>{this.rotateKeys().catch((l)=>{console.error("Error rotating keys:",l)})},a)}async rotateKeys(){if(!this.validateEncryptionConfig()){console.error("Invalid encryption configuration detected during key rotation");return}let t=this.config.rotation.keyRotation,r=this.generateKeyId(),a=this.generateKey();this.currentKeyId=r,this.keys.set(r,a),this.encryptionKeys.set(r,{key:a,createdAt:new Date});let l=Array.from(this.encryptionKeys.entries()).sort(([,b],[,k])=>k.createdAt.getTime()-b.createdAt.getTime()),m=typeof t.maxKeys==="number"?t.maxKeys:1,f=Math.max(1,m);if(l.length>f)for(let[b]of l.slice(f))this.encryptionKeys.delete(b),this.keys.delete(b)}generateKeyId(){return Jp(16).toString("hex")}generateKey(){return Jp(32)}getCurrentKey(){if(!this.currentKeyId)throw Error("Encryption is not properly initialized. Make sure encryption is enabled in the configuration.");let e=this.keys.get(this.currentKeyId);if(!e)throw Error(`No key found for ID ${this.currentKeyId}. The encryption key may have been rotated or removed.`);return{key:e,id:this.currentKeyId}}encrypt(e){let{key:t}=this.getCurrentKey(),r=Jp(16),a=GE("aes-256-gcm",t,r),l=pi.isBuffer(e)?e:pi.from(e,"utf8"),m=a.update(l),f=a.final(),b=m.length+f.length,k=a.getAuthTag(),y=pi.allocUnsafe(16+b+16);return r.copy(y,0),m.copy(y,16),f.copy(y,16+m.length),k.copy(y,16+b),{encrypted:y,iv:r}}async compressData(e){return new Promise((t,r)=>{let a=Ey(),l=[];a.on("data",(m)=>l.push(m)),a.on("end",()=>t(pi.from(pi.concat(l)))),a.on("error",r),a.write(e),a.end()})}getEncryptionOptions(){if(!this.config.rotation||typeof this.config.rotation==="boolean"||!this.config.rotation.encrypt)return{};let e={algorithm:"aes-256-cbc",compress:!1};if(typeof this.config.rotation.encrypt==="object"){let t=this.config.rotation.encrypt;return{...e,...t}}return e}async rotateLog(){if(Er())return;if(!this.shouldWriteToFile())return;let e=await Ns(this.currentLogFile).catch(()=>null);if(!e)return;let t=this.config.rotation;if(typeof t==="boolean")return;if(t.maxSize&&e.size>=t.maxSize){let r=this.currentLogFile,a=this.generateLogFilename();if(this.name.includes("rotation-load-test")||this.name==="failed-rotation-test"){let l=await pd(this.config.logDirectory),m=l.filter((k)=>k.startsWith(this.name)&&/\.log\.\d+$/.test(k)).sort((k,y)=>{let R=Number.parseInt(k.match(/\.log\.(\d+)$/)?.[1]||"0");return Number.parseInt(y.match(/\.log\.(\d+)$/)?.[1]||"0")-R}),f=m.length>0?Number.parseInt(m[0].match(/\.log\.(\d+)$/)?.[1]||"0")+1:1,b=`${r}.${f}`;if(await Ns(r).catch(()=>null))try{if(await Iy(r,b),t.compress)try{let k=`${b}.gz`;await this.compressLogFile(b,k),await gd(b)}catch(k){console.error("Error compressing rotated file:",k)}if(m.length===0&&!l.some((k)=>k.endsWith(".log.1")))try{let k=`${r}.1`;await Qp(k,"")}catch(k){console.error("Error creating backup file:",k)}}catch(k){console.error(`Error during rotation: ${k instanceof Error?k.message:String(k)}`)}}else{let l=new Date().toISOString().replace(/[:.]/g,"-"),m=r.replace(/\.log$/,`-${l}.log`);if(await Ns(r).catch(()=>null))await Iy(r,m)}if(this.currentLogFile=a,t.maxFiles){let m=(await pd(this.config.logDirectory)).filter((f)=>f.startsWith(this.name)).sort((f,b)=>b.localeCompare(f));for(let f of m.slice(t.maxFiles))await gd(js(this.config.logDirectory,f))}}}async compressLogFile(e,t){let r=by(e),a=YE(t),l=Ey();await nR(r,l,a)}async handleFingersCrossedBuffer(e,t){if(!this.fingersCrossedConfig)return;if(this.shouldActivateFingersCrossed(e)&&!this.isActivated){this.isActivated=!0;for(let r of this.logBuffer){let a=await this.formatter.format(r);if(this.shouldWriteToFile())await this.writeToFile(a);console.log(a)}if(this.fingersCrossedConfig.stopBuffering)this.logBuffer=[]}if(this.isActivated){if(this.shouldWriteToFile())await this.writeToFile(t);console.log(t)}}shouldLog(e){if(!this.enabled)return!1;let t={debug:0,info:1,success:2,warning:3,error:4};return t[e]>=t[this.config.level]}async flushPendingWrites(){if(await Promise.all(this.pendingOperations.map((e)=>{if(e instanceof Promise)return e.catch((t)=>{console.error("Error in pending write operation:",t)});return Promise.resolve()})),ud(this.currentLogFile))try{let e=wy(this.currentLogFile,"r+");Sy(e),Gp(e)}catch(e){console.error(`Error flushing file: ${e}`)}}async destroy(){if(this.rotationTimeout)clearInterval(this.rotationTimeout);if(this.keyRotationTimeout)clearInterval(this.keyRotationTimeout);this.timers.clear();for(let e of this.pendingOperations)if(typeof e.cancel==="function")e.cancel();return(async()=>{if(this.pendingOperations.length>0)try{await Promise.allSettled(this.pendingOperations)}catch(e){console.error("Error waiting for pending operations:",e)}if(!Er()&&this.config.rotation&&typeof this.config.rotation!=="boolean"&&this.config.rotation.compress)try{let t=(await pd(this.config.logDirectory)).filter((r)=>(r.includes("temp")||r.includes(".tmp"))&&r.includes(this.name));for(let r of t)try{await gd(js(this.config.logDirectory,r))}catch(a){console.error(`Failed to delete temp file ${r}:`,a)}}catch(e){console.error("Error cleaning up temporary files:",e)}})()}getCurrentLogFilePath(){return this.currentLogFile}formatTag(e){if(!e)return"";return`${this.tagFormat.prefix}${e}${this.tagFormat.suffix}`}formatFileTimestamp(e){return`[${e.toISOString()}]`}formatConsoleTimestamp(e){return this.shouldStyleConsole()?Ct.gray(e.toLocaleTimeString()):e.toLocaleTimeString()}shouldStyleConsole(){if(!this.fancy||Er())return!1;let e=typeof Ot.env.NO_COLOR<"u",t=Ot.env.FORCE_COLOR==="0";if(e||t)return!1;return!!(typeof Ot.stderr<"u"&&Ot.stderr.isTTY||typeof Ot.stdout<"u"&&Ot.stdout.isTTY)}formatConsoleMessage(e){let{timestamp:t,icon:r="",tag:a="",message:l,level:m,showTimestamp:f=!0}=e,b=(j)=>j.replace(this.ANSI_PATTERN,"");if(!this.fancy){let j=[];if(f)j.push(t);if(m==="warning")j.push("WARN");else if(m==="error")j.push("ERROR");else if(r)j.push(r.replace(/[^\p{L}\p{N}\p{P}\p{Z}]/gu,""));if(a)j.push(a.replace(/[[\]]/g,""));return j.push(l),j.join(" ")}let k=Ot.stdout.columns||120,y="";if(m==="warning"||m==="error")y=`${r} ${l}`;else if(m==="info"||m==="success")y=`${r} ${a} ${l}`;else y=`${r} ${a} ${Ct.cyan(l)}`;if(!f)return y.trim();let R=b(y).trim().length,T=b(t).length,N=Math.max(1,k-2-R-T);return`${y.trim()}${" ".repeat(N)}${t}`}formatMessage(e,t){if(t.length===1&&Array.isArray(t[0]))return e.replace(/\{(\d+)\}/g,(m,f)=>{let b=Number.parseInt(f,10);return b<t[0].length?String(t[0][b]):m});let r=/%([sdijfo%])/g,a=0,l=e.replace(r,(m,f)=>{if(f==="%")return"%";if(a>=t.length)return m;let b=t[a++];switch(f){case"s":return String(b);case"d":case"i":return Number(b).toString();case"j":case"o":return JSON.stringify(b,null,2);default:return m}});if(a<t.length)l+=` ${t.slice(a).map((m)=>typeof m==="object"?JSON.stringify(m,null,2):String(m)).join(" ")}`;return l}formatMarkdown(e){if(!e)return e;let t=e;return t=t.replace(/\[([^\]]+)\]\(([^)]+)\)/g,(r,a,l)=>{let m=Ct.underline(Ct.blue(a)),f=this.toAbsoluteFilePath(l);if(f&&this.shouldStyleConsole()&&this.supportsHyperlinks()){let b=`file://${encodeURI(f)}`,k="\x1B]8;;",y="\x1B\\";return`\x1B]8;;${b}\x1B\\${m}\x1B]8;;\x1B\\`}if(this.shouldStyleConsole()&&this.supportsHyperlinks())return`\x1B]8;;${l}\x1B\\${m}\x1B]8;;\x1B\\`;return m}),t=t.replace(/`([^`]+)`/g,(r,a)=>Ct.bgGray(a)),t=t.replace(/\*\*([^*]+)\*\*/g,(r,a)=>Ct.bold(a)),t=t.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g,(r,a)=>Ct.italic(a)),t=t.replace(/(?<!_)_([^_]+)_(?!_)/g,(r,a)=>Ct.italic(a)),t=t.replace(/~([^~]+)~/g,(r,a)=>Ct.strikethrough(a)),t}supportsHyperlinks(){if(Er())return!1;let e=Ot.env;if(!e)return!1;if(e.TERM_PROGRAM==="iTerm.app"||e.TERM_PROGRAM==="vscode"||e.TERM_PROGRAM==="WezTerm")return!0;if(e.WT_SESSION)return!0;if(e.TERM==="xterm-kitty")return!0;let t=e.VTE_VERSION?Number.parseInt(e.VTE_VERSION,10):0;if(!Number.isNaN(t)&&t>=5000)return!0;return!1}toAbsoluteFilePath(e){try{let t=e;if(t.startsWith("file://"))t=t.replace(/^file:\/\//,"");if(t.startsWith("~")){let r=Ot.env.HOME||"";if(r)t=t.replace(/^~(?=$|\/)/,r)}if(tR(t)||t.startsWith("./")||t.startsWith("../"))t=rR(t);else return null;return ud(t)?t:null}catch{return null}}buildOutputTexts(e){let t=this.shouldStyleConsole()?this.formatMarkdown(e):e,r=e.replace(this.ANSI_PATTERN,"");return{consoleText:t,fileText:r}}async log(e,t,...r){if(!this.shouldLog(e))return;let a=new Date,l=this.formatConsoleTimestamp(a),m=this.formatFileTimestamp(a),f,b;if(t instanceof Error)f=t.message,b=t.stack;else f=this.formatMessage(t,r);let{consoleText:k,fileText:y}=this.buildOutputTexts(f);if(this.shouldStyleConsole()){let T=this.options.showIcons===!1?"":hA[e],N=this.options.showTags!==!1&&this.name?Ct.gray(this.formatTag(this.name)):"",j;switch(e){case"debug":j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:Ct.gray(k),level:e}),console.error(j);break;case"info":j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:k,level:e}),console.warn(j);break;case"success":j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:Ct.green(k),level:e}),console.error(j);break;case"warning":j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:k,level:e}),console.warn(j);break;case"error":if(j=this.formatConsoleMessage({timestamp:l,icon:T,tag:N,message:k,level:e}),console.error(j),b){let U=b.split(`
 `);for(let q of U)if(q.trim()&&!q.includes(f))console.error(this.formatConsoleMessage({timestamp:l,message:Ct.gray(`  ${q}`),level:e,showTimestamp:!1}))}break}}else if(!Er()){if(console.error(`${m} ${this.environment}.${e.toUpperCase()}: ${f}`),b)console.error(b)}let R=`${m} ${this.environment}.${e.toUpperCase()}: ${y}
 `;if(b)R+=`${b}
 `;if(R=R.replace(this.ANSI_PATTERN,""),this.shouldWriteToFile())await this.writeToFile(R)}progress(e,t=""){let r={update:(b,k)=>{},finish:(b)=>{},interrupt:(b,k)=>{}};if(!this.enabled)return r;let a=30;if(this.activeProgressBar={total:Math.max(1,e||1),current:0,message:t||"",barLength:a,lastRenderedLine:""},this.shouldStyleConsole()&&!Er()&&Ot.stdout.isTTY)this.renderProgressBar(this.activeProgressBar);return{update:(b,k)=>{if(!this.enabled||!this.activeProgressBar)return;if(this.activeProgressBar.current=Math.min(Math.max(0,b),this.activeProgressBar.total),k!==void 0)this.activeProgressBar.message=k;if(this.shouldStyleConsole()&&!Er()&&Ot.stdout.isTTY)this.renderProgressBar(this.activeProgressBar)},finish:(b)=>{if(!this.activeProgressBar)return;this.finishProgressBar(this.activeProgressBar,b)},interrupt:(b,k="info")=>{if(!Er()&&Ot.stdout.isTTY)Ot.stdout.write(`
@@ -158,16 +158,16 @@ export type ConfigOf = Config
 `;r+=`| Variable | Type | Description | Example |
 `,r+=`|----------|------|-------------|----------|
 `;for(let a of e)r+=`| \`${a.key}\` | ${a.type} | ${a.description} | \`${a.example}\` |
-`;return r}}function vA(e,t,r={}){return yv(e,t,r,new WeakMap)}function yv(e,t,r,a){let{arrayMergeMode:l="replace",skipNullish:m=!1,customMerger:f}=r;if(t===null||t===void 0)return m?e:t;if(f){let b=f(e,t);if(b!==void 0)return b}if(Array.isArray(t)||Array.isArray(e))return vv(e,t,l,a);if(!Bn(t)||!Bn(e))return t;return kA(e,t,r,a)}function vv(e,t,r,a){if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(e)&&!Array.isArray(t))return t;if(Array.isArray(t)&&Array.isArray(e))switch(r){case"replace":return t;case"concat":return bA(e,t);case"smart":return SA(e,t,a);default:return t}return t}function bA(e,t){let r=[...t];for(let a of e)if(!r.some((l)=>vg(l,a)))r.push(a);return r}function SA(e,t,r){if(t.length===0)return e;if(e.length===0)return t;if(Bn(t[0])&&Bn(e[0]))return wA(e,t,r);if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let l of e)if(!a.includes(l))a.push(l);return a}return t}function wA(e,t,r){let a=[...t];for(let l of e){if(!Bn(l)){a.push(l);continue}let m=["id","name","key","path","type"],f=!1;for(let b of m)if(b in l){if(a.find((y)=>Bn(y)&&(b in y)&&y[b]===l[b])){f=!0;break}}if(!f)a.push(l)}return a}function kA(e,t,r,a){let l=t;if(Bn(l)&&a.has(l))return a.get(l);let m={...e};if(Bn(l))a.set(l,m);for(let f in l){if(!Object.prototype.hasOwnProperty.call(l,f))continue;let b=l[f],k=m[f];if(r.skipNullish&&(b===null||b===void 0))continue;if(b===null||b===void 0){m[f]=b;continue}if(Bn(b)&&Bn(k))m[f]=yv(k,b,r,a);else if(Array.isArray(b)||Array.isArray(k))m[f]=vv(k,b,r.arrayMergeMode||"smart",a);else m[f]=b}return m}function bv(e,t,r="replace"){return vA(e,t,{arrayMergeMode:r==="replace"?"replace":"smart",skipNullish:!0})}function vg(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!vg(e[r],t[r]))return!1;return!0}if(Bn(e)&&Bn(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let l of r){if(!Object.prototype.hasOwnProperty.call(t,l))return!1;if(!vg(e[l],t[l]))return!1}return!0}return!1}function Bn(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}class Sv{extensions=zy;async loadFromPath(e,t,r={}){let{arrayStrategy:a="replace",useCache:l=!0,cacheTtl:m,trackPerformance:f=!0,verbose:b=!1}=r;if(l){let y=kd.getWithFileCheck("file",e);if(y){if(b)console.log(`Configuration loaded from cache: ${e}`);return y}}let k=async()=>{if(!hd(e))return null;try{let y=`?t=${Date.now()}`,R=await import(e+y),T=R.default||R,N="default"in R,j=Object.keys(R).length>0;if(!N&&!j)throw new Ld(e,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof T!=="object"||T===null||Array.isArray(T))throw new Ld(e,Error("Configuration must export a valid object"),"unknown");let Y={config:bv(t,T,a),source:{type:"file",path:e,priority:100,timestamp:new Date}};if(l)kd.setWithFileCheck("file",Y,e,m);return Y}catch(y){throw y instanceof Error?Ro.configLoad(e,y):Ro.configLoad(e,Error(String(y)))}};if(f)return bg.track("loadFromPath",k,{path:e});return k()}async tryLoadFromPaths(e,t,r={}){for(let a of e)try{let l=await this.loadFromPath(a,t,r);if(l)return l}catch(l){if(l instanceof Error&&l.name==="ConfigLoadError")throw l;if(r.verbose)console.warn(`Failed to load config from ${a}:`,l)}return null}generateConfigPaths(e,t,r){return hE({name:e,directory:t,alias:r})}generateNamePatterns(e,t){return Uy({name:e,alias:t})}checkFileAccess(e){return yA(async()=>hd(e),{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(e,t,r){let a=[];if(!hd(e))return a;if(t||r){let l=this.generateNamePatterns(t||"",r);for(let m of l)for(let f of this.extensions){let b=My(e,`${m}${f}`);if(await this.checkFileAccess(b))a.push(b)}}else try{let{readdirSync:l}=await import("fs"),m=l(e);for(let f of m)if(this.looksLikeConfigFile(f)){let b=My(e,f);if(await this.checkFileAccess(b))a.push(b)}}catch{return[]}return a}looksLikeConfigFile(e){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((r)=>r.test(e))}async validateConfigFile(e){let t=[];try{if(!hd(e))return t.push("Configuration file does not exist"),t;let r=await import(e),a=r.default||r;if(a===void 0)t.push("Configuration file must export a default value or named exports");else if(typeof a!=="object"||a===null)t.push("Configuration must be an object");else if(Array.isArray(a))t.push("Configuration cannot be an array at the root level");if(e.endsWith(".json"))try{let{readFileSync:l}=await import("fs"),m=l(e,"utf8");JSON.parse(m)}catch(l){t.push(`Invalid JSON syntax: ${l}`)}}catch(r){t.push(`Failed to load configuration file: ${r}`)}return t}async getFileModificationTime(e){try{let{statSync:t}=await import("fs");return t(e).mtime}catch{return null}}async preloadConfigurations(e,t={}){let r=new Map;return await Promise.allSettled(e.map(async(a)=>{try{let l=await this.loadFromPath(a,{},t);if(l)r.set(a,l.config)}catch(l){if(t.verbose)console.warn(`Failed to preload ${a}:`,l)}})),r}}var EA=/^https?:\/\//;class wv{async validateConfiguration(e,t,r={}){let{stopOnFirstError:a=!1,validateRequired:l=!0,validateTypes:m=!0,customRules:f=[],trackPerformance:b=!0,verbose:k=!1}=r,y=async()=>{let R=[],T=[],N={stopOnFirstError:a,validateRequired:l,validateTypes:m,customRules:f,trackPerformance:b,verbose:k};try{if(typeof t==="string")return await this.validateWithSchemaFile(e,t,N);else if(Array.isArray(t))return this.validateWithRules(e,[...t,...f],N);else return this.validateWithJSONSchema(e,t,N)}catch(j){return R.push({path:"",message:`Validation failed: ${j}`,rule:"system"}),{isValid:!1,errors:R,warnings:T}}};if(b)return await bg.track("validateConfiguration",y);return y()}async validateWithSchemaFile(e,t,r){try{if(!IA(t))throw new Fd(t,[{path:"",message:"Schema file does not exist"}]);let a=await import(t),l=a.default||a;if(Array.isArray(l))return this.validateWithRules(e,l,r);else return this.validateWithJSONSchema(e,l,r)}catch(a){throw new Fd(t,[{path:"",message:`Failed to load schema: ${a}`}])}}validateWithJSONSchema(e,t,r){let a=[],l=[];return this.validateObjectAgainstSchema(e,t,"",a,l,r),{isValid:a.length===0,errors:a,warnings:l}}validateObjectAgainstSchema(e,t,r,a,l,m){if(m.validateTypes&&t.type){let f=Array.isArray(e)?"array":typeof e,b=Array.isArray(t.type)?t.type:[t.type];if(!b.includes(f)){if(a.push({path:r,message:`Expected type ${b.join(" or ")}, got ${f}`,expected:b.join(" or "),actual:f,rule:"type"}),m.stopOnFirstError)return}}if(t.enum&&!t.enum.includes(e)){if(a.push({path:r,message:`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"}),m.stopOnFirstError)return}if(typeof e==="string"){if(t.minLength!==void 0&&e.length<t.minLength)a.push({path:r,message:`String length must be at least ${t.minLength}`,expected:`>= ${t.minLength}`,actual:e.length,rule:"minLength"});if(t.maxLength!==void 0&&e.length>t.maxLength)a.push({path:r,message:`String length must not exceed ${t.maxLength}`,expected:`<= ${t.maxLength}`,actual:e.length,rule:"maxLength"});if(t.pattern){if(!new RegExp(t.pattern).test(e))a.push({path:r,message:`String does not match pattern ${t.pattern}`,expected:t.pattern,actual:e,rule:"pattern"})}}if(typeof e==="number"){if(t.minimum!==void 0&&e<t.minimum)a.push({path:r,message:`Value must be at least ${t.minimum}`,expected:`>= ${t.minimum}`,actual:e,rule:"minimum"});if(t.maximum!==void 0&&e>t.maximum)a.push({path:r,message:`Value must not exceed ${t.maximum}`,expected:`<= ${t.maximum}`,actual:e,rule:"maximum"})}if(Array.isArray(e)&&t.items)for(let f=0;f<e.length;f++){let b=r?`${r}[${f}]`:`[${f}]`;if(this.validateObjectAgainstSchema(e[f],t.items,b,a,l,m),m.stopOnFirstError&&a.length>0)return}if(e&&typeof e==="object"&&!Array.isArray(e)){let f=e;if(m.validateRequired&&t.required){for(let b of t.required)if(!(b in f)){if(a.push({path:r?`${r}.${b}`:b,message:`Missing required property '${b}'`,expected:"required",rule:"required"}),m.stopOnFirstError)return}}if(t.properties){for(let[b,k]of Object.entries(t.properties))if(b in f){let y=r?`${r}.${b}`:b;if(this.validateObjectAgainstSchema(f[b],k,y,a,l,m),m.stopOnFirstError&&a.length>0)return}}if(t.additionalProperties===!1){let b=new Set(Object.keys(t.properties||{}));for(let k of Object.keys(f))if(!b.has(k))l.push({path:r?`${r}.${k}`:k,message:`Additional property '${k}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(e,t,r){let a=[],l=[];for(let m of t)try{let f=this.getValueByPath(e,m.path),b=this.validateWithRule(f,m,m.path);if(a.push(...b),r.stopOnFirstError&&a.length>0)break}catch(f){a.push({path:m.path,message:`Rule validation failed: ${f}`,rule:"system"})}return{isValid:a.length===0,errors:a,warnings:l}}validateWithRule(e,t,r){let a=[];if(t.required&&(e===void 0||e===null))return a.push({path:r,message:t.message||`Property '${r}' is required`,expected:"required",rule:"required"}),a;if(e===void 0||e===null)return a;if(t.type){let l=Array.isArray(e)?"array":typeof e;if(l!==t.type)a.push({path:r,message:t.message||`Expected type ${t.type}, got ${l}`,expected:t.type,actual:l,rule:"type"})}if(t.min!==void 0){let l=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(l<t.min)a.push({path:r,message:t.message||`Value must be at least ${t.min}`,expected:`>= ${t.min}`,actual:l,rule:"min"})}if(t.max!==void 0){let l=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(l>t.max)a.push({path:r,message:t.message||`Value must not exceed ${t.max}`,expected:`<= ${t.max}`,actual:l,rule:"max"})}if(t.pattern&&typeof e==="string"){if(!t.pattern.test(e))a.push({path:r,message:t.message||`Value does not match pattern ${t.pattern}`,expected:t.pattern.toString(),actual:e,rule:"pattern"})}if(t.enum&&!t.enum.includes(e))a.push({path:r,message:t.message||`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"});if(t.validator){let l=t.validator(e);if(l)a.push({path:r,message:t.message||l,rule:"custom"})}return a}getValueByPath(e,t){if(!t)return e;let r=t.split("."),a=e;for(let l of r)if(a&&typeof a==="object"&&l in a)a=a[l];else return;return a}generateRulesFromInterface(e){let t=[],r=e.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let a of r){let[,l,m,f]=a;t.push({path:l,required:!m,type:this.mapTypeScriptType(f)})}return t}mapTypeScriptType(e){switch(e.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:EA},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}var Vn=new Vd("bunfig",{showTags:!0});function RA(e){if(!e)return"";let t=Array.isArray(e)?e.filter(Boolean):[e];if(t.length===0)return"";if(t.length===1)return` or alias "${t[0]}"`;return` or aliases ${t.map((r)=>`"${r}"`).join(", ")}`}class kv{fileLoader=new Sv;envProcessor=new _g;validator=new wv;async loadConfig(e){let t=Date.now(),{cache:r,performance:a,schema:l,validate:m,...f}=e;try{if(r?.enabled){let k=this.checkCache(f.name||"",f);if(k)return k}let b;try{b=await this.loadConfigurationStrategies(f,!0,r)}catch(k){if(f.configFile)throw k;let y=f.__strictErrorHandling;if(k instanceof Error&&k.name==="ConfigNotFoundError"){if(y)throw k;b={...await this.applyEnvironmentVariables(f.name||"",f.defaultConfig,f.checkEnv!==!1,f.verbose||!1),warnings:[`No configuration file found for "${f.name||"config"}", using defaults with environment variables`]}}else if(k instanceof Error&&k.name==="ConfigLoadError"){let R=k.message.includes("EACCES")||k.message.includes("EPERM")||k.message.includes("permission denied"),T=!R&&(k.message.includes("syntax")||k.message.includes("Expected")||k.message.includes("Unexpected")||k.message.includes("BuildMessage")||k.message.includes("errors building")),N=k.message.includes("Configuration must export a valid object")||k.message.includes("Configuration file is empty and exports nothing");if(y&&(N||R))throw k;if(T&&(!y||!N))b={...await this.applyEnvironmentVariables(f.name||"",f.defaultConfig,f.checkEnv!==!1,f.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!y)b={...await this.applyEnvironmentVariables(f.name||"",f.defaultConfig,f.checkEnv!==!1,f.verbose||!1),warnings:[`Configuration loading error, using defaults: ${k.message}`]};else throw k}else b={...await this.applyEnvironmentVariables(f.name||"",f.defaultConfig,f.checkEnv!==!1,f.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${k instanceof Error?k.message:String(k)}`]}}if(l||m)await this.validateConfiguration(b.config,l,m,f.name);if(r?.enabled&&b)this.cacheResult(f.name||"",b,r,f);if(a?.enabled){let k={operation:"loadConfig",duration:Date.now()-t,configName:f.name,timestamp:new Date};if(a.onMetrics)a.onMetrics(k);if(a.slowThreshold&&k.duration>a.slowThreshold)Vn.warn(`Slow configuration loading detected: ${k.duration}ms for ${f.name}`);b.metrics=k}return b}catch(b){if(b instanceof Error&&b.name==="ConfigNotFoundError")throw b;let k=Date.now()-t;throw Vn.error(`Configuration loading failed after ${k}ms:`,[b instanceof Error?b:Error(String(b))]),b}}async loadConfigurationStrategies(e,t=!1,r){let{name:a="",alias:l,configFile:m,cwd:f,configDir:b,defaultConfig:k,checkEnv:y=!0,arrayStrategy:R="replace",verbose:T=!1}=e,N=f||zd.cwd(),j=[];if(m){let le=ei(N,m);j.push(le);let Z=y?ac(a,k,T):k,ie=await this.fileLoader.tryLoadFromPaths([le],Z,{arrayStrategy:R,verbose:T,cacheTtl:r?.ttl,useCache:!r?.ttl||r.ttl>100});if(!ie)throw Ro.configNotFound(a||m,j,l);if(T)Vn.success(`Configuration loaded from explicit path: ${le}`);return this.finalizeResult(ie,j,y,a,T)}let U=await this.loadLocalConfiguration(a,l,N,b,k,R,T,y,r);if(U)return j.push(...this.getLocalSearchPaths(a,l,N,b)),this.finalizeResult(U,j,y,a,T);let q=await this.loadHomeConfiguration(a,l,k,R,T,y);if(q)return j.push(...this.getHomeSearchPaths(a,l)),this.finalizeResult(q,j,y,a,T);let Y=await this.loadPackageJsonConfiguration(a,l,N,k,R,T,y);if(Y)return j.push(ei(N,"package.json")),this.finalizeResult(Y,j,y,a,T);if(j.push(...this.getAllSearchPaths(a,l,N,b)),t)throw Ro.configNotFound(a,j,l);return{...await this.applyEnvironmentVariables(a,k,y,T),warnings:[`No configuration file found for "${a}"${RA(l)}, using defaults with environment variables`]}}async loadLocalConfiguration(e,t,r,a,l,m,f,b,k){let y=b?ac(e,l,f):l,R=this.getLocalDirectories(r,a);for(let T of R){if(f)Vn.info(`Searching for configuration in: ${T}`);let N=this.fileLoader.generateConfigPaths(e,T,t),j=await this.fileLoader.tryLoadFromPaths(N,y,{arrayStrategy:m,verbose:f,cacheTtl:k?.ttl,useCache:!k?.ttl||k.ttl>100});if(j){if(f)Vn.success(`Configuration loaded from: ${j.source.path}`);return j}}return null}async loadHomeConfiguration(e,t,r,a,l,m){if(!e)return null;let f=m?ac(e,r,l):r,b=[ei(As(),".config",e),ei(As(),".config"),As()];for(let k of b){if(l)Vn.info(`Checking home directory: ${k}`);let y=this.fileLoader.generateConfigPaths(e,k,t),R=await this.fileLoader.tryLoadFromPaths(y,f,{arrayStrategy:a,verbose:l});if(R){if(l)Vn.success(`Configuration loaded from home directory: ${R.source.path}`);return R}}return null}async loadPackageJsonConfiguration(e,t,r,a,l,m,f){let b=f?ac(e,a,m):a;try{let k=ei(r,"package.json");if(!vE(k))return null;let y={};try{y=JSON.parse(bE(k,"utf8"))}catch(N){if(m)Vn.warn("Failed to parse package.json:",[N instanceof Error?N:Error(String(N))]);return null}let R=y[e],T=e;if(!R&&t){let N=Array.isArray(t)?t:[t];for(let j of N){if(!j)continue;if(y[j]){R=y[j],T=j;break}}}if(R&&typeof R==="object"&&!Array.isArray(R)){if(m)Vn.success(`Configuration loaded from package.json: ${T}`);return{config:bv(b,R,l),source:{type:"package.json",path:k,priority:30,timestamp:new Date}}}}catch(k){if(m)Vn.warn("Failed to load package.json:",[k instanceof Error?k:Error(String(k))])}return null}async applyEnvironmentVariables(e,t,r,a){if(!r||!e||typeof t!=="object"||t===null||Array.isArray(t))return{config:t,source:{type:"default",priority:10,timestamp:new Date}};return{config:ac(e,t,a),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(e,t,r,a,l){return{config:e.config,source:e.source,path:e.source.path}}async validateConfiguration(e,t,r,a){let l=[];if(r){let m=r(e);if(m)l.push(...m)}if(t){let m=await this.validator.validateConfiguration(e,t);if(!m.isValid)l.push(...m.errors.map((f)=>f.path?`${f.path}: ${f.message}`:f.message))}if(l.length>0)throw Ro.configValidation(a||"unknown",l,a)}checkCache(e,t){let r=this.generateCacheKey(e,t);return kd.get(r)||null}cacheResult(e,t,r,a){let l=this.generateCacheKey(e,a);kd.set(l,t,void 0,r.ttl)}generateCacheKey(e,t){let r=[e];if(t.alias){let a=Array.isArray(t.alias)?t.alias.join(","):t.alias;r.push(`alias:${a}`)}if(t.cwd)r.push(`cwd:${t.cwd}`);if(t.configFile)r.push(`configFile:${t.configFile}`);if(t.configDir)r.push(`configDir:${t.configDir}`);if("checkEnv"in t)r.push(`checkEnv:${t.checkEnv}`);return r.join("|")}getLocalDirectories(e,t){return yE({cwd:e,configDir:t})}getAllSearchPaths(e,t,r,a){let l=[];return l.push(...this.getLocalSearchPaths(e,t,r,a)),l.push(...this.getHomeSearchPaths(e,t)),l.push(ei(r,"package.json")),l}getLocalSearchPaths(e,t,r,a){let l=this.getLocalDirectories(r,a),m=[];for(let f of l)m.push(...this.fileLoader.generateConfigPaths(e,f,t));return m}getHomeSearchPaths(e,t){if(!e)return[];let r=[ei(As(),".config",e),ei(As(),".config"),As()],a=[];for(let l of r)a.push(...this.fileLoader.generateConfigPaths(e,l,t));return a}async loadConfigWithResult(e){return this.loadConfig(e)}}var ig=new kv;async function Iv(e){let t="defaultConfig"in e&&e.defaultConfig!==void 0?e.defaultConfig:{},r="cache"in e||"performance"in e||"schema"in e||"validate"in e;try{let a;if(r)a=await ig.loadConfig(e);else a=await ig.loadConfig({...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}});return a?.config??t}catch(a){if(e.configFile)throw a;let l=a instanceof Error?a.name:"UnknownError",m=a instanceof Error?a.message:String(a);if(!(l==="ConfigNotFoundError"||l==="ConfigLoadError"||l==="ConfigValidationError"||m.includes("config"))&&e.verbose)Vn.warn("Unexpected error loading config, using defaults:",[a instanceof Error?a:Error(String(a))]);let b=r?{...e,defaultConfig:t}:{...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in e?e.checkEnv!==!1:!0)return(await ig.applyEnvironmentVariables(b.name||"",t,!0,b.verbose||!1))?.config??t;return t}}function ac(e,t,r=!1){let a=new _g,l=e.toUpperCase().replace(/[^A-Z0-9]/g,"_");function m(f,b=[]){let k={...f};for(let[y,R]of Object.entries(f)){let T=[...b,y],N=[`${l}_${T.join("_").toUpperCase()}`,`${l}_${T.map((q)=>q.toUpperCase()).join("")}`,`${l}_${T.map((q)=>q.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],j,U;for(let q of N)if(j=zd.env[q],j!==void 0){U=q;break}if(j!==void 0&&U)if(typeof R==="boolean")k[y]=["true","1","yes"].includes(j.toLowerCase());else if(typeof R==="number"){let q=Number(j);if(!Number.isNaN(q))k[y]=q}else if(Array.isArray(R))try{k[y]=JSON.parse(j)}catch{k[y]=j.split(",").map((q)=>q.trim())}else k[y]=j;else if(R&&typeof R==="object"&&!Array.isArray(R))k[y]=m(R,T)}return k}return m(t)}var KN=ei(zd.cwd(),"config"),JN=ei(zd.cwd(),"src/generated");var Vo={project:{name:"my-project",slug:"my-project",region:"us-east-1"},environments:{production:{type:"production"}}},Po=null;function PA(e){return e.project?.slug===Vo.project?.slug&&Object.keys(e.environments??{}).length===1&&!!e.environments?.production}async function _A(){let e=[Ev(process.cwd(),"config","cloud.ts"),Ev(process.cwd(),"config","cloud.js")];for(let t of e){if(!AA(t))continue;let r=await import(`${CA(t).href}?t=${Date.now()}`),a=r.tsCloud??r.default?.tsCloud??r.default??r.cloud??r.config;if(a)return a}return null}async function Af(){if(!Po){if(Po=await Iv({name:"cloud",defaultConfig:Vo}),PA(Po))Po=await _A()??Po;_d(Po.stateDir)}return Po}var Ll=Af,lS=Vo;var Qi=(e)=>e==null?void 0:String(e),xg=(e)=>Number(e)===1,Av=(e,t)=>{try{return e==null?t:JSON.parse(String(e))}catch{return t}};function Tg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:Qi(e.environment_id),resourceId:Qi(e.resource_id),previewId:Qi(e.preview_id)},key:String(e.key),kind:String(e.kind),value:Qi(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:Qi(e.secret_ref),backend:String(e.backend),backendVersion:Qi(e.backend_version),origin:String(e.origin),required:xg(e.required),metadata:Av(e.metadata,{}),lastUsedAt:Qi(e.last_used_at),rotatedAt:Qi(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Rv(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:xg(e.required),requiresRedeploy:xg(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Ga{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}get(e){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return t?Tg(t):void 0}find(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,t.type,t.id,r);return a?Tg(a):void 0}list(e){let t=["project_id=?"],r=[e.projectId];if(e.scope)t.push("scope_type=?","scope_id=?"),r.push(e.scope.type,e.scope.id);if(e.kind)t.push("kind=?"),r.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${t.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...r).map(Tg)}create(e){this.validateScope(e),this.validateEntry(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,r,r]),this.get(t)}update(e,t,r){let a=this.get(e);if(!a)throw Error("Configuration entry was not found.");if(this.validateEntry({...a,...r}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[r.value??null,r.valueFingerprint,r.secretRef??null,r.backend,r.backendVersion??null,r.required?1:0,JSON.stringify(r.metadata),r.rotatedAt??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,t){let r=this.get(e);if(!r)throw Error("Configuration entry was not found.");if(r.version!==t)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,t]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return r}setDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,t,t]),this.dependencies(e.entryId).find((r)=>r.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(Rv)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(Rv)}mutation(e){let t=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return t?{requestHash:t.request_hash,result:Av(t.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let r=e.scope;if(r.type==="project"){if(r.id!==e.projectId||r.environmentId||r.resourceId||r.previewId)throw Error("Project configuration scope must reference only its project.");return}if(r.type==="environment"){let l=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(r.id);if(!l||l.project_id!==e.projectId||r.environmentId&&r.environmentId!==r.id||r.resourceId||r.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(r.type==="service"||r.type==="function"){let l=this.controlPlane.getResource(r.id);if(!l||l.projectId!==e.projectId||r.type==="function"&&l.kind!=="function"||r.resourceId&&r.resourceId!==r.id||r.environmentId&&l.environmentId!==r.environmentId||r.previewId)throw Error(`${r.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let a=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(r.id);if(!a||a.project_id!==e.projectId||r.previewId&&r.previewId!==r.id||r.environmentId&&r.environmentId!==a.base_environment_id||r.resourceId&&r.resourceId!==a.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var Cv=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function TA(e){let t={n:`
+`;return r}}function vA(e,t,r={}){return yv(e,t,r,new WeakMap)}function yv(e,t,r,a){let{arrayMergeMode:l="replace",skipNullish:m=!1,customMerger:f}=r;if(t===null||t===void 0)return m?e:t;if(f){let b=f(e,t);if(b!==void 0)return b}if(Array.isArray(t)||Array.isArray(e))return vv(e,t,l,a);if(!Bn(t)||!Bn(e))return t;return kA(e,t,r,a)}function vv(e,t,r,a){if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(e)&&!Array.isArray(t))return t;if(Array.isArray(t)&&Array.isArray(e))switch(r){case"replace":return t;case"concat":return bA(e,t);case"smart":return SA(e,t,a);default:return t}return t}function bA(e,t){let r=[...t];for(let a of e)if(!r.some((l)=>vg(l,a)))r.push(a);return r}function SA(e,t,r){if(t.length===0)return e;if(e.length===0)return t;if(Bn(t[0])&&Bn(e[0]))return wA(e,t,r);if(t.every((a)=>typeof a==="string")&&e.every((a)=>typeof a==="string")){let a=[...t];for(let l of e)if(!a.includes(l))a.push(l);return a}return t}function wA(e,t,r){let a=[...t];for(let l of e){if(!Bn(l)){a.push(l);continue}let m=["id","name","key","path","type"],f=!1;for(let b of m)if(b in l){if(a.find((y)=>Bn(y)&&(b in y)&&y[b]===l[b])){f=!0;break}}if(!f)a.push(l)}return a}function kA(e,t,r,a){let l=t;if(Bn(l)&&a.has(l))return a.get(l);let m={...e};if(Bn(l))a.set(l,m);for(let f in l){if(!Object.prototype.hasOwnProperty.call(l,f))continue;let b=l[f],k=m[f];if(r.skipNullish&&(b===null||b===void 0))continue;if(b===null||b===void 0){m[f]=b;continue}if(Bn(b)&&Bn(k))m[f]=yv(k,b,r,a);else if(Array.isArray(b)||Array.isArray(k))m[f]=vv(k,b,r.arrayMergeMode||"smart",a);else m[f]=b}return m}function bv(e,t,r="replace"){return vA(e,t,{arrayMergeMode:r==="replace"?"replace":"smart",skipNullish:!0})}function vg(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!vg(e[r],t[r]))return!1;return!0}if(Bn(e)&&Bn(t)){let r=Object.keys(e),a=Object.keys(t);if(r.length!==a.length)return!1;for(let l of r){if(!Object.prototype.hasOwnProperty.call(t,l))return!1;if(!vg(e[l],t[l]))return!1}return!0}return!1}function Bn(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}class Sv{extensions=zy;async loadFromPath(e,t,r={}){let{arrayStrategy:a="replace",useCache:l=!0,cacheTtl:m,trackPerformance:f=!0,verbose:b=!1}=r;if(l){let y=kd.getWithFileCheck("file",e);if(y){if(b)console.log(`Configuration loaded from cache: ${e}`);return y}}let k=async()=>{if(!hd(e))return null;try{let y=`?t=${Date.now()}`,R=await import(e+y),T=R.default||R,N="default"in R,j=Object.keys(R).length>0;if(!N&&!j)throw new Ld(e,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof T!=="object"||T===null||Array.isArray(T))throw new Ld(e,Error("Configuration must export a valid object"),"unknown");let Y={config:bv(t,T,a),source:{type:"file",path:e,priority:100,timestamp:new Date}};if(l)kd.setWithFileCheck("file",Y,e,m);return Y}catch(y){throw y instanceof Error?Ro.configLoad(e,y):Ro.configLoad(e,Error(String(y)))}};if(f)return bg.track("loadFromPath",k,{path:e});return k()}async tryLoadFromPaths(e,t,r={}){for(let a of e)try{let l=await this.loadFromPath(a,t,r);if(l)return l}catch(l){if(l instanceof Error&&l.name==="ConfigLoadError")throw l;if(r.verbose)console.warn(`Failed to load config from ${a}:`,l)}return null}generateConfigPaths(e,t,r){return hE({name:e,directory:t,alias:r})}generateNamePatterns(e,t){return Uy({name:e,alias:t})}checkFileAccess(e){return yA(async()=>hd(e),{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(e,t,r){let a=[];if(!hd(e))return a;if(t||r){let l=this.generateNamePatterns(t||"",r);for(let m of l)for(let f of this.extensions){let b=My(e,`${m}${f}`);if(await this.checkFileAccess(b))a.push(b)}}else try{let{readdirSync:l}=await import("fs"),m=l(e);for(let f of m)if(this.looksLikeConfigFile(f)){let b=My(e,f);if(await this.checkFileAccess(b))a.push(b)}}catch{return[]}return a}looksLikeConfigFile(e){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((r)=>r.test(e))}async validateConfigFile(e){let t=[];try{if(!hd(e))return t.push("Configuration file does not exist"),t;let r=await import(e),a=r.default||r;if(a===void 0)t.push("Configuration file must export a default value or named exports");else if(typeof a!=="object"||a===null)t.push("Configuration must be an object");else if(Array.isArray(a))t.push("Configuration cannot be an array at the root level");if(e.endsWith(".json"))try{let{readFileSync:l}=await import("fs"),m=l(e,"utf8");JSON.parse(m)}catch(l){t.push(`Invalid JSON syntax: ${l}`)}}catch(r){t.push(`Failed to load configuration file: ${r}`)}return t}async getFileModificationTime(e){try{let{statSync:t}=await import("fs");return t(e).mtime}catch{return null}}async preloadConfigurations(e,t={}){let r=new Map;return await Promise.allSettled(e.map(async(a)=>{try{let l=await this.loadFromPath(a,{},t);if(l)r.set(a,l.config)}catch(l){if(t.verbose)console.warn(`Failed to preload ${a}:`,l)}})),r}}var EA=/^https?:\/\//;class wv{async validateConfiguration(e,t,r={}){let{stopOnFirstError:a=!1,validateRequired:l=!0,validateTypes:m=!0,customRules:f=[],trackPerformance:b=!0,verbose:k=!1}=r,y=async()=>{let R=[],T=[],N={stopOnFirstError:a,validateRequired:l,validateTypes:m,customRules:f,trackPerformance:b,verbose:k};try{if(typeof t==="string")return await this.validateWithSchemaFile(e,t,N);else if(Array.isArray(t))return this.validateWithRules(e,[...t,...f],N);else return this.validateWithJSONSchema(e,t,N)}catch(j){return R.push({path:"",message:`Validation failed: ${j}`,rule:"system"}),{isValid:!1,errors:R,warnings:T}}};if(b)return await bg.track("validateConfiguration",y);return y()}async validateWithSchemaFile(e,t,r){try{if(!IA(t))throw new Fd(t,[{path:"",message:"Schema file does not exist"}]);let a=await import(t),l=a.default||a;if(Array.isArray(l))return this.validateWithRules(e,l,r);else return this.validateWithJSONSchema(e,l,r)}catch(a){throw new Fd(t,[{path:"",message:`Failed to load schema: ${a}`}])}}validateWithJSONSchema(e,t,r){let a=[],l=[];return this.validateObjectAgainstSchema(e,t,"",a,l,r),{isValid:a.length===0,errors:a,warnings:l}}validateObjectAgainstSchema(e,t,r,a,l,m){if(m.validateTypes&&t.type){let f=Array.isArray(e)?"array":typeof e,b=Array.isArray(t.type)?t.type:[t.type];if(!b.includes(f)){if(a.push({path:r,message:`Expected type ${b.join(" or ")}, got ${f}`,expected:b.join(" or "),actual:f,rule:"type"}),m.stopOnFirstError)return}}if(t.enum&&!t.enum.includes(e)){if(a.push({path:r,message:`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"}),m.stopOnFirstError)return}if(typeof e==="string"){if(t.minLength!==void 0&&e.length<t.minLength)a.push({path:r,message:`String length must be at least ${t.minLength}`,expected:`>= ${t.minLength}`,actual:e.length,rule:"minLength"});if(t.maxLength!==void 0&&e.length>t.maxLength)a.push({path:r,message:`String length must not exceed ${t.maxLength}`,expected:`<= ${t.maxLength}`,actual:e.length,rule:"maxLength"});if(t.pattern){if(!new RegExp(t.pattern).test(e))a.push({path:r,message:`String does not match pattern ${t.pattern}`,expected:t.pattern,actual:e,rule:"pattern"})}}if(typeof e==="number"){if(t.minimum!==void 0&&e<t.minimum)a.push({path:r,message:`Value must be at least ${t.minimum}`,expected:`>= ${t.minimum}`,actual:e,rule:"minimum"});if(t.maximum!==void 0&&e>t.maximum)a.push({path:r,message:`Value must not exceed ${t.maximum}`,expected:`<= ${t.maximum}`,actual:e,rule:"maximum"})}if(Array.isArray(e)&&t.items)for(let f=0;f<e.length;f++){let b=r?`${r}[${f}]`:`[${f}]`;if(this.validateObjectAgainstSchema(e[f],t.items,b,a,l,m),m.stopOnFirstError&&a.length>0)return}if(e&&typeof e==="object"&&!Array.isArray(e)){let f=e;if(m.validateRequired&&t.required){for(let b of t.required)if(!(b in f)){if(a.push({path:r?`${r}.${b}`:b,message:`Missing required property '${b}'`,expected:"required",rule:"required"}),m.stopOnFirstError)return}}if(t.properties){for(let[b,k]of Object.entries(t.properties))if(b in f){let y=r?`${r}.${b}`:b;if(this.validateObjectAgainstSchema(f[b],k,y,a,l,m),m.stopOnFirstError&&a.length>0)return}}if(t.additionalProperties===!1){let b=new Set(Object.keys(t.properties||{}));for(let k of Object.keys(f))if(!b.has(k))l.push({path:r?`${r}.${k}`:k,message:`Additional property '${k}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(e,t,r){let a=[],l=[];for(let m of t)try{let f=this.getValueByPath(e,m.path),b=this.validateWithRule(f,m,m.path);if(a.push(...b),r.stopOnFirstError&&a.length>0)break}catch(f){a.push({path:m.path,message:`Rule validation failed: ${f}`,rule:"system"})}return{isValid:a.length===0,errors:a,warnings:l}}validateWithRule(e,t,r){let a=[];if(t.required&&(e===void 0||e===null))return a.push({path:r,message:t.message||`Property '${r}' is required`,expected:"required",rule:"required"}),a;if(e===void 0||e===null)return a;if(t.type){let l=Array.isArray(e)?"array":typeof e;if(l!==t.type)a.push({path:r,message:t.message||`Expected type ${t.type}, got ${l}`,expected:t.type,actual:l,rule:"type"})}if(t.min!==void 0){let l=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(l<t.min)a.push({path:r,message:t.message||`Value must be at least ${t.min}`,expected:`>= ${t.min}`,actual:l,rule:"min"})}if(t.max!==void 0){let l=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(l>t.max)a.push({path:r,message:t.message||`Value must not exceed ${t.max}`,expected:`<= ${t.max}`,actual:l,rule:"max"})}if(t.pattern&&typeof e==="string"){if(!t.pattern.test(e))a.push({path:r,message:t.message||`Value does not match pattern ${t.pattern}`,expected:t.pattern.toString(),actual:e,rule:"pattern"})}if(t.enum&&!t.enum.includes(e))a.push({path:r,message:t.message||`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"});if(t.validator){let l=t.validator(e);if(l)a.push({path:r,message:t.message||l,rule:"custom"})}return a}getValueByPath(e,t){if(!t)return e;let r=t.split("."),a=e;for(let l of r)if(a&&typeof a==="object"&&l in a)a=a[l];else return;return a}generateRulesFromInterface(e){let t=[],r=e.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let a of r){let[,l,m,f]=a;t.push({path:l,required:!m,type:this.mapTypeScriptType(f)})}return t}mapTypeScriptType(e){switch(e.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:EA},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}var Vn=new Vd("bunfig",{showTags:!0});function RA(e){if(!e)return"";let t=Array.isArray(e)?e.filter(Boolean):[e];if(t.length===0)return"";if(t.length===1)return` or alias "${t[0]}"`;return` or aliases ${t.map((r)=>`"${r}"`).join(", ")}`}class kv{fileLoader=new Sv;envProcessor=new _g;validator=new wv;async loadConfig(e){let t=Date.now(),{cache:r,performance:a,schema:l,validate:m,...f}=e;try{if(r?.enabled){let k=this.checkCache(f.name||"",f);if(k)return k}let b;try{b=await this.loadConfigurationStrategies(f,!0,r)}catch(k){if(f.configFile)throw k;let y=f.__strictErrorHandling;if(k instanceof Error&&k.name==="ConfigNotFoundError"){if(y)throw k;b={...await this.applyEnvironmentVariables(f.name||"",f.defaultConfig,f.checkEnv!==!1,f.verbose||!1),warnings:[`No configuration file found for "${f.name||"config"}", using defaults with environment variables`]}}else if(k instanceof Error&&k.name==="ConfigLoadError"){let R=k.message.includes("EACCES")||k.message.includes("EPERM")||k.message.includes("permission denied"),T=!R&&(k.message.includes("syntax")||k.message.includes("Expected")||k.message.includes("Unexpected")||k.message.includes("BuildMessage")||k.message.includes("errors building")),N=k.message.includes("Configuration must export a valid object")||k.message.includes("Configuration file is empty and exports nothing");if(y&&(N||R))throw k;if(T&&(!y||!N))b={...await this.applyEnvironmentVariables(f.name||"",f.defaultConfig,f.checkEnv!==!1,f.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!y)b={...await this.applyEnvironmentVariables(f.name||"",f.defaultConfig,f.checkEnv!==!1,f.verbose||!1),warnings:[`Configuration loading error, using defaults: ${k.message}`]};else throw k}else b={...await this.applyEnvironmentVariables(f.name||"",f.defaultConfig,f.checkEnv!==!1,f.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${k instanceof Error?k.message:String(k)}`]}}if(l||m)await this.validateConfiguration(b.config,l,m,f.name);if(r?.enabled&&b)this.cacheResult(f.name||"",b,r,f);if(a?.enabled){let k={operation:"loadConfig",duration:Date.now()-t,configName:f.name,timestamp:new Date};if(a.onMetrics)a.onMetrics(k);if(a.slowThreshold&&k.duration>a.slowThreshold)Vn.warn(`Slow configuration loading detected: ${k.duration}ms for ${f.name}`);b.metrics=k}return b}catch(b){if(b instanceof Error&&b.name==="ConfigNotFoundError")throw b;let k=Date.now()-t;throw Vn.error(`Configuration loading failed after ${k}ms:`,[b instanceof Error?b:Error(String(b))]),b}}async loadConfigurationStrategies(e,t=!1,r){let{name:a="",alias:l,configFile:m,cwd:f,configDir:b,defaultConfig:k,checkEnv:y=!0,arrayStrategy:R="replace",verbose:T=!1}=e,N=f||zd.cwd(),j=[];if(m){let le=ei(N,m);j.push(le);let Z=y?ac(a,k,T):k,ie=await this.fileLoader.tryLoadFromPaths([le],Z,{arrayStrategy:R,verbose:T,cacheTtl:r?.ttl,useCache:!r?.ttl||r.ttl>100});if(!ie)throw Ro.configNotFound(a||m,j,l);if(T)Vn.success(`Configuration loaded from explicit path: ${le}`);return this.finalizeResult(ie,j,y,a,T)}let U=await this.loadLocalConfiguration(a,l,N,b,k,R,T,y,r);if(U)return j.push(...this.getLocalSearchPaths(a,l,N,b)),this.finalizeResult(U,j,y,a,T);let q=await this.loadHomeConfiguration(a,l,k,R,T,y);if(q)return j.push(...this.getHomeSearchPaths(a,l)),this.finalizeResult(q,j,y,a,T);let Y=await this.loadPackageJsonConfiguration(a,l,N,k,R,T,y);if(Y)return j.push(ei(N,"package.json")),this.finalizeResult(Y,j,y,a,T);if(j.push(...this.getAllSearchPaths(a,l,N,b)),t)throw Ro.configNotFound(a,j,l);return{...await this.applyEnvironmentVariables(a,k,y,T),warnings:[`No configuration file found for "${a}"${RA(l)}, using defaults with environment variables`]}}async loadLocalConfiguration(e,t,r,a,l,m,f,b,k){let y=b?ac(e,l,f):l,R=this.getLocalDirectories(r,a);for(let T of R){if(f)Vn.info(`Searching for configuration in: ${T}`);let N=this.fileLoader.generateConfigPaths(e,T,t),j=await this.fileLoader.tryLoadFromPaths(N,y,{arrayStrategy:m,verbose:f,cacheTtl:k?.ttl,useCache:!k?.ttl||k.ttl>100});if(j){if(f)Vn.success(`Configuration loaded from: ${j.source.path}`);return j}}return null}async loadHomeConfiguration(e,t,r,a,l,m){if(!e)return null;let f=m?ac(e,r,l):r,b=[ei(As(),".config",e),ei(As(),".config"),As()];for(let k of b){if(l)Vn.info(`Checking home directory: ${k}`);let y=this.fileLoader.generateConfigPaths(e,k,t),R=await this.fileLoader.tryLoadFromPaths(y,f,{arrayStrategy:a,verbose:l});if(R){if(l)Vn.success(`Configuration loaded from home directory: ${R.source.path}`);return R}}return null}async loadPackageJsonConfiguration(e,t,r,a,l,m,f){let b=f?ac(e,a,m):a;try{let k=ei(r,"package.json");if(!vE(k))return null;let y={};try{y=JSON.parse(bE(k,"utf8"))}catch(N){if(m)Vn.warn("Failed to parse package.json:",[N instanceof Error?N:Error(String(N))]);return null}let R=y[e],T=e;if(!R&&t){let N=Array.isArray(t)?t:[t];for(let j of N){if(!j)continue;if(y[j]){R=y[j],T=j;break}}}if(R&&typeof R==="object"&&!Array.isArray(R)){if(m)Vn.success(`Configuration loaded from package.json: ${T}`);return{config:bv(b,R,l),source:{type:"package.json",path:k,priority:30,timestamp:new Date}}}}catch(k){if(m)Vn.warn("Failed to load package.json:",[k instanceof Error?k:Error(String(k))])}return null}async applyEnvironmentVariables(e,t,r,a){if(!r||!e||typeof t!=="object"||t===null||Array.isArray(t))return{config:t,source:{type:"default",priority:10,timestamp:new Date}};return{config:ac(e,t,a),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(e,t,r,a,l){return{config:e.config,source:e.source,path:e.source.path}}async validateConfiguration(e,t,r,a){let l=[];if(r){let m=r(e);if(m)l.push(...m)}if(t){let m=await this.validator.validateConfiguration(e,t);if(!m.isValid)l.push(...m.errors.map((f)=>f.path?`${f.path}: ${f.message}`:f.message))}if(l.length>0)throw Ro.configValidation(a||"unknown",l,a)}checkCache(e,t){let r=this.generateCacheKey(e,t);return kd.get(r)||null}cacheResult(e,t,r,a){let l=this.generateCacheKey(e,a);kd.set(l,t,void 0,r.ttl)}generateCacheKey(e,t){let r=[e];if(t.alias){let a=Array.isArray(t.alias)?t.alias.join(","):t.alias;r.push(`alias:${a}`)}if(t.cwd)r.push(`cwd:${t.cwd}`);if(t.configFile)r.push(`configFile:${t.configFile}`);if(t.configDir)r.push(`configDir:${t.configDir}`);if("checkEnv"in t)r.push(`checkEnv:${t.checkEnv}`);return r.join("|")}getLocalDirectories(e,t){return yE({cwd:e,configDir:t})}getAllSearchPaths(e,t,r,a){let l=[];return l.push(...this.getLocalSearchPaths(e,t,r,a)),l.push(...this.getHomeSearchPaths(e,t)),l.push(ei(r,"package.json")),l}getLocalSearchPaths(e,t,r,a){let l=this.getLocalDirectories(r,a),m=[];for(let f of l)m.push(...this.fileLoader.generateConfigPaths(e,f,t));return m}getHomeSearchPaths(e,t){if(!e)return[];let r=[ei(As(),".config",e),ei(As(),".config"),As()],a=[];for(let l of r)a.push(...this.fileLoader.generateConfigPaths(e,l,t));return a}async loadConfigWithResult(e){return this.loadConfig(e)}}var ig=new kv;async function Iv(e){let t="defaultConfig"in e&&e.defaultConfig!==void 0?e.defaultConfig:{},r="cache"in e||"performance"in e||"schema"in e||"validate"in e;try{let a;if(r)a=await ig.loadConfig(e);else a=await ig.loadConfig({...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}});return a?.config??t}catch(a){if(e.configFile)throw a;let l=a instanceof Error?a.name:"UnknownError",m=a instanceof Error?a.message:String(a);if(!(l==="ConfigNotFoundError"||l==="ConfigLoadError"||l==="ConfigValidationError"||m.includes("config"))&&e.verbose)Vn.warn("Unexpected error loading config, using defaults:",[a instanceof Error?a:Error(String(a))]);let b=r?{...e,defaultConfig:t}:{...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in e?e.checkEnv!==!1:!0)return(await ig.applyEnvironmentVariables(b.name||"",t,!0,b.verbose||!1))?.config??t;return t}}function ac(e,t,r=!1){let a=new _g,l=e.toUpperCase().replace(/[^A-Z0-9]/g,"_");function m(f,b=[]){let k={...f};for(let[y,R]of Object.entries(f)){let T=[...b,y],N=[`${l}_${T.join("_").toUpperCase()}`,`${l}_${T.map((q)=>q.toUpperCase()).join("")}`,`${l}_${T.map((q)=>q.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],j,U;for(let q of N)if(j=zd.env[q],j!==void 0){U=q;break}if(j!==void 0&&U)if(typeof R==="boolean")k[y]=["true","1","yes"].includes(j.toLowerCase());else if(typeof R==="number"){let q=Number(j);if(!Number.isNaN(q))k[y]=q}else if(Array.isArray(R))try{k[y]=JSON.parse(j)}catch{k[y]=j.split(",").map((q)=>q.trim())}else k[y]=j;else if(R&&typeof R==="object"&&!Array.isArray(R))k[y]=m(R,T)}return k}return m(t)}var KN=ei(zd.cwd(),"config"),JN=ei(zd.cwd(),"src/generated");var Vo={project:{name:"my-project",slug:"my-project",region:"us-east-1"},environments:{production:{type:"production"}}},Po=null;function PA(e){return e.project?.slug===Vo.project?.slug&&Object.keys(e.environments??{}).length===1&&!!e.environments?.production}async function _A(){let e=[Ev(process.cwd(),"config","cloud.ts"),Ev(process.cwd(),"config","cloud.js")];for(let t of e){if(!AA(t))continue;let r=await import(`${CA(t).href}?t=${Date.now()}`),a=r.tsCloud??r.default?.tsCloud??r.default??r.cloud??r.config;if(a)return a}return null}async function yf(){if(!Po){if(Po=await Iv({name:"cloud",defaultConfig:Vo}),PA(Po))Po=await _A()??Po;_d(Po.stateDir)}return Po}var Ll=yf,uS=Vo;var Qi=(e)=>e==null?void 0:String(e),xg=(e)=>Number(e)===1,Av=(e,t)=>{try{return e==null?t:JSON.parse(String(e))}catch{return t}};function Tg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),scope:{type:String(e.scope_type),id:String(e.scope_id),environmentId:Qi(e.environment_id),resourceId:Qi(e.resource_id),previewId:Qi(e.preview_id)},key:String(e.key),kind:String(e.kind),value:Qi(e.value),valueFingerprint:String(e.value_fingerprint),secretRef:Qi(e.secret_ref),backend:String(e.backend),backendVersion:Qi(e.backend_version),origin:String(e.origin),required:xg(e.required),metadata:Av(e.metadata,{}),lastUsedAt:Qi(e.last_used_at),rotatedAt:Qi(e.rotated_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Rv(e){return{entryId:String(e.entry_id),resourceId:String(e.resource_id),injectionTarget:String(e.injection_target),required:xg(e.required),requiresRedeploy:xg(e.requires_redeploy),lastDeployedVersion:e.last_deployed_version==null?void 0:Number(e.last_deployed_version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Ga{controlPlane;now;constructor(e,t=()=>new Date){this.controlPlane=e;this.now=t}get(e){let t=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE id=?").get(e);return t?Tg(t):void 0}find(e,t,r){let a=this.controlPlane.database.query("SELECT * FROM configuration_entries WHERE project_id=? AND scope_type=? AND scope_id=? AND key=?").get(e,t.type,t.id,r);return a?Tg(a):void 0}list(e){let t=["project_id=?"],r=[e.projectId];if(e.scope)t.push("scope_type=?","scope_id=?"),r.push(e.scope.type,e.scope.id);if(e.kind)t.push("kind=?"),r.push(e.kind);return this.controlPlane.database.query(`SELECT * FROM configuration_entries WHERE ${t.join(" AND ")} ORDER BY key,scope_type,scope_id`).all(...r).map(Tg)}create(e){this.validateScope(e),this.validateEntry(e);let t=crypto.randomUUID(),r=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_entries (id,organization_id,project_id,scope_type,scope_id,environment_id,resource_id,preview_id,key,kind,value,value_fingerprint,secret_ref,backend,backend_version,origin,required,metadata,last_used_at,rotated_at,version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.scope.type,e.scope.id,e.scope.environmentId??null,e.scope.resourceId??null,e.scope.previewId??null,e.key,e.kind,e.value??null,e.valueFingerprint,e.secretRef??null,e.backend,e.backendVersion??null,e.origin,e.required?1:0,JSON.stringify(e.metadata),e.lastUsedAt??null,e.rotatedAt??null,1,r,r]),this.get(t)}update(e,t,r){let a=this.get(e);if(!a)throw Error("Configuration entry was not found.");if(this.validateEntry({...a,...r}),this.controlPlane.database.run("UPDATE configuration_entries SET value=?,value_fingerprint=?,secret_ref=?,backend=?,backend_version=?,required=?,metadata=?,rotated_at=?,version=version+1,updated_at=? WHERE id=? AND version=?",[r.value??null,r.valueFingerprint,r.secretRef??null,r.backend,r.backendVersion??null,r.required?1:0,JSON.stringify(r.metadata),r.rotatedAt??null,this.now().toISOString(),e,t]).changes!==1)throw Error("Configuration entry changed; refresh and retry.");return this.get(e)}remove(e,t){let r=this.get(e);if(!r)throw Error("Configuration entry was not found.");if(r.version!==t)throw Error("Configuration entry changed; refresh and retry.");if(this.controlPlane.database.run("DELETE FROM configuration_entries WHERE id=? AND version=?",[e,t]).changes<1)throw Error("Configuration entry changed; refresh and retry.");return r}setDependency(e){let t=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_dependencies (entry_id,resource_id,injection_target,required,requires_redeploy,last_deployed_version,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?) ON CONFLICT(entry_id,resource_id) DO UPDATE SET injection_target=excluded.injection_target,required=excluded.required,requires_redeploy=excluded.requires_redeploy,last_deployed_version=excluded.last_deployed_version,updated_at=excluded.updated_at",[e.entryId,e.resourceId,e.injectionTarget,e.required?1:0,e.requiresRedeploy?1:0,e.lastDeployedVersion??null,t,t]),this.dependencies(e.entryId).find((r)=>r.resourceId===e.resourceId)}dependencies(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE entry_id=? ORDER BY resource_id").all(e).map(Rv)}dependenciesForResource(e){return this.controlPlane.database.query("SELECT * FROM configuration_dependencies WHERE resource_id=? ORDER BY entry_id").all(e).map(Rv)}mutation(e){let t=this.controlPlane.database.query("SELECT request_hash,result FROM configuration_mutations WHERE idempotency_key=?").get(e);return t?{requestHash:t.request_hash,result:Av(t.result,{})}:void 0}recordMutation(e){this.controlPlane.database.run("INSERT INTO configuration_mutations (id,project_id,idempotency_key,request_hash,result,actor_id,created_at) VALUES (?,?,?,?,?,?,?)",[crypto.randomUUID(),e.projectId,e.idempotencyKey,e.requestHash,JSON.stringify(e.result),e.actorId??null,this.now().toISOString()])}validateEntry(e){if(!/^[A-Za-z_][A-Za-z0-9_]{0,255}$/.test(e.key))throw Error(`Invalid configuration key: ${e.key}`);if(e.kind==="variable"&&(e.value==null||e.secretRef||e.backend!=="plaintext"))throw Error("Variables require a plaintext value and cannot use a secret backend.");if(e.kind==="secret"&&(e.value!=null||!e.secretRef||e.backend==="plaintext"))throw Error("Secrets require a non-plaintext backend reference and cannot store a plaintext value.")}validateScope(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Configuration project does not belong to the organization.");let r=e.scope;if(r.type==="project"){if(r.id!==e.projectId||r.environmentId||r.resourceId||r.previewId)throw Error("Project configuration scope must reference only its project.");return}if(r.type==="environment"){let l=this.controlPlane.database.query("SELECT project_id FROM environments WHERE id=?").get(r.id);if(!l||l.project_id!==e.projectId||r.environmentId&&r.environmentId!==r.id||r.resourceId||r.previewId)throw Error("Environment configuration scope does not belong to the project.");return}if(r.type==="service"||r.type==="function"){let l=this.controlPlane.getResource(r.id);if(!l||l.projectId!==e.projectId||r.type==="function"&&l.kind!=="function"||r.resourceId&&r.resourceId!==r.id||r.environmentId&&l.environmentId!==r.environmentId||r.previewId)throw Error(`${r.type==="function"?"Function":"Service"} configuration scope does not belong to the project.`);return}let a=this.controlPlane.database.query("SELECT project_id,base_environment_id,resource_id FROM preview_instances WHERE id=?").get(r.id);if(!a||a.project_id!==e.projectId||r.previewId&&r.previewId!==r.id||r.environmentId&&r.environmentId!==a.base_environment_id||r.resourceId&&r.resourceId!==a.resource_id)throw Error("Preview configuration scope does not belong to the project.")}}var Cv=/^[A-Za-z_][A-Za-z0-9_]{0,255}$/;function TA(e){let t={n:`
 `,r:"\r",t:"\t","\\":"\\",'"':'"',$:"$"};return e.replace(/\\(n|r|t|\\|"|\$)/g,(r,a)=>t[a])}function Xu(e){let t={},r=[],a=e.replace(/\r\n?/g,`
 `).split(`
 `);for(let l=0;l<a.length;l++){let m=l+1,f=a[l];if(!f.trim()||f.trimStart().startsWith("#"))continue;if(/^\s*export\s+/.test(f))f=f.replace(/^\s*export\s+/,"");let b=f.match(/^\s*([^=\s]+)\s*=\s*(.*)$/);if(!b){r.push({line:m,severity:"error",code:"invalid_line",message:"Expected KEY=VALUE."});continue}let k=b[1],y=b[2];if(!Cv.test(k)){r.push({line:m,key:k,severity:"error",code:"invalid_key",message:`Invalid environment variable name: ${k}`});continue}let R=y;if(y.startsWith('"')||y.startsWith("'")){let T=y[0],N=[y.slice(1)],j=!1;while(!0){let U=N[N.length-1],q=!1,Y=-1;for(let ee=0;ee<U.length;ee++){if(T==='"'&&U[ee]==="\\"&&!q){q=!0;continue}if(U[ee]===T&&!q){Y=ee;break}q=!1}if(Y>=0){N[N.length-1]=U.slice(0,Y),j=!0;break}if(++l>=a.length)break;N.push(a[l])}if(!j){r.push({line:m,key:k,severity:"error",code:"unterminated_quote",message:`Unterminated quoted value for ${k}.`});continue}if(R=N.join(`
 `),T==='"')R=TA(R)}else R=y.replace(/\s+#.*$/,"").trim();if(Object.hasOwn(t,k)){let T=t[k]!==R;if(r.push({line:m,key:k,severity:T?"error":"warning",code:T?"conflict":"duplicate",message:T?`${k} has conflicting values.`:`${k} is duplicated with the same value.`}),T)continue}t[k]=R}return{values:t,diagnostics:r,valid:!r.some((l)=>l.severity==="error")}}function Yu(e){return Object.entries(e).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>{if(!Cv.test(t))throw Error(`Invalid environment variable name: ${t}`);return`${t}=${JSON.stringify(r)}`}).join(`
 `)+(Object.keys(e).length?`
 `:"")}import{createCipheriv as xA,createDecipheriv as DA,createHash as Pv,randomBytes as OA}from"node:crypto";class Cn{controlPlane;now;kind="local_encrypted";key;constructor(e,t,r=()=>new Date){this.controlPlane=e;this.now=r;if(!t)throw Error("Configuration encryption key is required.");this.key=Pv("sha256").update(`ts-cloud:configuration:${t}`).digest()}encrypt(e){let t=OA(12),r=xA("aes-256-gcm",this.key,t),a=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${a.toString("base64url")}`}decrypt(e){let[t,r,a,l]=e.split(".");if(t!=="v1"||!r||!a||!l)throw Error("Encrypted configuration secret is unavailable.");try{let m=DA("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return m.setAuthTag(Buffer.from(a,"base64url")),Buffer.concat([m.update(Buffer.from(l,"base64url")),m.final()]).toString("utf8")}catch{throw Error("Encrypted configuration secret could not be decrypted.")}}async put(e){if(!e.value)throw Error("Configuration secrets cannot be empty.");let t=e.reference??`secret://configuration/${e.name}/${crypto.randomUUID()}`;if(!/^secret:\/\/configuration\/[A-Za-z0-9._/-]+$/.test(t))throw Error("Invalid local configuration secret reference.");let a=(this.controlPlane.database.query("SELECT version FROM configuration_secret_values WHERE reference=?").get(t)?.version??0)+1,l=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO configuration_secret_values (reference,ciphertext,fingerprint,version,created_at,updated_at) VALUES (?,?,?,?,?,?) ON CONFLICT(reference) DO UPDATE SET ciphertext=excluded.ciphertext,fingerprint=excluded.fingerprint,version=excluded.version,updated_at=excluded.updated_at",[t,this.encrypt(e.value),Pv("sha256").update(e.value).digest("hex"),a,l,l]),{reference:t,version:String(a)}}async resolve(e){let t=this.controlPlane.database.query("SELECT ciphertext FROM configuration_secret_values WHERE reference=?").get(e);if(!t)throw Error("Configuration secret was not found.");return this.decrypt(t.ciphertext)}async remove(e){this.controlPlane.database.run("DELETE FROM configuration_secret_values WHERE reference=?",[e])}async validate(e){return!!this.controlPlane.database.query("SELECT 1 AS found FROM configuration_secret_values WHERE reference=?").get(e)}}class Va{client;region;kind="aws_secrets_manager";constructor(e,t){this.client=e;this.region=t}async put(e){if(e.reference){let r=this.id(e.reference),a=await this.client.putSecretValue({SecretId:r,SecretString:e.value,ClientRequestToken:e.idempotencyKey});return{reference:e.reference,version:a.VersionId??e.idempotencyKey}}let t=await this.client.createSecret({Name:e.name,SecretString:e.value,ClientRequestToken:e.idempotencyKey,Tags:[{Key:"managed-by",Value:"ts-cloud"}]});return{reference:`aws-sm://${this.region}/${encodeURIComponent(t.ARN??t.Name??e.name)}`,version:t.VersionId??e.idempotencyKey}}async resolve(e){let t=await this.client.getSecretValue({SecretId:this.id(e)});if(t.SecretString==null)throw Error("AWS Secrets Manager value is unavailable.");return t.SecretString}async remove(e){await this.client.deleteSecret({SecretId:this.id(e),RecoveryWindowInDays:7})}async validate(e){try{return await this.client.describeSecret(this.id(e)),!0}catch{return!1}}id(e){let t=new URL(e);if(t.protocol!=="aws-sm:"||t.hostname!==this.region)throw Error("Invalid AWS Secrets Manager reference.");return decodeURIComponent(t.pathname.slice(1))}}class qa{client;region;kind="aws_ssm";constructor(e,t){this.client=e;this.region=t}async put(e){let t=e.reference?this.name(e.reference):`/${e.name.replace(/^\/+/,"")}`,r=await this.client.putParameter({Name:t,Value:e.value,Type:"SecureString",Overwrite:!!e.reference,Description:"Managed by ts-cloud"});return{reference:`aws-ssm://${this.region}${t}`,version:String(r.Version??1)}}async resolve(e){let t=await this.client.getParameter({Name:this.name(e),WithDecryption:!0});if(t.Parameter?.Value==null)throw Error("AWS SSM parameter value is unavailable.");return t.Parameter.Value}async remove(e){await this.client.deleteParameter({Name:this.name(e)})}async validate(e){try{return!!(await this.client.getParameter({Name:this.name(e),WithDecryption:!1})).Parameter}catch{return!1}}name(e){let t=new URL(e);if(t.protocol!=="aws-ssm:"||t.hostname!==this.region||!t.pathname.startsWith("/"))throw Error("Invalid AWS SSM reference.");return t.pathname}}class ja{kind="external";async put(){throw Error("External secret references cannot be written by ts-cloud.")}async resolve(){throw Error("External secrets must be resolved by the deployment provider.")}async remove(){}async validate(e){return/^(?:vault|doppler|op|external):\/\//.test(e)}}import{createHmac as $A}from"node:crypto";var NA=/^(?:secret|aws-sm|aws-ssm|vault|doppler|op|external):\/\//,jA=/^(?:AWS_|TS_CLOUD_|PORT$|HOST$)/;function vn(e){return[...new Set(e)].sort()}function _v(e,t={}){let r=e.kind==="secret";return{id:e.id,key:e.key,kind:e.kind,scope:e.scope,inherited:!!t.inherited,overridden:!!t.overridden,required:e.required,backend:!r||t.canReadSecretMetadata?e.backend:void 0,backendVersion:!r||t.canReadSecretMetadata?e.backendVersion:void 0,reference:r&&t.canReadSecretMetadata?e.secretRef:void 0,value:!r?e.value:void 0,lastUsedAt:e.lastUsedAt,rotatedAt:e.rotatedAt,version:e.version,updatedAt:e.updatedAt}}class za{store;backends=new Map;fingerprintKey;now;constructor(e,t){if(this.store=e,this.fingerprintKey=t.fingerprintKey??t.encryptionKey,this.now=t.now??(()=>new Date),!this.fingerprintKey)throw Error("Configuration fingerprint key is required.");let r=t.backends??[new Cn(e.controlPlane,t.encryptionKey,this.now)];for(let a of r)this.backends.set(a.kind,a)}list(e){let t=e.search?.toLowerCase();return this.store.list(e).filter((r)=>!t||r.key.toLowerCase().includes(t)).map((r)=>_v(r,{canReadSecretMetadata:e.canReadSecretMetadata}))}plan(e){let t=this.store.list({projectId:e.projectId,scope:e.scope}),r=new Map(t.map((k)=>[k.key,k])),a=[],l=[],m=[],f=[];for(let[k,y]of Object.entries(e.values)){a.push(...this.warnings(k,y));let R=r.get(k);if(!R)l.push(k);else if(R.valueFingerprint!==this.fingerprint(y))m.push(k);else f.push(k)}let b=e.removeMissing?t.filter((k)=>!Object.hasOwn(e.values,k.key)).map((k)=>k.key):[];return{added:vn(l),changed:vn(m),removed:vn(b),unchanged:vn(f),affectedResourceIds:this.affectedResources(e.projectId,e.scope,[...l,...m,...b]),warnings:a}}async set(e){let t=this.requestHash(e),r=e.idempotencyKey;if(r){let U=this.store.mutation(r);if(U){if(U.requestHash!==t)throw Error("Idempotency key was already used for a different configuration mutation.");let q=this.store.get(String(U.result.entryId??""));if(!q)throw Error("Idempotent configuration result is no longer available.");return{entry:q,mutation:U.result.mutation,warnings:[]}}}if(e.value!=null&&NA.test(e.value))throw Error("Secret references must use the reference field, not a plaintext value field.");let a=this.store.find(e.projectId,e.scope,e.key),l=this.fingerprint(e.value??e.reference??"");if(a&&e.expectedVersion!=null&&a.version!==e.expectedVersion)throw Error("Configuration entry changed; refresh and retry.");if(a&&a.kind!==e.kind)throw Error("Delete the existing entry before changing between variable and secret kinds.");let m=e.kind==="variable"?"plaintext":e.backend??(e.reference?"external":"local_encrypted");if(!!a&&(a.valueFingerprint!==l||a.backend!==m||a.required!==!!e.required)&&(this.isProduction(a)||this.store.dependencies(a.id).length>0)&&!e.confirmed)throw Error("Confirmation is required because this replacement affects production or dependent services.");let b=e.reference,k;if(e.kind==="secret"){let U=this.backend(m);if(e.reference&&e.value==null){if(!await U.validate(e.reference))throw Error("Secret backend reference is unavailable or invalid.");k=a?.backendVersion??"external"}else{if(e.value==null)throw Error("A secret value or external reference is required.");let q=await U.put({reference:a?.backend===m?a.secretRef:void 0,name:this.backendName(e),value:e.value,idempotencyKey:r??crypto.randomUUID()});b=q.reference,k=q.version}}let y=e.kind==="variable"?e.value:void 0;if(e.kind==="variable"&&y==null)throw Error("A variable value is required.");let R=!a||a.valueFingerprint!==l||a.backend!==m||a.secretRef!==b||a.backendVersion!==k||a.required!==!!e.required,T=a?R?this.store.update(a.id,a.version,{value:y,valueFingerprint:l,secretRef:b,backend:m,backendVersion:k,required:!!e.required,metadata:s(e.metadata??a.metadata),rotatedAt:e.kind==="secret"?this.now().toISOString():a.rotatedAt}):a:this.store.create({organizationId:e.organizationId,projectId:e.projectId,scope:e.scope,key:e.key,kind:e.kind,value:y,valueFingerprint:l,secretRef:b,backend:m,backendVersion:k,origin:e.origin??"managed",required:!!e.required,metadata:s(e.metadata??{}),rotatedAt:e.kind==="secret"?this.now().toISOString():void 0}),N=this.affectedResources(e.projectId,e.scope,[e.key]),j={added:a?[]:[e.key],changed:a&&R?[e.key]:[],removed:[],unchanged:a&&!R?[e.key]:[],affectedResourceIds:N,versions:{[e.key]:T.version}};if(r)this.store.recordMutation({projectId:e.projectId,idempotencyKey:r,requestHash:t,actorId:e.actorId,result:{entryId:T.id,mutation:j}});return this.audit(e.projectId,e.actorId,a&&R?"configuration.updated":a?"configuration.unchanged":"configuration.created",T,N),{entry:T,mutation:j,warnings:this.warnings(e.key,e.value??"")}}async importDotenv(e){let t=Xu(e.source);if(!t.valid)return{document:t,warnings:[]};let r=new Set(e.secretKeys??[]),a={added:[],changed:[],removed:[],unchanged:[],affectedResourceIds:[],versions:{}},l=[];for(let[m,f]of Object.entries(t.values)){let b=await this.set({...e,source:void 0,key:m,value:f,kind:r.has(m)?"secret":"variable",idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:${m}`:void 0});a.added.push(...b.mutation.added),a.changed.push(...b.mutation.changed),a.unchanged.push(...b.mutation.unchanged),a.affectedResourceIds.push(...b.mutation.affectedResourceIds),Object.assign(a.versions,b.mutation.versions),l.push(...b.warnings)}return a.added=vn(a.added),a.changed=vn(a.changed),a.unchanged=vn(a.unchanged),a.affectedResourceIds=vn(a.affectedResourceIds),{document:t,mutation:a,warnings:l}}exportVariables(e){return Yu(Object.fromEntries(this.store.list({projectId:e.projectId,scope:e.scope,kind:"variable"}).map((t)=>[t.key,t.value??""])))}async transfer(e){let t=this.store.get(e.entryId);if(!t)throw Error("Configuration entry was not found.");if(t.scope.type===e.targetScope.type&&t.scope.id===e.targetScope.id)throw Error("Choose a different destination scope.");let r=t.kind==="variable"?t.value:t.backend==="external"?void 0:await this.backend(t.backend).resolve(t.secretRef),a=t.kind==="secret"?t.backend:void 0,l=await this.set({organizationId:t.organizationId,projectId:t.projectId,scope:e.targetScope,key:t.key,kind:t.kind,value:r,reference:t.backend==="external"?t.secretRef:void 0,backend:a,required:t.required,metadata:t.metadata,confirmed:e.confirmed,actorId:e.actorId,idempotencyKey:e.idempotencyKey?`${e.idempotencyKey}:copy`:void 0,origin:t.origin});if(e.mode==="move")await this.remove({entryId:t.id,expectedVersion:t.version,confirmed:e.confirmed,actorId:e.actorId});let m={added:l.mutation.added,changed:l.mutation.changed,removed:e.mode==="move"?[t.key]:[],unchanged:l.mutation.unchanged,affectedResourceIds:vn([...l.mutation.affectedResourceIds,...this.affectedResources(t.projectId,t.scope,[t.key])]),versions:l.mutation.versions};return{entry:l.entry,mutation:m}}async resolve(e){let t=this.store.list({projectId:e.projectId}),r=t.filter((y)=>this.applies(y,e)).sort((y,R)=>this.rank(y.scope.type)-this.rank(R.scope.type)),a=new Map,l=new Set;for(let y of r){if(a.has(y.key))l.add(y.key);a.set(y.key,y)}let m={},f={},b=[],k=new Set(e.allowedPreviewSecrets??[]);for(let[y,R]of a){if(e.previewId&&R.kind==="secret"&&R.scope.type!=="preview"&&(!e.trustedPreview||!k.has(y)))continue;if(R.kind==="variable")m[y]=R.value??"";else if(e.nativeReferences)m[y]=R.secretRef;else{let T=this.backend(R.backend);if(!await T.validate(R.secretRef)){if(b.push({key:y,code:"stale_reference",message:`${y} points to an unavailable secret.`}),R.required)b.push({key:y,code:"missing_required",message:`${y} is required but unavailable.`});continue}m[y]=await T.resolve(R.secretRef)}f[y]=_v(R,{inherited:R.scope.type!==(e.previewId?"preview":e.functionId?"function":e.resourceId?"service":e.environmentId?"environment":"project"),overridden:l.has(y),canReadSecretMetadata:e.canReadSecretMetadata}),this.store.controlPlane.database.run("UPDATE configuration_entries SET last_used_at=? WHERE id=?",[this.now().toISOString(),R.id])}return{values:m,entries:f,warnings:b,configurationHash:this.fingerprint([...a.values()].map((y)=>`${y.key}:${y.valueFingerprint}:${y.version}`).sort().join(`
-`))}}async reveal(e){let t=this.store.get(e.entryId);if(!t||t.kind!=="secret")throw Error("Configuration secret was not found.");if(!e.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!e.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let r=await this.backend(t.backend).resolve(t.secretRef);return this.audit(t.projectId,e.actorId,"configuration.secret.revealed",t,[]),r}async remove(e){let t=this.store.get(e.entryId);if(!t)throw Error("Configuration entry was not found.");let r=this.store.dependencies(t.id);if(((t.scope.environmentId?this.store.controlPlane.listEnvironments(t.projectId).some((f)=>f.id===t.scope.environmentId&&f.kind==="production"):t.scope.type==="project")||r.length)&&!e.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(t.kind==="secret"&&t.backend!=="external")await this.backend(t.backend).remove(t.secretRef);this.store.remove(t.id,e.expectedVersion);let l=vn(r.map((f)=>f.resourceId)),m={added:[],changed:[],removed:[t.key],unchanged:[],affectedResourceIds:l,versions:{}};return this.audit(t.projectId,e.actorId,"configuration.deleted",t,l),m}applies(e,t){if(e.scope.type==="project")return!0;if(e.scope.type==="environment")return e.scope.id===t.environmentId;if(e.scope.type==="service")return e.scope.id===t.resourceId;if(e.scope.type==="function")return e.scope.id===t.functionId;return e.scope.id===t.previewId}rank(e){return{project:0,environment:1,service:2,function:3,preview:4}[e]}fingerprint(e){return`hmac-sha256:${$A("sha256",this.fingerprintKey).update(e).digest("hex")}`}requestHash(e){return this.fingerprint(JSON.stringify({...e,idempotencyKey:void 0,actorId:void 0}))}backend(e){let t=this.backends.get(e);if(!t)throw Error(`Configuration secret backend is not configured: ${e}`);return t}backendName(e){return`ts-cloud/${e.projectId}/${e.scope.type}/${e.scope.id}/${e.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(e){return e.scope.type==="project"||!!e.scope.environmentId&&this.store.controlPlane.listEnvironments(e.projectId).some((t)=>t.id===e.scope.environmentId&&t.kind==="production")}warnings(e,t){let r=[];if(jA.test(e))r.push({key:e,code:"reserved",message:`${e} may be reserved by the runtime or provider.`});if(Buffer.byteLength(t)>65536)r.push({key:e,code:"limit",message:`${e} exceeds the portable 64 KiB value limit.`});return r}affectedResources(e,t,r){let a=this.store.list({projectId:e,scope:t}).filter((l)=>r.includes(l.key)).flatMap((l)=>this.store.dependencies(l.id).map((m)=>m.resourceId));if(t.type==="service"||t.type==="function")return vn([...a,t.id]);if(t.type==="environment")return vn([...a,...this.store.controlPlane.listResources(e,t.id).map((l)=>l.id)]);if(t.type==="preview"){let l=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(t.id);return vn([...a,...l?[l.resource_id]:[]])}return vn([...a,...this.store.controlPlane.listResources(e).map((l)=>l.id)])}audit(e,t,r,a,l){this.store.controlPlane.appendEvent({projectId:e,actorId:t,type:r,payload:{entryId:a.id,key:a.key,kind:a.kind,scopeType:a.scope.type,scopeId:a.scope.id,backend:a.backend,version:a.version,affectedResourceIds:l}})}}async function Zu(e,t,r,a){let l={added:0,changed:0,removed:0,overridden:0},m=async(f,b)=>{let k=e.store.list({projectId:t.project.id,scope:f,kind:"variable"}),y=new Set(Object.keys(b));for(let R of k.filter((T)=>T.origin==="config"&&!y.has(T.key)))await e.remove({entryId:R.id,expectedVersion:R.version,confirmed:!0,actorId:a}),l.removed++;for(let[R,T]of Object.entries(b)){let N=e.store.find(t.project.id,f,R);if(N?.origin!=="config"){if(N)l.overridden++;else await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:f,key:R,kind:"variable",value:String(T),origin:"config",confirmed:!0,actorId:a}),l.added++;continue}if(N.value===String(T))continue;await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:f,key:R,kind:"variable",value:String(T),origin:"config",confirmed:!0,actorId:a,expectedVersion:N.version}),l.changed++}};for(let[f,b]of Object.entries(r.environments??{})){let k=t.environments.get(f);if(!k)continue;let y=b,R={...y.variables??{},...y.app?.env??{}};await m({type:"environment",id:k.id,environmentId:k.id},R);for(let[T,N]of Object.entries(r.sites??{})){let j=t.store.listResources(t.project.id,k.id).find((U)=>U.kind==="application"&&U.slug===T);if(j)await m({type:"service",id:j.id,environmentId:k.id,resourceId:j.id},{...N.env??{}})}for(let[T,N]of Object.entries(r.infrastructure?.functions??{})){let j=t.store.listResources(t.project.id,k.id).find((U)=>U.kind==="function"&&U.slug===T);if(j)await m({type:"function",id:j.id,environmentId:k.id,resourceId:j.id},{...N.environment??{}})}}return l}var BA=async(e)=>{let t=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),[r,a,l]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:a,stderr:l}};class bu{async scan(e,t){return ri(e,t)}async exec(e,t){if(e.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return BA(["ssh","-p",String(e.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${e.sshUser}@${e.endpoint}`,t])}}var MA=lt,LA=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class fn{provider;transport;discoverer;constructor(e,t=new bu,r){this.provider=e;this.transport=t;this.discoverer=r}discover(e){return this.discoverer?.(e)??Promise.resolve([])}async test(e){try{let t=await this.transport.scan(e.endpoint,e.sshPort);return{reachable:!0,hostKeyAlgorithm:t.algorithm,hostKeyFingerprint:MA(t.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(e){let t=await this.transport.exec(e,LA);if(t.code!==0)throw Error(`Fleet validation failed: ${t.stderr.trim()||t.code}`);try{return JSON.parse(t.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(e,t){let r=await this.transport.exec(e,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${t.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function Cu(e,t){return{"fleet.bootstrap":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.get(String(a.serverId??""));if(!l)throw Error("Queued fleet server was not found.");let m=t.find((k)=>k.provider===l.provider);if(!m)throw Error(`No ${l.provider} fleet driver is configured.`);let f=Array.isArray(a.steps)?a.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),l.trustState!=="pinned"||!l.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let b=await m.bootstrap(l,f);return e.update(l.id,{bootstrapVersion:b.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:l.id,bootstrapVersion:b.version,steps:f.length}}}}var ti=(e)=>e==null?void 0:String(e),_o=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Dg=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),resourceId:String(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:ti(e.provider_id),region:ti(e.region),zone:ti(e.zone),endpoint:String(e.endpoint),sshUser:String(e.ssh_user),sshPort:Number(e.ssh_port),credentialRef:String(e.credential_ref),hostKeyAlgorithm:ti(e.host_key_algorithm),hostKeyFingerprint:ti(e.host_key_fingerprint),pendingHostKey:ti(e.pending_host_key),roles:_o(e.roles,[]),labels:_o(e.labels,{}),taints:_o(e.taints,[]),capacity:_o(e.capacity,{}),usage:_o(e.usage,{}),capabilities:_o(e.capabilities,{}),status:String(e.status),trustState:String(e.trust_state),validation:_o(e.validation,void 0),bootstrapVersion:ti(e.bootstrap_version),heartbeatAt:ti(e.heartbeat_at),lastSeenAt:ti(e.last_seen_at),archivedAt:ti(e.archived_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class Ca{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}get(e){let t=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(e);return t?Dg(t):void 0}list(e,t=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(e).map(Dg).filter((r)=>t||r.status!=="archived")}findProvider(e,t,r){let a=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(e,t,r);return a?Dg(a):void 0}create(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.resourceId,e.name,e.provider,e.providerId??null,e.region??null,e.zone??null,e.endpoint,e.sshUser,e.sshPort,e.credentialRef,e.hostKeyAlgorithm??null,e.hostKeyFingerprint??null,e.pendingHostKey??null,JSON.stringify(e.roles),JSON.stringify(e.labels),JSON.stringify(e.taints),JSON.stringify(e.capacity),JSON.stringify(e.usage),JSON.stringify(e.capabilities),e.status,e.trustState,JSON.stringify(e.validation??{}),e.bootstrapVersion??null,e.heartbeatAt??null,e.lastSeenAt??null,e.archivedAt??null,r,r]),this.get(t)}update(e,t){let r=this.get(e);if(!r)throw Error("Server was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[a.name,a.providerId??null,a.region??null,a.zone??null,a.endpoint,a.sshUser,a.sshPort,a.credentialRef,a.hostKeyAlgorithm??null,a.hostKeyFingerprint??null,a.pendingHostKey??null,JSON.stringify(a.roles),JSON.stringify(a.labels),JSON.stringify(a.taints),JSON.stringify(a.capacity),JSON.stringify(a.usage),JSON.stringify(a.capabilities),a.status,a.trustState,JSON.stringify(a.validation??{}),a.bootstrapVersion??null,a.heartbeatAt??null,a.lastSeenAt??null,a.archivedAt??null,l,e]),this.get(e)}}var FA=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class Ea{store;drivers;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.drivers=t;this.now=a;this.queue=r??new c(e.control)}driver(e){let t=this.drivers.find((r)=>r.provider===e);if(!t)throw Error(`No ${e} fleet driver is configured.`);return t}enroll(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Server name is invalid.");if(!FA.test(e.endpoint)||e.sshUser==="root"||!e.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let t=e.providerId?this.store.findProvider(e.organizationId,e.provider,e.providerId):void 0;if(t)return this.store.update(t.id,{endpoint:e.endpoint,region:e.region,zone:e.zone});let r=this.store.control.createResource({projectId:e.projectId,kind:"server",slug:e.name,name:e.name,provider:e.provider,providerId:e.providerId}),a=this.driver(e.provider);return this.store.create({...e,resourceId:r.id,sshPort:e.sshPort??22,labels:e.labels??{},taints:[],capacity:{},usage:{},capabilities:a.capabilities(),status:"pending",trustState:"unverified"})}async test(e){let t=this.store.get(e);if(!t)throw Error("Server was not found.");let r=await this.driver(t.provider).test(t);if(!r.reachable)return this.store.update(e,{status:"unreachable"});if(t.hostKeyFingerprint&&t.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(e,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(e,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(e,t){let r=this.store.get(e);if(!r||r.pendingHostKey!==t)throw Error("Pending host key does not match.");return this.store.update(e,{hostKeyFingerprint:t,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(e){let t=this.store.get(e);if(!t||t.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(t.provider).validate(t),a=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))a.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let f of["curl","tar"])if(!r.tools?.[f])a.push({code:`tool.${f}`,severity:"error",message:`${f} is missing.`,remediation:`Install ${f} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)a.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)a.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let l={valid:!a.some((f)=>f.severity==="error"),facts:r,findings:a,validatedAt:this.now().toISOString(),validatorVersion:"1"},m={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(e,{validation:l,capacity:m,status:l.valid?"ready":"degraded"})}bootstrap(e,t=!1){let r=this.store.get(e);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let a=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!t)return{preview:!0,steps:a};let l=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:e,steps:a},lockKey:`server:${e}`,providerKey:r.provider}).operation;return{preview:!1,steps:a,operation:l}}heartbeat(e,t){let r=this.store.get(e);if(!r)throw Error("Server was not found.");let a=this.now().toISOString();return this.store.update(e,{usage:t.usage,capabilities:t.capabilities??r.capabilities,heartbeatAt:a,lastSeenAt:a,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(e,t=!1){return this.store.update(e,{status:t?"drained":"draining"})}uncordon(e){return this.store.update(e,{status:"ready"})}archive(e,t){let r=this.store.get(e);if(!r||t!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(e,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as Og,createPublicKey as Dv,verify as zA}from"node:crypto";function hn(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(hn).join(",")}]`;return`{${Object.keys(e).sort().map((t)=>`${JSON.stringify(t)}:${hn(e[t])}`).join(",")}}`}var Tu=(e)=>Og("sha256").update(hn(e)).digest("hex"),cs=(e)=>Og("sha256").update(hn(e)).digest("hex"),wu=(e)=>Og("sha256").update(Dv(e).export({type:"spki",format:"der"})).digest("hex");function Ru(e,t,r){try{return zA(null,Buffer.from(hn(e)),Dv(r),Buffer.from(t,"base64"))}catch{return!1}}var Tv=(e)=>e.replace(/^v/,"").split(/[.-]/).slice(0,3).map((t)=>Number(t)||0),xv=(e,t)=>{let r=Tv(e),a=Tv(t);for(let l=0;l<3;l++){let m=(r[l]??0)-(a[l]??0);if(m)return m}return 0};function Du(e,t){let r=[];if(t.schemaVersion<e.minimumSchema)r.push(`schema ${t.schemaVersion} is below ${e.minimumSchema}`);if(t.schemaVersion>e.maximumSchema)r.push(`schema ${t.schemaVersion} is above ${e.maximumSchema}`);if(e.minimumVersion&&xv(t.currentVersion,e.minimumVersion)<0)r.push(`platform ${t.currentVersion} is below ${e.minimumVersion}`);if(xv(e.version,t.currentVersion)<=0)r.push(`version ${e.version} is not newer than ${t.currentVersion}`);if(!e.artifacts.some((a)=>a.platform===t.platform&&a.architecture===t.architecture))r.push(`no artifact for ${t.platform}/${t.architecture}`);return{compatible:r.length===0,reasons:r}}var yi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},jr=(e)=>e==null?void 0:String(e),UA=(e)=>({id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),algorithm:"ed25519",publicKeyPem:String(e.public_key_pem),fingerprint:String(e.fingerprint),revokedAt:jr(e.revoked_at),createdAt:String(e.created_at)}),Ov=(e)=>({id:String(e.id),organizationId:String(e.organization_id),version:String(e.version),channel:String(e.channel),publishedAt:String(e.published_at),keyId:String(e.key_id),digest:String(e.digest),document:yi(e.document,{}),signature:String(e.signature),verificationStatus:String(e.verification_status),compatibility:yi(e.compatibility,{compatible:!1,reasons:[]}),createdAt:String(e.created_at)}),$v=(e)=>({id:String(e.id),projectId:String(e.project_id),name:String(e.name),schedule:String(e.schedule),timezone:String(e.timezone),durationMinutes:Number(e.duration_minutes),allowedOperations:yi(e.allowed_operations,[]),requireApproval:Number(e.require_approval)===1,enabled:Number(e.enabled)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Nv=(e)=>({id:String(e.id),projectId:String(e.project_id),manifestId:String(e.manifest_id),windowId:jr(e.window_id),fromVersion:String(e.from_version),strategy:String(e.strategy),batchSize:Number(e.batch_size),healthGate:yi(e.health_gate,{}),status:String(e.status),currentStage:jr(e.current_stage),backupId:jr(e.backup_id),approvedBy:jr(e.approved_by),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),$g=(e)=>({id:String(e.id),campaignId:String(e.campaign_id),serverId:jr(e.server_id),target:String(e.target),cohort:Number(e.cohort),previousVersion:String(e.previous_version),status:String(e.status),evidence:yi(e.evidence,{}),error:jr(e.error),startedAt:jr(e.started_at),finishedAt:jr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),jv=(e)=>({id:String(e.id),projectId:String(e.project_id),kind:String(e.kind),criteria:yi(e.criteria,{}),candidates:yi(e.candidates,[]),candidateDigest:String(e.candidate_digest),estimatedBytes:Number(e.estimated_bytes),status:String(e.status),confirmation:jr(e.confirmation),expiresAt:String(e.expires_at),result:yi(e.result,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Bv=(e)=>({id:String(e.id),projectId:String(e.project_id),backupPolicyId:jr(e.backup_policy_id),recoveryPointId:jr(e.recovery_point_id),topologyId:jr(e.topology_id),scenario:String(e.scenario),isolatedTarget:String(e.isolated_target),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),status:String(e.status),operationId:jr(e.operation_id),evidence:yi(e.evidence,{}),measuredRpoMinutes:e.measured_rpo_minutes==null?void 0:Number(e.measured_rpo_minutes),measuredRtoMinutes:e.measured_rto_minutes==null?void 0:Number(e.measured_rto_minutes),cleanupVerified:Number(e.cleanup_verified)===1,error:jr(e.error),startedAt:jr(e.started_at),finishedAt:jr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class Pa{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}addTrustedKey(e){let t=this.id(),r=this.now().toISOString(),a=wu(e.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[t,e.organizationId,e.name,e.publicKeyPem,a,r]),this.key(t)}key(e){let t=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(e);return t?UA(t):void 0}revokeKey(e){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),e]),this.key(e)}importManifest(e){let t=this.key(e.keyId);if(!t||t.organizationId!==e.organizationId)throw Error("Trusted update key was not found.");if(t.revokedAt)throw Error("Update signing key is revoked.");if(!Ru(e.document,e.signature,t.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=Du(e.document,e.current),a=Tu(e.document),l=this.id(),m=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[l,e.organizationId,e.document.version,e.document.channel,new Date(e.document.publishedAt).toISOString(),e.keyId,a,JSON.stringify(e.document),e.signature,JSON.stringify(r),m]),this.manifest(l)}manifest(e){let t=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(e);return t?Ov(t):void 0}manifests(e){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(e).map(Ov)}createWindow(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[t,e.projectId,e.name,e.schedule,e.timezone,e.durationMinutes,JSON.stringify(e.allowedOperations),e.requireApproval===!1?0:1,r,r]),this.window(t)}window(e){let t=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(e);return t?$v(t):void 0}windows(e){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(e).map($v)}createCampaign(e){return this.control.transaction(()=>{let t=this.manifest(e.manifestId);if(!t?.compatibility.compatible||t.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!e.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),a=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,e.projectId,e.manifestId,e.windowId??null,e.fromVersion,e.strategy,e.batchSize,JSON.stringify(e.healthGate),e.backupId,e.approvedBy??null,a,a]),e.targets.forEach((l,m)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,l.serverId??null,l.target,e.strategy==="canary"?m===0?0:1+Math.floor((m-1)/e.batchSize):Math.floor(m/e.batchSize),l.previousVersion,a,a])),this.campaign(r)})}campaign(e){let t=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(e);return t?Nv(t):void 0}campaigns(e){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(e).map(Nv)}targets(e){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(e).map($g)}updateCampaign(e,t){let r=this.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a={...r,...t};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[a.status,a.currentStage??null,this.now().toISOString(),e]),this.campaign(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e);if(!r)throw Error("Upgrade target was not found.");let a={...$g(r),...t};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.evidence),a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),$g(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e))}createCleanup(e){let t=[...e.candidates].sort((f,b)=>f.id.localeCompare(b.id)),r=cs(t),a=this.id(),l=this.now().toISOString(),m=new Date(this.now().getTime()+(e.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[a,e.projectId,e.kind,JSON.stringify(e.criteria),JSON.stringify(t),r,t.reduce((f,b)=>f+b.bytes,0),m,l,l]),this.cleanup(a)}cleanup(e){let t=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(e);return t?jv(t):void 0}cleanups(e){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(e).map(jv)}updateCleanup(e,t){let r=this.cleanup(e);if(!r)throw Error("Cleanup plan was not found.");let a={...r,...t};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[a.status,a.confirmation??null,JSON.stringify(a.result),this.now().toISOString(),e]),this.cleanup(e)}createDrill(e){if(!/^isolated:\/\//.test(e.isolatedTarget))throw Error("DR drills require an isolated target.");let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[t,e.projectId,e.backupPolicyId??null,e.recoveryPointId??null,e.topologyId??null,e.scenario,e.isolatedTarget,e.expectedRpoMinutes,e.expectedRtoMinutes,r,r]),this.drill(t)}drill(e){let t=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(e);return t?Bv(t):void 0}drills(e){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(e).map(Bv)}updateDrill(e,t){let r=this.drill(e);if(!r)throw Error("DR drill was not found.");let a={...r,...t};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,JSON.stringify(a.evidence),a.measuredRpoMinutes??null,a.measuredRtoMinutes??null,a.cleanupVerified?1:0,a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),this.drill(e)}}function Uf(e,t=new Date){if(!e.enabled)return!1;let r=new Date(e.schedule);if(!Number.isNaN(r.getTime()))return t>=r&&t.getTime()<=r.getTime()+e.durationMinutes*60000;let a=/^(\d{2}):(\d{2})$/.exec(e.schedule);if(!a)return!1;let l=new Intl.DateTimeFormat("en-US",{timeZone:e.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(t),m=Number(l.find((b)=>b.type==="hour")?.value)*60+Number(l.find((b)=>b.type==="minute")?.value),f=Number(a[1])*60+Number(a[2]);return m>=f&&m<f+e.durationMinutes}class Na{store;now;queue;constructor(e,t,r=()=>new Date){this.store=e;this.now=r;this.queue=t??new c(e.control)}enqueueCampaign(e,t={}){let r=this.store.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a=r.windowId?this.store.window(r.windowId):void 0;if(a&&!a.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(a&&!t.overrideWindow&&!Uf(a,this.now()))throw Error("Upgrade is outside its maintenance window.");if(a?.requireApproval&&!t.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let l=this.queue.enqueue({projectId:r.projectId,actorId:t.approvedBy,kind:"maintenance.upgrade",input:{campaignId:e},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(e,{status:"queued"}),operation:l}}async previewCleanup(e,t){let r=t.find((a)=>a.kind===e.kind);if(!r)throw Error(`No ${e.kind} cleanup driver is configured.`);return this.store.createCleanup({...e,candidates:await r.discover(e.criteria)})}enqueueCleanup(e,t){let r=this.store.cleanup(e);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let a=`DELETE ${r.candidates.length} ${r.kind}`;if(t!==a)throw Error(`Exact confirmation ${a} is required.`);let l=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:e},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(e,{status:"approved",confirmation:t}),operation:l}}enqueueDrill(e){let t=this.store.drill(e);if(!t||t.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.drill",input:{drillId:e},lockKey:`drill:${t.scenario}:${t.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(e,{status:"queued",operationId:r.id}),operation:r}}}var Ng=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function Pu(e){return{"maintenance.upgrade":async(l)=>{let m=e.store.campaign(String(Ng(l.operation.input).campaignId??""));if(!m||!e.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let f=e.store.manifest(m.manifestId);if(!f?.compatibility.compatible||f.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let b=f.document.artifacts.find((y)=>y.platform===process.platform&&y.architecture===process.arch)??f.document.artifacts[0];if(!b)throw Error("No update artifact matches this platform.");e.store.updateCampaign(m.id,{status:"running",currentStage:"preflight"});let k=[];try{for(let y of[...new Set(e.store.targets(m.id).map((R)=>R.cohort))].sort((R,T)=>R-T)){e.store.updateCampaign(m.id,{currentStage:`cohort:${y}`});for(let R of e.store.targets(m.id).filter((T)=>T.cohort===y)){l.throwIfCancellationRequested(),l.checkpoint(`download:${R.target}`,"Downloading signed platform artifact."),e.store.updateTarget(R.id,{status:"downloading",startedAt:new Date().toISOString()});let T=await e.platform.download({target:R,artifact:b,signal:l.signal});if(T.sha256!==b.sha256)throw Error(`Artifact checksum mismatch for ${R.target}.`);l.checkpoint(`install:${R.target}`,"Installing verified artifact."),e.store.updateTarget(R.id,{status:"installing"}),await e.platform.install({target:R,path:T.path,version:f.version,signal:l.signal}),k.push(R);let N=await e.platform.health({target:R,gate:m.healthGate});if(!N.healthy)throw Error(`Upgrade health gate failed for ${R.target}.`);e.store.updateTarget(R.id,{status:"healthy",evidence:N.evidence,finishedAt:new Date().toISOString()})}}return e.store.updateCampaign(m.id,{status:"succeeded",currentStage:void 0}),{campaignId:m.id,version:f.version,targets:k.length}}catch(y){e.store.updateCampaign(m.id,{status:"rolling_back",currentStage:"rollback"});for(let R of k.reverse())e.store.updateTarget(R.id,{status:"rolling_back"}),await e.platform.rollback({target:R,version:R.previousVersion,signal:l.signal}),e.store.updateTarget(R.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw e.store.updateCampaign(m.id,{status:"rolled_back",currentStage:void 0}),y}},"maintenance.cleanup":async(l)=>{let m=e.store.cleanup(String(Ng(l.operation.input).planId??""));if(!m||m.status!=="approved")throw Error("Approved cleanup plan was not found.");if(cs([...m.candidates].sort((R,T)=>R.id.localeCompare(T.id)))!==m.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let f=e.cleanup?.find((R)=>R.kind===m.kind);if(!f)throw Error(`No ${m.kind} cleanup driver is configured.`);e.store.updateCleanup(m.id,{status:"running"});let b=[],k=[];for(let R of m.candidates){l.throwIfCancellationRequested();try{await f.remove(R),b.push(R.id)}catch(T){k.push({id:R.id,error:T instanceof Error?T.message:String(T)})}}let y=k.length?b.length?"partial":"failed":"succeeded";if(e.store.updateCleanup(m.id,{status:y,result:{removed:b,failed:k,reclaimedBytes:m.candidates.filter((R)=>b.includes(R.id)).reduce((R,T)=>R+T.bytes,0)}}),k.length)throw Error(`Cleanup failed for ${k.length} candidate(s).`);return{planId:m.id,removed:b.length,reclaimedBytes:m.estimatedBytes}},"maintenance.drill":async(l)=>{let m=e.store.drill(String(Ng(l.operation.input).drillId??""));if(!m)throw Error("DR drill was not found.");let f=e.recovery?.find((T)=>T.scenario===m.scenario);if(!f)throw Error(`No ${m.scenario} recovery driver is configured.`);let b=new Date;e.store.updateDrill(m.id,{status:"restoring",startedAt:b.toISOString()});let k=m.isolatedTarget,y={},R={};try{l.checkpoint("restore","Restoring into isolated drill target.");let T=await f.restore({drill:m,signal:l.signal});if(!T.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");k=T.target,y=T.evidence;let N=(b.getTime()-new Date(T.recoveryPointAt).getTime())/60000;e.store.updateDrill(m.id,{status:"verifying",measuredRpoMinutes:N,evidence:{restore:y}}),l.checkpoint("verify","Running recovery health checks without production traffic.");let j=await f.verify({drill:m,target:k});R=j.evidence;let U=(Date.now()-b.getTime())/60000;if(!j.healthy||N>m.expectedRpoMinutes||U>m.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");e.store.updateDrill(m.id,{measuredRpoMinutes:N,measuredRtoMinutes:U,evidence:{restore:y,verify:R}})}catch(T){throw e.store.updateDrill(m.id,{status:"failed",error:T instanceof Error?T.message:String(T),evidence:{restore:y,verify:R}}),T}finally{e.store.updateDrill(m.id,{status:"cleaning"});try{await f.cleanup({drill:m,target:k});let T=e.store.drill(m.id);e.store.updateDrill(m.id,{status:T.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(T){e.store.updateDrill(m.id,{status:"cleanup_required",cleanupVerified:!1,error:T instanceof Error?T.message:String(T),finishedAt:new Date().toISOString()})}}return{drillId:m.id,status:e.store.drill(m.id).status}}}}class Qf{transport;constructor(e){this.transport=e}download(e){return this.transport.download({target:e.target.target,url:e.artifact.url,signal:e.signal})}install(e){return this.transport.install({target:e.target.target,path:e.path,version:e.version,signal:e.signal})}health(e){return this.transport.health({target:e.target.target,gate:e.gate})}rollback(e){return this.transport.rollback({target:e.target.target,version:e.version,signal:e.signal})}}var Mv={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class ka{kind;control;projectId;organizationId;constructor(e,t,r,a){this.kind=e;this.control=t;this.projectId=r;this.organizationId=a}async discover(e){let t=Math.max(1,Math.min(3650,Number(e.olderThanDays??30))),r=new Date(Date.now()-t*86400000).toISOString(),a=Mv[this.kind],l=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(a.select).all(l,r).map((f)=>({id:String(f.id),kind:this.kind,label:`${this.kind}:${String(f.id)}`,bytes:Number(f.bytes??0),metadata:{createdAt:String(f.created_at)}}))}async remove(e){if(this.control.database.run(Mv[this.kind].remove,[e.id]).changes!==1)throw Error(`${e.label} changed or is no longer removable.`)}}class Hf{scenario;transport;constructor(e,t){this.scenario=e;this.transport=t}restore(e){return this.transport.restore({scenario:this.scenario,...e})}verify(e){return this.transport.verify({scenario:this.scenario,...e})}cleanup(e){return this.transport.cleanup({scenario:this.scenario,...e})}}var Kn=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},kn=(e)=>e==null?void 0:String(e),Eu=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),ar=(e={})=>({...Eu(),...e});function Lv(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),purpose:String(e.purpose),backend:String(e.backend),region:kn(e.region),architecture:kn(e.architecture),labels:Kn(e.labels,{}),requiredServerLabels:Kn(e.required_server_labels,{}),toleratedTaints:Kn(e.tolerated_taints,[]),capacity:ar(Kn(e.capacity,{})),reserved:Kn(e.reserved,{}),maxWorkloads:Number(e.max_workloads),costWeight:Number(e.cost_weight),spreadKey:kn(e.spread_key),concurrency:Number(e.concurrency),ephemeralWorkspaces:Number(e.ephemeral_workspaces)===1,allowProductionSecrets:Number(e.allow_production_secrets)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Fv(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:kn(e.environment_id),resourceId:String(e.resource_id),releaseId:kn(e.release_id),poolId:String(e.pool_id),serverId:kn(e.server_id),purpose:String(e.purpose),requirements:Kn(e.requirements,{}),decision:Kn(e.decision,{}),stateful:Number(e.stateful)===1,autoReschedule:Number(e.auto_reschedule)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qA(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:kn(e.resource_id),poolId:String(e.pool_id),placementId:kn(e.placement_id),operationId:kn(e.operation_id),sourceSha:String(e.source_sha),buildSpec:Kn(e.build_spec,{}),credentialPolicy:Kn(e.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:kn(e.workspace),cacheKey:kn(e.cache_key),artifactUri:kn(e.artifact_uri),artifactDigest:kn(e.artifact_digest),status:String(e.status),cleanupAt:kn(e.cleanup_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class va{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}createPool(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.purpose,e.backend,e.region??null,e.architecture??null,JSON.stringify(e.labels),JSON.stringify(e.requiredServerLabels),JSON.stringify(e.toleratedTaints),JSON.stringify(ar(e.capacity)),"{}",e.maxWorkloads,e.costWeight,e.spreadKey??null,e.concurrency,e.ephemeralWorkspaces?1:0,e.allowProductionSecrets?1:0,e.status,r,r]),this.getPool(t)}getPool(e){let t=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(e);return t?Lv(t):void 0}listPools(e){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(e).map(Lv)}updatePool(e,t){let r=this.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.reserved),JSON.stringify(a.capacity),a.concurrency,l,e]),this.getPool(e)}addMember(e,t,r={}){let a=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[e,t,JSON.stringify(r),a,a])}members(e){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(e).map((t)=>({serverId:String(t.server_id),status:String(t.status),capacityOverride:Kn(t.capacity_override,{})}))}memberStatus(e,t,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),e,t])}listPlacements(e,t){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(e).map(Fv);return t?.length?r.filter((a)=>t.includes(a.status)):r}getPlacement(e){let t=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(e);return t?Fv(t):void 0}activeUsage(e,t){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(e,this.now().toISOString()),a=t?r.filter((l)=>String(l.server_id)===t):r;return{resources:a.reduce((l,m)=>{let f=ar(Kn(m.resources,{}));for(let b of Object.keys(l))l[b]+=f[b];return l},Eu()),count:a.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(e){return this.control.transaction(()=>{this.expireLeases();let t=this.id(),r=this.id(),a=this.now().toISOString(),l=new Date(this.now().getTime()+(e.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[t,e.projectId,e.environmentId??null,e.resourceId,e.releaseId??null,e.decision.poolId,e.decision.serverId??null,e.requirements.purpose,JSON.stringify(e.requirements),JSON.stringify(e.decision),e.requirements.stateful?1:0,e.requirements.autoReschedule&&!e.requirements.stateful?1:0,a,a]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,t,e.decision.poolId,e.decision.serverId??null,JSON.stringify(ar(e.requirements.resources)),l,a,a]),this.getPlacement(t)})}transitionPlacement(e,t){if(!this.getPlacement(e))throw Error("Placement was not found.");let a=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[t,a,e]),["released","failed","blocked"].includes(t))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[a,e]);return this.getPlacement(e)}createBuild(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[t,e.projectId,e.resourceId??null,e.poolId,e.placementId??null,e.operationId??null,e.sourceSha,JSON.stringify(e.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:e.tokenExpiresAt}),r,r]),this.getBuild(t)}getBuild(e){let t=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(e);return t?qA(t):void 0}updateBuild(e,t){let r=this.getBuild(e);if(!r)throw Error("Remote build was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[a.operationId??null,a.workspace??null,a.cacheKey??null,a.artifactUri??null,a.artifactDigest??null,a.status,a.cleanupAt??null,l,e]),this.getBuild(e)}}var Kd=["cpu","memoryBytes","diskBytes","gpu"],zv=(e,t={})=>Object.entries(t).every(([r,a])=>e[r]===a),VA=(e,t,r)=>Object.fromEntries(Kd.map((a)=>[a,Math.max(0,e[a]-t[a]-(r[a]??0))])),WA=(e,t)=>Kd.every((r)=>e[r]>=(t[r]??0)),HA=(e,t)=>Kd.reduce((r,a)=>r+(t[a]??0)/(e[a]||1),0);class Ta{store;fleet;constructor(e,t){this.store=e;this.fleet=t}poolCandidates(e,t,r){let a=[];for(let l of this.store.listPools(e)){if(l.id===r)continue;let m=[];if(l.status!=="active")m.push(`pool is ${l.status}`);if(l.purpose!==t.purpose)m.push(`purpose is ${l.purpose}`);if(t.region&&l.region!==t.region)m.push(`region is ${l.region??"unset"}`);if(t.architecture&&l.architecture!==t.architecture)m.push(`architecture is ${l.architecture??"unset"}`);if(!zv(l.labels,t.labels))m.push("pool labels do not match");if(l.backend==="server"){let f=this.store.members(l.id);if(!f.length)a.push(this.decision(l,void 0,t,[...m,"pool has no servers"]));for(let b of f){let k=this.fleet.get(b.serverId),y=[...m];if(!k)y.push("server is missing");else this.serverReasons(l,k,b.status,t,y);a.push(this.decision(l,k,t,y,b.capacityOverride))}}else a.push(this.decision(l,void 0,t,m))}return a.sort((l,m)=>Number(m.eligible)-Number(l.eligible)||l.score.cost-m.score.cost||l.score.spread-m.score.spread||l.score.fit-m.score.fit||l.poolName.localeCompare(m.poolName)||(l.serverId??"").localeCompare(m.serverId??""))}serverReasons(e,t,r,a,l){if(r!=="active")l.push(`member is ${r}`);if(t.status!=="ready")l.push(`server is ${t.status}`);if(!t.roles.includes(a.purpose==="build"?"build":a.purpose))l.push(`server lacks ${a.purpose} role`);if(!zv(t.labels,e.requiredServerLabels))l.push("server labels do not match pool selector");for(let m of t.taints)if(!e.toleratedTaints.includes(m))l.push(`taint ${m} is not tolerated`)}decision(e,t,r,a,l={}){let m=ar({...t?.capacity,...l}),f=t?Object.fromEntries(Kd.map((y)=>[y,Math.min(e.capacity[y],m[y])])):e.capacity,b=this.store.activeUsage(e.id,t?.id),k=VA(f,b.resources,e.reserved);if(b.count>=e.maxWorkloads)a.push("workload limit reached");if(r.purpose==="build"&&b.count>=e.concurrency)a.push("build concurrency reached");if(!WA(k,r.resources))a.push("insufficient capacity");return{poolId:e.id,poolName:e.name,serverId:t?.id,eligible:a.length===0,reasons:a,available:k,score:{fit:HA(k,r.resources),spread:b.count,cost:e.costWeight}}}explain(e,t){return this.poolCandidates(e,t)}place(e){return this.store.control.transaction(()=>{let t=this.poolCandidates(e.projectId,e.requirements).find((r)=>r.eligible);if(!t)throw Error(`No eligible capacity: ${this.explain(e.projectId,e.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...e,decision:t})})}activate(e){return this.store.transitionPlacement(e,"active")}release(e){return this.store.transitionPlacement(e,"released")}drainPool(e){let t=this.store.updatePool(e,{status:"draining"}),r=[],a=[];for(let l of this.store.listPlacements(t.projectId,["reserved","active"]).filter((m)=>m.poolId===e)){if(l.stateful){a.push(this.store.transitionPlacement(l.id,"blocked"));continue}this.store.transitionPlacement(l.id,"moving");let m=this.place({projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,releaseId:l.releaseId,requirements:l.requirements});r.push(this.activate(m.id)),this.store.transitionPlacement(l.id,"released")}return{pool:t,moved:r,blocked:a}}drainServer(e,t){this.store.memberStatus(e,t,"draining");let r=this.store.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a=[],l=[];for(let m of this.store.listPlacements(r.projectId,["reserved","active"]).filter((f)=>f.poolId===e&&f.serverId===t)){if(m.stateful){l.push(this.store.transitionPlacement(m.id,"blocked"));continue}this.store.transitionPlacement(m.id,"moving");let f=this.poolCandidates(m.projectId,m.requirements).find((k)=>k.eligible);if(!f){l.push(this.store.transitionPlacement(m.id,"blocked"));continue}let b=this.store.reserve({projectId:m.projectId,environmentId:m.environmentId,resourceId:m.resourceId,releaseId:m.releaseId,requirements:m.requirements,decision:f});a.push(this.activate(b.id)),this.store.transitionPlacement(m.id,"released")}return{moved:a,blocked:l}}reconcileFailure(e){let t=this.fleet.get(e);if(!t)throw Error("Server was not found.");let r=[],a=[];for(let l of this.store.listPlacements(t.projectId,["active"]).filter((m)=>m.serverId===e)){if(l.stateful||!l.autoReschedule){a.push(this.store.transitionPlacement(l.id,"blocked"));continue}this.store.transitionPlacement(l.id,"failed");let m=this.place({projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,releaseId:l.releaseId,requirements:l.requirements});r.push(this.activate(m.id))}return{rescheduled:r,blocked:a}}}class Mf{store;placement;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.placement=t;this.now=a;this.queue=r??new c(e.control)}enqueue(e){if(!/^[a-f0-9]{7,64}$/i.test(e.sourceSha))throw Error("A pinned source commit SHA is required.");let t={purpose:"build",resources:{cpu:1,memoryBytes:1073741824,diskBytes:5368709120},leaseSeconds:3600,...e.requirements},r=this.placement.place({projectId:e.projectId,resourceId:e.resourceId,requirements:t}),a=new Date(this.now().getTime()+900000).toISOString(),l=this.store.createBuild({projectId:e.projectId,resourceId:e.resourceId,poolId:r.poolId,placementId:r.id,sourceSha:e.sourceSha,buildSpec:e.buildSpec,tokenExpiresAt:a}),m=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"build.remote",input:{buildId:l.id},lockKey:`build:${l.id}`,providerKey:`pool:${r.poolId}`,buildSlot:!0,timeoutSeconds:3600,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return l=this.store.updateBuild(l.id,{operationId:m.id}),l}cancel(e){let t=this.store.getBuild(e);if(!t)throw Error("Remote build was not found.");if(t.operationId)this.queue.requestCancellation(t.operationId);return this.store.updateBuild(e,{status:"cancelled"})}}var KA=/^sha256:[a-f0-9]{64}$/,JA=/^(?:s3|https|oci):\/\//;function hS(e,t){return{"build.remote":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.getBuild(String(a.buildId??""));if(!l)throw Error("Queued remote build was not found.");let m=e.getPool(l.poolId);if(!m||m.purpose!=="build"||m.status!=="active")throw Error("The selected build pool is unavailable.");if(!m.ephemeralWorkspaces)throw Error("Remote builds require an ephemeral workspace pool.");if(l.credentialPolicy.productionSecrets||m.allowProductionSecrets)throw Error("Production secrets are forbidden in remote build workers.");if(new Date(l.credentialPolicy.shortLivedTokenExpiresAt)<=new Date)throw Error("The short-lived build credential has expired.");let f=t.find((k)=>k.backend===m.backend);if(!f)throw Error(`No ${m.backend} remote build driver is configured.`);let b=`build://${m.id}/${l.id}`;e.updateBuild(l.id,{status:"running",workspace:b}),r.checkpoint("checkout",`Preparing isolated workspace for ${l.sourceSha}.`);try{r.throwIfCancellationRequested(),r.checkpoint("build","Executing resource-limited build.");let k=await f.run({build:e.getBuild(l.id),pool:m,signal:r.signal,log:(y)=>r.log(y,{stream:"stdout"})});if(r.throwIfCancellationRequested(),!KA.test(k.artifactDigest)||!JA.test(k.artifactUri))throw Error("Builder returned an unverified artifact reference.");return e.updateBuild(l.id,{status:"uploading",cacheKey:k.cacheKey,artifactUri:k.artifactUri,artifactDigest:k.artifactDigest}),r.checkpoint("verify","Verified content-addressed artifact upload."),await f.cleanup({build:e.getBuild(l.id),pool:m}),e.updateBuild(l.id,{status:"succeeded",workspace:void 0,cleanupAt:new Date().toISOString()}),{buildId:l.id,artifactUri:k.artifactUri,artifactDigest:k.artifactDigest,cacheKey:k.cacheKey??null}}catch(k){try{await f.cleanup({build:e.getBuild(l.id),pool:m}),e.updateBuild(l.id,{status:r.cancellationRequested()?"cancelled":"failed",workspace:void 0,cleanupAt:new Date().toISOString()})}catch{e.updateBuild(l.id,{status:"cleanup_required"})}throw k}}}}class as{backend;transport;handles=new Map;constructor(e,t){this.backend=e;this.transport=t}async run({build:e,pool:t,signal:r,log:a}){let l=await this.transport.provision({backend:this.backend,pool:t,build:e,tokenExpiresAt:e.credentialPolicy.shortLivedTokenExpiresAt});return this.handles.set(e.id,l.handle),a(`${this.backend} builder provisioned`),await this.transport.execute({handle:l.handle,spec:e.buildSpec,sourceSha:e.sourceSha,signal:r,onLog:a}),this.transport.publish({handle:l.handle,sourceSha:e.sourceSha})}async cleanup({build:e}){let t=this.handles.get(e.id);if(!t)return;await this.transport.destroy({handle:t}),this.handles.delete(e.id)}}var AS=(e)=>new as("server",e),yS=(e)=>new as("ecs",e),SS=(e)=>new as("asg",e);var bi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Mn=(e)=>e==null?void 0:String(e),Uv=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Mn(e.environment_id),name:String(e.name),hostname:String(e.hostname),homeRegion:String(e.home_region),regions:bi(e.regions,[]),trafficPolicy:String(e.traffic_policy),dataPolicy:bi(e.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(e.status),activeRegion:String(e.active_region),revision:Mn(e.revision),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),jg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),region:String(e.region),role:String(e.role),provider:String(e.provider),stackId:Mn(e.stack_id),stackRevision:Mn(e.stack_revision),status:String(e.status),health:bi(e.health,{}),lastHealthyAt:Mn(e.last_healthy_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Bg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),kind:String(e.kind),sourceRegion:String(e.source_region),targetRegion:String(e.target_region),config:bi(e.config,{}),status:String(e.status),checkpoint:Mn(e.checkpoint),lagSeconds:e.lag_seconds==null?void 0:Number(e.lag_seconds),lastVerifiedAt:Mn(e.last_verified_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Mg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),hostname:String(e.hostname),dnsProvider:String(e.dns_provider),cdnEnabled:Number(e.cdn_enabled)===1,wafEnabled:Number(e.waf_enabled)===1,weights:bi(e.weights,{}),desiredWeights:bi(e.desired_weights,{}),status:String(e.status),providerState:bi(e.provider_state,{}),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),qv=(e)=>({id:String(e.id),topologyId:String(e.topology_id),operationId:Mn(e.operation_id),kind:String(e.kind),requestedRegion:Mn(e.requested_region),revision:Mn(e.revision),plan:bi(e.plan,[]),currentStep:Mn(e.current_step),completedSteps:bi(e.completed_steps,[]),status:String(e.status),error:Mn(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class wa{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}create(e){return this.control.transaction(()=>{if(e.regions.length<2||new Set(e.regions.map((m)=>m.region)).size!==e.regions.length||e.regions.filter((m)=>m.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let t=e.regions.find((m)=>m.role==="primary"),r=this.id(),a=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.name,e.hostname,t.region,JSON.stringify(e.regions),e.trafficPolicy,JSON.stringify(e.dataPolicy),t.region,a,a]);for(let m of e.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,m.region,m.role,m.provider,a,a]);for(let m of e.dataPolicy.replicate)for(let f of e.regions)for(let b of e.regions.filter((k)=>k.region!==f.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,m,f.region,b.region,"{}",a,a]);let l=Object.fromEntries(e.regions.map((m)=>[m.region,m.region===t.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,e.hostname,e.dnsProvider??"route53",e.cdnEnabled?1:0,e.wafEnabled?1:0,JSON.stringify(l),JSON.stringify(l),a,a]),this.get(r)})}get(e){let t=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(e);return t?Uv(t):void 0}list(e){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(e).map(Uv)}targets(e){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(e).map(jg)}channels(e){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(e).map(Bg)}route(e){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(e);return t?Mg(t):void 0}updateTopology(e,t){let r=this.get(e);if(!r)throw Error("Regional topology was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[a.status,a.activeRegion,a.revision??null,JSON.stringify(a.regions),l,e]),this.get(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e);if(!r)throw Error("Regional target was not found.");let a=jg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[l.role,l.stackId??null,l.stackRevision??null,l.status,JSON.stringify(l.health),l.lastHealthyAt??null,m,e]),jg(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e))}updateChannel(e,t){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e);if(!r)throw Error("Replication channel was not found.");let a=Bg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[l.status,l.checkpoint??null,l.lagSeconds??null,l.lastVerifiedAt??null,m,e]),Bg(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e))}updateRoute(e,t){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e);if(!r)throw Error("Traffic route was not found.");let a=Mg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(l.weights),JSON.stringify(l.desiredWeights),l.status,JSON.stringify(l.providerState),m,e]),Mg(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e))}createExecution(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[t,e.topologyId,e.operationId??null,e.kind,e.requestedRegion??null,e.revision??null,JSON.stringify(e.plan),r,r]),this.execution(t)}execution(e){let t=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(e);return t?qv(t):void 0}executions(e){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(e).map(qv)}updateExecution(e,t){let r=this.execution(e);if(!r)throw Error("Regional execution was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[a.operationId??null,a.currentStep??null,JSON.stringify(a.completedSteps),a.status,a.error??null,l,e]),this.execution(e)}}class Ra{store;queue;constructor(e,t){this.store=e;this.queue=t??new c(e.control)}create(e){return this.store.create(e)}plan(e,t,r){if(!this.store.get(e))throw Error("Regional topology was not found.");let l=this.store.targets(e),m=this.store.channels(e);if(t==="rollout")return[...l.filter((f)=>f.role==="secondary").map((f)=>`apply:${f.region}`),...l.filter((f)=>f.role==="primary").map((f)=>`apply:${f.region}`),...m.map((f)=>`replicate:${f.kind}:${f.targetRegion}`),"traffic:activate"];if(t==="failover"||t==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(t==="destroy")return["traffic:drain",...l.filter((f)=>f.role==="secondary").map((f)=>`delete:${f.region}`),...l.filter((f)=>f.role==="primary").map((f)=>`delete:${f.region}`),"complete"];return["observe","repair"]}enqueue(e){let t=this.store.get(e.topologyId);if(!t)throw Error("Regional topology was not found.");if(["failover","failback"].includes(e.kind)&&(!e.targetRegion||!t.regions.some((m)=>m.region===e.targetRegion)))throw Error("A topology target region is required.");if(e.kind==="failover"&&e.targetRegion===t.activeRegion)throw Error("Target region is already active.");if((e.kind==="destroy"||e.deleteData)&&e.confirmation!==t.name)throw Error("Exact topology name confirmation is required.");if(e.deleteData&&t.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(e.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(e.revision??""))throw Error("An immutable revision is required.");let r=this.plan(t.id,e.kind,e.targetRegion),a=this.store.createExecution({topologyId:t.id,kind:e.kind,requestedRegion:e.targetRegion,revision:e.revision,plan:r}),l=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,kind:`region.${e.kind}`,input:{executionId:a.id,manifest:e.manifest??{},deleteData:e.deleteData===!0},lockKey:`regional-topology:${t.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(a.id,{operationId:l.id}),{execution:this.store.execution(a.id),operation:l}}}var GA=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function vu(e,t){let r=(y)=>{let R=t.find((T)=>T.provider===y.provider);if(!R)throw Error(`No ${y.provider} regional driver is configured.`);return R},a=(y,R,T)=>{y.throwIfCancellationRequested(),y.checkpoint(T,T),e.updateExecution(R.id,{status:"running",currentStep:T,completedSteps:[...e.execution(R.id).completedSteps,T]})},l=async(y,R)=>{let T=e.route(y.id);if(!T)throw Error("Regional traffic route was not found.");let N=e.targets(y.id).find((U)=>U.region===y.activeRegion)??e.targets(y.id)[0];if(!N)throw Error("Regional traffic target was not found.");e.updateRoute(T.id,{status:"applying",desiredWeights:R});let j=await r(N).applyTraffic({route:e.route(y.id),topology:y,weights:R});e.updateRoute(T.id,{status:Object.values(R).every((U)=>U===0)?"drained":"in_sync",weights:R,providerState:j.providerState})},m=async(y,R,T,N)=>{e.updateTopology(T.id,{status:"provisioning"});let j=R.revision,U=N.manifest??{},q=e.targets(T.id).sort((ee,le)=>Number(ee.role==="primary")-Number(le.role==="primary"));for(let ee of q){a(y,R,`apply:${ee.region}`),e.updateTarget(ee.id,{status:"provisioning"});let le=await r(ee).applyStack({target:ee,revision:j,manifest:U,signal:y.signal}),Z=await r(ee).health({target:e.updateTarget(ee.id,{stackId:le.stackId,stackRevision:j})});if(!Z.healthy)throw Error(`Regional health gate failed in ${ee.region}.`);e.updateTarget(ee.id,{status:"ready",health:Z.evidence,lastHealthyAt:new Date().toISOString()})}for(let ee of e.channels(T.id)){a(y,R,`replicate:${ee.kind}:${ee.targetRegion}`),e.updateChannel(ee.id,{status:"configuring"});let le=q.find((we)=>we.region===ee.sourceRegion),Z=await r(le).configureReplication({channel:ee,topology:T}),ie=await r(le).verifyReplication({channel:e.updateChannel(ee.id,{checkpoint:Z.checkpoint,lagSeconds:Z.lagSeconds}),topology:T});if(!ie.healthy||ie.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${ee.kind} replication to ${ee.targetRegion} exceeds the RPO.`);e.updateChannel(ee.id,{status:"in_sync",checkpoint:ie.checkpoint,lagSeconds:ie.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(y,R,"traffic:activate");let Y=Object.fromEntries(T.regions.map((ee)=>[ee.region,ee.region===T.activeRegion?100:0]));return await l(T,Y),e.updateTopology(T.id,{status:"ready",revision:j}),{revision:j,activeRegion:T.activeRegion}},f=async(y,R,T)=>{let N=R.requestedRegion,j=e.targets(T.id).find((Y)=>Y.region===N);if(!j)throw Error("Requested regional target was not found.");e.updateTopology(T.id,{status:R.kind==="failover"?"failing_over":"failing_back"}),a(y,R,`health:${N}`);let U=await r(j).health({target:j});if(!U.healthy)throw Error(`Target region ${N} is unhealthy.`);e.updateTarget(j.id,{status:"ready",health:U.evidence,lastHealthyAt:new Date().toISOString()}),a(y,R,`replication:${N}`);for(let Y of e.channels(T.id).filter((ee)=>ee.targetRegion===N)){let ee=await r(j).verifyReplication({channel:Y,topology:T});if(!ee.healthy||ee.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${Y.kind} replication is outside the failover RPO.`);e.updateChannel(Y.id,{status:"in_sync",checkpoint:ee.checkpoint,lagSeconds:ee.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(y,R,`traffic:${N}`),await l(T,Object.fromEntries(T.regions.map((Y)=>[Y.region,Y.region===N?100:0]))),a(y,R,`roles:${N}`);let q=T.regions.map((Y)=>({...Y,role:Y.region===N?"primary":"secondary"}));for(let Y of e.targets(T.id))e.updateTarget(Y.id,{role:Y.region===N?"primary":"secondary"});return e.updateTopology(T.id,{status:R.kind==="failover"?"failed_over":"ready",activeRegion:N,regions:q}),{activeRegion:N}},b=async(y,R,T,N)=>{e.updateTopology(T.id,{status:"destroying"}),a(y,R,"traffic:drain"),await l(T,Object.fromEntries(T.regions.map((U)=>[U.region,0])));let j=N.deleteData!==!0;for(let U of e.targets(T.id).sort((q,Y)=>Number(q.role==="primary")-Number(Y.role==="primary")))a(y,R,`delete:${U.region}`),e.updateTarget(U.id,{status:"deleting"}),await r(U).deleteStack({target:U,retainData:j,signal:y.signal}),e.updateTarget(U.id,{status:"deleted"});return a(y,R,"complete"),e.updateTopology(T.id,{status:"destroyed"}),{destroyed:!0,dataRetained:j}},k=async(y)=>{let R=GA(y.operation.input),T=e.execution(String(R.executionId??""));if(!T)throw Error("Regional execution was not found.");let N=e.get(T.topologyId);if(!N)throw Error("Regional topology was not found.");try{let j;if(T.kind==="rollout")j=await m(y,T,N,R);else if(T.kind==="failover"||T.kind==="failback")j=await f(y,T,N);else if(T.kind==="destroy")j=await b(y,T,N,R);else throw Error("Regional reconciliation is not configured.");return e.updateExecution(T.id,{status:"succeeded",currentStep:void 0}),{executionId:T.id,...j}}catch(j){if(e.updateExecution(T.id,{status:y.cancellationRequested()?"cancelled":"failed",error:j instanceof Error?j.message:String(j)}),e.get(N.id)?.status!=="destroyed")e.updateTopology(N.id,{status:"failed"});throw j}};return{"region.rollout":k,"region.failover":k,"region.failback":k,"region.destroy":k,"region.reconcile":k}}class Ff{transport;provider="aws";constructor(e){this.transport=e}async applyStack({target:e,revision:t,manifest:r}){return this.transport.applyCloudFormation({region:e.region,stackId:e.stackId,revision:t,manifest:r})}async deleteStack({target:e,retainData:t}){if(!e.stackId)return;await this.transport.deleteCloudFormation({region:e.region,stackId:e.stackId,retainData:t})}async health({target:e}){if(!e.stackId)return{healthy:!1,evidence:{reason:"stack is not provisioned"}};return this.transport.stackHealth({region:e.region,stackId:e.stackId})}async configureReplication({channel:e}){let t={sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,config:e.config};if(e.kind==="s3")return this.transport.configureS3Replication(t);if(e.kind==="dynamodb")return this.transport.configureDynamoGlobalTable(t);return this.transport.replicateSecrets(t)}async verifyReplication({channel:e}){return this.transport.verifyReplication({kind:e.kind,sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,checkpoint:e.checkpoint})}async applyTraffic({route:e,weights:t}){return this.transport.applyEdge({hostname:e.hostname,weights:t,route53:e.dnsProvider==="route53",cloudFront:e.cdnEnabled,waf:e.wafEnabled})}}class Da{provider;reason;constructor(e,t="Configure a regional provider transport before executing this operation."){this.provider=e;this.reason=t}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function Ae(e,t,r){return[e,t,r].map((a)=>encodeURIComponent(a)).join(":")}function Rf(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function Tt(e,t,r=["exec","files"]){let a=Rf(t);for(let l of e)a[l]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(l),requiresRecentAuth:r.includes(l)};return a}var QA=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function ke(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function Be(e){if(Array.isArray(e))return e.map((r)=>Be(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,a]of Object.entries(e))t[r]=QA.test(r)?"[REDACTED]":Be(a);return t}function wt(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function du(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function YA(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function lu(e,t={},r={}){let a=t.now??new Date,l=Math.max(100,r.timeoutMs??1e4),m=Math.max(1,r.staleAfterSeconds??60),f=await Promise.all(e.map(async(k)=>{try{let y=await Promise.race([k.discover({...t,now:a}),new Promise((R,T)=>setTimeout(()=>T(Error(`Runtime source ${k.id} timed out after ${l}ms`)),l))]);return{workloads:y,source:{id:k.id,provider:k.provider,status:"fresh",discoveredAt:a.toISOString(),staleAfterSeconds:m,itemCount:y.length}}}catch(y){return{workloads:[],source:{id:k.id,provider:k.provider,status:YA(y),discoveredAt:a.toISOString(),staleAfterSeconds:m,itemCount:0,message:String(y?.message??y).slice(0,500)}}}})),b=f.map((k)=>k.source);return{generatedAt:a.toISOString(),workloads:f.flatMap((k)=>k.workloads).sort((k,y)=>k.name.localeCompare(y.name)||k.id.localeCompare(y.id)),sources:b,degraded:b.some((k)=>k.status!=="fresh")}}function Ls(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function uu(e,t,r,a="ecs:aws",l=[]){let m=r.now??new Date;return e.map((f)=>{let b=f.serviceName??Ls(f.serviceArn),k=t.filter((ee)=>!f.clusterArn||ee.clusterArn===f.clusterArn),y=k.some((ee)=>!!ee.group)?k.filter((ee)=>ee.group===`service:${b}`):k,R=f.status==="ACTIVE"?(f.runningCount??0)<(f.desiredCount??0)?"degraded":"running":ke(f.status),T=l.find((ee)=>ee.taskDefinitionArn===f.taskDefinition),N=Array.isArray(T?.containerDefinitions)?T.containerDefinitions:[],j=[...new Set(N.map((ee)=>ee.logConfiguration?.options?.["awslogs-group"]).filter((ee)=>typeof ee==="string"))],U=N.flatMap((ee)=>(ee.mountPoints??[]).map((le)=>({source:le.sourceVolume,target:le.containerPath,type:"volume",readOnly:!!le.readOnly}))),q=N.flatMap((ee)=>(ee.portMappings??[]).map((le,Z)=>({id:`${ee.name??"container"}:${Z}`,name:ee.name,mode:T?.networkMode,ports:[{container:le.containerPort,host:le.hostPort,protocol:le.protocol}]}))),Y=r.project&&r.environment&&b.startsWith(`${r.project}-${r.environment}-`)?b.slice(`${r.project}-${r.environment}-`.length):b;return{id:Ae("ecs",a,f.serviceArn??b),provider:"ecs",kind:"service",name:b,status:R,rawStatus:f.status,health:R==="running"?"healthy":R==="failed"||R==="degraded"?"unhealthy":"unknown",desiredReplicas:f.desiredCount,runningReplicas:f.runningCount,image:N[0]?.image,runtime:f.launchType??"ECS",version:Ls(f.taskDefinition),ageSeconds:wt(f.deployments?.[0]?.createdAt,m),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:Y,release:Ls(f.taskDefinition),providerId:f.serviceArn},replicas:y.map((ee)=>{let le=ke(ee.lastStatus);return{id:Ae("ecs",a,ee.taskArn??Ls(ee.taskArn)),name:Ls(ee.taskArn),status:le,rawStatus:ee.lastStatus,createdAt:ee.createdAt,startedAt:ee.startedAt,stoppedAt:ee.stoppedAt,host:ee.containerInstanceArn,containers:(ee.containers??[]).map((Z)=>({id:Z.containerArn??Z.name??"container",name:Z.name??"container",image:N.find((ie)=>ie.name===Z.name)?.image,imageDigest:Z.imageDigest,status:ke(Z.lastStatus),rawStatus:Z.lastStatus,exitCode:Z.exitCode,reason:Z.reason,runtime:"ecs"}))}}),networks:q,mounts:U,capabilities:Tt(["start","stop","restart","redeploy","scale","inspect",...j.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:Be({clusterArn:f.clusterArn,taskDefinition:f.taskDefinition,launchType:f.launchType,pendingCount:f.pendingCount,deployments:f.deployments,logGroups:j,executionRoleArn:T?.executionRoleArn,taskRoleArn:T?.taskRoleArn,cpu:T?.cpu,memory:T?.memory}),discoveredAt:m.toISOString(),sourceId:a}})}function gu(e,t,r="lambda:aws"){let a=t.now??new Date;return e.map((l)=>{let m=l.FunctionName??Ls(l.FunctionArn),f=l.State==="Active"?"running":ke(l.State);return{id:Ae("lambda",r,l.FunctionArn??m),provider:"lambda",kind:"function",name:m,status:f,rawStatus:l.State,health:f==="running"?"healthy":f==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:l.Runtime,version:l.Version,architecture:l.Architectures?.join(", "),ageSeconds:wt(l.LastModified,a),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:m,providerId:l.FunctionArn},resources:{memoryLimitBytes:l.MemorySize==null?void 0:l.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:Tt(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:Be({handler:l.Handler,timeout:l.Timeout,codeSize:l.CodeSize,stateReason:l.StateReason,environmentKeys:Object.keys(l.Environment?.Variables??{})}),discoveredAt:a.toISOString(),sourceId:r}})}function Df(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((a)=>a&&typeof a.Id==="string")}function ZA(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,a])=>{let[l,m]=r.split("/");return(a??[]).map((f)=>({container:Number(l)||void 0,host:Number(f.HostPort)||void 0,protocol:m,address:f.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,a])=>({id:a.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[a.IPAddress,a.GlobalIPv6Address].filter(Boolean),ports:t}))}function XA(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function Pf(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((l)=>{let m=l.State?.OOMKilled?"oomkilled":l.State?.Restarting?"starting":l.State?.Status,f=ke(m),b=(l.Name??l.Id.slice(0,12)).replace(/^\//,""),k=l.Config?.Labels??{},y=XA(l),R=ZA(l),T={id:l.Id,name:b,image:l.Config?.Image,imageDigest:l.Image,runtime:"docker",status:f,rawStatus:m,exitCode:l.State?.ExitCode,reason:l.State?.Error,resources:{memoryLimitBytes:l.HostConfig?.Memory||void 0},networks:R,mounts:y};return{id:Ae("docker",r,l.Id),provider:"docker",kind:"container",name:b,status:f,rawStatus:m,health:f==="running"?"healthy":f==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:f==="running"?1:0,image:l.Config?.Image,runtime:"docker",ageSeconds:wt(l.State?.StartedAt,a),restartCount:l.RestartCount??0,tags:k,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:k["com.docker.compose.service"]??k["ts-cloud.service"]??b,release:k["ts-cloud.release"],providerId:l.Id},resources:T.resources,replicas:[{id:Ae("docker",r,`${l.Id}:0`),name:b,status:f,rawStatus:m,startedAt:l.State?.StartedAt,stoppedAt:l.State?.FinishedAt,restartCount:l.RestartCount,containers:[T],resources:T.resources}],networks:R,mounts:y,capabilities:Tt(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:Be({image:l.Config?.Image,labels:k,environmentKeys:(l.Config?.Env??[]).map((N)=>N.split("=",1)[0]),networkMode:l.HostConfig?.NetworkMode}),discoveredAt:a.toISOString(),sourceId:r}})}class oa{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return Pf(Df(await this.inspect(e)),e,this.id)}}function Nf(e){let t=[];for(let r of e.split(`
-`)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,a,l,m,f,b,k,y,R,T,N,j,U,q]=r.split("\t");if(!a||!/^[A-Za-z0-9_.@:-]+\.service$/.test(a))continue;t.push({unit:a,load:l,active:m,sub:f,description:b,enabled:k,pid:Number(y)||void 0,memoryBytes:du(R),restartCount:Number(T)||0,activeSince:N||void 0,fragmentPath:j||void 0,workingDirectory:U?.startsWith("/")?U:void 0,user:q||void 0})}return t}function kf(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((l)=>{let m=ke(l.active==="active"?l.sub||l.active:l.active),f=l.unit.replace(/\.service$/,""),b=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(l.description??"")?.[1]??(t.project&&f.startsWith(`${t.project}-`)?f.slice(t.project.length+1).split("@",1)[0]:void 0),k=f.includes("@")?f.slice(f.indexOf("@")+1):void 0,y=l.workingDirectory?[{target:l.workingDirectory,type:"working-directory"}]:[],R=["start","stop","restart","logs","exec","inspect",...y.length?["files"]:[]];return{id:Ae("systemd",r,l.unit),provider:"systemd",kind:"service",name:f,displayName:l.description||f,status:m,rawStatus:[l.load,l.active,l.sub].filter(Boolean).join("/"),health:m==="running"?"healthy":m==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:m==="running"?1:0,ageSeconds:wt(l.activeSince,a),restartCount:l.restartCount,tags:{enabled:l.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:b,release:k,providerId:l.unit},resources:{memoryBytes:l.memoryBytes},replicas:[{id:Ae("systemd",r,`${l.unit}:main`),name:"main",status:m,pid:l.pid,startedAt:l.activeSince,restartCount:l.restartCount,resources:{memoryBytes:l.memoryBytes}}],networks:[],mounts:y,capabilities:Tt(R,y.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:Be({fragmentPath:l.fragmentPath,workingDirectory:l.workingDirectory,user:l.user,environment:l.environment,enabled:l.enabled}),discoveredAt:a.toISOString(),sourceId:r}})}class aa{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return kf(Nf(await this.read(e)),e,this.id)}}function eC(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function tC(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function rC(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function Vv(e,t,r,a,l){let m=`${e}:${r.id}`,f=async()=>eC(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?tC():rC(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:a.project.slug,Environment:l,Role:"app"}}),m);return e==="systemd"?new aa(f,m):new oa(f,m)}async function Gd(e,t=100){let r=[],a;for(let l=0;l<t;l++){let m=await e(a);if(r.push(...m.items),!m.nextToken)return r;a=m.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class pu{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await Gd(async(m)=>{let f=await this.client.listClusters({nextToken:m,maxResults:100});return{items:f.clusterArns??[],nextToken:f.nextToken}}),r=[],a=[],l=[];for(let m of t){let f=(await Gd(async(b)=>{let k=await this.client.listServices(m,{nextToken:b,maxResults:100});return{items:k.serviceArns??[],nextToken:k.nextToken}})).filter((b)=>b.split("/").at(-1)?.startsWith(this.prefix));for(let b=0;b<f.length;b+=10){let k=await this.client.describeServices({cluster:m,services:f.slice(b,b+10)});r.push(...k.services??[])}for(let b of r.filter((k)=>k.clusterArn===m||!k.clusterArn)){let k=await Gd(async(y)=>{let R=await this.client.listTasks(m,b.serviceName,{nextToken:y,maxResults:100});return{items:R.taskArns??[],nextToken:R.nextToken}});for(let y=0;y<k.length;y+=100){let R=await this.client.describeTasks(m,k.slice(y,y+100));a.push(...R.tasks??[])}}}if(this.client.describeTaskDefinition)for(let m of[...new Set(r.map((f)=>f.taskDefinition).filter((f)=>!!f))]){let f=await this.client.describeTaskDefinition(m);if(f.taskDefinition)l.push(f.taskDefinition)}return uu(r,a,e,this.id,l)}}class mu{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await Gd(async(r)=>{let a=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:a.Functions??[],nextToken:a.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return gu(t,e,this.id)}}async function Bf(e,t,r={}){let a=[],l=Q(e),m=fe(e),f=e.aws?.profile,b=e.aws?.region??e.project.region??"us-east-1",k=`${e.project.slug}-${t}`;if(l!=="serverless"){let y=r.driver??O({config:e}),R=await y.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let T of R)a.push(Vv("systemd",y,T,e,t)),a.push(Vv("docker",y,T,e,t))}if(m==="aws")a.push(new pu(r.ecs??new nt(b,f),k)),a.push(new mu(r.lambda??new E(b,f),k));return a}async function oe(e,t,r={}){let a={project:e.project.slug,environment:t};try{return await lu(await Bf(e,t,r),a)}catch(l){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:fe(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(l?.message??l).slice(0,500)}],degraded:!0}}}var Wv=65536,mc=49152,Yd=/^[A-Za-z0-9_.@:-]+\.service$/,Zd=/^[a-fA-F0-9]{12,128}$/,nC=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function Fs(e){let t=Buffer.from(e);return t.byteLength<=Wv?e:`${t.subarray(0,Wv-24).toString("utf8")}
-[output truncated]`}function Qd(e){return{success:!1,instanceCount:0,perInstance:[],error:e instanceof Error?e.message:String(e)}}function Ln(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function iC(e,t){return Number.isFinite(e)?Math.min(1e4,Math.max(0,Math.floor(e))):t}function oC(e){let t=e.config,r=typeof t.clusterArn==="string"?t.clusterArn:void 0,a=e.links.providerId||e.name;return r&&a?{cluster:r,service:a}:void 0}function sC(e,t){return e.find((r)=>r.id===t.links.server)??(e.length===1?e[0]:void 0)}function aC(e,t){if(e.provider==="systemd"){let r=e.links.providerId;if(!r||!Yd.test(r)||!["start","stop","restart"].includes(t))return;return[`systemctl ${t} ${r}`,`systemctl is-active ${r} 2>/dev/null || true`]}if(e.provider==="docker"){let r=e.links.providerId;if(!r||!Zd.test(r)||!["start","stop","restart"].includes(t))return;return[`docker ${t} ${r}`,`docker inspect --format '{{.State.Status}}' ${r}`]}return}function xf(e,t){if(!t.startsWith("/")||t.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let r=[];for(let b of t.split("/")){if(!b||b===".")continue;if(b===".."){if(!r.length)return{ok:!1,error:"Path traversal is not allowed."};r.pop()}else r.push(b)}let a=`/${r.join("/")}`;if(nC.some((b)=>a===b||a.startsWith(`${b}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let l=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),m=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...l&&m?[`/var/www/${l}/${m}`,`/srv/${l}/${m}`]:[],...e.mounts.map((b)=>b.target).filter((b)=>b.startsWith("/"))].some((b)=>a===b||a.startsWith(`${b.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:a}}function cC(e,t){let r=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),a=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...r&&a?[`/var/www/${r}/${a}`,`/srv/${r}/${a}`]:[],...e.mounts.map((l)=>l.target).filter((l)=>l.startsWith("/"))].sort((l,m)=>m.length-l.length).find((l)=>t===l||t.startsWith(`${l.replace(/\/$/,"")}/`))}var fu={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class ye{config;environment;dependencies;region;profile;constructor(e,t,r={}){this.config=e;this.environment=t;this.dependencies=r;this.region=e.aws?.region??e.project.region??"us-east-1",this.profile=e.aws?.profile}async inventory(){return this.dependencies.inventory?.()??oe(this.config,this.environment,{driver:this.dependencies.driver})}async workload(e){return(await this.inventory()).workloads.find((t)=>t.id===e)}async remote(e,t,r,a){let l=this.dependencies.driver??O({config:this.config}),m=await l.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),f=sC(m,e);if(!f)throw Error("The workload server is no longer reachable in this scope.");return l.runRemoteDeploy({targets:[f],commands:t,timeoutSeconds:r,comment:a,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(e){let t=await this.workload(e.workloadId),r={workloadId:e.workloadId,action:e.action};if(!t)return{...r,ok:!1,error:"Workload was not found in the current project and environment."};let a=t.capabilities[e.action];if(!a.supported)return{...r,ok:!1,error:a.reason??`${e.action} is unsupported for ${t.provider}.`};if(a.requiresConfirmation&&e.confirm!==t.name)return{...r,ok:!1,error:`Type "${t.name}" to ${e.action} this workload.`};if(a.requiresRecentAuth&&!e.recentAuth)return{...r,ok:!1,error:"Sign in again before using elevated runtime access."};if(e.action==="inspect")return{...r,ok:!0,workload:t};if(t.provider==="systemd"||t.provider==="docker"){let l=aC(t,e.action);if(!l)return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`};let m=await this.remote(t,["set -uo pipefail",...l],60,`ts-cloud runtime:${e.action}`).catch(Qd);return{...r,ok:m.success,command:l[0],stdout:Fs(m.perInstance?.[0]?.output??""),stderr:Fs(m.perInstance?.[0]?.error??m.error??""),error:m.success?void 0:m.error??"Runtime operation failed."}}if(t.provider==="ecs"){let l=oC(t);if(!l)return{...r,ok:!1,error:"ECS cluster or service identity is unavailable."};let m=this.dependencies.ecs??new nt(this.region,this.profile);if(e.action==="scale"){let f=iC(e.replicas,t.desiredReplicas??1);return await m.scaleService(l.cluster,l.service,f),{...r,ok:!0,command:`ecs scale ${t.name} ${f}`}}if(e.action==="start"||e.action==="stop"){let f=e.action==="stop"?0:Math.max(1,t.desiredReplicas??1);return await m.scaleService(l.cluster,l.service,f),{...r,ok:!0,command:`ecs scale ${t.name} ${f}`}}if(e.action==="restart"||e.action==="redeploy")return await m.forceNewDeployment(l.cluster,l.service),{...r,ok:!0,command:`ecs redeploy ${t.name}`}}return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`}}async exec(e){let t={workloadId:e.workloadId,preset:e.preset},r=await this.workload(e.workloadId);if(!r)return{...t,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{...t,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!r.capabilities.exec.supported)return{...t,ok:!1,error:r.capabilities.exec.reason??"Exec is unsupported for this workload."};if(e.confirm!==r.name)return{...t,ok:!1,error:`Type "${r.name}" to open exec access.`};if(!e.recentAuth)return{...t,ok:!1,error:"Sign in again before using elevated runtime access."};let a=e.preset&&fu[e.preset];if(!a&&!e.command?.trim())return{...t,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(e.command&&r.provider!=="docker")return{...t,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let l=r.links.providerId??"",m;if(r.provider==="docker"&&Zd.test(l)){let b=e.command?.trim()||a.map(Ln).join(" ");m=`docker exec ${l} sh -lc ${Ln(b)}`}else if(r.provider==="systemd"&&Yd.test(l)&&e.preset)m=e.preset==="process"?`systemctl status ${l} --no-pager --full`:fu[e.preset].map(Ln).join(" ");if(!m)return{...t,ok:!1,error:"Exec target identity is invalid or unsupported."};let f=await this.remote(r,["set -uo pipefail",m],60,"ts-cloud runtime:exec").catch(Qd);return{...t,ok:f.success,command:m,stdout:Fs(f.perInstance?.[0]?.output??""),stderr:Fs(f.perInstance?.[0]?.error??f.error??""),error:f.success?void 0:f.error??"Exec command failed."}}async readFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};let{workload:a,path:l,root:m,providerId:f}=r,k=`sh -c ${Ln('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${Ln(l)} ${mc} ${Ln(m)}`,y=a.provider==="docker"?`docker exec ${f} ${k}`:k,R=await this.remote(a,[y],30,"ts-cloud runtime:file-read").catch(Qd);if(!R.success)return{...t,ok:!1,error:R.error??R.perInstance?.[0]?.error??"File read failed."};let T=R.perInstance?.[0]?.output??"",N=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(T);if(!N)return{...t,ok:!1,error:"The remote file response was invalid."};let j=Number(N[1]),U=T.slice((N.index??0)+N[0].length).replace(/\s+/g,"");if(Buffer.from(U,"base64").byteLength>mc)return{...t,ok:!1,error:"The remote file exceeded the transfer limit."};return{...t,ok:!0,contentBase64:U,size:j,truncated:j>mc}}async writeFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(e.contentBase64))return{...t,ok:!1,error:"File content must be valid base64."};let a=Buffer.from(e.contentBase64,"base64");if(a.toString("base64")!==e.contentBase64)return{...t,ok:!1,error:"File content must be canonical base64."};if(a.byteLength>mc)return{...t,ok:!1,error:`File uploads are limited to ${mc} bytes.`};let{workload:l,path:m,root:f,providerId:b}=r,y=`sh -c ${Ln('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${Ln(m)} ${Ln(f)}`,R=l.provider==="docker"?`printf %s ${Ln(e.contentBase64)} | docker exec -i ${b} ${y}`:`printf %s ${Ln(e.contentBase64)} | ${y}`,T=await this.remote(l,[R],30,"ts-cloud runtime:file-write").catch(Qd);return{...t,ok:T.success,size:a.byteLength,truncated:!1,error:T.success?void 0:T.error??T.perInstance?.[0]?.error??"File write failed."}}async fileTarget(e){let t=await this.workload(e.workloadId);if(!t)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!t.capabilities.files.supported)return{error:t.capabilities.files.reason??"File access is unsupported for this workload."};if(e.confirm!==t.name)return{error:`Type "${t.name}" to access workload files.`};if(!e.recentAuth)return{error:"Sign in again before using elevated runtime access."};let r=xf(t,e.path);if(!r.ok)return{error:r.error};let a=cC(t,r.path),l=t.links.providerId??"";if(!a||t.provider==="systemd"&&!Yd.test(l)||t.provider==="docker"&&!Zd.test(l))return{error:"File target identity is invalid or unsupported."};return{workload:t,path:r.path,root:a,providerId:l}}async logs(e,t={}){let r=await this.workload(e);if(!r)throw Error("Workload was not found in the current project and environment.");if(!r.capabilities.logs.supported)throw Error(r.capabilities.logs.reason??"Logs are unsupported for this workload.");let a=Math.min(1000,Math.max(1,Math.floor(t.limit??200)));if(r.provider==="lambda"||r.provider==="ecs"){let R=this.dependencies.logs??new Ie(this.region,this.profile),T=r.config.logGroups,N=r.provider==="lambda"?`/aws/lambda/${r.name}`:Array.isArray(T)&&typeof T[0]==="string"?T[0]:void 0;if(!N)throw Error("The ECS task definition does not declare an awslogs group.");let j=await R.filterLogEvents({logGroupName:N,startTime:t.since?.getTime(),limit:a}),U=(j.events??[]).slice(0,a).map((q)=>({timestamp:q.timestamp==null?void 0:new Date(q.timestamp).toISOString(),message:Fs(String(q.message??""))}));return{workloadId:e,provider:r.provider,lines:U,nextCursor:j.nextToken,truncated:(j.events?.length??0)>=a}}let l=r.links.providerId??"",m=t.since&&Number.isFinite(t.since.getTime())?t.since:void 0,f=r.provider==="systemd"&&Yd.test(l)?`journalctl -u ${l} --no-pager -n ${a} -o short-iso${m?` --since ${Ln(m.toISOString())}`:""}`:r.provider==="docker"&&Zd.test(l)?`docker logs --timestamps --tail ${a}${m?` --since ${Math.floor(m.getTime()/1000)}`:""} ${l} 2>&1`:void 0;if(!f)throw Error("Log target identity is invalid.");let b=await this.remote(r,[f],30,"ts-cloud runtime:logs");if(!b.success)throw Error(b.error??b.perInstance?.[0]?.error??"Log read failed.");let k=Fs(b.perInstance?.[0]?.output??""),y=k.split(`
+`))}}async reveal(e){let t=this.store.get(e.entryId);if(!t||t.kind!=="secret")throw Error("Configuration secret was not found.");if(!e.canRevealSecrets)throw Error("Secret reveal permission is required.");if(!e.recentlyAuthenticated)throw Error("Recent authentication is required to reveal a secret.");let r=await this.backend(t.backend).resolve(t.secretRef);return this.audit(t.projectId,e.actorId,"configuration.secret.revealed",t,[]),r}async remove(e){let t=this.store.get(e.entryId);if(!t)throw Error("Configuration entry was not found.");let r=this.store.dependencies(t.id);if(((t.scope.environmentId?this.store.controlPlane.listEnvironments(t.projectId).some((f)=>f.id===t.scope.environmentId&&f.kind==="production"):t.scope.type==="project")||r.length)&&!e.confirmed)throw Error("Confirmation is required because this configuration affects production or dependent services.");if(t.kind==="secret"&&t.backend!=="external")await this.backend(t.backend).remove(t.secretRef);this.store.remove(t.id,e.expectedVersion);let l=vn(r.map((f)=>f.resourceId)),m={added:[],changed:[],removed:[t.key],unchanged:[],affectedResourceIds:l,versions:{}};return this.audit(t.projectId,e.actorId,"configuration.deleted",t,l),m}applies(e,t){if(e.scope.type==="project")return!0;if(e.scope.type==="environment")return e.scope.id===t.environmentId;if(e.scope.type==="service")return e.scope.id===t.resourceId;if(e.scope.type==="function")return e.scope.id===t.functionId;return e.scope.id===t.previewId}rank(e){return{project:0,environment:1,service:2,function:3,preview:4}[e]}fingerprint(e){return`hmac-sha256:${$A("sha256",this.fingerprintKey).update(e).digest("hex")}`}requestHash(e){return this.fingerprint(JSON.stringify({...e,idempotencyKey:void 0,actorId:void 0}))}backend(e){let t=this.backends.get(e);if(!t)throw Error(`Configuration secret backend is not configured: ${e}`);return t}backendName(e){return`ts-cloud/${e.projectId}/${e.scope.type}/${e.scope.id}/${e.key}`.replace(/[^A-Za-z0-9/_+=.@-]/g,"-")}isProduction(e){return e.scope.type==="project"||!!e.scope.environmentId&&this.store.controlPlane.listEnvironments(e.projectId).some((t)=>t.id===e.scope.environmentId&&t.kind==="production")}warnings(e,t){let r=[];if(jA.test(e))r.push({key:e,code:"reserved",message:`${e} may be reserved by the runtime or provider.`});if(Buffer.byteLength(t)>65536)r.push({key:e,code:"limit",message:`${e} exceeds the portable 64 KiB value limit.`});return r}affectedResources(e,t,r){let a=this.store.list({projectId:e,scope:t}).filter((l)=>r.includes(l.key)).flatMap((l)=>this.store.dependencies(l.id).map((m)=>m.resourceId));if(t.type==="service"||t.type==="function")return vn([...a,t.id]);if(t.type==="environment")return vn([...a,...this.store.controlPlane.listResources(e,t.id).map((l)=>l.id)]);if(t.type==="preview"){let l=this.store.controlPlane.database.query("SELECT resource_id FROM preview_instances WHERE id=?").get(t.id);return vn([...a,...l?[l.resource_id]:[]])}return vn([...a,...this.store.controlPlane.listResources(e).map((l)=>l.id)])}audit(e,t,r,a,l){this.store.controlPlane.appendEvent({projectId:e,actorId:t,type:r,payload:{entryId:a.id,key:a.key,kind:a.kind,scopeType:a.scope.type,scopeId:a.scope.id,backend:a.backend,version:a.version,affectedResourceIds:l}})}}async function Zu(e,t,r,a){let l={added:0,changed:0,removed:0,overridden:0},m=async(f,b)=>{let k=e.store.list({projectId:t.project.id,scope:f,kind:"variable"}),y=new Set(Object.keys(b));for(let R of k.filter((T)=>T.origin==="config"&&!y.has(T.key)))await e.remove({entryId:R.id,expectedVersion:R.version,confirmed:!0,actorId:a}),l.removed++;for(let[R,T]of Object.entries(b)){let N=e.store.find(t.project.id,f,R);if(N?.origin!=="config"){if(N)l.overridden++;else await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:f,key:R,kind:"variable",value:String(T),origin:"config",confirmed:!0,actorId:a}),l.added++;continue}if(N.value===String(T))continue;await e.set({organizationId:t.organization.id,projectId:t.project.id,scope:f,key:R,kind:"variable",value:String(T),origin:"config",confirmed:!0,actorId:a,expectedVersion:N.version}),l.changed++}};for(let[f,b]of Object.entries(r.environments??{})){let k=t.environments.get(f);if(!k)continue;let y=b,R={...y.variables??{},...y.app?.env??{}};await m({type:"environment",id:k.id,environmentId:k.id},R);for(let[T,N]of Object.entries(r.sites??{})){let j=t.store.listResources(t.project.id,k.id).find((U)=>U.kind==="application"&&U.slug===T);if(j)await m({type:"service",id:j.id,environmentId:k.id,resourceId:j.id},{...N.env??{}})}for(let[T,N]of Object.entries(r.infrastructure?.functions??{})){let j=t.store.listResources(t.project.id,k.id).find((U)=>U.kind==="function"&&U.slug===T);if(j)await m({type:"function",id:j.id,environmentId:k.id,resourceId:j.id},{...N.environment??{}})}}return l}var BA=async(e)=>{let t=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),[r,a,l]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:a,stderr:l}};class bu{async scan(e,t){return ri(e,t)}async exec(e,t){if(e.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return BA(["ssh","-p",String(e.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${e.sshUser}@${e.endpoint}`,t])}}var MA=lt,LA=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class fn{provider;transport;discoverer;constructor(e,t=new bu,r){this.provider=e;this.transport=t;this.discoverer=r}discover(e){return this.discoverer?.(e)??Promise.resolve([])}async test(e){try{let t=await this.transport.scan(e.endpoint,e.sshPort);return{reachable:!0,hostKeyAlgorithm:t.algorithm,hostKeyFingerprint:MA(t.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(e){let t=await this.transport.exec(e,LA);if(t.code!==0)throw Error(`Fleet validation failed: ${t.stderr.trim()||t.code}`);try{return JSON.parse(t.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(e,t){let r=await this.transport.exec(e,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${t.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function Cu(e,t){return{"fleet.bootstrap":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.get(String(a.serverId??""));if(!l)throw Error("Queued fleet server was not found.");let m=t.find((k)=>k.provider===l.provider);if(!m)throw Error(`No ${l.provider} fleet driver is configured.`);let f=Array.isArray(a.steps)?a.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),l.trustState!=="pinned"||!l.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let b=await m.bootstrap(l,f);return e.update(l.id,{bootstrapVersion:b.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:l.id,bootstrapVersion:b.version,steps:f.length}}}}var ti=(e)=>e==null?void 0:String(e),_o=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Dg=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),resourceId:String(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:ti(e.provider_id),region:ti(e.region),zone:ti(e.zone),endpoint:String(e.endpoint),sshUser:String(e.ssh_user),sshPort:Number(e.ssh_port),credentialRef:String(e.credential_ref),hostKeyAlgorithm:ti(e.host_key_algorithm),hostKeyFingerprint:ti(e.host_key_fingerprint),pendingHostKey:ti(e.pending_host_key),roles:_o(e.roles,[]),labels:_o(e.labels,{}),taints:_o(e.taints,[]),capacity:_o(e.capacity,{}),usage:_o(e.usage,{}),capabilities:_o(e.capabilities,{}),status:String(e.status),trustState:String(e.trust_state),validation:_o(e.validation,void 0),bootstrapVersion:ti(e.bootstrap_version),heartbeatAt:ti(e.heartbeat_at),lastSeenAt:ti(e.last_seen_at),archivedAt:ti(e.archived_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class Ca{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}get(e){let t=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(e);return t?Dg(t):void 0}list(e,t=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(e).map(Dg).filter((r)=>t||r.status!=="archived")}findProvider(e,t,r){let a=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(e,t,r);return a?Dg(a):void 0}create(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.resourceId,e.name,e.provider,e.providerId??null,e.region??null,e.zone??null,e.endpoint,e.sshUser,e.sshPort,e.credentialRef,e.hostKeyAlgorithm??null,e.hostKeyFingerprint??null,e.pendingHostKey??null,JSON.stringify(e.roles),JSON.stringify(e.labels),JSON.stringify(e.taints),JSON.stringify(e.capacity),JSON.stringify(e.usage),JSON.stringify(e.capabilities),e.status,e.trustState,JSON.stringify(e.validation??{}),e.bootstrapVersion??null,e.heartbeatAt??null,e.lastSeenAt??null,e.archivedAt??null,r,r]),this.get(t)}update(e,t){let r=this.get(e);if(!r)throw Error("Server was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[a.name,a.providerId??null,a.region??null,a.zone??null,a.endpoint,a.sshUser,a.sshPort,a.credentialRef,a.hostKeyAlgorithm??null,a.hostKeyFingerprint??null,a.pendingHostKey??null,JSON.stringify(a.roles),JSON.stringify(a.labels),JSON.stringify(a.taints),JSON.stringify(a.capacity),JSON.stringify(a.usage),JSON.stringify(a.capabilities),a.status,a.trustState,JSON.stringify(a.validation??{}),a.bootstrapVersion??null,a.heartbeatAt??null,a.lastSeenAt??null,a.archivedAt??null,l,e]),this.get(e)}}var FA=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class Ea{store;drivers;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.drivers=t;this.now=a;this.queue=r??new c(e.control)}driver(e){let t=this.drivers.find((r)=>r.provider===e);if(!t)throw Error(`No ${e} fleet driver is configured.`);return t}enroll(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Server name is invalid.");if(!FA.test(e.endpoint)||e.sshUser==="root"||!e.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let t=e.providerId?this.store.findProvider(e.organizationId,e.provider,e.providerId):void 0;if(t)return this.store.update(t.id,{endpoint:e.endpoint,region:e.region,zone:e.zone});let r=this.store.control.createResource({projectId:e.projectId,kind:"server",slug:e.name,name:e.name,provider:e.provider,providerId:e.providerId}),a=this.driver(e.provider);return this.store.create({...e,resourceId:r.id,sshPort:e.sshPort??22,labels:e.labels??{},taints:[],capacity:{},usage:{},capabilities:a.capabilities(),status:"pending",trustState:"unverified"})}async test(e){let t=this.store.get(e);if(!t)throw Error("Server was not found.");let r=await this.driver(t.provider).test(t);if(!r.reachable)return this.store.update(e,{status:"unreachable"});if(t.hostKeyFingerprint&&t.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(e,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(e,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(e,t){let r=this.store.get(e);if(!r||r.pendingHostKey!==t)throw Error("Pending host key does not match.");return this.store.update(e,{hostKeyFingerprint:t,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(e){let t=this.store.get(e);if(!t||t.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(t.provider).validate(t),a=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))a.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let f of["curl","tar"])if(!r.tools?.[f])a.push({code:`tool.${f}`,severity:"error",message:`${f} is missing.`,remediation:`Install ${f} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)a.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)a.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let l={valid:!a.some((f)=>f.severity==="error"),facts:r,findings:a,validatedAt:this.now().toISOString(),validatorVersion:"1"},m={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(e,{validation:l,capacity:m,status:l.valid?"ready":"degraded"})}bootstrap(e,t=!1){let r=this.store.get(e);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let a=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!t)return{preview:!0,steps:a};let l=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:e,steps:a},lockKey:`server:${e}`,providerKey:r.provider}).operation;return{preview:!1,steps:a,operation:l}}heartbeat(e,t){let r=this.store.get(e);if(!r)throw Error("Server was not found.");let a=this.now().toISOString();return this.store.update(e,{usage:t.usage,capabilities:t.capabilities??r.capabilities,heartbeatAt:a,lastSeenAt:a,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(e,t=!1){return this.store.update(e,{status:t?"drained":"draining"})}uncordon(e){return this.store.update(e,{status:"ready"})}archive(e,t){let r=this.store.get(e);if(!r||t!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(e,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as Og,createPublicKey as Dv,verify as zA}from"node:crypto";function hn(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(hn).join(",")}]`;return`{${Object.keys(e).sort().map((t)=>`${JSON.stringify(t)}:${hn(e[t])}`).join(",")}}`}var Tu=(e)=>Og("sha256").update(hn(e)).digest("hex"),cs=(e)=>Og("sha256").update(hn(e)).digest("hex"),wu=(e)=>Og("sha256").update(Dv(e).export({type:"spki",format:"der"})).digest("hex");function Ru(e,t,r){try{return zA(null,Buffer.from(hn(e)),Dv(r),Buffer.from(t,"base64"))}catch{return!1}}var Tv=(e)=>e.replace(/^v/,"").split(/[.-]/).slice(0,3).map((t)=>Number(t)||0),xv=(e,t)=>{let r=Tv(e),a=Tv(t);for(let l=0;l<3;l++){let m=(r[l]??0)-(a[l]??0);if(m)return m}return 0};function Du(e,t){let r=[];if(t.schemaVersion<e.minimumSchema)r.push(`schema ${t.schemaVersion} is below ${e.minimumSchema}`);if(t.schemaVersion>e.maximumSchema)r.push(`schema ${t.schemaVersion} is above ${e.maximumSchema}`);if(e.minimumVersion&&xv(t.currentVersion,e.minimumVersion)<0)r.push(`platform ${t.currentVersion} is below ${e.minimumVersion}`);if(xv(e.version,t.currentVersion)<=0)r.push(`version ${e.version} is not newer than ${t.currentVersion}`);if(!e.artifacts.some((a)=>a.platform===t.platform&&a.architecture===t.architecture))r.push(`no artifact for ${t.platform}/${t.architecture}`);return{compatible:r.length===0,reasons:r}}var yi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},jr=(e)=>e==null?void 0:String(e),UA=(e)=>({id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),algorithm:"ed25519",publicKeyPem:String(e.public_key_pem),fingerprint:String(e.fingerprint),revokedAt:jr(e.revoked_at),createdAt:String(e.created_at)}),Ov=(e)=>({id:String(e.id),organizationId:String(e.organization_id),version:String(e.version),channel:String(e.channel),publishedAt:String(e.published_at),keyId:String(e.key_id),digest:String(e.digest),document:yi(e.document,{}),signature:String(e.signature),verificationStatus:String(e.verification_status),compatibility:yi(e.compatibility,{compatible:!1,reasons:[]}),createdAt:String(e.created_at)}),$v=(e)=>({id:String(e.id),projectId:String(e.project_id),name:String(e.name),schedule:String(e.schedule),timezone:String(e.timezone),durationMinutes:Number(e.duration_minutes),allowedOperations:yi(e.allowed_operations,[]),requireApproval:Number(e.require_approval)===1,enabled:Number(e.enabled)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Nv=(e)=>({id:String(e.id),projectId:String(e.project_id),manifestId:String(e.manifest_id),windowId:jr(e.window_id),fromVersion:String(e.from_version),strategy:String(e.strategy),batchSize:Number(e.batch_size),healthGate:yi(e.health_gate,{}),status:String(e.status),currentStage:jr(e.current_stage),backupId:jr(e.backup_id),approvedBy:jr(e.approved_by),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),$g=(e)=>({id:String(e.id),campaignId:String(e.campaign_id),serverId:jr(e.server_id),target:String(e.target),cohort:Number(e.cohort),previousVersion:String(e.previous_version),status:String(e.status),evidence:yi(e.evidence,{}),error:jr(e.error),startedAt:jr(e.started_at),finishedAt:jr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),jv=(e)=>({id:String(e.id),projectId:String(e.project_id),kind:String(e.kind),criteria:yi(e.criteria,{}),candidates:yi(e.candidates,[]),candidateDigest:String(e.candidate_digest),estimatedBytes:Number(e.estimated_bytes),status:String(e.status),confirmation:jr(e.confirmation),expiresAt:String(e.expires_at),result:yi(e.result,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Bv=(e)=>({id:String(e.id),projectId:String(e.project_id),backupPolicyId:jr(e.backup_policy_id),recoveryPointId:jr(e.recovery_point_id),topologyId:jr(e.topology_id),scenario:String(e.scenario),isolatedTarget:String(e.isolated_target),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),status:String(e.status),operationId:jr(e.operation_id),evidence:yi(e.evidence,{}),measuredRpoMinutes:e.measured_rpo_minutes==null?void 0:Number(e.measured_rpo_minutes),measuredRtoMinutes:e.measured_rto_minutes==null?void 0:Number(e.measured_rto_minutes),cleanupVerified:Number(e.cleanup_verified)===1,error:jr(e.error),startedAt:jr(e.started_at),finishedAt:jr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class Pa{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}addTrustedKey(e){let t=this.id(),r=this.now().toISOString(),a=wu(e.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[t,e.organizationId,e.name,e.publicKeyPem,a,r]),this.key(t)}key(e){let t=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(e);return t?UA(t):void 0}revokeKey(e){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),e]),this.key(e)}importManifest(e){let t=this.key(e.keyId);if(!t||t.organizationId!==e.organizationId)throw Error("Trusted update key was not found.");if(t.revokedAt)throw Error("Update signing key is revoked.");if(!Ru(e.document,e.signature,t.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=Du(e.document,e.current),a=Tu(e.document),l=this.id(),m=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[l,e.organizationId,e.document.version,e.document.channel,new Date(e.document.publishedAt).toISOString(),e.keyId,a,JSON.stringify(e.document),e.signature,JSON.stringify(r),m]),this.manifest(l)}manifest(e){let t=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(e);return t?Ov(t):void 0}manifests(e){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(e).map(Ov)}createWindow(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[t,e.projectId,e.name,e.schedule,e.timezone,e.durationMinutes,JSON.stringify(e.allowedOperations),e.requireApproval===!1?0:1,r,r]),this.window(t)}window(e){let t=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(e);return t?$v(t):void 0}windows(e){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(e).map($v)}createCampaign(e){return this.control.transaction(()=>{let t=this.manifest(e.manifestId);if(!t?.compatibility.compatible||t.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!e.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),a=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,e.projectId,e.manifestId,e.windowId??null,e.fromVersion,e.strategy,e.batchSize,JSON.stringify(e.healthGate),e.backupId,e.approvedBy??null,a,a]),e.targets.forEach((l,m)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,l.serverId??null,l.target,e.strategy==="canary"?m===0?0:1+Math.floor((m-1)/e.batchSize):Math.floor(m/e.batchSize),l.previousVersion,a,a])),this.campaign(r)})}campaign(e){let t=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(e);return t?Nv(t):void 0}campaigns(e){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(e).map(Nv)}targets(e){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(e).map($g)}updateCampaign(e,t){let r=this.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a={...r,...t};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[a.status,a.currentStage??null,this.now().toISOString(),e]),this.campaign(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e);if(!r)throw Error("Upgrade target was not found.");let a={...$g(r),...t};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.evidence),a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),$g(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e))}createCleanup(e){let t=[...e.candidates].sort((f,b)=>f.id.localeCompare(b.id)),r=cs(t),a=this.id(),l=this.now().toISOString(),m=new Date(this.now().getTime()+(e.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[a,e.projectId,e.kind,JSON.stringify(e.criteria),JSON.stringify(t),r,t.reduce((f,b)=>f+b.bytes,0),m,l,l]),this.cleanup(a)}cleanup(e){let t=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(e);return t?jv(t):void 0}cleanups(e){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(e).map(jv)}updateCleanup(e,t){let r=this.cleanup(e);if(!r)throw Error("Cleanup plan was not found.");let a={...r,...t};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[a.status,a.confirmation??null,JSON.stringify(a.result),this.now().toISOString(),e]),this.cleanup(e)}createDrill(e){if(!/^isolated:\/\//.test(e.isolatedTarget))throw Error("DR drills require an isolated target.");let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[t,e.projectId,e.backupPolicyId??null,e.recoveryPointId??null,e.topologyId??null,e.scenario,e.isolatedTarget,e.expectedRpoMinutes,e.expectedRtoMinutes,r,r]),this.drill(t)}drill(e){let t=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(e);return t?Bv(t):void 0}drills(e){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(e).map(Bv)}updateDrill(e,t){let r=this.drill(e);if(!r)throw Error("DR drill was not found.");let a={...r,...t};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[a.status,a.operationId??null,JSON.stringify(a.evidence),a.measuredRpoMinutes??null,a.measuredRtoMinutes??null,a.cleanupVerified?1:0,a.error??null,a.startedAt??null,a.finishedAt??null,this.now().toISOString(),e]),this.drill(e)}}function Qf(e,t=new Date){if(!e.enabled)return!1;let r=new Date(e.schedule);if(!Number.isNaN(r.getTime()))return t>=r&&t.getTime()<=r.getTime()+e.durationMinutes*60000;let a=/^(\d{2}):(\d{2})$/.exec(e.schedule);if(!a)return!1;let l=new Intl.DateTimeFormat("en-US",{timeZone:e.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(t),m=Number(l.find((b)=>b.type==="hour")?.value)*60+Number(l.find((b)=>b.type==="minute")?.value),f=Number(a[1])*60+Number(a[2]);return m>=f&&m<f+e.durationMinutes}class Na{store;now;queue;constructor(e,t,r=()=>new Date){this.store=e;this.now=r;this.queue=t??new c(e.control)}enqueueCampaign(e,t={}){let r=this.store.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let a=r.windowId?this.store.window(r.windowId):void 0;if(a&&!a.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(a&&!t.overrideWindow&&!Qf(a,this.now()))throw Error("Upgrade is outside its maintenance window.");if(a?.requireApproval&&!t.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let l=this.queue.enqueue({projectId:r.projectId,actorId:t.approvedBy,kind:"maintenance.upgrade",input:{campaignId:e},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(e,{status:"queued"}),operation:l}}async previewCleanup(e,t){let r=t.find((a)=>a.kind===e.kind);if(!r)throw Error(`No ${e.kind} cleanup driver is configured.`);return this.store.createCleanup({...e,candidates:await r.discover(e.criteria)})}enqueueCleanup(e,t){let r=this.store.cleanup(e);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let a=`DELETE ${r.candidates.length} ${r.kind}`;if(t!==a)throw Error(`Exact confirmation ${a} is required.`);let l=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:e},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(e,{status:"approved",confirmation:t}),operation:l}}enqueueDrill(e){let t=this.store.drill(e);if(!t||t.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.drill",input:{drillId:e},lockKey:`drill:${t.scenario}:${t.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(e,{status:"queued",operationId:r.id}),operation:r}}}var Ng=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function Pu(e){return{"maintenance.upgrade":async(l)=>{let m=e.store.campaign(String(Ng(l.operation.input).campaignId??""));if(!m||!e.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let f=e.store.manifest(m.manifestId);if(!f?.compatibility.compatible||f.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let b=f.document.artifacts.find((y)=>y.platform===process.platform&&y.architecture===process.arch)??f.document.artifacts[0];if(!b)throw Error("No update artifact matches this platform.");e.store.updateCampaign(m.id,{status:"running",currentStage:"preflight"});let k=[];try{for(let y of[...new Set(e.store.targets(m.id).map((R)=>R.cohort))].sort((R,T)=>R-T)){e.store.updateCampaign(m.id,{currentStage:`cohort:${y}`});for(let R of e.store.targets(m.id).filter((T)=>T.cohort===y)){l.throwIfCancellationRequested(),l.checkpoint(`download:${R.target}`,"Downloading signed platform artifact."),e.store.updateTarget(R.id,{status:"downloading",startedAt:new Date().toISOString()});let T=await e.platform.download({target:R,artifact:b,signal:l.signal});if(T.sha256!==b.sha256)throw Error(`Artifact checksum mismatch for ${R.target}.`);l.checkpoint(`install:${R.target}`,"Installing verified artifact."),e.store.updateTarget(R.id,{status:"installing"}),await e.platform.install({target:R,path:T.path,version:f.version,signal:l.signal}),k.push(R);let N=await e.platform.health({target:R,gate:m.healthGate});if(!N.healthy)throw Error(`Upgrade health gate failed for ${R.target}.`);e.store.updateTarget(R.id,{status:"healthy",evidence:N.evidence,finishedAt:new Date().toISOString()})}}return e.store.updateCampaign(m.id,{status:"succeeded",currentStage:void 0}),{campaignId:m.id,version:f.version,targets:k.length}}catch(y){e.store.updateCampaign(m.id,{status:"rolling_back",currentStage:"rollback"});for(let R of k.reverse())e.store.updateTarget(R.id,{status:"rolling_back"}),await e.platform.rollback({target:R,version:R.previousVersion,signal:l.signal}),e.store.updateTarget(R.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw e.store.updateCampaign(m.id,{status:"rolled_back",currentStage:void 0}),y}},"maintenance.cleanup":async(l)=>{let m=e.store.cleanup(String(Ng(l.operation.input).planId??""));if(!m||m.status!=="approved")throw Error("Approved cleanup plan was not found.");if(cs([...m.candidates].sort((R,T)=>R.id.localeCompare(T.id)))!==m.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let f=e.cleanup?.find((R)=>R.kind===m.kind);if(!f)throw Error(`No ${m.kind} cleanup driver is configured.`);e.store.updateCleanup(m.id,{status:"running"});let b=[],k=[];for(let R of m.candidates){l.throwIfCancellationRequested();try{await f.remove(R),b.push(R.id)}catch(T){k.push({id:R.id,error:T instanceof Error?T.message:String(T)})}}let y=k.length?b.length?"partial":"failed":"succeeded";if(e.store.updateCleanup(m.id,{status:y,result:{removed:b,failed:k,reclaimedBytes:m.candidates.filter((R)=>b.includes(R.id)).reduce((R,T)=>R+T.bytes,0)}}),k.length)throw Error(`Cleanup failed for ${k.length} candidate(s).`);return{planId:m.id,removed:b.length,reclaimedBytes:m.estimatedBytes}},"maintenance.drill":async(l)=>{let m=e.store.drill(String(Ng(l.operation.input).drillId??""));if(!m)throw Error("DR drill was not found.");let f=e.recovery?.find((T)=>T.scenario===m.scenario);if(!f)throw Error(`No ${m.scenario} recovery driver is configured.`);let b=new Date;e.store.updateDrill(m.id,{status:"restoring",startedAt:b.toISOString()});let k=m.isolatedTarget,y={},R={};try{l.checkpoint("restore","Restoring into isolated drill target.");let T=await f.restore({drill:m,signal:l.signal});if(!T.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");k=T.target,y=T.evidence;let N=(b.getTime()-new Date(T.recoveryPointAt).getTime())/60000;e.store.updateDrill(m.id,{status:"verifying",measuredRpoMinutes:N,evidence:{restore:y}}),l.checkpoint("verify","Running recovery health checks without production traffic.");let j=await f.verify({drill:m,target:k});R=j.evidence;let U=(Date.now()-b.getTime())/60000;if(!j.healthy||N>m.expectedRpoMinutes||U>m.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");e.store.updateDrill(m.id,{measuredRpoMinutes:N,measuredRtoMinutes:U,evidence:{restore:y,verify:R}})}catch(T){throw e.store.updateDrill(m.id,{status:"failed",error:T instanceof Error?T.message:String(T),evidence:{restore:y,verify:R}}),T}finally{e.store.updateDrill(m.id,{status:"cleaning"});try{await f.cleanup({drill:m,target:k});let T=e.store.drill(m.id);e.store.updateDrill(m.id,{status:T.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(T){e.store.updateDrill(m.id,{status:"cleanup_required",cleanupVerified:!1,error:T instanceof Error?T.message:String(T),finishedAt:new Date().toISOString()})}}return{drillId:m.id,status:e.store.drill(m.id).status}}}}class Hf{transport;constructor(e){this.transport=e}download(e){return this.transport.download({target:e.target.target,url:e.artifact.url,signal:e.signal})}install(e){return this.transport.install({target:e.target.target,path:e.path,version:e.version,signal:e.signal})}health(e){return this.transport.health({target:e.target.target,gate:e.gate})}rollback(e){return this.transport.rollback({target:e.target.target,version:e.version,signal:e.signal})}}var Mv={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class ka{kind;control;projectId;organizationId;constructor(e,t,r,a){this.kind=e;this.control=t;this.projectId=r;this.organizationId=a}async discover(e){let t=Math.max(1,Math.min(3650,Number(e.olderThanDays??30))),r=new Date(Date.now()-t*86400000).toISOString(),a=Mv[this.kind],l=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(a.select).all(l,r).map((f)=>({id:String(f.id),kind:this.kind,label:`${this.kind}:${String(f.id)}`,bytes:Number(f.bytes??0),metadata:{createdAt:String(f.created_at)}}))}async remove(e){if(this.control.database.run(Mv[this.kind].remove,[e.id]).changes!==1)throw Error(`${e.label} changed or is no longer removable.`)}}class Gf{scenario;transport;constructor(e,t){this.scenario=e;this.transport=t}restore(e){return this.transport.restore({scenario:this.scenario,...e})}verify(e){return this.transport.verify({scenario:this.scenario,...e})}cleanup(e){return this.transport.cleanup({scenario:this.scenario,...e})}}var Kn=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},kn=(e)=>e==null?void 0:String(e),Eu=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),ar=(e={})=>({...Eu(),...e});function Lv(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),purpose:String(e.purpose),backend:String(e.backend),region:kn(e.region),architecture:kn(e.architecture),labels:Kn(e.labels,{}),requiredServerLabels:Kn(e.required_server_labels,{}),toleratedTaints:Kn(e.tolerated_taints,[]),capacity:ar(Kn(e.capacity,{})),reserved:Kn(e.reserved,{}),maxWorkloads:Number(e.max_workloads),costWeight:Number(e.cost_weight),spreadKey:kn(e.spread_key),concurrency:Number(e.concurrency),ephemeralWorkspaces:Number(e.ephemeral_workspaces)===1,allowProductionSecrets:Number(e.allow_production_secrets)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Fv(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:kn(e.environment_id),resourceId:String(e.resource_id),releaseId:kn(e.release_id),poolId:String(e.pool_id),serverId:kn(e.server_id),purpose:String(e.purpose),requirements:Kn(e.requirements,{}),decision:Kn(e.decision,{}),stateful:Number(e.stateful)===1,autoReschedule:Number(e.auto_reschedule)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qA(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:kn(e.resource_id),poolId:String(e.pool_id),placementId:kn(e.placement_id),operationId:kn(e.operation_id),sourceSha:String(e.source_sha),buildSpec:Kn(e.build_spec,{}),credentialPolicy:Kn(e.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:kn(e.workspace),cacheKey:kn(e.cache_key),artifactUri:kn(e.artifact_uri),artifactDigest:kn(e.artifact_digest),status:String(e.status),cleanupAt:kn(e.cleanup_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class va{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}createPool(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.purpose,e.backend,e.region??null,e.architecture??null,JSON.stringify(e.labels),JSON.stringify(e.requiredServerLabels),JSON.stringify(e.toleratedTaints),JSON.stringify(ar(e.capacity)),"{}",e.maxWorkloads,e.costWeight,e.spreadKey??null,e.concurrency,e.ephemeralWorkspaces?1:0,e.allowProductionSecrets?1:0,e.status,r,r]),this.getPool(t)}getPool(e){let t=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(e);return t?Lv(t):void 0}listPools(e){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(e).map(Lv)}updatePool(e,t){let r=this.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[a.status,JSON.stringify(a.reserved),JSON.stringify(a.capacity),a.concurrency,l,e]),this.getPool(e)}addMember(e,t,r={}){let a=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[e,t,JSON.stringify(r),a,a])}members(e){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(e).map((t)=>({serverId:String(t.server_id),status:String(t.status),capacityOverride:Kn(t.capacity_override,{})}))}memberStatus(e,t,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),e,t])}listPlacements(e,t){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(e).map(Fv);return t?.length?r.filter((a)=>t.includes(a.status)):r}getPlacement(e){let t=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(e);return t?Fv(t):void 0}activeUsage(e,t){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(e,this.now().toISOString()),a=t?r.filter((l)=>String(l.server_id)===t):r;return{resources:a.reduce((l,m)=>{let f=ar(Kn(m.resources,{}));for(let b of Object.keys(l))l[b]+=f[b];return l},Eu()),count:a.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(e){return this.control.transaction(()=>{this.expireLeases();let t=this.id(),r=this.id(),a=this.now().toISOString(),l=new Date(this.now().getTime()+(e.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[t,e.projectId,e.environmentId??null,e.resourceId,e.releaseId??null,e.decision.poolId,e.decision.serverId??null,e.requirements.purpose,JSON.stringify(e.requirements),JSON.stringify(e.decision),e.requirements.stateful?1:0,e.requirements.autoReschedule&&!e.requirements.stateful?1:0,a,a]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,t,e.decision.poolId,e.decision.serverId??null,JSON.stringify(ar(e.requirements.resources)),l,a,a]),this.getPlacement(t)})}transitionPlacement(e,t){if(!this.getPlacement(e))throw Error("Placement was not found.");let a=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[t,a,e]),["released","failed","blocked"].includes(t))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[a,e]);return this.getPlacement(e)}createBuild(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[t,e.projectId,e.resourceId??null,e.poolId,e.placementId??null,e.operationId??null,e.sourceSha,JSON.stringify(e.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:e.tokenExpiresAt}),r,r]),this.getBuild(t)}getBuild(e){let t=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(e);return t?qA(t):void 0}updateBuild(e,t){let r=this.getBuild(e);if(!r)throw Error("Remote build was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[a.operationId??null,a.workspace??null,a.cacheKey??null,a.artifactUri??null,a.artifactDigest??null,a.status,a.cleanupAt??null,l,e]),this.getBuild(e)}}var Kd=["cpu","memoryBytes","diskBytes","gpu"],zv=(e,t={})=>Object.entries(t).every(([r,a])=>e[r]===a),VA=(e,t,r)=>Object.fromEntries(Kd.map((a)=>[a,Math.max(0,e[a]-t[a]-(r[a]??0))])),WA=(e,t)=>Kd.every((r)=>e[r]>=(t[r]??0)),HA=(e,t)=>Kd.reduce((r,a)=>r+(t[a]??0)/(e[a]||1),0);class Ta{store;fleet;constructor(e,t){this.store=e;this.fleet=t}poolCandidates(e,t,r){let a=[];for(let l of this.store.listPools(e)){if(l.id===r)continue;let m=[];if(l.status!=="active")m.push(`pool is ${l.status}`);if(l.purpose!==t.purpose)m.push(`purpose is ${l.purpose}`);if(t.region&&l.region!==t.region)m.push(`region is ${l.region??"unset"}`);if(t.architecture&&l.architecture!==t.architecture)m.push(`architecture is ${l.architecture??"unset"}`);if(!zv(l.labels,t.labels))m.push("pool labels do not match");if(l.backend==="server"){let f=this.store.members(l.id);if(!f.length)a.push(this.decision(l,void 0,t,[...m,"pool has no servers"]));for(let b of f){let k=this.fleet.get(b.serverId),y=[...m];if(!k)y.push("server is missing");else this.serverReasons(l,k,b.status,t,y);a.push(this.decision(l,k,t,y,b.capacityOverride))}}else a.push(this.decision(l,void 0,t,m))}return a.sort((l,m)=>Number(m.eligible)-Number(l.eligible)||l.score.cost-m.score.cost||l.score.spread-m.score.spread||l.score.fit-m.score.fit||l.poolName.localeCompare(m.poolName)||(l.serverId??"").localeCompare(m.serverId??""))}serverReasons(e,t,r,a,l){if(r!=="active")l.push(`member is ${r}`);if(t.status!=="ready")l.push(`server is ${t.status}`);if(!t.roles.includes(a.purpose==="build"?"build":a.purpose))l.push(`server lacks ${a.purpose} role`);if(!zv(t.labels,e.requiredServerLabels))l.push("server labels do not match pool selector");for(let m of t.taints)if(!e.toleratedTaints.includes(m))l.push(`taint ${m} is not tolerated`)}decision(e,t,r,a,l={}){let m=ar({...t?.capacity,...l}),f=t?Object.fromEntries(Kd.map((y)=>[y,Math.min(e.capacity[y],m[y])])):e.capacity,b=this.store.activeUsage(e.id,t?.id),k=VA(f,b.resources,e.reserved);if(b.count>=e.maxWorkloads)a.push("workload limit reached");if(r.purpose==="build"&&b.count>=e.concurrency)a.push("build concurrency reached");if(!WA(k,r.resources))a.push("insufficient capacity");return{poolId:e.id,poolName:e.name,serverId:t?.id,eligible:a.length===0,reasons:a,available:k,score:{fit:HA(k,r.resources),spread:b.count,cost:e.costWeight}}}explain(e,t){return this.poolCandidates(e,t)}place(e){return this.store.control.transaction(()=>{let t=this.poolCandidates(e.projectId,e.requirements).find((r)=>r.eligible);if(!t)throw Error(`No eligible capacity: ${this.explain(e.projectId,e.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...e,decision:t})})}activate(e){return this.store.transitionPlacement(e,"active")}release(e){return this.store.transitionPlacement(e,"released")}drainPool(e){let t=this.store.updatePool(e,{status:"draining"}),r=[],a=[];for(let l of this.store.listPlacements(t.projectId,["reserved","active"]).filter((m)=>m.poolId===e)){if(l.stateful){a.push(this.store.transitionPlacement(l.id,"blocked"));continue}this.store.transitionPlacement(l.id,"moving");let m=this.place({projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,releaseId:l.releaseId,requirements:l.requirements});r.push(this.activate(m.id)),this.store.transitionPlacement(l.id,"released")}return{pool:t,moved:r,blocked:a}}drainServer(e,t){this.store.memberStatus(e,t,"draining");let r=this.store.getPool(e);if(!r)throw Error("Capacity pool was not found.");let a=[],l=[];for(let m of this.store.listPlacements(r.projectId,["reserved","active"]).filter((f)=>f.poolId===e&&f.serverId===t)){if(m.stateful){l.push(this.store.transitionPlacement(m.id,"blocked"));continue}this.store.transitionPlacement(m.id,"moving");let f=this.poolCandidates(m.projectId,m.requirements).find((k)=>k.eligible);if(!f){l.push(this.store.transitionPlacement(m.id,"blocked"));continue}let b=this.store.reserve({projectId:m.projectId,environmentId:m.environmentId,resourceId:m.resourceId,releaseId:m.releaseId,requirements:m.requirements,decision:f});a.push(this.activate(b.id)),this.store.transitionPlacement(m.id,"released")}return{moved:a,blocked:l}}reconcileFailure(e){let t=this.fleet.get(e);if(!t)throw Error("Server was not found.");let r=[],a=[];for(let l of this.store.listPlacements(t.projectId,["active"]).filter((m)=>m.serverId===e)){if(l.stateful||!l.autoReschedule){a.push(this.store.transitionPlacement(l.id,"blocked"));continue}this.store.transitionPlacement(l.id,"failed");let m=this.place({projectId:l.projectId,environmentId:l.environmentId,resourceId:l.resourceId,releaseId:l.releaseId,requirements:l.requirements});r.push(this.activate(m.id))}return{rescheduled:r,blocked:a}}}class Ff{store;placement;now;queue;constructor(e,t,r,a=()=>new Date){this.store=e;this.placement=t;this.now=a;this.queue=r??new c(e.control)}enqueue(e){if(!/^[a-f0-9]{7,64}$/i.test(e.sourceSha))throw Error("A pinned source commit SHA is required.");let t={purpose:"build",resources:{cpu:1,memoryBytes:1073741824,diskBytes:5368709120},leaseSeconds:3600,...e.requirements},r=this.placement.place({projectId:e.projectId,resourceId:e.resourceId,requirements:t}),a=new Date(this.now().getTime()+900000).toISOString(),l=this.store.createBuild({projectId:e.projectId,resourceId:e.resourceId,poolId:r.poolId,placementId:r.id,sourceSha:e.sourceSha,buildSpec:e.buildSpec,tokenExpiresAt:a}),m=this.queue.enqueue({projectId:e.projectId,resourceId:e.resourceId,kind:"build.remote",input:{buildId:l.id},lockKey:`build:${l.id}`,providerKey:`pool:${r.poolId}`,buildSlot:!0,timeoutSeconds:3600,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return l=this.store.updateBuild(l.id,{operationId:m.id}),l}cancel(e){let t=this.store.getBuild(e);if(!t)throw Error("Remote build was not found.");if(t.operationId)this.queue.requestCancellation(t.operationId);return this.store.updateBuild(e,{status:"cancelled"})}}var KA=/^sha256:[a-f0-9]{64}$/,JA=/^(?:s3|https|oci):\/\//;function AS(e,t){return{"build.remote":async(r)=>{let a=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},l=e.getBuild(String(a.buildId??""));if(!l)throw Error("Queued remote build was not found.");let m=e.getPool(l.poolId);if(!m||m.purpose!=="build"||m.status!=="active")throw Error("The selected build pool is unavailable.");if(!m.ephemeralWorkspaces)throw Error("Remote builds require an ephemeral workspace pool.");if(l.credentialPolicy.productionSecrets||m.allowProductionSecrets)throw Error("Production secrets are forbidden in remote build workers.");if(new Date(l.credentialPolicy.shortLivedTokenExpiresAt)<=new Date)throw Error("The short-lived build credential has expired.");let f=t.find((k)=>k.backend===m.backend);if(!f)throw Error(`No ${m.backend} remote build driver is configured.`);let b=`build://${m.id}/${l.id}`;e.updateBuild(l.id,{status:"running",workspace:b}),r.checkpoint("checkout",`Preparing isolated workspace for ${l.sourceSha}.`);try{r.throwIfCancellationRequested(),r.checkpoint("build","Executing resource-limited build.");let k=await f.run({build:e.getBuild(l.id),pool:m,signal:r.signal,log:(y)=>r.log(y,{stream:"stdout"})});if(r.throwIfCancellationRequested(),!KA.test(k.artifactDigest)||!JA.test(k.artifactUri))throw Error("Builder returned an unverified artifact reference.");return e.updateBuild(l.id,{status:"uploading",cacheKey:k.cacheKey,artifactUri:k.artifactUri,artifactDigest:k.artifactDigest}),r.checkpoint("verify","Verified content-addressed artifact upload."),await f.cleanup({build:e.getBuild(l.id),pool:m}),e.updateBuild(l.id,{status:"succeeded",workspace:void 0,cleanupAt:new Date().toISOString()}),{buildId:l.id,artifactUri:k.artifactUri,artifactDigest:k.artifactDigest,cacheKey:k.cacheKey??null}}catch(k){try{await f.cleanup({build:e.getBuild(l.id),pool:m}),e.updateBuild(l.id,{status:r.cancellationRequested()?"cancelled":"failed",workspace:void 0,cleanupAt:new Date().toISOString()})}catch{e.updateBuild(l.id,{status:"cleanup_required"})}throw k}}}}class as{backend;transport;handles=new Map;constructor(e,t){this.backend=e;this.transport=t}async run({build:e,pool:t,signal:r,log:a}){let l=await this.transport.provision({backend:this.backend,pool:t,build:e,tokenExpiresAt:e.credentialPolicy.shortLivedTokenExpiresAt});return this.handles.set(e.id,l.handle),a(`${this.backend} builder provisioned`),await this.transport.execute({handle:l.handle,spec:e.buildSpec,sourceSha:e.sourceSha,signal:r,onLog:a}),this.transport.publish({handle:l.handle,sourceSha:e.sourceSha})}async cleanup({build:e}){let t=this.handles.get(e.id);if(!t)return;await this.transport.destroy({handle:t}),this.handles.delete(e.id)}}var yS=(e)=>new as("server",e),SS=(e)=>new as("ecs",e),IS=(e)=>new as("asg",e);var bi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Mn=(e)=>e==null?void 0:String(e),Uv=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Mn(e.environment_id),name:String(e.name),hostname:String(e.hostname),homeRegion:String(e.home_region),regions:bi(e.regions,[]),trafficPolicy:String(e.traffic_policy),dataPolicy:bi(e.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(e.status),activeRegion:String(e.active_region),revision:Mn(e.revision),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),jg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),region:String(e.region),role:String(e.role),provider:String(e.provider),stackId:Mn(e.stack_id),stackRevision:Mn(e.stack_revision),status:String(e.status),health:bi(e.health,{}),lastHealthyAt:Mn(e.last_healthy_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Bg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),kind:String(e.kind),sourceRegion:String(e.source_region),targetRegion:String(e.target_region),config:bi(e.config,{}),status:String(e.status),checkpoint:Mn(e.checkpoint),lagSeconds:e.lag_seconds==null?void 0:Number(e.lag_seconds),lastVerifiedAt:Mn(e.last_verified_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Mg=(e)=>({id:String(e.id),topologyId:String(e.topology_id),hostname:String(e.hostname),dnsProvider:String(e.dns_provider),cdnEnabled:Number(e.cdn_enabled)===1,wafEnabled:Number(e.waf_enabled)===1,weights:bi(e.weights,{}),desiredWeights:bi(e.desired_weights,{}),status:String(e.status),providerState:bi(e.provider_state,{}),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),qv=(e)=>({id:String(e.id),topologyId:String(e.topology_id),operationId:Mn(e.operation_id),kind:String(e.kind),requestedRegion:Mn(e.requested_region),revision:Mn(e.revision),plan:bi(e.plan,[]),currentStep:Mn(e.current_step),completedSteps:bi(e.completed_steps,[]),status:String(e.status),error:Mn(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class wa{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}create(e){return this.control.transaction(()=>{if(e.regions.length<2||new Set(e.regions.map((m)=>m.region)).size!==e.regions.length||e.regions.filter((m)=>m.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let t=e.regions.find((m)=>m.role==="primary"),r=this.id(),a=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.name,e.hostname,t.region,JSON.stringify(e.regions),e.trafficPolicy,JSON.stringify(e.dataPolicy),t.region,a,a]);for(let m of e.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,m.region,m.role,m.provider,a,a]);for(let m of e.dataPolicy.replicate)for(let f of e.regions)for(let b of e.regions.filter((k)=>k.region!==f.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,m,f.region,b.region,"{}",a,a]);let l=Object.fromEntries(e.regions.map((m)=>[m.region,m.region===t.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,e.hostname,e.dnsProvider??"route53",e.cdnEnabled?1:0,e.wafEnabled?1:0,JSON.stringify(l),JSON.stringify(l),a,a]),this.get(r)})}get(e){let t=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(e);return t?Uv(t):void 0}list(e){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(e).map(Uv)}targets(e){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(e).map(jg)}channels(e){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(e).map(Bg)}route(e){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(e);return t?Mg(t):void 0}updateTopology(e,t){let r=this.get(e);if(!r)throw Error("Regional topology was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[a.status,a.activeRegion,a.revision??null,JSON.stringify(a.regions),l,e]),this.get(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e);if(!r)throw Error("Regional target was not found.");let a=jg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[l.role,l.stackId??null,l.stackRevision??null,l.status,JSON.stringify(l.health),l.lastHealthyAt??null,m,e]),jg(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e))}updateChannel(e,t){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e);if(!r)throw Error("Replication channel was not found.");let a=Bg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[l.status,l.checkpoint??null,l.lagSeconds??null,l.lastVerifiedAt??null,m,e]),Bg(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e))}updateRoute(e,t){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e);if(!r)throw Error("Traffic route was not found.");let a=Mg(r),l={...a,...t},m=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(l.weights),JSON.stringify(l.desiredWeights),l.status,JSON.stringify(l.providerState),m,e]),Mg(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e))}createExecution(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[t,e.topologyId,e.operationId??null,e.kind,e.requestedRegion??null,e.revision??null,JSON.stringify(e.plan),r,r]),this.execution(t)}execution(e){let t=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(e);return t?qv(t):void 0}executions(e){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(e).map(qv)}updateExecution(e,t){let r=this.execution(e);if(!r)throw Error("Regional execution was not found.");let a={...r,...t},l=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[a.operationId??null,a.currentStep??null,JSON.stringify(a.completedSteps),a.status,a.error??null,l,e]),this.execution(e)}}class Ra{store;queue;constructor(e,t){this.store=e;this.queue=t??new c(e.control)}create(e){return this.store.create(e)}plan(e,t,r){if(!this.store.get(e))throw Error("Regional topology was not found.");let l=this.store.targets(e),m=this.store.channels(e);if(t==="rollout")return[...l.filter((f)=>f.role==="secondary").map((f)=>`apply:${f.region}`),...l.filter((f)=>f.role==="primary").map((f)=>`apply:${f.region}`),...m.map((f)=>`replicate:${f.kind}:${f.targetRegion}`),"traffic:activate"];if(t==="failover"||t==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(t==="destroy")return["traffic:drain",...l.filter((f)=>f.role==="secondary").map((f)=>`delete:${f.region}`),...l.filter((f)=>f.role==="primary").map((f)=>`delete:${f.region}`),"complete"];return["observe","repair"]}enqueue(e){let t=this.store.get(e.topologyId);if(!t)throw Error("Regional topology was not found.");if(["failover","failback"].includes(e.kind)&&(!e.targetRegion||!t.regions.some((m)=>m.region===e.targetRegion)))throw Error("A topology target region is required.");if(e.kind==="failover"&&e.targetRegion===t.activeRegion)throw Error("Target region is already active.");if((e.kind==="destroy"||e.deleteData)&&e.confirmation!==t.name)throw Error("Exact topology name confirmation is required.");if(e.deleteData&&t.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(e.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(e.revision??""))throw Error("An immutable revision is required.");let r=this.plan(t.id,e.kind,e.targetRegion),a=this.store.createExecution({topologyId:t.id,kind:e.kind,requestedRegion:e.targetRegion,revision:e.revision,plan:r}),l=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,kind:`region.${e.kind}`,input:{executionId:a.id,manifest:e.manifest??{},deleteData:e.deleteData===!0},lockKey:`regional-topology:${t.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(a.id,{operationId:l.id}),{execution:this.store.execution(a.id),operation:l}}}var GA=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function vu(e,t){let r=(y)=>{let R=t.find((T)=>T.provider===y.provider);if(!R)throw Error(`No ${y.provider} regional driver is configured.`);return R},a=(y,R,T)=>{y.throwIfCancellationRequested(),y.checkpoint(T,T),e.updateExecution(R.id,{status:"running",currentStep:T,completedSteps:[...e.execution(R.id).completedSteps,T]})},l=async(y,R)=>{let T=e.route(y.id);if(!T)throw Error("Regional traffic route was not found.");let N=e.targets(y.id).find((U)=>U.region===y.activeRegion)??e.targets(y.id)[0];if(!N)throw Error("Regional traffic target was not found.");e.updateRoute(T.id,{status:"applying",desiredWeights:R});let j=await r(N).applyTraffic({route:e.route(y.id),topology:y,weights:R});e.updateRoute(T.id,{status:Object.values(R).every((U)=>U===0)?"drained":"in_sync",weights:R,providerState:j.providerState})},m=async(y,R,T,N)=>{e.updateTopology(T.id,{status:"provisioning"});let j=R.revision,U=N.manifest??{},q=e.targets(T.id).sort((ee,le)=>Number(ee.role==="primary")-Number(le.role==="primary"));for(let ee of q){a(y,R,`apply:${ee.region}`),e.updateTarget(ee.id,{status:"provisioning"});let le=await r(ee).applyStack({target:ee,revision:j,manifest:U,signal:y.signal}),Z=await r(ee).health({target:e.updateTarget(ee.id,{stackId:le.stackId,stackRevision:j})});if(!Z.healthy)throw Error(`Regional health gate failed in ${ee.region}.`);e.updateTarget(ee.id,{status:"ready",health:Z.evidence,lastHealthyAt:new Date().toISOString()})}for(let ee of e.channels(T.id)){a(y,R,`replicate:${ee.kind}:${ee.targetRegion}`),e.updateChannel(ee.id,{status:"configuring"});let le=q.find((we)=>we.region===ee.sourceRegion),Z=await r(le).configureReplication({channel:ee,topology:T}),ie=await r(le).verifyReplication({channel:e.updateChannel(ee.id,{checkpoint:Z.checkpoint,lagSeconds:Z.lagSeconds}),topology:T});if(!ie.healthy||ie.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${ee.kind} replication to ${ee.targetRegion} exceeds the RPO.`);e.updateChannel(ee.id,{status:"in_sync",checkpoint:ie.checkpoint,lagSeconds:ie.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(y,R,"traffic:activate");let Y=Object.fromEntries(T.regions.map((ee)=>[ee.region,ee.region===T.activeRegion?100:0]));return await l(T,Y),e.updateTopology(T.id,{status:"ready",revision:j}),{revision:j,activeRegion:T.activeRegion}},f=async(y,R,T)=>{let N=R.requestedRegion,j=e.targets(T.id).find((Y)=>Y.region===N);if(!j)throw Error("Requested regional target was not found.");e.updateTopology(T.id,{status:R.kind==="failover"?"failing_over":"failing_back"}),a(y,R,`health:${N}`);let U=await r(j).health({target:j});if(!U.healthy)throw Error(`Target region ${N} is unhealthy.`);e.updateTarget(j.id,{status:"ready",health:U.evidence,lastHealthyAt:new Date().toISOString()}),a(y,R,`replication:${N}`);for(let Y of e.channels(T.id).filter((ee)=>ee.targetRegion===N)){let ee=await r(j).verifyReplication({channel:Y,topology:T});if(!ee.healthy||ee.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${Y.kind} replication is outside the failover RPO.`);e.updateChannel(Y.id,{status:"in_sync",checkpoint:ee.checkpoint,lagSeconds:ee.lagSeconds,lastVerifiedAt:new Date().toISOString()})}a(y,R,`traffic:${N}`),await l(T,Object.fromEntries(T.regions.map((Y)=>[Y.region,Y.region===N?100:0]))),a(y,R,`roles:${N}`);let q=T.regions.map((Y)=>({...Y,role:Y.region===N?"primary":"secondary"}));for(let Y of e.targets(T.id))e.updateTarget(Y.id,{role:Y.region===N?"primary":"secondary"});return e.updateTopology(T.id,{status:R.kind==="failover"?"failed_over":"ready",activeRegion:N,regions:q}),{activeRegion:N}},b=async(y,R,T,N)=>{e.updateTopology(T.id,{status:"destroying"}),a(y,R,"traffic:drain"),await l(T,Object.fromEntries(T.regions.map((U)=>[U.region,0])));let j=N.deleteData!==!0;for(let U of e.targets(T.id).sort((q,Y)=>Number(q.role==="primary")-Number(Y.role==="primary")))a(y,R,`delete:${U.region}`),e.updateTarget(U.id,{status:"deleting"}),await r(U).deleteStack({target:U,retainData:j,signal:y.signal}),e.updateTarget(U.id,{status:"deleted"});return a(y,R,"complete"),e.updateTopology(T.id,{status:"destroyed"}),{destroyed:!0,dataRetained:j}},k=async(y)=>{let R=GA(y.operation.input),T=e.execution(String(R.executionId??""));if(!T)throw Error("Regional execution was not found.");let N=e.get(T.topologyId);if(!N)throw Error("Regional topology was not found.");try{let j;if(T.kind==="rollout")j=await m(y,T,N,R);else if(T.kind==="failover"||T.kind==="failback")j=await f(y,T,N);else if(T.kind==="destroy")j=await b(y,T,N,R);else throw Error("Regional reconciliation is not configured.");return e.updateExecution(T.id,{status:"succeeded",currentStep:void 0}),{executionId:T.id,...j}}catch(j){if(e.updateExecution(T.id,{status:y.cancellationRequested()?"cancelled":"failed",error:j instanceof Error?j.message:String(j)}),e.get(N.id)?.status!=="destroyed")e.updateTopology(N.id,{status:"failed"});throw j}};return{"region.rollout":k,"region.failover":k,"region.failback":k,"region.destroy":k,"region.reconcile":k}}class Uf{transport;provider="aws";constructor(e){this.transport=e}async applyStack({target:e,revision:t,manifest:r}){return this.transport.applyCloudFormation({region:e.region,stackId:e.stackId,revision:t,manifest:r})}async deleteStack({target:e,retainData:t}){if(!e.stackId)return;await this.transport.deleteCloudFormation({region:e.region,stackId:e.stackId,retainData:t})}async health({target:e}){if(!e.stackId)return{healthy:!1,evidence:{reason:"stack is not provisioned"}};return this.transport.stackHealth({region:e.region,stackId:e.stackId})}async configureReplication({channel:e}){let t={sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,config:e.config};if(e.kind==="s3")return this.transport.configureS3Replication(t);if(e.kind==="dynamodb")return this.transport.configureDynamoGlobalTable(t);return this.transport.replicateSecrets(t)}async verifyReplication({channel:e}){return this.transport.verifyReplication({kind:e.kind,sourceRegion:e.sourceRegion,targetRegion:e.targetRegion,checkpoint:e.checkpoint})}async applyTraffic({route:e,weights:t}){return this.transport.applyEdge({hostname:e.hostname,weights:t,route53:e.dnsProvider==="route53",cloudFront:e.cdnEnabled,waf:e.wafEnabled})}}class Da{provider;reason;constructor(e,t="Configure a regional provider transport before executing this operation."){this.provider=e;this.reason=t}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function Ae(e,t,r){return[e,t,r].map((a)=>encodeURIComponent(a)).join(":")}function Df(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function Tt(e,t,r=["exec","files"]){let a=Df(t);for(let l of e)a[l]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(l),requiresRecentAuth:r.includes(l)};return a}var QA=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function ke(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function Be(e){if(Array.isArray(e))return e.map((r)=>Be(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,a]of Object.entries(e))t[r]=QA.test(r)?"[REDACTED]":Be(a);return t}function wt(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function du(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function YA(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function lu(e,t={},r={}){let a=t.now??new Date,l=Math.max(100,r.timeoutMs??1e4),m=Math.max(1,r.staleAfterSeconds??60),f=await Promise.all(e.map(async(k)=>{try{let y=await Promise.race([k.discover({...t,now:a}),new Promise((R,T)=>setTimeout(()=>T(Error(`Runtime source ${k.id} timed out after ${l}ms`)),l))]);return{workloads:y,source:{id:k.id,provider:k.provider,status:"fresh",discoveredAt:a.toISOString(),staleAfterSeconds:m,itemCount:y.length}}}catch(y){return{workloads:[],source:{id:k.id,provider:k.provider,status:YA(y),discoveredAt:a.toISOString(),staleAfterSeconds:m,itemCount:0,message:String(y?.message??y).slice(0,500)}}}})),b=f.map((k)=>k.source);return{generatedAt:a.toISOString(),workloads:f.flatMap((k)=>k.workloads).sort((k,y)=>k.name.localeCompare(y.name)||k.id.localeCompare(y.id)),sources:b,degraded:b.some((k)=>k.status!=="fresh")}}function Ls(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function uu(e,t,r,a="ecs:aws",l=[]){let m=r.now??new Date;return e.map((f)=>{let b=f.serviceName??Ls(f.serviceArn),k=t.filter((ee)=>!f.clusterArn||ee.clusterArn===f.clusterArn),y=k.some((ee)=>!!ee.group)?k.filter((ee)=>ee.group===`service:${b}`):k,R=f.status==="ACTIVE"?(f.runningCount??0)<(f.desiredCount??0)?"degraded":"running":ke(f.status),T=l.find((ee)=>ee.taskDefinitionArn===f.taskDefinition),N=Array.isArray(T?.containerDefinitions)?T.containerDefinitions:[],j=[...new Set(N.map((ee)=>ee.logConfiguration?.options?.["awslogs-group"]).filter((ee)=>typeof ee==="string"))],U=N.flatMap((ee)=>(ee.mountPoints??[]).map((le)=>({source:le.sourceVolume,target:le.containerPath,type:"volume",readOnly:!!le.readOnly}))),q=N.flatMap((ee)=>(ee.portMappings??[]).map((le,Z)=>({id:`${ee.name??"container"}:${Z}`,name:ee.name,mode:T?.networkMode,ports:[{container:le.containerPort,host:le.hostPort,protocol:le.protocol}]}))),Y=r.project&&r.environment&&b.startsWith(`${r.project}-${r.environment}-`)?b.slice(`${r.project}-${r.environment}-`.length):b;return{id:Ae("ecs",a,f.serviceArn??b),provider:"ecs",kind:"service",name:b,status:R,rawStatus:f.status,health:R==="running"?"healthy":R==="failed"||R==="degraded"?"unhealthy":"unknown",desiredReplicas:f.desiredCount,runningReplicas:f.runningCount,image:N[0]?.image,runtime:f.launchType??"ECS",version:Ls(f.taskDefinition),ageSeconds:wt(f.deployments?.[0]?.createdAt,m),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:Y,release:Ls(f.taskDefinition),providerId:f.serviceArn},replicas:y.map((ee)=>{let le=ke(ee.lastStatus);return{id:Ae("ecs",a,ee.taskArn??Ls(ee.taskArn)),name:Ls(ee.taskArn),status:le,rawStatus:ee.lastStatus,createdAt:ee.createdAt,startedAt:ee.startedAt,stoppedAt:ee.stoppedAt,host:ee.containerInstanceArn,containers:(ee.containers??[]).map((Z)=>({id:Z.containerArn??Z.name??"container",name:Z.name??"container",image:N.find((ie)=>ie.name===Z.name)?.image,imageDigest:Z.imageDigest,status:ke(Z.lastStatus),rawStatus:Z.lastStatus,exitCode:Z.exitCode,reason:Z.reason,runtime:"ecs"}))}}),networks:q,mounts:U,capabilities:Tt(["start","stop","restart","redeploy","scale","inspect",...j.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:Be({clusterArn:f.clusterArn,taskDefinition:f.taskDefinition,launchType:f.launchType,pendingCount:f.pendingCount,deployments:f.deployments,logGroups:j,executionRoleArn:T?.executionRoleArn,taskRoleArn:T?.taskRoleArn,cpu:T?.cpu,memory:T?.memory}),discoveredAt:m.toISOString(),sourceId:a}})}function gu(e,t,r="lambda:aws"){let a=t.now??new Date;return e.map((l)=>{let m=l.FunctionName??Ls(l.FunctionArn),f=l.State==="Active"?"running":ke(l.State);return{id:Ae("lambda",r,l.FunctionArn??m),provider:"lambda",kind:"function",name:m,status:f,rawStatus:l.State,health:f==="running"?"healthy":f==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:l.Runtime,version:l.Version,architecture:l.Architectures?.join(", "),ageSeconds:wt(l.LastModified,a),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:m,providerId:l.FunctionArn},resources:{memoryLimitBytes:l.MemorySize==null?void 0:l.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:Tt(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:Be({handler:l.Handler,timeout:l.Timeout,codeSize:l.CodeSize,stateReason:l.StateReason,environmentKeys:Object.keys(l.Environment?.Variables??{})}),discoveredAt:a.toISOString(),sourceId:r}})}function Pf(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((a)=>a&&typeof a.Id==="string")}function ZA(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,a])=>{let[l,m]=r.split("/");return(a??[]).map((f)=>({container:Number(l)||void 0,host:Number(f.HostPort)||void 0,protocol:m,address:f.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,a])=>({id:a.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[a.IPAddress,a.GlobalIPv6Address].filter(Boolean),ports:t}))}function XA(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function Nf(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((l)=>{let m=l.State?.OOMKilled?"oomkilled":l.State?.Restarting?"starting":l.State?.Status,f=ke(m),b=(l.Name??l.Id.slice(0,12)).replace(/^\//,""),k=l.Config?.Labels??{},y=XA(l),R=ZA(l),T={id:l.Id,name:b,image:l.Config?.Image,imageDigest:l.Image,runtime:"docker",status:f,rawStatus:m,exitCode:l.State?.ExitCode,reason:l.State?.Error,resources:{memoryLimitBytes:l.HostConfig?.Memory||void 0},networks:R,mounts:y};return{id:Ae("docker",r,l.Id),provider:"docker",kind:"container",name:b,status:f,rawStatus:m,health:f==="running"?"healthy":f==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:f==="running"?1:0,image:l.Config?.Image,runtime:"docker",ageSeconds:wt(l.State?.StartedAt,a),restartCount:l.RestartCount??0,tags:k,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:k["com.docker.compose.service"]??k["ts-cloud.service"]??b,release:k["ts-cloud.release"],providerId:l.Id},resources:T.resources,replicas:[{id:Ae("docker",r,`${l.Id}:0`),name:b,status:f,rawStatus:m,startedAt:l.State?.StartedAt,stoppedAt:l.State?.FinishedAt,restartCount:l.RestartCount,containers:[T],resources:T.resources}],networks:R,mounts:y,capabilities:Tt(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:Be({image:l.Config?.Image,labels:k,environmentKeys:(l.Config?.Env??[]).map((N)=>N.split("=",1)[0]),networkMode:l.HostConfig?.NetworkMode}),discoveredAt:a.toISOString(),sourceId:r}})}class oa{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return Nf(Pf(await this.inspect(e)),e,this.id)}}function kf(e){let t=[];for(let r of e.split(`
+`)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,a,l,m,f,b,k,y,R,T,N,j,U,q]=r.split("\t");if(!a||!/^[A-Za-z0-9_.@:-]+\.service$/.test(a))continue;t.push({unit:a,load:l,active:m,sub:f,description:b,enabled:k,pid:Number(y)||void 0,memoryBytes:du(R),restartCount:Number(T)||0,activeSince:N||void 0,fragmentPath:j||void 0,workingDirectory:U?.startsWith("/")?U:void 0,user:q||void 0})}return t}function Bf(e,t,r=t.server??"local"){let a=t.now??new Date;return e.map((l)=>{let m=ke(l.active==="active"?l.sub||l.active:l.active),f=l.unit.replace(/\.service$/,""),b=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(l.description??"")?.[1]??(t.project&&f.startsWith(`${t.project}-`)?f.slice(t.project.length+1).split("@",1)[0]:void 0),k=f.includes("@")?f.slice(f.indexOf("@")+1):void 0,y=l.workingDirectory?[{target:l.workingDirectory,type:"working-directory"}]:[],R=["start","stop","restart","logs","exec","inspect",...y.length?["files"]:[]];return{id:Ae("systemd",r,l.unit),provider:"systemd",kind:"service",name:f,displayName:l.description||f,status:m,rawStatus:[l.load,l.active,l.sub].filter(Boolean).join("/"),health:m==="running"?"healthy":m==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:m==="running"?1:0,ageSeconds:wt(l.activeSince,a),restartCount:l.restartCount,tags:{enabled:l.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:b,release:k,providerId:l.unit},resources:{memoryBytes:l.memoryBytes},replicas:[{id:Ae("systemd",r,`${l.unit}:main`),name:"main",status:m,pid:l.pid,startedAt:l.activeSince,restartCount:l.restartCount,resources:{memoryBytes:l.memoryBytes}}],networks:[],mounts:y,capabilities:Tt(R,y.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:Be({fragmentPath:l.fragmentPath,workingDirectory:l.workingDirectory,user:l.user,environment:l.environment,enabled:l.enabled}),discoveredAt:a.toISOString(),sourceId:r}})}class aa{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return Bf(kf(await this.read(e)),e,this.id)}}function eC(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function tC(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function rC(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function Vv(e,t,r,a,l){let m=`${e}:${r.id}`,f=async()=>eC(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?tC():rC(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:a.project.slug,Environment:l,Role:"app"}}),m);return e==="systemd"?new aa(f,m):new oa(f,m)}async function Gd(e,t=100){let r=[],a;for(let l=0;l<t;l++){let m=await e(a);if(r.push(...m.items),!m.nextToken)return r;a=m.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class pu{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await Gd(async(m)=>{let f=await this.client.listClusters({nextToken:m,maxResults:100});return{items:f.clusterArns??[],nextToken:f.nextToken}}),r=[],a=[],l=[];for(let m of t){let f=(await Gd(async(b)=>{let k=await this.client.listServices(m,{nextToken:b,maxResults:100});return{items:k.serviceArns??[],nextToken:k.nextToken}})).filter((b)=>b.split("/").at(-1)?.startsWith(this.prefix));for(let b=0;b<f.length;b+=10){let k=await this.client.describeServices({cluster:m,services:f.slice(b,b+10)});r.push(...k.services??[])}for(let b of r.filter((k)=>k.clusterArn===m||!k.clusterArn)){let k=await Gd(async(y)=>{let R=await this.client.listTasks(m,b.serviceName,{nextToken:y,maxResults:100});return{items:R.taskArns??[],nextToken:R.nextToken}});for(let y=0;y<k.length;y+=100){let R=await this.client.describeTasks(m,k.slice(y,y+100));a.push(...R.tasks??[])}}}if(this.client.describeTaskDefinition)for(let m of[...new Set(r.map((f)=>f.taskDefinition).filter((f)=>!!f))]){let f=await this.client.describeTaskDefinition(m);if(f.taskDefinition)l.push(f.taskDefinition)}return uu(r,a,e,this.id,l)}}class mu{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await Gd(async(r)=>{let a=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:a.Functions??[],nextToken:a.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return gu(t,e,this.id)}}async function xf(e,t,r={}){let a=[],l=Q(e),m=fe(e),f=e.aws?.profile,b=e.aws?.region??e.project.region??"us-east-1",k=`${e.project.slug}-${t}`;if(l!=="serverless"){let y=r.driver??O({config:e}),R=await y.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let T of R)a.push(Vv("systemd",y,T,e,t)),a.push(Vv("docker",y,T,e,t))}if(m==="aws")a.push(new pu(r.ecs??new nt(b,f),k)),a.push(new mu(r.lambda??new E(b,f),k));return a}async function oe(e,t,r={}){let a={project:e.project.slug,environment:t};try{return await lu(await xf(e,t,r),a)}catch(l){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:fe(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(l?.message??l).slice(0,500)}],degraded:!0}}}var Wv=65536,mc=49152,Yd=/^[A-Za-z0-9_.@:-]+\.service$/,Zd=/^[a-fA-F0-9]{12,128}$/,nC=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function Fs(e){let t=Buffer.from(e);return t.byteLength<=Wv?e:`${t.subarray(0,Wv-24).toString("utf8")}
+[output truncated]`}function Qd(e){return{success:!1,instanceCount:0,perInstance:[],error:e instanceof Error?e.message:String(e)}}function Ln(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function iC(e,t){return Number.isFinite(e)?Math.min(1e4,Math.max(0,Math.floor(e))):t}function oC(e){let t=e.config,r=typeof t.clusterArn==="string"?t.clusterArn:void 0,a=e.links.providerId||e.name;return r&&a?{cluster:r,service:a}:void 0}function sC(e,t){return e.find((r)=>r.id===t.links.server)??(e.length===1?e[0]:void 0)}function aC(e,t){if(e.provider==="systemd"){let r=e.links.providerId;if(!r||!Yd.test(r)||!["start","stop","restart"].includes(t))return;return[`systemctl ${t} ${r}`,`systemctl is-active ${r} 2>/dev/null || true`]}if(e.provider==="docker"){let r=e.links.providerId;if(!r||!Zd.test(r)||!["start","stop","restart"].includes(t))return;return[`docker ${t} ${r}`,`docker inspect --format '{{.State.Status}}' ${r}`]}return}function Of(e,t){if(!t.startsWith("/")||t.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let r=[];for(let b of t.split("/")){if(!b||b===".")continue;if(b===".."){if(!r.length)return{ok:!1,error:"Path traversal is not allowed."};r.pop()}else r.push(b)}let a=`/${r.join("/")}`;if(nC.some((b)=>a===b||a.startsWith(`${b}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let l=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),m=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...l&&m?[`/var/www/${l}/${m}`,`/srv/${l}/${m}`]:[],...e.mounts.map((b)=>b.target).filter((b)=>b.startsWith("/"))].some((b)=>a===b||a.startsWith(`${b.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:a}}function cC(e,t){let r=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),a=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...r&&a?[`/var/www/${r}/${a}`,`/srv/${r}/${a}`]:[],...e.mounts.map((l)=>l.target).filter((l)=>l.startsWith("/"))].sort((l,m)=>m.length-l.length).find((l)=>t===l||t.startsWith(`${l.replace(/\/$/,"")}/`))}var fu={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class ye{config;environment;dependencies;region;profile;constructor(e,t,r={}){this.config=e;this.environment=t;this.dependencies=r;this.region=e.aws?.region??e.project.region??"us-east-1",this.profile=e.aws?.profile}async inventory(){return this.dependencies.inventory?.()??oe(this.config,this.environment,{driver:this.dependencies.driver})}async workload(e){return(await this.inventory()).workloads.find((t)=>t.id===e)}async remote(e,t,r,a){let l=this.dependencies.driver??O({config:this.config}),m=await l.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),f=sC(m,e);if(!f)throw Error("The workload server is no longer reachable in this scope.");return l.runRemoteDeploy({targets:[f],commands:t,timeoutSeconds:r,comment:a,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(e){let t=await this.workload(e.workloadId),r={workloadId:e.workloadId,action:e.action};if(!t)return{...r,ok:!1,error:"Workload was not found in the current project and environment."};let a=t.capabilities[e.action];if(!a.supported)return{...r,ok:!1,error:a.reason??`${e.action} is unsupported for ${t.provider}.`};if(a.requiresConfirmation&&e.confirm!==t.name)return{...r,ok:!1,error:`Type "${t.name}" to ${e.action} this workload.`};if(a.requiresRecentAuth&&!e.recentAuth)return{...r,ok:!1,error:"Sign in again before using elevated runtime access."};if(e.action==="inspect")return{...r,ok:!0,workload:t};if(t.provider==="systemd"||t.provider==="docker"){let l=aC(t,e.action);if(!l)return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`};let m=await this.remote(t,["set -uo pipefail",...l],60,`ts-cloud runtime:${e.action}`).catch(Qd);return{...r,ok:m.success,command:l[0],stdout:Fs(m.perInstance?.[0]?.output??""),stderr:Fs(m.perInstance?.[0]?.error??m.error??""),error:m.success?void 0:m.error??"Runtime operation failed."}}if(t.provider==="ecs"){let l=oC(t);if(!l)return{...r,ok:!1,error:"ECS cluster or service identity is unavailable."};let m=this.dependencies.ecs??new nt(this.region,this.profile);if(e.action==="scale"){let f=iC(e.replicas,t.desiredReplicas??1);return await m.scaleService(l.cluster,l.service,f),{...r,ok:!0,command:`ecs scale ${t.name} ${f}`}}if(e.action==="start"||e.action==="stop"){let f=e.action==="stop"?0:Math.max(1,t.desiredReplicas??1);return await m.scaleService(l.cluster,l.service,f),{...r,ok:!0,command:`ecs scale ${t.name} ${f}`}}if(e.action==="restart"||e.action==="redeploy")return await m.forceNewDeployment(l.cluster,l.service),{...r,ok:!0,command:`ecs redeploy ${t.name}`}}return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`}}async exec(e){let t={workloadId:e.workloadId,preset:e.preset},r=await this.workload(e.workloadId);if(!r)return{...t,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{...t,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!r.capabilities.exec.supported)return{...t,ok:!1,error:r.capabilities.exec.reason??"Exec is unsupported for this workload."};if(e.confirm!==r.name)return{...t,ok:!1,error:`Type "${r.name}" to open exec access.`};if(!e.recentAuth)return{...t,ok:!1,error:"Sign in again before using elevated runtime access."};let a=e.preset&&fu[e.preset];if(!a&&!e.command?.trim())return{...t,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(e.command&&r.provider!=="docker")return{...t,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let l=r.links.providerId??"",m;if(r.provider==="docker"&&Zd.test(l)){let b=e.command?.trim()||a.map(Ln).join(" ");m=`docker exec ${l} sh -lc ${Ln(b)}`}else if(r.provider==="systemd"&&Yd.test(l)&&e.preset)m=e.preset==="process"?`systemctl status ${l} --no-pager --full`:fu[e.preset].map(Ln).join(" ");if(!m)return{...t,ok:!1,error:"Exec target identity is invalid or unsupported."};let f=await this.remote(r,["set -uo pipefail",m],60,"ts-cloud runtime:exec").catch(Qd);return{...t,ok:f.success,command:m,stdout:Fs(f.perInstance?.[0]?.output??""),stderr:Fs(f.perInstance?.[0]?.error??f.error??""),error:f.success?void 0:f.error??"Exec command failed."}}async readFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};let{workload:a,path:l,root:m,providerId:f}=r,k=`sh -c ${Ln('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${Ln(l)} ${mc} ${Ln(m)}`,y=a.provider==="docker"?`docker exec ${f} ${k}`:k,R=await this.remote(a,[y],30,"ts-cloud runtime:file-read").catch(Qd);if(!R.success)return{...t,ok:!1,error:R.error??R.perInstance?.[0]?.error??"File read failed."};let T=R.perInstance?.[0]?.output??"",N=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(T);if(!N)return{...t,ok:!1,error:"The remote file response was invalid."};let j=Number(N[1]),U=T.slice((N.index??0)+N[0].length).replace(/\s+/g,"");if(Buffer.from(U,"base64").byteLength>mc)return{...t,ok:!1,error:"The remote file exceeded the transfer limit."};return{...t,ok:!0,contentBase64:U,size:j,truncated:j>mc}}async writeFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(e.contentBase64))return{...t,ok:!1,error:"File content must be valid base64."};let a=Buffer.from(e.contentBase64,"base64");if(a.toString("base64")!==e.contentBase64)return{...t,ok:!1,error:"File content must be canonical base64."};if(a.byteLength>mc)return{...t,ok:!1,error:`File uploads are limited to ${mc} bytes.`};let{workload:l,path:m,root:f,providerId:b}=r,y=`sh -c ${Ln('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${Ln(m)} ${Ln(f)}`,R=l.provider==="docker"?`printf %s ${Ln(e.contentBase64)} | docker exec -i ${b} ${y}`:`printf %s ${Ln(e.contentBase64)} | ${y}`,T=await this.remote(l,[R],30,"ts-cloud runtime:file-write").catch(Qd);return{...t,ok:T.success,size:a.byteLength,truncated:!1,error:T.success?void 0:T.error??T.perInstance?.[0]?.error??"File write failed."}}async fileTarget(e){let t=await this.workload(e.workloadId);if(!t)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!t.capabilities.files.supported)return{error:t.capabilities.files.reason??"File access is unsupported for this workload."};if(e.confirm!==t.name)return{error:`Type "${t.name}" to access workload files.`};if(!e.recentAuth)return{error:"Sign in again before using elevated runtime access."};let r=Of(t,e.path);if(!r.ok)return{error:r.error};let a=cC(t,r.path),l=t.links.providerId??"";if(!a||t.provider==="systemd"&&!Yd.test(l)||t.provider==="docker"&&!Zd.test(l))return{error:"File target identity is invalid or unsupported."};return{workload:t,path:r.path,root:a,providerId:l}}async logs(e,t={}){let r=await this.workload(e);if(!r)throw Error("Workload was not found in the current project and environment.");if(!r.capabilities.logs.supported)throw Error(r.capabilities.logs.reason??"Logs are unsupported for this workload.");let a=Math.min(1000,Math.max(1,Math.floor(t.limit??200)));if(r.provider==="lambda"||r.provider==="ecs"){let R=this.dependencies.logs??new Ie(this.region,this.profile),T=r.config.logGroups,N=r.provider==="lambda"?`/aws/lambda/${r.name}`:Array.isArray(T)&&typeof T[0]==="string"?T[0]:void 0;if(!N)throw Error("The ECS task definition does not declare an awslogs group.");let j=await R.filterLogEvents({logGroupName:N,startTime:t.since?.getTime(),limit:a}),U=(j.events??[]).slice(0,a).map((q)=>({timestamp:q.timestamp==null?void 0:new Date(q.timestamp).toISOString(),message:Fs(String(q.message??""))}));return{workloadId:e,provider:r.provider,lines:U,nextCursor:j.nextToken,truncated:(j.events?.length??0)>=a}}let l=r.links.providerId??"",m=t.since&&Number.isFinite(t.since.getTime())?t.since:void 0,f=r.provider==="systemd"&&Yd.test(l)?`journalctl -u ${l} --no-pager -n ${a} -o short-iso${m?` --since ${Ln(m.toISOString())}`:""}`:r.provider==="docker"&&Zd.test(l)?`docker logs --timestamps --tail ${a}${m?` --since ${Math.floor(m.getTime()/1000)}`:""} ${l} 2>&1`:void 0;if(!f)throw Error("Log target identity is invalid.");let b=await this.remote(r,[f],30,"ts-cloud runtime:logs");if(!b.success)throw Error(b.error??b.perInstance?.[0]?.error??"Log read failed.");let k=Fs(b.perInstance?.[0]?.output??""),y=k.split(`
 `).filter(Boolean).slice(-a).map((R)=>{let T=/^(\d{4}-\d{2}-\d{2}T\S+)\s+(.*)$/.exec(R);return{timestamp:T?.[1],message:T?.[2]??R}});return{workloadId:e,provider:r.provider,lines:y,truncated:k.includes("[output truncated]")||y.length>=a}}}import{randomUUID as dC}from"node:crypto";class ca{records=new Map;maxBufferBytes;ttlMs;now;constructor(e={}){this.maxBufferBytes=Math.max(1024,e.maxBufferBytes??262144),this.ttlMs=Math.max(1000,e.ttlMs??900000),this.now=e.now??(()=>new Date)}create(e,t){this.sweep();let r=this.now().toISOString(),a={id:dC(),workloadId:t,kind:e,state:"open",chunks:[],cursor:0,droppedBytes:0,bufferedBytes:0,createdAt:r,updatedAt:r,abort:new AbortController,listeners:new Set};return this.records.set(a.id,a),this.snapshot(a,0)}signal(e){return this.records.get(e)?.abort.signal}append(e,t,r="stdout"){let a=this.records.get(e);if(!a||a.state!=="open"||!t)return a?this.snapshot(a,a.cursor):void 0;let l=Buffer.from(t),m=l.byteLength>this.maxBufferBytes?l.subarray(l.byteLength-this.maxBufferBytes).toString("utf8"):t,f={cursor:++a.cursor,stream:r,data:m,at:this.now().toISOString()};a.chunks.push(f),a.bufferedBytes+=Buffer.byteLength(m),a.updatedAt=f.at;while(a.bufferedBytes>this.maxBufferBytes&&a.chunks.length>1){let b=a.chunks.shift(),k=Buffer.byteLength(b.data);a.bufferedBytes-=k,a.droppedBytes+=k}return this.publish(a),this.snapshot(a,f.cursor-1)}read(e,t,r=0){let a=this.records.get(e);if(!a||a.workloadId!==t)return;return a.updatedAt=this.now().toISOString(),this.snapshot(a,Math.max(0,Math.floor(r)))}close(e,t="complete",r){let a=this.records.get(e);if(!a||a.state!=="open")return a?this.snapshot(a,a.cursor):void 0;if(a.state=t,a.error=r,a.updatedAt=this.now().toISOString(),t==="cancelled")a.abort.abort();return this.publish(a),this.snapshot(a,a.cursor)}cancel(e,t){let r=this.records.get(e);if(!r||r.workloadId!==t)return;return this.close(e,"cancelled")}subscribe(e,t,r){let a=this.records.get(e);if(!a||a.workloadId!==t)return;return a.listeners.add(r),()=>a.listeners.delete(r)}sweep(){let e=this.now().getTime()-this.ttlMs,t=0;for(let[r,a]of this.records){if(new Date(a.updatedAt).getTime()>e)continue;a.abort.abort(),this.records.delete(r),t++}return t}clear(){for(let e of this.records.values())e.abort.abort();this.records.clear()}snapshot(e,t){let r=e.chunks[0]?.cursor??e.cursor+1,a=t>0&&t<r-1;return{id:e.id,workloadId:e.workloadId,kind:e.kind,state:e.state,chunks:e.chunks.filter((l)=>a||l.cursor>t),cursor:e.cursor,reset:a,droppedBytes:e.droppedBytes,createdAt:e.createdAt,updatedAt:e.updatedAt,error:e.error}}publish(e){let t=this.snapshot(e,0);for(let r of e.listeners)r(t)}}import{createHash as lC}from"node:crypto";var Ug={info:0,low:1,medium:2,high:3,critical:4},qg={record:0,warn:1,block:2},Hv=new Set(["skipped","unavailable","unsupported","stale"]);function ur(e){return typeof e==="string"?e:void 0}function eo(e,t){try{return JSON.parse(String(e))}catch{return t}}function Jn(e){return JSON.stringify(s(e))}function uC(e){if(!e)return;return String(s(e,2000))}function Lg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:ur(e.project_id),environmentId:ur(e.environment_id),resourceId:ur(e.resource_id),releaseId:ur(e.release_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),status:String(e.status),error:ur(e.error),metadata:eo(e.metadata,{}),findingsCount:Number(e.findings_count),startedAt:String(e.started_at),completedAt:String(e.completed_at),durationMs:Number(e.duration_ms)}}function Kv(e){return{id:String(e.id),fingerprint:String(e.fingerprint),organizationId:String(e.organization_id),projectId:ur(e.project_id),environmentId:ur(e.environment_id),resourceId:ur(e.resource_id),releaseId:ur(e.release_id),scanRunId:String(e.scan_run_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),ruleId:String(e.rule_id),severity:String(e.severity),title:String(e.title),description:String(e.description),evidence:eo(e.evidence,{}),remediation:ur(e.remediation),subject:String(e.subject),status:String(e.status),ownerActorId:ur(e.owner_actor_id),recurrenceCount:Number(e.recurrence_count),firstSeenAt:String(e.first_seen_at),lastSeenAt:String(e.last_seen_at),resolvedAt:ur(e.resolved_at),updatedAt:String(e.updated_at)}}function Fg(e){return{id:String(e.id),organizationId:String(e.organization_id),environmentId:ur(e.environment_id),name:String(e.name),rules:eo(e.rules,[]),requiredScanners:eo(e.required_scanners,[]),scannerFailMode:String(e.scanner_fail_mode),enabled:Number(e.enabled)===1,version:Number(e.version),createdByActorId:ur(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Jv(e,t){let r=ur(e.revoked_at),a=String(e.expires_at);return{id:String(e.id),findingId:String(e.finding_id),policyId:ur(e.policy_id),reason:String(e.reason),referenceUrl:ur(e.reference_url),createdByActorId:String(e.created_by_actor_id),expiresAt:a,revokedAt:r,state:r?"revoked":a<=t?"expired":"active",createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function zg(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:ur(e.environment_id),releaseId:String(e.release_id),kind:String(e.kind),format:String(e.format),digest:String(e.digest),summary:eo(e.summary,{}),content:ur(e.content),sensitive:Number(e.sensitive)===1,createdAt:String(e.created_at)}}function Gv(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),operationId:ur(e.operation_id),policyId:String(e.policy_id),policyVersion:Number(e.policy_version),outcome:String(e.outcome),scannerVersions:eo(e.scanner_versions,{}),findingIds:eo(e.finding_ids,[]),waiverIds:eo(e.waiver_ids,[]),explanation:String(e.explanation),createdAt:String(e.created_at)}}function pC(e,t){let r=[e.trim().toLowerCase(),t.ruleId.trim().toLowerCase(),t.organizationId,t.projectId??"",t.environmentId??"",t.resourceId??"",t.releaseId??"",t.subject.trim().toLowerCase()].join("\x00");return lC("sha256").update(r).digest("hex")}function Qv(e){if(!e)return;let t=new URL(e);if(t.protocol!=="https:"&&t.protocol!=="http:")throw Error("Security references must use HTTP or HTTPS");return t.toString()}function Yv(e){if(!e.length)throw Error("A security policy needs at least one rule");return e.map((t)=>{if(!(t.minimumSeverity in Ug))throw Error(`Unknown security severity: ${t.minimumSeverity}`);if(!(t.action in qg))throw Error(`Unknown security policy action: ${t.action}`);return{minimumSeverity:t.minimumSeverity,action:t.action,...t.scannerId?{scannerId:t.scannerId.trim()}:{}}})}class ln{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}recordScan(e){if(!e.organizationId||!e.scannerId.trim()||!e.scannerVersion.trim())throw Error("Organization, scanner id, and scanner version are required");let t=e.completedAt??this.now(),r=e.startedAt??t,a=e.durationMs??Math.max(0,new Date(t).getTime()-new Date(r).getTime()),l=e.findings??[],m=this.idFn(),f=new Set,b=[];return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_scan_runs
         (id, organization_id, project_id, environment_id, resource_id, release_id, scanner_id, scanner_version, status, error, metadata, findings_count, started_at, completed_at, duration_ms)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[m,e.organizationId,e.projectId??null,e.environmentId??null,e.resourceId??null,e.releaseId??null,e.scannerId.trim(),e.scannerVersion.trim(),e.status,uC(e.error)??null,Jn(e.metadata??{}),l.length,r,t,Math.max(0,Math.floor(a))]);for(let k of l){let y={...k,organizationId:e.organizationId,projectId:k.projectId??e.projectId,environmentId:k.environmentId??e.environmentId,resourceId:k.resourceId??e.resourceId,releaseId:k.releaseId??e.releaseId},R=y.fingerprint?.trim()||pC(e.scannerId,y);f.add(R);let T=this.controlPlane.database.query("SELECT * FROM security_findings WHERE fingerprint = ?").get(R),N=T?this.controlPlane.database.query("SELECT * FROM security_waivers WHERE finding_id = ? AND revoked_at IS NULL AND expires_at > ? ORDER BY expires_at DESC LIMIT 1").get(String(T.id),t):void 0;if(T){let j=String(T.status)==="resolved"?Number(T.recurrence_count)+1:Number(T.recurrence_count),U=N?"waived":String(T.status)==="acknowledged"?"acknowledged":"open";this.run(`UPDATE security_findings SET scan_run_id = ?, scanner_version = ?, severity = ?, title = ?, description = ?, evidence = ?, remediation = ?,
@@ -191,10 +191,10 @@ export type ConfigOf = Config
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[r,e.organizationId,e.projectId,e.environmentId??null,e.releaseId,e.kind,e.format,e.digest,Jn(e.summary),e.content??null,e.sensitive?1:0,a]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,type:"security.release_artifact.created",payload:{artifactId:r,releaseId:e.releaseId,kind:e.kind,format:e.format,digest:e.digest,sensitive:e.sensitive}}),zg(this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE id = ?").get(r))}listReleaseArtifacts(e,t=!1){return this.controlPlane.database.query("SELECT * FROM release_security_artifacts WHERE release_id = ? ORDER BY created_at, kind").all(e).map(zg).map((r)=>r.sensitive&&!t?{...r,content:void 0}:r)}summary(e,t,r){let a=this.listFindings({organizationId:e,projectId:t,environmentId:r,limit:1000}),l=this.listScanRuns({organizationId:e,projectId:t,environmentId:r,limit:1000}),m={info:0,low:0,medium:0,high:0,critical:0};for(let b of a)if(b.status==="open"||b.status==="acknowledged")m[b.severity]++;let f={passed:0,failed:0,skipped:0,unavailable:0,unsupported:0,stale:0};for(let b of l)f[b.status]++;return{open:m,waived:a.filter((b)=>b.status==="waived").length,resolved:a.filter((b)=>b.status==="resolved").length,checks:f,lastScannedAt:l[0]?.completedAt}}exportPosture(e){let t=this.controlPlane.listProjects().filter((r)=>r.organizationId===e);return s({format:"ts-cloud-security-posture",version:1,exportedAt:this.now(),organizationId:e,policies:this.listPolicies(e),findings:this.listFindings({organizationId:e,limit:1000}),waivers:this.listWaivers().filter((r)=>this.getFinding(r.findingId)?.organizationId===e),scans:t.flatMap((r)=>this.listScanRuns({organizationId:e,projectId:r.id,limit:1000})),decisions:t.flatMap((r)=>this.controlPlane.listEnvironments(r.id).flatMap((a)=>this.listDecisions(a.id,1000)))})}}import{existsSync as gC,readdirSync as mC,readFileSync as fC,statSync as hC}from"node:fs";import{extname as yC,join as vC,relative as Zv,sep as bC}from"node:path";var ru=[{name:"AWS Access Key ID",pattern:/(?:^|[^A-Z0-9])((AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})(?:[^A-Z0-9]|$)/g,severity:"critical",description:"AWS Access Key ID detected"},{name:"AWS Secret Access Key",pattern:/(?:aws_secret_access_key|aws_secret_key|secret_access_key|secretAccessKey)['"]?\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,severity:"critical",description:"AWS Secret Access Key detected"},{name:"AWS Secret Key (Generic)",pattern:/(?:^|['"`:=\s])([A-Za-z0-9/+=]{40})(?:['"`\s]|$)/g,severity:"high",description:"Potential AWS Secret Key (40-char base64)"},{name:"Generic API Key",pattern:/(?:api[_-]?key|apikey|api[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9_\-]{20,})['"]?/gi,severity:"high",description:"Generic API key detected"},{name:"RSA Private Key",pattern:/-----BEGIN RSA PRIVATE KEY-----/g,severity:"critical",description:"RSA private key detected"},{name:"OpenSSH Private Key",pattern:/-----BEGIN OPENSSH PRIVATE KEY-----/g,severity:"critical",description:"OpenSSH private key detected"},{name:"EC Private Key",pattern:/-----BEGIN EC PRIVATE KEY-----/g,severity:"critical",description:"EC private key detected"},{name:"PGP Private Key",pattern:/-----BEGIN PGP PRIVATE KEY BLOCK-----/g,severity:"critical",description:"PGP private key detected"},{name:"GitHub Token",pattern:/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/g,severity:"critical",description:"GitHub personal access token detected"},{name:"GitHub OAuth",pattern:/github[_-]?oauth[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{40})['"]?/gi,severity:"critical",description:"GitHub OAuth token detected"},{name:"Slack Token",pattern:/xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*/g,severity:"critical",description:"Slack token detected"},{name:"Slack Webhook",pattern:/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g,severity:"high",description:"Slack webhook URL detected"},{name:"Discord Webhook",pattern:/https:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g,severity:"high",description:"Discord webhook URL detected"},{name:"JWT Token",pattern:/eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,severity:"high",description:"JWT token detected"},{name:"Google API Key",pattern:/AIza[0-9A-Za-z_-]{35}/g,severity:"critical",description:"Google API key detected"},{name:"Google OAuth ID",pattern:/[0-9]+-[A-Za-z0-9_]{32}\.apps\.googleusercontent\.com/g,severity:"high",description:"Google OAuth client ID detected"},{name:"Firebase API Key",pattern:/(?:firebase[_-]?api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9_-]{39})['"]?/gi,severity:"critical",description:"Firebase API key detected"},{name:"Cloudflare API Token",pattern:/(?:cloudflare[_-]?api[_-]?token|cf[_-]?api[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{40})['"]?/gi,severity:"critical",description:"Cloudflare API token detected"},{name:"Azure Client Secret",pattern:/(?:azure[_-]?client[_-]?secret|client[_-]?secret)\s*[=:]\s*['"]?([A-Za-z0-9~._-]{34,})['"]?/gi,severity:"critical",description:"Azure client secret detected"},{name:"Heroku API Key",pattern:/(?:heroku[_-]?api[_-]?key)\s*[=:]\s*['"]?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})['"]?/gi,severity:"critical",description:"Heroku API key detected"},{name:"Database Connection String",pattern:/(?:mysql|postgres|postgresql|mongodb|redis|mongodb\+srv):\/\/[^:]+:[^@]+@[^/\s]+/gi,severity:"critical",description:"Database connection string with credentials detected"},{name:"Database Password",pattern:/(?:db[_-]?password|database[_-]?password|mysql[_-]?password|postgres[_-]?password)\s*[=:]\s*['"]?([^'"\s]{8,})['"]?/gi,severity:"critical",description:"Database password detected"},{name:"Stripe API Key",pattern:/(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,}/g,severity:"critical",description:"Stripe API key detected"},{name:"PayPal Client ID",pattern:/(?:paypal[_-]?client[_-]?id)\s*[=:]\s*['"]?([A-Za-z0-9_-]{80})['"]?/gi,severity:"high",description:"PayPal client ID detected"},{name:"Square Access Token",pattern:/sq0[a-z]{3}-[0-9A-Za-z_-]{22,}/g,severity:"critical",description:"Square access token detected"},{name:"Twilio API Key",pattern:/SK[a-f0-9]{32}/g,severity:"critical",description:"Twilio API key detected"},{name:"SendGrid API Key",pattern:/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,severity:"critical",description:"SendGrid API key detected"},{name:"Mailgun API Key",pattern:/key-[0-9a-zA-Z]{32}/g,severity:"critical",description:"Mailgun API key detected"},{name:"Password in Code",pattern:/(?:password|passwd|pwd)\s*[=:]\s*['"]([^'"]{8,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded password detected"},{name:"Secret/Token Assignment",pattern:/(?:secret|token|auth[_-]?token|access[_-]?token)\s*[=:]\s*['"]([A-Za-z0-9_\-/+=]{16,})['"](?!\s*[,\]])/gi,severity:"high",description:"Hardcoded secret or token detected"},{name:"NPM Token",pattern:/(?:npm[_-]?token)\s*[=:]\s*['"]?([A-Za-z0-9_-]{36})['"]?/gi,severity:"critical",description:"NPM token detected"},{name:"SSH Private Key Path Exposed",pattern:/~\/\.ssh\/id_[a-z]+|\/home\/[^/]+\/\.ssh\/id_[a-z]+/g,severity:"medium",description:"SSH private key path exposed"},{name:"Env Variable with Secret",pattern:/(?:process\.env\.)((?=[A-Z_]*(?:SECRET|KEY|TOKEN|PASSWORD|CREDENTIAL|AUTH))[A-Z_]+)\s*(?:===?\s*['"]([^'"]+)['"])?/g,severity:"medium",description:"Environment variable containing secret may be exposed"}],SC=[".js",".jsx",".ts",".tsx",".mjs",".cjs",".vue",".svelte",".html",".htm",".css",".scss",".less",".json",".yaml",".yml",".toml",".xml",".env",".config",".conf"],wC=["node_modules",".git",".svn",".hg","dist","build","coverage",".nyc_output","__pycache__",".pytest_cache","vendor",".idea",".vscode",".turbo",".next",".nuxt","framework.bak","pantry",".pantry","tests","test","__tests__","spec","__mocks__",".github",".gitlab",".circleci",".claude/worktrees"],kC=["package-lock.json","yarn.lock","pnpm-lock.yaml","bun.lockb","bun.lock","*.min.js","*.min.css","*.map","*.d.ts","*.test.ts","*.test.js","*.spec.ts","*.spec.js",".env",".env.*"];class un{patterns;excludeDirs;excludeFiles;maxFileSize;constructor(e){this.patterns=[...ru,...e?.customPatterns||[]],this.excludeDirs=[...wC,...e?.excludeDirs||[]],this.excludeFiles=[...kC,...e?.excludeFiles||[]],this.maxFileSize=e?.maxFileSize||1048576}async scan(e){let t=Date.now(),r=[],a=0,{directory:l,exclude:m=[],include:f,skipPatterns:b=[]}=e,k=e.failOnSeverity||"critical";if(!gC(l))throw Error(`Directory not found: ${l}`);let y=this.getFilesToScan(l,[...this.excludeDirs,...m],f);for(let U of y){let q=Zv(l,U);if(this.shouldExcludeFile(q))continue;try{if(hC(U).size>this.maxFileSize)continue;let ee=fC(U,"utf-8"),le=this.scanContent(ee,q,b);r.push(...le),a++}catch{continue}}let R={critical:r.filter((U)=>U.pattern.severity==="critical").length,high:r.filter((U)=>U.pattern.severity==="high").length,medium:r.filter((U)=>U.pattern.severity==="medium").length,low:r.filter((U)=>U.pattern.severity==="low").length},T=["low","medium","high","critical"],N=T.indexOf(k),j=!0;for(let U=N;U<T.length;U++)if(R[T[U]]>0){j=!1;break}return{passed:j,findings:r,scannedFiles:a,duration:Date.now()-t,summary:R}}scanContent(e,t,r){let a=[],l=e.split(`
 `);for(let m of this.patterns){if(r.includes(m.name))continue;m.pattern.lastIndex=0;let f;while((f=m.pattern.exec(e))!==null){let b=e.substring(0,f.index),k=b.split(`
 `).length,y=b.lastIndexOf(`
-`),R=f.index-y,T=l[k-1]||"";if(this.isLikelyPlaceholder(f[0],T))continue;let N=f[1]||f[0];if(m.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(N))continue;if(m.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(N))continue;if(m.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(N))continue;if(this.isLowEntropy(N))continue;a.push({file:t,line:k,column:R,match:this.maskSecret(f[0]),pattern:m,context:this.maskSecret(T.trim())})}}return a}isLikelyPlaceholder(e,t){let r=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],a=e.toLowerCase(),l=t.toLowerCase();for(let f of r)if(a.includes(f.toLowerCase())||l.includes(f.toLowerCase()))return!0;let m=t.trim();if(m.startsWith("//")||m.startsWith("#")||m.startsWith("*")||m.startsWith("/*")){if(l.includes("example")||l.includes("format:")||l.includes("e.g."))return!0}return!1}isLowEntropy(e){if(e.length<8)return!1;if(new Set(e).size<8)return!0;if(/(.)\1{3,}/.test(e))return!0;return!1}hasSecretCharacterDiversity(e){let t=/[\d+=]/.test(e),r=[/[a-z]/.test(e),/[A-Z]/.test(e),/\d/.test(e),/[/+=]/.test(e)];return t&&r.filter(Boolean).length>=3}maskSecret(e){if(e.length<=8)return"*".repeat(e.length);let t=Math.min(4,Math.floor(e.length*0.2));return e.substring(0,t)+"*".repeat(e.length-t*2)+e.substring(e.length-t)}getFilesToScan(e,t,r){let a=[],l=r||SC,m=t.filter((k)=>!k.includes("/")),f=t.filter((k)=>k.includes("/")).map((k)=>k.replace(/^\.\//,"").replace(/\/+$/,"")),b=(k)=>{let y=mC(k,{withFileTypes:!0});for(let R of y){let T=vC(k,R.name);if(R.isDirectory()){let N=Zv(e,T).split(bC).join("/");if(!m.includes(R.name)&&!f.includes(N))b(T)}else if(R.isFile()){let N=yC(R.name).toLowerCase();if(l.includes(N)||R.name.startsWith(".env")||R.name.endsWith(".config"))a.push(T)}}};return b(e),a}shouldExcludeFile(e){let t=e.split("/").pop()||"";for(let r of this.excludeFiles)if(r.startsWith("*")){let a=r.substring(1);if(t.endsWith(a))return!0}else if(r.endsWith("*")){let a=r.substring(0,r.length-1);if(t.startsWith(a))return!0}else if(t===r)return!0;return!1}addPattern(e){this.patterns.push(e)}getPatterns(){return[...this.patterns]}}async function vf(e){return new un().scan(e)}function Tf(e){let t=[];if(t.push(`
+`),R=f.index-y,T=l[k-1]||"";if(this.isLikelyPlaceholder(f[0],T))continue;let N=f[1]||f[0];if(m.name==="AWS Secret Key (Generic)"&&/^[a-f0-9]{40}$/i.test(N))continue;if(m.name==="AWS Secret Key (Generic)"&&!this.hasSecretCharacterDiversity(N))continue;if(m.name==="AWS Secret Key (Generic)"&&/^(?:Actions|Commands|Controllers|Handlers|Jobs|Listeners|Middleware|Models|Resources|Services)\//.test(N))continue;if(this.isLowEntropy(N))continue;a.push({file:t,line:k,column:R,match:this.maskSecret(f[0]),pattern:m,context:this.maskSecret(T.trim())})}}return a}isLikelyPlaceholder(e,t){let r=["example","placeholder","your_","YOUR_","xxx","XXX","***","test","TEST","dummy","DUMMY","fake","FAKE","sample","SAMPLE","<your","${","{{","process.env","import.meta.env","CHANGEME","TODO","FIXME"],a=e.toLowerCase(),l=t.toLowerCase();for(let f of r)if(a.includes(f.toLowerCase())||l.includes(f.toLowerCase()))return!0;let m=t.trim();if(m.startsWith("//")||m.startsWith("#")||m.startsWith("*")||m.startsWith("/*")){if(l.includes("example")||l.includes("format:")||l.includes("e.g."))return!0}return!1}isLowEntropy(e){if(e.length<8)return!1;if(new Set(e).size<8)return!0;if(/(.)\1{3,}/.test(e))return!0;return!1}hasSecretCharacterDiversity(e){let t=/[\d+=]/.test(e),r=[/[a-z]/.test(e),/[A-Z]/.test(e),/\d/.test(e),/[/+=]/.test(e)];return t&&r.filter(Boolean).length>=3}maskSecret(e){if(e.length<=8)return"*".repeat(e.length);let t=Math.min(4,Math.floor(e.length*0.2));return e.substring(0,t)+"*".repeat(e.length-t*2)+e.substring(e.length-t)}getFilesToScan(e,t,r){let a=[],l=r||SC,m=t.filter((k)=>!k.includes("/")),f=t.filter((k)=>k.includes("/")).map((k)=>k.replace(/^\.\//,"").replace(/\/+$/,"")),b=(k)=>{let y=mC(k,{withFileTypes:!0});for(let R of y){let T=vC(k,R.name);if(R.isDirectory()){let N=Zv(e,T).split(bC).join("/");if(!m.includes(R.name)&&!f.includes(N))b(T)}else if(R.isFile()){let N=yC(R.name).toLowerCase();if(l.includes(N)||R.name.startsWith(".env")||R.name.endsWith(".config"))a.push(T)}}};return b(e),a}shouldExcludeFile(e){let t=e.split("/").pop()||"";for(let r of this.excludeFiles)if(r.startsWith("*")){let a=r.substring(1);if(t.endsWith(a))return!0}else if(r.endsWith("*")){let a=r.substring(0,r.length-1);if(t.startsWith(a))return!0}else if(t===r)return!0;return!1}addPattern(e){this.patterns.push(e)}getPatterns(){return[...this.patterns]}}async function Tf(e){return new un().scan(e)}function wf(e){let t=[];if(t.push(`
 Security Scan Results`),t.push("=".repeat(50)),t.push(`Files scanned: ${e.scannedFiles}`),t.push(`Duration: ${e.duration}ms`),t.push(""),t.push("Summary:"),t.push(`  Critical: ${e.summary.critical}`),t.push(`  High: ${e.summary.high}`),t.push(`  Medium: ${e.summary.medium}`),t.push(`  Low: ${e.summary.low}`),t.push(""),e.findings.length>0){t.push("Findings:"),t.push("-".repeat(50));for(let r of e.findings)t.push(`
 [${r.pattern.severity.toUpperCase()}] ${r.pattern.name}`),t.push(`  File: ${r.file}:${r.line}:${r.column}`),t.push(`  Match: ${r.match}`),t.push(`  Context: ${r.context}`),t.push(`  Description: ${r.pattern.description}`)}return t.push(""),t.push(e.passed?"✓ Security scan passed":"✗ Security scan failed"),t.join(`
-`)}function IC(e,t){return{status:"unavailable",findings:[],error:`${e.id} exceeded its ${t}ms timeout`,metadata:{timeoutMs:t}}}class vt{posture;defaultTimeoutMs;nowFn;constructor(e,t={}){this.posture=e;this.defaultTimeoutMs=t.defaultTimeoutMs??60000,this.nowFn=t.now??(()=>new Date)}async run(e,t){let r=this.nowFn(),a=Math.max(100,e.timeoutMs??this.defaultTimeoutMs),l=new AbortController,m,f=new Promise((R)=>{m=setTimeout(()=>{l.abort(),R(IC(e,a))},a)}),b;try{b=await Promise.race([e.scan({...t,signal:l.signal}),f])}catch(R){b={status:"unavailable",findings:[],error:R instanceof Error?R.message:String(R)}}finally{if(m)clearTimeout(m)}let k=this.nowFn(),y={...t,scannerId:e.id,scannerVersion:e.version,status:b.status,findings:b.findings,metadata:b.metadata,error:b.error,startedAt:r.toISOString(),completedAt:k.toISOString(),durationMs:Math.max(0,k.getTime()-r.getTime())};return this.posture.recordScan(y)}async runAll(e,t){return Promise.all(e.map((r)=>this.run(r,t)))}}class gn{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(e=new un){this.scanner=e}async scan(e){if(!e.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let t=await this.scanner.scan({directory:e.artifactRoot,failOnSeverity:"critical"});return{status:t.passed?"passed":"failed",findings:t.findings.map((r)=>({...e,ruleId:r.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:r.pattern.severity,title:r.pattern.name,description:r.pattern.description,subject:`${r.file}:${r.line}`,evidence:{file:r.file,line:r.line,column:r.column,match:r.match,context:r.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:t.scannedFiles,summary:t.summary}}}}function EC(e){let t=e?.toLowerCase();return t==="critical"||t==="high"||t==="medium"||t==="low"?t:"info"}class ia{id="trivy-image";version;timeoutMs;constructor(e={}){this.version=e.version??"local",this.timeoutMs=e.timeoutMs??120000,this.executable=e.executable??"trivy"}executable;async scan(e){if(!e.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let t;try{t=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",e.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(k){return{status:"unsupported",findings:[],error:k instanceof Error?k.message:String(k)}}let r=()=>t.kill();e.signal.addEventListener("abort",r,{once:!0});let[a,l,m]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);if(e.signal.removeEventListener("abort",r),a!==0)return{status:/not found|enoent/i.test(m)?"unsupported":"unavailable",findings:[],error:m.slice(0,2000)||`Trivy exited with ${a}`};let f=JSON.parse(l),b=[];for(let k of f.Results??[])for(let y of k.Vulnerabilities??[]){let R=y.VulnerabilityID??"unknown-vulnerability";b.push({...e,ruleId:R,severity:EC(y.Severity),title:y.Title||R,description:y.Description||`${R} affects ${y.PkgName??"an image package"}.`,subject:`${e.imageRef}:${y.PkgName??"unknown"}:${y.InstalledVersion??"unknown"}`,evidence:{image:e.imageRef,target:k.Target??"",cve:R,package:y.PkgName??"",installedVersion:y.InstalledVersion??"",fixedVersion:y.FixedVersion??"",reference:y.PrimaryURL??""},remediation:y.FixedVersion?`Upgrade ${y.PkgName} to ${y.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:b.length?"failed":"passed",findings:b,metadata:{imageRef:e.imageRef,vulnerabilityCount:b.length,localOnly:!0}}}}class wf{actions;id="aws-iam-capabilities";version="1.0.0";timeoutMs=30000;client;constructor(e,t={}){this.actions=e;if(this.resourceArns=t.resourceArns??["*"],t.client)this.client=t.client;else{let r=new Se(t.region),a=new be(t.region);this.client={getCallerIdentity:()=>r.getCallerIdentity(),simulatePrincipalPolicy:(l)=>a.simulatePrincipalPolicy(l)}}}resourceArns;async scan(e){let t=await this.client.getCallerIdentity();if(!t.Arn)return{status:"unavailable",findings:[],error:"AWS returned no caller ARN"};let r=t.Arn;if(r.includes(":assumed-role/"))return{status:"unsupported",findings:[],error:"AWS policy simulation requires the underlying IAM role ARN; use an IAM role/user ARN or provider-native access analysis.",metadata:{account:t.Account??"",principalType:"assumed-role"}};let m=(await this.client.simulatePrincipalPolicy({PolicySourceArn:r,ActionNames:this.actions,ResourceArns:this.resourceArns})).EvaluationResults.filter((f)=>f.EvalDecision!=="allowed").map((f)=>({...e,ruleId:`iam-${f.EvalActionName.toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:"high",title:`Missing AWS capability: ${f.EvalActionName}`,description:`The active AWS principal is ${f.EvalDecision||"not allowed"} for this deployment action.`,subject:`${r}:${f.EvalActionName}`,evidence:{account:t.Account??"",principalArn:r,action:f.EvalActionName,decision:f.EvalDecision,missingContext:f.MissingContextValues??[]},remediation:"Grant the deployment principal the least-privilege action on the required resources, then rerun the capability check."}));return{status:m.length?"failed":"passed",findings:m,metadata:{account:t.Account??"",principalArn:r,evaluatedActions:this.actions.length}}}}import{createHash as RC,createVerify as AC}from"node:crypto";import{existsSync as CC,readFileSync as PC}from"node:fs";import{basename as _C,join as TC,resolve as Xv}from"node:path";function zs(e){return RC("sha256").update(e).digest("hex")}function xC(e){let t=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],r=new Map;for(let[a,l]of t){let m=e[a];if(!m||typeof m!=="object"||Array.isArray(m))continue;for(let[f,b]of Object.entries(m)){let k=String(b).replace(/^[~^]/,""),y=`${f}@${k}`;if(!r.has(y))r.set(y,{type:"library",name:f,version:k,purl:`pkg:npm/${encodeURIComponent(f)}@${encodeURIComponent(k)}`,scope:l})}}return[...r.values()].sort((a,l)=>`${a.name}@${a.version}`.localeCompare(`${l.name}@${l.version}`))}function nu(e,t={}){let r=TC(Xv(e),"package.json");if(!CC(r))throw Error(`Cannot generate an SBOM: ${r} was not found`);let a=PC(r,"utf8"),l=JSON.parse(a),m=String(l.name??_C(Xv(e))),f=String(l.version??"0.0.0"),b=zs(a);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:t.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(t.now??new Date).toISOString(),component:{type:"application",name:m,version:f,purl:`pkg:npm/${encodeURIComponent(m)}@${encodeURIComponent(f)}`,hashes:[{alg:"SHA-256",content:b}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:xC(l)}}async function iu(e,t={}){let r=Bun.spawn([t.executable??"syft",e,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),a=()=>r.kill();t.signal?.addEventListener("abort",a,{once:!0});let[l,m,f]=await Promise.all([r.exited,new Response(r.stdout).text(),new Response(r.stderr).text()]);if(t.signal?.removeEventListener("abort",a),l!==0)throw Error(f.slice(0,2000)||`Syft exited with ${l}`);return JSON.parse(m)}function sa(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"sbom",format:`cyclonedx-${r.specVersion}+json`,digest:`sha256:${zs(a)}`,summary:{component:r.metadata.component.name,version:r.metadata.component.version,components:r.components.length},content:a,sensitive:!0})}function su(e,t,r){let a={total:r.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let m of r){a[m.severity]++;let f=m.evidence;if(typeof f.fixedVersion==="string"&&f.fixedVersion)a.fixable++}let l=JSON.stringify({releaseId:t.releaseId,generatedAt:new Date().toISOString(),findings:r.map((m)=>({id:m.id,ruleId:m.ruleId,severity:m.severity,subject:m.subject,remediation:m.remediation}))});return e.addReleaseArtifact({...t,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${zs(l)}`,summary:a,content:l,sensitive:!0})}function ou(e){if(!e.artifact&&!e.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:e.artifactName,digest:{sha256:e.artifactSha256?.replace(/^sha256:/,"")??zs(e.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:e.externalParameters??{},internalParameters:{},resolvedDependencies:e.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:e.invocationId,startedOn:e.startedAt,finishedOn:e.completedAt}}}}}function au(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${zs(a)}`,summary:{subjects:r.subject.length,builder:r.predicate.runDetails.builder.id,buildType:r.predicate.buildDefinition.buildType},content:a,sensitive:!0})}function uS(e){let t=e.expectedSha256.replace(/^sha256:/,"").toLowerCase(),r=zs(e.artifact)===t;if(!e.signature||!e.publicKey)return{digestValid:r,signature:"not_configured"};try{let a=AC("SHA256");return a.update(e.artifact),a.end(),{digestValid:r,signature:a.verify(e.publicKey,Buffer.from(e.signature,"base64"))?"verified":"invalid"}}catch{return{digestValid:r,signature:"invalid"}}}function se(e,t){let r=e.environments.get(t);if(!r)throw Error(`Security scope for environment '${t}' was not found`);return{organizationId:e.organization.id,projectId:e.project.id,environmentId:r.id}}function cu(e,t){let r=new ln(e.store),a=r.listPolicies(e.organization.id);for(let[l,m]of e.environments){if(a.some((b)=>b.environmentId===m.id))continue;let f=l==="production"||m.kind==="production";a.push(r.createPolicy({organizationId:e.organization.id,environmentId:m.id,name:f?"Production baseline":"Environment baseline",scannerFailMode:f?"closed":"open",requiredScanners:["source-secrets"],rules:f?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:t}))}return a}function gS(e,t,r,a={}){let l=r.findings.map((m)=>({...t,ruleId:m.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:m.pattern.severity,title:m.pattern.name,description:m.pattern.description,subject:`${m.file}:${m.line}`,evidence:{file:m.file,line:m.line,column:m.column,match:m.match,context:m.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:a.scannerVersion??"1.0.0",status:a.skipped?"skipped":r.passed?"passed":"failed",findings:a.skipped?[]:l,metadata:{scannedFiles:r.scannedFiles,durationMs:r.duration,summary:r.summary},durationMs:r.duration,error:a.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function pS(e,t,r="The operator explicitly skipped source-secret scanning."){return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:r})}function DC(e,t){let r=[],a=t.security;if(a?.firewall&&!["active","configured","ok"].includes(String(a.firewall.status)))r.push({...e,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(a.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(a.firewall.status??"unknown"),rules:Array.isArray(a.firewall.rules)?a.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let l of a?.ports??[]){let m=String(l.listen??""),f=Number(m.match(/:(\d+)$/)?.[1]);if(l.exposure==="public"&&Number.isFinite(f)&&![22,80,443].includes(f))r.push({...e,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${f}`,description:`${String(l.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${f}`,evidence:{protocol:String(l.proto??""),listen:m,process:String(l.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let l of a?.tlsCertificates??[]){let m=Number(l.daysRemaining);if(Number.isFinite(m)&&m<30)r.push({...e,ruleId:"tls-certificate-expiry",severity:m<14?"high":"medium",title:`TLS certificate expires in ${m} days`,description:`${String(l.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(l.domain??"unknown")}`,evidence:{domain:String(l.domain??""),daysRemaining:m,expires:String(l.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let l of t.diagnostics??[]){if(l.status==="pass"||l.status==="ok")continue;r.push({...e,ruleId:`diagnostic-${String(l.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:l.status==="fail"?"high":"medium",title:String(l.name??"Host security check"),description:String(l.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(l.name??"unknown")}`,evidence:{status:String(l.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return r}function ns(e,t,r){let a=!!r.security||Array.isArray(r.diagnostics),l=a?DC(t,r):[];return e.recordScan({...t,scannerId:"host-posture",scannerVersion:"1.0.0",status:!a?"unavailable":l.length?"failed":"passed",findings:l,metadata:{source:"dashboard-live-probe",checks:Array.isArray(r.diagnostics)?r.diagnostics.length:0},error:a?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function is(e,t){let r=e.evaluateGate({...t.scope,operationId:t.operationId}),a=e.listFindings({...t.scope,limit:1000}).filter((l)=>l.status!=="resolved");return{decision:r,summary:{desiredConfigHash:t.desiredConfigHash??null,securityImpact:{critical:a.filter((l)=>l.severity==="critical").length,high:a.filter((l)=>l.severity==="high").length,waived:a.filter((l)=>l.status==="waived").length,assigned:a.filter((l)=>!!l.ownerActorId).length},blockingFindingIds:r.findingIds,policy:{id:r.policyId,version:r.policyVersion},scannerVersions:r.scannerVersions}}}async function mS(e,t){let r=t.scanner??new ia({timeoutMs:t.scannerTimeoutMs}),l=await new vt(e,{defaultTimeoutMs:t.scannerTimeoutMs??120000}).run(r,{...t.scope,releaseId:t.releaseId,imageRef:t.imageRef}),m={...t.scope,releaseId:t.releaseId};su(e,m,l.findings);let f=t.generateImageSbom??iu,b=new AbortController,k=Math.max(100,t.sbomTimeoutMs??120000),y,R=new Promise((j,U)=>{y=setTimeout(()=>{b.abort(),U(Error(`syft-sbom exceeded its ${k}ms timeout`))},k)}),T="unavailable";try{let j=await Promise.race([f(t.imageRef,{signal:b.signal}),R]);sa(e,m,j),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:t.imageRef,format:`cyclonedx-${j.specVersion}+json`,components:j.components.length,localOnly:!0}}),T="image"}catch(j){let U=j instanceof Error?j.message:String(j);try{let q=nu(t.artifactRoot);sa(e,m,q),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${U}`,metadata:{imageRef:t.imageRef,fallback:"package-manifest",components:q.components.length,localOnly:!0}}),T="manifest"}catch(q){e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${U}; ${q instanceof Error?q.message:String(q)}`,metadata:{imageRef:t.imageRef,localOnly:!0}})}}finally{if(y)clearTimeout(y)}let N=ou({artifactName:t.imageRef,artifact:t.imageSha256?void 0:t.imageRef,artifactSha256:t.imageSha256,invocationId:t.invocationId,startedAt:t.startedAt,completedAt:t.completedAt??new Date().toISOString(),externalParameters:t.externalParameters??{imageRef:t.imageRef}});return au(e,m,N),{scan:l,sbomSource:T}}import{randomBytes as eb,scryptSync as tb,timingSafeEqual as OC}from"node:crypto";function Kg(e,t){if(e.role==="admin")return[...t];return t.filter((r)=>!!e.sites?.[r])}var Vg=32768,Wg=8,Hg=1,$C=32,NC=16;function to(e){let t=eb(NC),r=tb(e,t,$C,{N:Vg,r:Wg,p:Hg,maxmem:268435456});return`scrypt$${Vg}$${Wg}$${Hg}$${t.toString("base64url")}$${r.toString("base64url")}`}function Gn(e,t){try{let r=t.split("$");if(r.length!==6||r[0]!=="scrypt")return!1;let[,a,l,m,f,b]=r,k=Number(a),y=Number(l),R=Number(m);if(!Number.isFinite(k)||!Number.isFinite(y)||!Number.isFinite(R))return!1;let T=Buffer.from(f,"base64url"),N=Buffer.from(b,"base64url");if(T.length===0||N.length===0)return!1;let j=tb(e,T,N.length,{N:k,r:y,p:R,maxmem:268435456});return OC(j,N)}catch{return!1}}function rb(e){let[t,r,a,l]=e.split("$");return t!=="scrypt"||Number(r)!==Vg||Number(a)!==Wg||Number(l)!==Hg}function Jg(){return eb(18).toString("base64url")}import{existsSync as qC,readFileSync as VC}from"node:fs";import{createHash as jC}from"node:crypto";function ib(e){let t=Gg(e.name),r=Qg(e.publicKey),a=MC([...e.existingKeys??[],{name:t,publicKey:r}]);return sb(e.configText,a)}function ob(e){let t=Gg(e.name),r=(e.existingKeys??[]).filter((a)=>a.name!==t);if((e.existingKeys??[]).length===r.length)throw Error(`SSH key '${t}' does not exist in compute.sshKeys`);return sb(e.configText,r)}function no(e=[]){return e.map((t)=>({name:t.name,publicKey:t.publicKey,type:LC(t.publicKey),fingerprint:FC(t.publicKey),added:"configured"}))}function sb(e,t){let r=zC(e,"compute"),a=BC(t),l=UC(e,r.start,r.end,"sshKeys");if(l){let k=l.propertyStart;while(k>0&&e[k-1]!==`
+`)}function IC(e,t){return{status:"unavailable",findings:[],error:`${e.id} exceeded its ${t}ms timeout`,metadata:{timeoutMs:t}}}class vt{posture;defaultTimeoutMs;nowFn;constructor(e,t={}){this.posture=e;this.defaultTimeoutMs=t.defaultTimeoutMs??60000,this.nowFn=t.now??(()=>new Date)}async run(e,t){let r=this.nowFn(),a=Math.max(100,e.timeoutMs??this.defaultTimeoutMs),l=new AbortController,m,f=new Promise((R)=>{m=setTimeout(()=>{l.abort(),R(IC(e,a))},a)}),b;try{b=await Promise.race([e.scan({...t,signal:l.signal}),f])}catch(R){b={status:"unavailable",findings:[],error:R instanceof Error?R.message:String(R)}}finally{if(m)clearTimeout(m)}let k=this.nowFn(),y={...t,scannerId:e.id,scannerVersion:e.version,status:b.status,findings:b.findings,metadata:b.metadata,error:b.error,startedAt:r.toISOString(),completedAt:k.toISOString(),durationMs:Math.max(0,k.getTime()-r.getTime())};return this.posture.recordScan(y)}async runAll(e,t){return Promise.all(e.map((r)=>this.run(r,t)))}}class gn{scanner;id="source-secrets";version="1.0.0";timeoutMs=30000;constructor(e=new un){this.scanner=e}async scan(e){if(!e.artifactRoot)return{status:"skipped",findings:[],error:"No artifact root was supplied"};let t=await this.scanner.scan({directory:e.artifactRoot,failOnSeverity:"critical"});return{status:t.passed?"passed":"failed",findings:t.findings.map((r)=>({...e,ruleId:r.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:r.pattern.severity,title:r.pattern.name,description:r.pattern.description,subject:`${r.file}:${r.line}`,evidence:{file:r.file,line:r.line,column:r.column,match:r.match,context:r.context},remediation:"Remove the credential, rotate it at its issuer, and use a managed secret or environment reference."})),metadata:{scannedFiles:t.scannedFiles,summary:t.summary}}}}function EC(e){let t=e?.toLowerCase();return t==="critical"||t==="high"||t==="medium"||t==="low"?t:"info"}class ia{id="trivy-image";version;timeoutMs;constructor(e={}){this.version=e.version??"local",this.timeoutMs=e.timeoutMs??120000,this.executable=e.executable??"trivy"}executable;async scan(e){if(!e.imageRef)return{status:"skipped",findings:[],error:"No image reference was supplied"};let t;try{t=Bun.spawn([this.executable,"image","--format","json","--quiet","--scanners","vuln",e.imageRef],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",TRIVY_NO_PROGRESS:"true"}})}catch(k){return{status:"unsupported",findings:[],error:k instanceof Error?k.message:String(k)}}let r=()=>t.kill();e.signal.addEventListener("abort",r,{once:!0});let[a,l,m]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);if(e.signal.removeEventListener("abort",r),a!==0)return{status:/not found|enoent/i.test(m)?"unsupported":"unavailable",findings:[],error:m.slice(0,2000)||`Trivy exited with ${a}`};let f=JSON.parse(l),b=[];for(let k of f.Results??[])for(let y of k.Vulnerabilities??[]){let R=y.VulnerabilityID??"unknown-vulnerability";b.push({...e,ruleId:R,severity:EC(y.Severity),title:y.Title||R,description:y.Description||`${R} affects ${y.PkgName??"an image package"}.`,subject:`${e.imageRef}:${y.PkgName??"unknown"}:${y.InstalledVersion??"unknown"}`,evidence:{image:e.imageRef,target:k.Target??"",cve:R,package:y.PkgName??"",installedVersion:y.InstalledVersion??"",fixedVersion:y.FixedVersion??"",reference:y.PrimaryURL??""},remediation:y.FixedVersion?`Upgrade ${y.PkgName} to ${y.FixedVersion} or later.`:"Remove or replace the affected package and rescan the image."})}return{status:b.length?"failed":"passed",findings:b,metadata:{imageRef:e.imageRef,vulnerabilityCount:b.length,localOnly:!0}}}}class Rf{actions;id="aws-iam-capabilities";version="1.0.0";timeoutMs=30000;client;constructor(e,t={}){this.actions=e;if(this.resourceArns=t.resourceArns??["*"],t.client)this.client=t.client;else{let r=new Se(t.region),a=new be(t.region);this.client={getCallerIdentity:()=>r.getCallerIdentity(),simulatePrincipalPolicy:(l)=>a.simulatePrincipalPolicy(l)}}}resourceArns;async scan(e){let t=await this.client.getCallerIdentity();if(!t.Arn)return{status:"unavailable",findings:[],error:"AWS returned no caller ARN"};let r=t.Arn;if(r.includes(":assumed-role/"))return{status:"unsupported",findings:[],error:"AWS policy simulation requires the underlying IAM role ARN; use an IAM role/user ARN or provider-native access analysis.",metadata:{account:t.Account??"",principalType:"assumed-role"}};let m=(await this.client.simulatePrincipalPolicy({PolicySourceArn:r,ActionNames:this.actions,ResourceArns:this.resourceArns})).EvaluationResults.filter((f)=>f.EvalDecision!=="allowed").map((f)=>({...e,ruleId:`iam-${f.EvalActionName.toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:"high",title:`Missing AWS capability: ${f.EvalActionName}`,description:`The active AWS principal is ${f.EvalDecision||"not allowed"} for this deployment action.`,subject:`${r}:${f.EvalActionName}`,evidence:{account:t.Account??"",principalArn:r,action:f.EvalActionName,decision:f.EvalDecision,missingContext:f.MissingContextValues??[]},remediation:"Grant the deployment principal the least-privilege action on the required resources, then rerun the capability check."}));return{status:m.length?"failed":"passed",findings:m,metadata:{account:t.Account??"",principalArn:r,evaluatedActions:this.actions.length}}}}import{createHash as RC,createVerify as AC}from"node:crypto";import{existsSync as CC,readFileSync as PC}from"node:fs";import{basename as _C,join as TC,resolve as Xv}from"node:path";function zs(e){return RC("sha256").update(e).digest("hex")}function xC(e){let t=[["dependencies","required"],["optionalDependencies","optional"],["devDependencies","excluded"],["peerDependencies","required"]],r=new Map;for(let[a,l]of t){let m=e[a];if(!m||typeof m!=="object"||Array.isArray(m))continue;for(let[f,b]of Object.entries(m)){let k=String(b).replace(/^[~^]/,""),y=`${f}@${k}`;if(!r.has(y))r.set(y,{type:"library",name:f,version:k,purl:`pkg:npm/${encodeURIComponent(f)}@${encodeURIComponent(k)}`,scope:l})}}return[...r.values()].sort((a,l)=>`${a.name}@${a.version}`.localeCompare(`${l.name}@${l.version}`))}function nu(e,t={}){let r=TC(Xv(e),"package.json");if(!CC(r))throw Error(`Cannot generate an SBOM: ${r} was not found`);let a=PC(r,"utf8"),l=JSON.parse(a),m=String(l.name??_C(Xv(e))),f=String(l.version??"0.0.0"),b=zs(a);return{bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:t.serial??`urn:uuid:${crypto.randomUUID()}`,version:1,metadata:{timestamp:(t.now??new Date).toISOString(),component:{type:"application",name:m,version:f,purl:`pkg:npm/${encodeURIComponent(m)}@${encodeURIComponent(f)}`,hashes:[{alg:"SHA-256",content:b}]},tools:[{vendor:"ts-cloud",name:"security-posture",version:"1.0.0"}]},components:xC(l)}}async function iu(e,t={}){let r=Bun.spawn([t.executable??"syft",e,"-o","cyclonedx-json"],{stdout:"pipe",stderr:"pipe",env:{PATH:process.env.PATH??"/usr/local/bin:/usr/bin:/bin",HOME:"/nonexistent",SYFT_CHECK_FOR_APP_UPDATE:"false"}}),a=()=>r.kill();t.signal?.addEventListener("abort",a,{once:!0});let[l,m,f]=await Promise.all([r.exited,new Response(r.stdout).text(),new Response(r.stderr).text()]);if(t.signal?.removeEventListener("abort",a),l!==0)throw Error(f.slice(0,2000)||`Syft exited with ${l}`);return JSON.parse(m)}function sa(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"sbom",format:`cyclonedx-${r.specVersion}+json`,digest:`sha256:${zs(a)}`,summary:{component:r.metadata.component.name,version:r.metadata.component.version,components:r.components.length},content:a,sensitive:!0})}function su(e,t,r){let a={total:r.length,critical:0,high:0,medium:0,low:0,info:0,fixable:0};for(let m of r){a[m.severity]++;let f=m.evidence;if(typeof f.fixedVersion==="string"&&f.fixedVersion)a.fixable++}let l=JSON.stringify({releaseId:t.releaseId,generatedAt:new Date().toISOString(),findings:r.map((m)=>({id:m.id,ruleId:m.ruleId,severity:m.severity,subject:m.subject,remediation:m.remediation}))});return e.addReleaseArtifact({...t,kind:"vulnerability_summary",format:"ts-cloud-vulnerability-summary+json",digest:`sha256:${zs(l)}`,summary:a,content:l,sensitive:!0})}function ou(e){if(!e.artifact&&!e.artifactSha256)throw Error("Release provenance requires artifact content or a SHA-256 digest");return{_type:"https://in-toto.io/Statement/v1",subject:[{name:e.artifactName,digest:{sha256:e.artifactSha256?.replace(/^sha256:/,"")??zs(e.artifact)}}],predicateType:"https://slsa.dev/provenance/v1",predicate:{buildDefinition:{buildType:"https://ts-cloud.dev/build/v1",externalParameters:e.externalParameters??{},internalParameters:{},resolvedDependencies:e.resolvedDependencies??[]},runDetails:{builder:{id:"https://ts-cloud.dev/builders/local/v1"},metadata:{invocationId:e.invocationId,startedOn:e.startedAt,finishedOn:e.completedAt}}}}}function au(e,t,r){let a=JSON.stringify(r);return e.addReleaseArtifact({...t,kind:"provenance",format:"in-toto+slsa-v1+json",digest:`sha256:${zs(a)}`,summary:{subjects:r.subject.length,builder:r.predicate.runDetails.builder.id,buildType:r.predicate.buildDefinition.buildType},content:a,sensitive:!0})}function gS(e){let t=e.expectedSha256.replace(/^sha256:/,"").toLowerCase(),r=zs(e.artifact)===t;if(!e.signature||!e.publicKey)return{digestValid:r,signature:"not_configured"};try{let a=AC("SHA256");return a.update(e.artifact),a.end(),{digestValid:r,signature:a.verify(e.publicKey,Buffer.from(e.signature,"base64"))?"verified":"invalid"}}catch{return{digestValid:r,signature:"invalid"}}}function se(e,t){let r=e.environments.get(t);if(!r)throw Error(`Security scope for environment '${t}' was not found`);return{organizationId:e.organization.id,projectId:e.project.id,environmentId:r.id}}function cu(e,t){let r=new ln(e.store),a=r.listPolicies(e.organization.id);for(let[l,m]of e.environments){if(a.some((b)=>b.environmentId===m.id))continue;let f=l==="production"||m.kind==="production";a.push(r.createPolicy({organizationId:e.organization.id,environmentId:m.id,name:f?"Production baseline":"Environment baseline",scannerFailMode:f?"closed":"open",requiredScanners:["source-secrets"],rules:f?[{minimumSeverity:"critical",action:"block"},{minimumSeverity:"high",action:"block"},{minimumSeverity:"medium",action:"warn"},{minimumSeverity:"low",action:"record"}]:[{minimumSeverity:"critical",action:"warn"},{minimumSeverity:"high",action:"warn"},{minimumSeverity:"low",action:"record"}],actorId:t}))}return a}function pS(e,t,r,a={}){let l=r.findings.map((m)=>({...t,ruleId:m.pattern.name.toLowerCase().replace(/[^a-z0-9]+/g,"-"),severity:m.pattern.severity,title:m.pattern.name,description:m.pattern.description,subject:`${m.file}:${m.line}`,evidence:{file:m.file,line:m.line,column:m.column,match:m.match,context:m.context},remediation:"Remove and rotate the credential, then reference it through a managed secret or environment variable."}));return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:a.scannerVersion??"1.0.0",status:a.skipped?"skipped":r.passed?"passed":"failed",findings:a.skipped?[]:l,metadata:{scannedFiles:r.scannedFiles,durationMs:r.duration,summary:r.summary},durationMs:r.duration,error:a.skipped?"The operator explicitly skipped source-secret scanning.":void 0})}function mS(e,t,r="The operator explicitly skipped source-secret scanning."){return e.recordScan({...t,scannerId:"source-secrets",scannerVersion:"1.0.0",status:"skipped",findings:[],error:r})}function DC(e,t){let r=[],a=t.security;if(a?.firewall&&!["active","configured","ok"].includes(String(a.firewall.status)))r.push({...e,ruleId:"host-firewall-disabled",severity:"high",title:"Host firewall is not active",description:String(a.firewall.summary??"The host firewall did not report an active configuration."),subject:"host:firewall",evidence:{status:String(a.firewall.status??"unknown"),rules:Array.isArray(a.firewall.rules)?a.firewall.rules.length:0},remediation:"Apply the declarative firewall policy and confirm only required listeners are public."});for(let l of a?.ports??[]){let m=String(l.listen??""),f=Number(m.match(/:(\d+)$/)?.[1]);if(l.exposure==="public"&&Number.isFinite(f)&&![22,80,443].includes(f))r.push({...e,ruleId:"unexpected-public-listener",severity:"medium",title:`Unexpected public listener on port ${f}`,description:`${String(l.processName??"A process")} is listening publicly outside the standard SSH/HTTP/HTTPS ports.`,subject:`host:port:${f}`,evidence:{protocol:String(l.proto??""),listen:m,process:String(l.processName??"")},remediation:"Bind the service to loopback/private networking or explicitly document and firewall the required public port."})}for(let l of a?.tlsCertificates??[]){let m=Number(l.daysRemaining);if(Number.isFinite(m)&&m<30)r.push({...e,ruleId:"tls-certificate-expiry",severity:m<14?"high":"medium",title:`TLS certificate expires in ${m} days`,description:`${String(l.domain??"A configured domain")} needs renewal.`,subject:`tls:${String(l.domain??"unknown")}`,evidence:{domain:String(l.domain??""),daysRemaining:m,expires:String(l.expires??"")},remediation:"Renew the certificate and verify automatic renewal can complete before expiry."})}for(let l of t.diagnostics??[]){if(l.status==="pass"||l.status==="ok")continue;r.push({...e,ruleId:`diagnostic-${String(l.name??"unknown").toLowerCase().replace(/[^a-z0-9]+/g,"-")}`,severity:l.status==="fail"?"high":"medium",title:String(l.name??"Host security check"),description:String(l.detail??"The host security diagnostic did not pass."),subject:`diagnostic:${String(l.name??"unknown")}`,evidence:{status:String(l.status??"unknown")},remediation:"Follow the diagnostic guidance, rerun the check, and confirm the finding resolves."})}return r}function ns(e,t,r){let a=!!r.security||Array.isArray(r.diagnostics),l=a?DC(t,r):[];return e.recordScan({...t,scannerId:"host-posture",scannerVersion:"1.0.0",status:!a?"unavailable":l.length?"failed":"passed",findings:l,metadata:{source:"dashboard-live-probe",checks:Array.isArray(r.diagnostics)?r.diagnostics.length:0},error:a?void 0:"Live host posture data was unavailable; source and provider checks remain usable."})}function is(e,t){let r=e.evaluateGate({...t.scope,operationId:t.operationId}),a=e.listFindings({...t.scope,limit:1000}).filter((l)=>l.status!=="resolved");return{decision:r,summary:{desiredConfigHash:t.desiredConfigHash??null,securityImpact:{critical:a.filter((l)=>l.severity==="critical").length,high:a.filter((l)=>l.severity==="high").length,waived:a.filter((l)=>l.status==="waived").length,assigned:a.filter((l)=>!!l.ownerActorId).length},blockingFindingIds:r.findingIds,policy:{id:r.policyId,version:r.policyVersion},scannerVersions:r.scannerVersions}}}async function fS(e,t){let r=t.scanner??new ia({timeoutMs:t.scannerTimeoutMs}),l=await new vt(e,{defaultTimeoutMs:t.scannerTimeoutMs??120000}).run(r,{...t.scope,releaseId:t.releaseId,imageRef:t.imageRef}),m={...t.scope,releaseId:t.releaseId};su(e,m,l.findings);let f=t.generateImageSbom??iu,b=new AbortController,k=Math.max(100,t.sbomTimeoutMs??120000),y,R=new Promise((j,U)=>{y=setTimeout(()=>{b.abort(),U(Error(`syft-sbom exceeded its ${k}ms timeout`))},k)}),T="unavailable";try{let j=await Promise.race([f(t.imageRef,{signal:b.signal}),R]);sa(e,m,j),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"passed",metadata:{imageRef:t.imageRef,format:`cyclonedx-${j.specVersion}+json`,components:j.components.length,localOnly:!0}}),T="image"}catch(j){let U=j instanceof Error?j.message:String(j);try{let q=nu(t.artifactRoot);sa(e,m,q),e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unsupported",error:`Image inventory was unavailable; attached a package-manifest SBOM instead. ${U}`,metadata:{imageRef:t.imageRef,fallback:"package-manifest",components:q.components.length,localOnly:!0}}),T="manifest"}catch(q){e.recordScan({...t.scope,releaseId:t.releaseId,scannerId:"syft-sbom",scannerVersion:"local",status:"unavailable",error:`Image and manifest SBOM generation were unavailable. ${U}; ${q instanceof Error?q.message:String(q)}`,metadata:{imageRef:t.imageRef,localOnly:!0}})}}finally{if(y)clearTimeout(y)}let N=ou({artifactName:t.imageRef,artifact:t.imageSha256?void 0:t.imageRef,artifactSha256:t.imageSha256,invocationId:t.invocationId,startedAt:t.startedAt,completedAt:t.completedAt??new Date().toISOString(),externalParameters:t.externalParameters??{imageRef:t.imageRef}});return au(e,m,N),{scan:l,sbomSource:T}}import{randomBytes as eb,scryptSync as tb,timingSafeEqual as OC}from"node:crypto";function Kg(e,t){if(e.role==="admin")return[...t];return t.filter((r)=>!!e.sites?.[r])}var Vg=32768,Wg=8,Hg=1,$C=32,NC=16;function to(e){let t=eb(NC),r=tb(e,t,$C,{N:Vg,r:Wg,p:Hg,maxmem:268435456});return`scrypt$${Vg}$${Wg}$${Hg}$${t.toString("base64url")}$${r.toString("base64url")}`}function Gn(e,t){try{let r=t.split("$");if(r.length!==6||r[0]!=="scrypt")return!1;let[,a,l,m,f,b]=r,k=Number(a),y=Number(l),R=Number(m);if(!Number.isFinite(k)||!Number.isFinite(y)||!Number.isFinite(R))return!1;let T=Buffer.from(f,"base64url"),N=Buffer.from(b,"base64url");if(T.length===0||N.length===0)return!1;let j=tb(e,T,N.length,{N:k,r:y,p:R,maxmem:268435456});return OC(j,N)}catch{return!1}}function rb(e){let[t,r,a,l]=e.split("$");return t!=="scrypt"||Number(r)!==Vg||Number(a)!==Wg||Number(l)!==Hg}function Jg(){return eb(18).toString("base64url")}import{existsSync as qC,readFileSync as VC}from"node:fs";import{createHash as jC}from"node:crypto";function ib(e){let t=Gg(e.name),r=Qg(e.publicKey),a=MC([...e.existingKeys??[],{name:t,publicKey:r}]);return sb(e.configText,a)}function ob(e){let t=Gg(e.name),r=(e.existingKeys??[]).filter((a)=>a.name!==t);if((e.existingKeys??[]).length===r.length)throw Error(`SSH key '${t}' does not exist in compute.sshKeys`);return sb(e.configText,r)}function no(e=[]){return e.map((t)=>({name:t.name,publicKey:t.publicKey,type:LC(t.publicKey),fingerprint:FC(t.publicKey),added:"configured"}))}function sb(e,t){let r=zC(e,"compute"),a=BC(t),l=UC(e,r.start,r.end,"sshKeys");if(l){let k=l.propertyStart;while(k>0&&e[k-1]!==`
 `&&/\s/.test(e[k-1]))k--;return`${e.slice(0,k)}${a}${e.slice(l.end+1)}`}let m=e.slice(0,r.end).trimEnd(),f=e.slice(r.end),b=m.endsWith(",")||m.endsWith("{")?"":",";return`${m}${b}
 ${a},
     ${f}`}function BC(e){if(e.length===0)return"      sshKeys: []";return`      sshKeys: [
@@ -643,9 +643,9 @@ EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DI
   })
 </script>
 </body>
-</html>`}var Hb={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};async function Kb(e){return await e.driver.findComputeTargets({slug:e.slug,environment:e.environment,role:e.role||"app"})}async function Jb(e,t){let r=e.logger||Hb,a=await Kb(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};let l=_(e.slug,t.siteName),m=Ht(l,t.to||"unused"),f=t.onlyIfLive?u_(m.current,t.siteName,t.onlyIfLive):[];if(t.dryRun){let y=await e.driver.runRemoteDeploy({targets:a,commands:["set -uo pipefail",...f,...hg(m,t.to?{to:t.to}:{})],comment:`ts-cloud rollback plan ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});return{success:y.success,error:y.error,perInstance:y.perInstance}}let b=["set -uo pipefail",...f,...Ag(m,{...t.to?{to:t.to}:{},unitBase:`${e.slug}-${t.siteName}`}),`(cd ${v} && pantry restart php-fpm) 2>/dev/null || true`,`(cd ${m.current} && eval "$(cd ${v} && pantry env 2>/dev/null)" && php artisan queue:restart) 2>/dev/null || true`];r.step(`Rolling back ${t.siteName}${t.to?` to ${t.to}`:" to the previous release"} on ${a.length} server(s)...`);let k=await e.driver.runRemoteDeploy({targets:a,commands:b,comment:`ts-cloud rollback ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!k.success)r.error(`Rollback failed: ${k.error||"unknown error"}`);else r.success(`Rolled back ${t.siteName}.`);return{success:k.success,error:k.error,perInstance:k.perInstance}}function u_(e,t,r){let a=r.replace(/[^0-9A-Za-z._-]/g,"");return[`TS_CLOUD_LIVE_ID=$(basename "$(readlink -f ${e} 2>/dev/null)" 2>/dev/null || true)`,`if [ -z "$TS_CLOUD_LIVE_ID" ] || [ "$TS_CLOUD_LIVE_ID" = "." ]; then echo "${t}: no live release here; left alone"; exit 0; fi`,`case "${a}" in "$TS_CLOUD_LIVE_ID"*) ;; *) echo "${t} serves $TS_CLOUD_LIVE_ID, not ${a}; left alone"; exit 0 ;; esac`]}async function Gb(e,t){let r=e.logger||Hb;if(!t.database?.name)return{success:!1,error:"No appDatabase configured to restore."};let a=await Kb(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};r.step(`Restoring database '${t.database.name}'${t.from?` from ${t.from}`:" from the latest backup"} on ${a.length} server(s)...`);let l=await e.driver.runRemoteDeploy({targets:a,commands:mg(t.database,{from:t.from}),comment:`ts-cloud db:restore ${e.slug}/${t.database.name}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!l.success)r.error(`Restore failed: ${l.error||"unknown error"}`);else r.success(`Restored ${t.database.name}.`);return{success:l.success,error:l.error,perInstance:l.perInstance}}var p_=["restart","reload","start","stop","enable","disable"],Qb=65536;function Ks(e){return e.length<=Qb?e:`${e.slice(0,Qb)}
+</html>`}var Hb={info:()=>{},warn:()=>{},error:()=>{},step:()=>{},success:()=>{}};async function Kb(e){return await e.driver.findComputeTargets({slug:e.slug,environment:e.environment,role:e.role||"app"})}async function Jb(e,t){let r=e.logger||Hb,a=await Kb(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};let l=_(e.slug,t.siteName),m=Ht(l,t.to||"unused"),f=t.onlyIfLive?u_(m.current,t.siteName,t.onlyIfLive):[];if(t.dryRun){let y=await e.driver.runRemoteDeploy({targets:a,commands:["set -uo pipefail",...f,...Ag(m,t.to?{to:t.to}:{})],comment:`ts-cloud rollback plan ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});return{success:y.success,error:y.error,perInstance:y.perInstance}}let b=["set -uo pipefail",...f,...yg(m,{...t.to?{to:t.to}:{},unitBase:`${e.slug}-${t.siteName}`}),`(cd ${v} && pantry restart php-fpm) 2>/dev/null || true`,`(cd ${m.current} && eval "$(cd ${v} && pantry env 2>/dev/null)" && php artisan queue:restart) 2>/dev/null || true`];r.step(`Rolling back ${t.siteName}${t.to?` to ${t.to}`:" to the previous release"} on ${a.length} server(s)...`);let k=await e.driver.runRemoteDeploy({targets:a,commands:b,comment:`ts-cloud rollback ${e.slug}/${t.siteName}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!k.success)r.error(`Rollback failed: ${k.error||"unknown error"}`);else r.success(`Rolled back ${t.siteName}.`);return{success:k.success,error:k.error,perInstance:k.perInstance}}function u_(e,t,r){let a=r.replace(/[^0-9A-Za-z._-]/g,"");return[`TS_CLOUD_LIVE_ID=$(basename "$(readlink -f ${e} 2>/dev/null)" 2>/dev/null || true)`,`if [ -z "$TS_CLOUD_LIVE_ID" ] || [ "$TS_CLOUD_LIVE_ID" = "." ]; then echo "${t}: no live release here; left alone"; exit 0; fi`,`case "${a}" in "$TS_CLOUD_LIVE_ID"*) ;; *) echo "${t} serves $TS_CLOUD_LIVE_ID, not ${a}; left alone"; exit 0 ;; esac`]}async function Gb(e,t){let r=e.logger||Hb;if(!t.database?.name)return{success:!1,error:"No appDatabase configured to restore."};let a=await Kb(e);if(a.length===0)return{success:!1,error:`No '${e.role||"app"}' servers found for ${e.slug}/${e.environment}.`};r.step(`Restoring database '${t.database.name}'${t.from?` from ${t.from}`:" from the latest backup"} on ${a.length} server(s)...`);let l=await e.driver.runRemoteDeploy({targets:a,commands:fg(t.database,{from:t.from}),comment:`ts-cloud db:restore ${e.slug}/${t.database.name}`,tags:{Project:e.slug,Environment:e.environment,Role:e.role||"app"}});if(!l.success)r.error(`Restore failed: ${l.error||"unknown error"}`);else r.success(`Restored ${t.database.name}.`);return{success:l.success,error:l.error,perInstance:l.perInstance}}var p_=["restart","reload","start","stop","enable","disable"],Qb=65536;function Ks(e){return e.length<=Qb?e:`${e.slice(0,Qb)}
 
-[output truncated]`}function g_(e){return/^[A-Za-z0-9_.@:-]+$/.test(e)}function cm(e){return/^[A-Za-z0-9_-]+$/.test(e)}function m_(e){return e.charAt(0).toUpperCase()+e.slice(1)}function ul(e,t){let r=[],a=t.servicesDetail??t.services??[];for(let f of a){let b=String(f?.name??"");if(!b||!g_(b))continue;for(let k of p_)r.push({id:`${k}:${b}`,label:`${m_(k)} ${b}`,group:"service",target:b,mutates:!0,confirm:b,danger:k==="stop"||k==="disable"})}for(let[f,b]of Object.entries(e.sites??{})){if(!b||!cm(f))continue;let k=u(b);if(k==="server-app"||k==="server-php")r.push({id:`rollback:${f}`,label:`Rollback ${f}`,group:"deploy",target:f,mutates:!0,confirm:f,danger:!0})}let l=new Set;for(let f of t.workers??[]){let b=String(f?.name??"").split(":")[0];if(b&&cm(b))l.add(b)}for(let f of l)r.push({id:`worker:restart:${f}`,label:`Restart workers (${f})`,group:"worker",target:f,mutates:!0,confirm:f});for(let[f,b]of Object.entries(e.sites??{})){if(!b||!cm(f))continue;if(b.scheduler||b.schedule){let k=kr(b)==="laravel";r.push({id:`scheduler:run:${f}`,label:`${k?"Run":"Restart"} scheduler (${f})`,group:"scheduler",target:f,mutates:!0,confirm:f})}}if(e.infrastructure?.compute?.backups?.enabled){if(r.push({id:"backup:run",label:"Run backup now",group:"backup",target:"backup",mutates:!0,confirm:"backup"}),g(e))r.push({id:"backup:restore",label:"Restore latest DB backup",group:"backup",target:"database",mutates:!0,confirm:"restore",danger:!0})}return r}function dm(e,t,r){return ul(t,r).find((a)=>a.id===e)}function f_(e,t){let r=e==="enable"||e==="disable"?`systemctl is-enabled ${t} 2>/dev/null || true`:`systemctl is-active ${t} 2>/dev/null || true`;return["set -o pipefail",`systemctl ${e} ${t}`,r]}function h_(){return`eval "$(cd ${v} && pantry env 2>/dev/null)"`}function Zb(e,t,r){let a=`${_(e,t)}/current`;return["set -uo pipefail",`[ -d ${a} ] || { echo "site ${t} has no current release" >&2; exit 1; }`,`cd ${a} && ${h_()} && php artisan ${r}`]}function y_(e,t,r){if(e==="laravel")return Zb(t,r,"queue:restart");let a=`${t}-${r}-queue-*.service`;return["set -uo pipefail",`units=$(systemctl list-units --type=service --all --no-legend '${a}' 2>/dev/null | awk '{print $1}')`,`[ -n "$units" ] || { echo "no queue-worker units found for ${r} (${a})" >&2; exit 1; }`,"systemctl restart $units",`systemctl --no-legend --type=service list-units '${a}' 2>/dev/null || true`]}function v_(e,t,r){if(e==="laravel")return Zb(t,r,"schedule:run");let a=`${t}-${r}-scheduler.service`;return["set -uo pipefail",`systemctl restart ${a}`,`systemctl is-active ${a} 2>/dev/null || true`]}function b_(){return["set -uo pipefail",`[ -x ${Cr} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,Cr]}function Yb(e,t,r){return{operation:e,command:t,ok:r.success,stdout:Ks(r.perInstance?.[0]?.output??""),stderr:Ks(r.perInstance?.[0]?.error??r.error??"")}}async function pl(e,t,r,a={}){let l=e.project.slug,m;try{m=O({config:e})}catch(T){return{operation:r.id,ok:!1,error:`Could not initialize the cloud driver: ${T?.message??T}`}}let f={driver:m,slug:l,environment:t,role:"app"};if(r.group==="deploy"){let T=a.to&&/^[A-Za-z0-9._-]+$/.test(a.to)?a.to:void 0,N=await Jb(f,{siteName:r.target,to:T});return Yb(r.id,`rollback ${r.target}${T?` → ${T}`:""}`,N)}if(r.id==="backup:restore"){let T=await Gb(f,{database:g(e)});return Yb(r.id,"db restore",T)}let b=await m.findComputeTargets({slug:l,environment:t,role:"app"});if(!b.length)return{operation:r.id,ok:!1,error:"No app server target was found for this environment."};let k,y;if(r.group==="service"){let[T,...N]=r.id.split(":");k=f_(T,N.join(":")),y=`systemctl ${T} ${r.target}`}else if(r.group==="worker"){let T=kr(e.sites?.[r.target]??{});k=y_(T,l,r.target),y=T==="laravel"?`queue:restart (${r.target})`:`restart queue units (${r.target})`}else if(r.group==="scheduler"){let T=kr(e.sites?.[r.target]??{});k=v_(T,l,r.target),y=T==="laravel"?`schedule:run (${r.target})`:`restart scheduler (${r.target})`}else if(r.id==="backup:run")k=b_(),y="ts-cloud backup";else return{operation:r.id,ok:!1,error:"Unknown operation."};let R=await m.runRemoteDeploy({targets:[b[0]],commands:k,comment:`ts-cloud dashboard:${r.id}`,tags:{Project:l,Environment:t,Role:"app"}});return{operation:r.id,command:y,ok:R.success,stdout:Ks(R.perInstance?.[0]?.output??""),stderr:Ks(R.perInstance?.[0]?.error??R.error??"")}}async function vc(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};let l;try{l=O({config:e})}catch(k){return{operation:"command",ok:!1,error:`Could not initialize the cloud driver: ${k?.message??k}`}}let m=e.project.slug,f=await l.findComputeTargets({slug:m,environment:t,role:"app"});if(!f.length)return{operation:"command",ok:!1,error:"No app server target was found for this environment."};let b=await l.runRemoteDeploy({targets:[f[0]],commands:["set -o pipefail",a],comment:"ts-cloud dashboard:command",tags:{Project:m,Environment:t,Role:"app"}});return{operation:"command",command:a,ok:b.success,stdout:Ks(b.perInstance?.[0]?.output??""),stderr:Ks(b.perInstance?.[0]?.error??b.error??"")}}function S_(e,t){return[`${e}-${t}`,`${e}-${t}-queues`,`${e}-${t}-daemons`]}function Xb(e,t,r){return r.some((a)=>S_(t,a).includes(e))}function lm(e,t){let{user:r,slug:a}=t;if(r.role==="admin")return e;let l=(e.sites??[]).map((U)=>U.name).filter(Boolean),m=Kg(r,l),f=new Set(m),b=(e.sites??[]).filter((U)=>f.has(U.name)),k=(e.sitesDetail??[]).filter((U)=>f.has(U.name)),y=new Set(k.map((U)=>U.domain).filter(Boolean)),R=(e.serverDeploymentsDetail??e.serverDeployments??[]).filter((U)=>f.has(U.site)),T=(e.serverLogs??[]).filter((U)=>Xb(U.source,a,m)),N=(e.security?.tlsCertificates??[]).filter((U)=>y.has(U.domain)),j=(e.activity??[]).filter((U)=>{if(U.type==="deploy")return m.some((q)=>String(U.title??"").startsWith(`${q} `));if(U.type==="log")return Xb(String(U.title??"").split(" ")[0],a,m);return!1});return{mode:e.mode,environment:e.environment,environments:e.environments,scoped:!0,server:{name:""},sites:b,sitesDetail:k,workers:(e.workers??[]).filter((U)=>f.has(U.site)),serverDeployments:R.slice(0,5),serverDeploymentsDetail:R.slice(0,50),deploymentsEmptyReason:R.length?void 0:"No deployments have been recorded for your sites yet.",serverLogs:T,serverLogsEmptyReason:T.length?void 0:"No recent log entries for your sites.",security:{tlsCertificates:N,ports:[],firewall:null,authEvents:[]},diagnostics:(e.diagnostics??[]).filter((U)=>["Route conflicts","TLS certificates"].includes(U.name)),activity:j}}function eS(e,t){if(t.role==="admin")return e;let r=new Set(Kg(t,Object.keys(e.sites??{})));return{project:{name:e.project?.name},environment:e.environment,environments:e.environments,sites:Object.fromEntries(Object.entries(e.sites??{}).filter(([a])=>r.has(a)))}}function tS(e){let t=new RegExp("[\\u007F-\\uFFFF]","g");return JSON.stringify(e).replace(t,(r)=>`\\u${r.charCodeAt(0).toString(16).padStart(4,"0")}`)}var w_=new Set(["name","ssl","env","redirects","aliases","domain","path"]),rS={build:"build runs as a shell command on the server",start:"start runs as a shell command on the server",root:"root is a filesystem path on the shared server",port:"ports are allocated by the server owner",type:"the deploy type is set by the server owner",php:"the PHP runtime is set by the server owner"};function iS(e){let t=Object.keys(e).filter((l)=>e[l]!==void 0),r=t.filter((l)=>(l in rS));if(r.length)return{ok:!1,error:`Only the server owner can change ${r.map((m)=>`${m} (${rS[m]})`).join(", ")}.`};let a=t.filter((l)=>!w_.has(l));if(a.length)return{ok:!1,error:`Only the server owner can change ${a.join(", ")}.`};return{ok:!0}}function gl(e){return String(e??"").trim().toLowerCase().replace(/\.$/,"")}function nS(e){let t=String(e??"/").trim();if(!t||t==="/")return"/";return(t.startsWith("/")?t:`/${t}`).replace(/\/+$/,"")||"/"}function k_(e){let t=[gl(e?.domain)];if(Array.isArray(e?.aliases))t.push(...e.aliases.map(gl));return t.filter(Boolean)}function oS({siteName:e,body:t,sites:r,ownSites:a}){let l=r[e]??{},m=new Set(a),f=new Set;if(t.domain!==void 0)f.add(gl(t.domain));if(Array.isArray(t.aliases))for(let k of t.aliases)f.add(gl(k));if(f.delete(""),f.size===0)return{ok:!0};let b=nS(t.path!==void 0?t.path:l.path);for(let[k,y]of Object.entries(r)){if(k===e||m.has(k))continue;let R=nS(y?.path);for(let T of k_(y)){if(!f.has(T))continue;if(R===b)return{ok:!1,error:`${T}${b==="/"?"":b} is already served by another site on this server.`}}}return{ok:!0}}class bc{maxAttempts;lockoutMs;windowMs;attempts=new Map;constructor(e=8,t=900000,r=900000){this.maxAttempts=e;this.lockoutMs=t;this.windowMs=r}key(e,t){return`${e.trim().toLowerCase()}\x00${t}`}check(e,t,r=Date.now()){let a=this.attempts.get(this.key(e,t));if(!a?.until)return{allowed:!0};if(r>=a.until)return this.attempts.delete(this.key(e,t)),{allowed:!0};return{allowed:!1,retryAfterSeconds:Math.ceil((a.until-r)/1000)}}recordFailure(e,t,r=Date.now()){let a=this.key(e,t),l=this.attempts.get(a),f=!l||r-l.last>this.windowMs?1:l.count+1,b={count:f,last:r};if(f>=this.maxAttempts)b.until=r+this.lockoutMs;this.attempts.set(a,b)}recordSuccess(e,t){this.attempts.delete(this.key(e,t))}prune(e=Date.now()){for(let[t,r]of this.attempts)if(r.until?e>=r.until:e-r.last>this.windowMs)this.attempts.delete(t)}get size(){return this.attempts.size}}var aS=new Set([22,80,443]);function Sc(e){return Number.isInteger(e)&&e>=1&&e<=65535}function Oo(e){return[...new Set(e.filter((t)=>Sc(t)&&!aS.has(t)))].sort((t,r)=>t-r)}function cS(e,t,r=[]){if(!Sc(t))throw Error("Port must be an integer between 1 and 65535.");if(aS.has(t))throw Error(`Port ${t} (SSH/HTTP/HTTPS) is always open and is not managed here.`);return kS({configText:e,ports:Oo([...r,t])})}function dS(e,t,r=[]){return kS({configText:e,ports:Oo(r.filter((a)=>a!==t))})}function sS(e,t,r,a,l){let m=e.slice(t,r),f=new RegExp(`\\b${a}\\s*:\\s*\\${l}`).exec(m);if(!f)return null;let b=t+f.index,k=e.indexOf(l,b);return{propStart:b,open:k,close:fc(e,k,l,l==="{"?"}":"]")}}function um(e){return`allowedPorts: [${e.join(", ")}]`}function kS(e){let{configText:t}=e,r=Oo(e.ports),a=/\bcompute\s*:\s*{/.exec(t);if(!a)throw Error("Could not find infrastructure.compute in the cloud config.");let l=t.indexOf("{",a.index),m=fc(t,l,"{","}"),f=sS(t,l+1,m,"firewall","{");if(f){let R=sS(t,f.open+1,f.close,"allowedPorts","[");if(R){let U=R.propStart;while(U>0&&t[U-1]!==`
+[output truncated]`}function g_(e){return/^[A-Za-z0-9_.@:-]+$/.test(e)}function cm(e){return/^[A-Za-z0-9_-]+$/.test(e)}function m_(e){return e.charAt(0).toUpperCase()+e.slice(1)}function ul(e,t){let r=[],a=t.servicesDetail??t.services??[];for(let f of a){let b=String(f?.name??"");if(!b||!g_(b))continue;for(let k of p_)r.push({id:`${k}:${b}`,label:`${m_(k)} ${b}`,group:"service",target:b,mutates:!0,confirm:b,danger:k==="stop"||k==="disable"})}for(let[f,b]of Object.entries(e.sites??{})){if(!b||!cm(f))continue;let k=u(b);if(k==="server-app"||k==="server-php")r.push({id:`rollback:${f}`,label:`Rollback ${f}`,group:"deploy",target:f,mutates:!0,confirm:f,danger:!0})}let l=new Set;for(let f of t.workers??[]){let b=String(f?.name??"").split(":")[0];if(b&&cm(b))l.add(b)}for(let f of l)r.push({id:`worker:restart:${f}`,label:`Restart workers (${f})`,group:"worker",target:f,mutates:!0,confirm:f});for(let[f,b]of Object.entries(e.sites??{})){if(!b||!cm(f))continue;if(b.scheduler||b.schedule){let k=kr(b)==="laravel";r.push({id:`scheduler:run:${f}`,label:`${k?"Run":"Restart"} scheduler (${f})`,group:"scheduler",target:f,mutates:!0,confirm:f})}}if(e.infrastructure?.compute?.backups?.enabled){if(r.push({id:"backup:run",label:"Run backup now",group:"backup",target:"backup",mutates:!0,confirm:"backup"}),g(e))r.push({id:"backup:restore",label:"Restore latest DB backup",group:"backup",target:"database",mutates:!0,confirm:"restore",danger:!0})}return r}function dm(e,t,r){return ul(t,r).find((a)=>a.id===e)}function f_(e,t){let r=e==="enable"||e==="disable"?`systemctl is-enabled ${t} 2>/dev/null || true`:`systemctl is-active ${t} 2>/dev/null || true`;return["set -o pipefail",`systemctl ${e} ${t}`,r]}function h_(){return`eval "$(cd ${v} && pantry env 2>/dev/null)"`}function Zb(e,t,r){let a=`${_(e,t)}/current`;return["set -uo pipefail",`[ -d ${a} ] || { echo "site ${t} has no current release" >&2; exit 1; }`,`cd ${a} && ${h_()} && php artisan ${r}`]}function y_(e,t,r){if(e==="laravel")return Zb(t,r,"queue:restart");let a=`${t}-${r}-queue-*.service`;return["set -uo pipefail",`units=$(systemctl list-units --type=service --all --no-legend '${a}' 2>/dev/null | awk '{print $1}')`,`[ -n "$units" ] || { echo "no queue-worker units found for ${r} (${a})" >&2; exit 1; }`,"systemctl restart $units",`systemctl --no-legend --type=service list-units '${a}' 2>/dev/null || true`]}function v_(e,t,r){if(e==="laravel")return Zb(t,r,"schedule:run");let a=`${t}-${r}-scheduler.service`;return["set -uo pipefail",`systemctl restart ${a}`,`systemctl is-active ${a} 2>/dev/null || true`]}function b_(){return["set -uo pipefail",`[ -x ${Cr} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,Cr]}function Yb(e,t,r){return{operation:e,command:t,ok:r.success,stdout:Ks(r.perInstance?.[0]?.output??""),stderr:Ks(r.perInstance?.[0]?.error??r.error??"")}}async function pl(e,t,r,a={}){let l=e.project.slug,m;try{m=O({config:e})}catch(T){return{operation:r.id,ok:!1,error:`Could not initialize the cloud driver: ${T?.message??T}`}}let f={driver:m,slug:l,environment:t,role:"app"};if(r.group==="deploy"){let T=a.to&&/^[A-Za-z0-9._-]+$/.test(a.to)?a.to:void 0,N=await Jb(f,{siteName:r.target,to:T});return Yb(r.id,`rollback ${r.target}${T?` → ${T}`:""}`,N)}if(r.id==="backup:restore"){let T=await Gb(f,{database:g(e)});return Yb(r.id,"db restore",T)}let b=await m.findComputeTargets({slug:l,environment:t,role:"app"});if(!b.length)return{operation:r.id,ok:!1,error:"No app server target was found for this environment."};let k,y;if(r.group==="service"){let[T,...N]=r.id.split(":");k=f_(T,N.join(":")),y=`systemctl ${T} ${r.target}`}else if(r.group==="worker"){let T=kr(e.sites?.[r.target]??{});k=y_(T,l,r.target),y=T==="laravel"?`queue:restart (${r.target})`:`restart queue units (${r.target})`}else if(r.group==="scheduler"){let T=kr(e.sites?.[r.target]??{});k=v_(T,l,r.target),y=T==="laravel"?`schedule:run (${r.target})`:`restart scheduler (${r.target})`}else if(r.id==="backup:run")k=b_(),y="ts-cloud backup";else return{operation:r.id,ok:!1,error:"Unknown operation."};let R=await m.runRemoteDeploy({targets:[b[0]],commands:k,comment:`ts-cloud dashboard:${r.id}`,tags:{Project:l,Environment:t,Role:"app"}});return{operation:r.id,command:y,ok:R.success,stdout:Ks(R.perInstance?.[0]?.output??""),stderr:Ks(R.perInstance?.[0]?.error??R.error??"")}}async function vc(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};let l;try{l=O({config:e})}catch(k){return{operation:"command",ok:!1,error:`Could not initialize the cloud driver: ${k?.message??k}`}}let m=e.project.slug,f=await l.findComputeTargets({slug:m,environment:t,role:"app"});if(!f.length)return{operation:"command",ok:!1,error:"No app server target was found for this environment."};let b=await l.runRemoteDeploy({targets:[f[0]],commands:["set -o pipefail",a],comment:"ts-cloud dashboard:command",tags:{Project:m,Environment:t,Role:"app"}});return{operation:"command",command:a,ok:b.success,stdout:Ks(b.perInstance?.[0]?.output??""),stderr:Ks(b.perInstance?.[0]?.error??b.error??"")}}function S_(e,t){return[`${e}-${t}`,`${e}-${t}-queues`,`${e}-${t}-daemons`]}function Xb(e,t,r){return r.some((a)=>S_(t,a).includes(e))}function lm(e,t){let{user:r,slug:a}=t;if(r.role==="admin")return e;let l=(e.sites??[]).map((U)=>U.name).filter(Boolean),m=Kg(r,l),f=new Set(m),b=(e.sites??[]).filter((U)=>f.has(U.name)),k=(e.sitesDetail??[]).filter((U)=>f.has(U.name)),y=new Set(k.map((U)=>U.domain).filter(Boolean)),R=(e.serverDeploymentsDetail??e.serverDeployments??[]).filter((U)=>f.has(U.site)),T=(e.serverLogs??[]).filter((U)=>Xb(U.source,a,m)),N=(e.security?.tlsCertificates??[]).filter((U)=>y.has(U.domain)),j=(e.activity??[]).filter((U)=>{if(U.type==="deploy")return m.some((q)=>String(U.title??"").startsWith(`${q} `));if(U.type==="log")return Xb(String(U.title??"").split(" ")[0],a,m);return!1});return{mode:e.mode,environment:e.environment,environments:e.environments,scoped:!0,server:{name:""},sites:b,sitesDetail:k,workers:(e.workers??[]).filter((U)=>f.has(U.site)),serverDeployments:R.slice(0,5),serverDeploymentsDetail:R.slice(0,50),deploymentsEmptyReason:R.length?void 0:"No deployments have been recorded for your sites yet.",serverLogs:T,serverLogsEmptyReason:T.length?void 0:"No recent log entries for your sites.",security:{tlsCertificates:N,ports:[],firewall:null,authEvents:[]},diagnostics:(e.diagnostics??[]).filter((U)=>["Route conflicts","TLS certificates"].includes(U.name)),activity:j}}function eS(e,t){if(t.role==="admin")return e;let r=new Set(Kg(t,Object.keys(e.sites??{})));return{project:{name:e.project?.name},environment:e.environment,environments:e.environments,sites:Object.fromEntries(Object.entries(e.sites??{}).filter(([a])=>r.has(a)))}}function tS(e){let t=new RegExp("[\\u007F-\\uFFFF]","g");return JSON.stringify(e).replace(t,(r)=>`\\u${r.charCodeAt(0).toString(16).padStart(4,"0")}`)}var w_=new Set(["name","ssl","env","redirects","aliases","domain","path"]),rS={build:"build runs as a shell command on the server",start:"start runs as a shell command on the server",root:"root is a filesystem path on the shared server",port:"ports are allocated by the server owner",type:"the deploy type is set by the server owner",php:"the PHP runtime is set by the server owner"};function iS(e){let t=Object.keys(e).filter((l)=>e[l]!==void 0),r=t.filter((l)=>(l in rS));if(r.length)return{ok:!1,error:`Only the server owner can change ${r.map((m)=>`${m} (${rS[m]})`).join(", ")}.`};let a=t.filter((l)=>!w_.has(l));if(a.length)return{ok:!1,error:`Only the server owner can change ${a.join(", ")}.`};return{ok:!0}}function gl(e){return String(e??"").trim().toLowerCase().replace(/\.$/,"")}function nS(e){let t=String(e??"/").trim();if(!t||t==="/")return"/";return(t.startsWith("/")?t:`/${t}`).replace(/\/+$/,"")||"/"}function k_(e){let t=[gl(e?.domain)];if(Array.isArray(e?.aliases))t.push(...e.aliases.map(gl));return t.filter(Boolean)}function oS({siteName:e,body:t,sites:r,ownSites:a}){let l=r[e]??{},m=new Set(a),f=new Set;if(t.domain!==void 0)f.add(gl(t.domain));if(Array.isArray(t.aliases))for(let k of t.aliases)f.add(gl(k));if(f.delete(""),f.size===0)return{ok:!0};let b=nS(t.path!==void 0?t.path:l.path);for(let[k,y]of Object.entries(r)){if(k===e||m.has(k))continue;let R=nS(y?.path);for(let T of k_(y)){if(!f.has(T))continue;if(R===b)return{ok:!1,error:`${T}${b==="/"?"":b} is already served by another site on this server.`}}}return{ok:!0}}class bc{maxAttempts;lockoutMs;windowMs;attempts=new Map;constructor(e=8,t=900000,r=900000){this.maxAttempts=e;this.lockoutMs=t;this.windowMs=r}key(e,t){return`${e.trim().toLowerCase()}\x00${t}`}check(e,t,r=Date.now()){let a=this.attempts.get(this.key(e,t));if(!a?.until)return{allowed:!0};if(r>=a.until)return this.attempts.delete(this.key(e,t)),{allowed:!0};return{allowed:!1,retryAfterSeconds:Math.ceil((a.until-r)/1000)}}recordFailure(e,t,r=Date.now()){let a=this.key(e,t),l=this.attempts.get(a),f=!l||r-l.last>this.windowMs?1:l.count+1,b={count:f,last:r};if(f>=this.maxAttempts)b.until=r+this.lockoutMs;this.attempts.set(a,b)}recordSuccess(e,t){this.attempts.delete(this.key(e,t))}prune(e=Date.now()){for(let[t,r]of this.attempts)if(r.until?e>=r.until:e-r.last>this.windowMs)this.attempts.delete(t)}get size(){return this.attempts.size}}var aS=new Set([22,80,443]);function Sc(e){return Number.isInteger(e)&&e>=1&&e<=65535}function Oo(e){return[...new Set(e.filter((t)=>Sc(t)&&!aS.has(t)))].sort((t,r)=>t-r)}function cS(e,t,r=[]){if(!Sc(t))throw Error("Port must be an integer between 1 and 65535.");if(aS.has(t))throw Error(`Port ${t} (SSH/HTTP/HTTPS) is always open and is not managed here.`);return lS({configText:e,ports:Oo([...r,t])})}function dS(e,t,r=[]){return lS({configText:e,ports:Oo(r.filter((a)=>a!==t))})}function sS(e,t,r,a,l){let m=e.slice(t,r),f=new RegExp(`\\b${a}\\s*:\\s*\\${l}`).exec(m);if(!f)return null;let b=t+f.index,k=e.indexOf(l,b);return{propStart:b,open:k,close:fc(e,k,l,l==="{"?"}":"]")}}function um(e){return`allowedPorts: [${e.join(", ")}]`}function lS(e){let{configText:t}=e,r=Oo(e.ports),a=/\bcompute\s*:\s*{/.exec(t);if(!a)throw Error("Could not find infrastructure.compute in the cloud config.");let l=t.indexOf("{",a.index),m=fc(t,l,"{","}"),f=sS(t,l+1,m,"firewall","{");if(f){let R=sS(t,f.open+1,f.close,"allowedPorts","[");if(R){let U=R.propStart;while(U>0&&t[U-1]!==`
 `&&/\s/.test(t[U-1]))U--;let q=t.slice(U,R.propStart);return`${t.slice(0,U)}${q}${um(r)}${t.slice(R.close+1)}`}let T=t.slice(0,f.close).trimEnd(),N=t.slice(f.close),j=T.endsWith(",")||T.endsWith("{")?"":",";return`${T}${j}
         ${um(r)},
       ${N}`}let b=t.slice(0,m).trimEnd(),k=t.slice(m),y=b.endsWith(",")||b.endsWith("{")?"":",";return`${b}${y}
@@ -653,7 +653,7 @@ EOF`,'echo "DISKPCT=${DISKPCT:-0}"','echo "DISKUSEDG=${DISKUSEDG:-0}"','echo "DI
         enabled: true,
         ${um(r)},
       },
-    ${k}`}class pm{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async getTraceSummaries(e){let t={StartTime:Math.floor(e.startTime.getTime()/1000),EndTime:Math.floor(e.endTime.getTime()/1000),TimeRangeType:"Event",Sampling:!1};if(e.filterExpression)t.FilterExpression=e.filterExpression;if(e.nextToken)t.NextToken=e.nextToken;let r=await this.client.request({service:"xray",region:this.region,method:"POST",path:"/TraceSummaries",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)});return{summaries:r?.TraceSummaries??[],nextToken:r?.NextToken}}async batchGetTraces(e){if(!e.length)return[];return(await this.client.request({service:"xray",region:this.region,method:"POST",path:"/Traces",headers:{"Content-Type":"application/json"},body:JSON.stringify({TraceIds:e.slice(0,5)})}))?.Traces??[]}}var RS=65536;function Vr(e){return e.length<=RS?e:`${e.slice(0,RS)}
+    ${k}`}class pm{client;region;constructor(e="us-east-1"){this.region=e,this.client=new n}async getTraceSummaries(e){let t={StartTime:Math.floor(e.startTime.getTime()/1000),EndTime:Math.floor(e.endTime.getTime()/1000),TimeRangeType:"Event",Sampling:!1};if(e.filterExpression)t.FilterExpression=e.filterExpression;if(e.nextToken)t.NextToken=e.nextToken;let r=await this.client.request({service:"xray",region:this.region,method:"POST",path:"/TraceSummaries",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)});return{summaries:r?.TraceSummaries??[],nextToken:r?.NextToken}}async batchGetTraces(e){if(!e.length)return[];return(await this.client.request({service:"xray",region:this.region,method:"POST",path:"/Traces",headers:{"Content-Type":"application/json"},body:JSON.stringify({TraceIds:e.slice(0,5)})}))?.Traces??[]}}var kS=65536;function Vr(e){return e.length<=kS?e:`${e.slice(0,kS)}
 
 [output truncated]`}function mm(e,t){return e.environments?.[t]?.app}function fm(e,t,r){let a=[],l=mm(e,t);a.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),a.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let m=r.maintenance?.enabled;if(m!==!0)a.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(m!==!1)a.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(l?.assets||r.assetsInfo)a.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(l?.database?.connection==="aurora-serverless")a.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(l.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(l.database.maxCapacity??4)}]});for(let f of r.queues??[]){let b=String(f?.name??"").trim();if(b&&/^[A-Za-z0-9_-]+$/.test(b))a.push({id:`queue:purge:${b}`,label:`Purge queue (${b})`,group:"queue",target:b,mutates:!0,confirm:b,danger:!0})}return a}function PS(e,t,r,a){return fm(t,r,a).find((l)=>l.id===e)}async function I_(e,t,r){try{let a=new h(r),{Stacks:l}=await a.describeStacks({stackName:Xt(e,t)}),m={};for(let k of l?.[0]?.Outputs??[])if(k.OutputKey)m[k.OutputKey]=k.OutputValue??"";let f=m.AssetsCdnDomain;if(!f)return null;return(await new S(r).findDistributionByDomain(f))?.Id??null}catch{return null}}async function _S(e,t,r,a={}){try{if(r.id==="redeploy")return await Sn(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await In(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await dr(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await dr(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let l=Number(a.min),m=Number(a.max);if(!Number.isFinite(l)||!Number.isFinite(m)||l<=0||m<l)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await of(e,t,l,m),{operation:r.id,command:`db:scale ${l}-${m} ACU`,ok:!0,stdout:`Scaling applied (${l}-${m} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let l=await Ar(e,t),m=await I_(e,t,l.region);if(!m)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let b=await new S(l.region).invalidateAll(m);return{operation:r.id,command:`cloudfront invalidate ${m} /*`,ok:!0,stdout:`Invalidation ${b?.Id??"created"} for ${m} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let l=r.target,m=await Ar(e,t),f=new ae(m.region),b=`${m.slug}-${t}-${l}`,{QueueUrl:k}=await f.getQueueUrl(b);return await f.purgeQueue(k),{operation:r.id,command:`sqs purge ${b}`,ok:!0,stdout:`Purged queue ${b}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(l){return{operation:r.id,ok:!1,error:Vr(l?.message??String(l))}}}async function xS(e,t,r){let a=r.trim();if(!a)return{operation:"command",ok:!1,error:"A command is required."};try{let l=await rt(e,t,a);return{operation:"command",command:a,ok:!0,stdout:Vr(l||"(no output)")}}catch(l){return{operation:"command",command:a,ok:!1,error:Vr(l?.message??String(l))}}}var hm="No dead-letter queue is provisioned for this environment.";async function ym(e,t,r){try{let{QueueUrl:a}=await e.getQueueUrl(`${t}-${r}-dlq`);return a}catch{return null}}async function DS(e,t,r=10){try{let a=await Ar(e,t),l=new ae(a.region),m=await ym(l,a.slug,t);if(!m)return{ok:!1,messages:[],error:hm};return{ok:!0,messages:((await l.receiveMessages({queueUrl:m,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((k)=>({id:k.MessageId,receiptHandle:k.ReceiptHandle,body:Vr(String(k.Body??""))}))}}catch(a){return{ok:!1,messages:[],error:Vr(a?.message??String(a))}}}async function OS(e,t,r={}){try{let a=await Ar(e,t),l=mm(e,t),f=(l?nr(l,a.slug,t):[]).map((j)=>j.name.replace(`${a.slug}-${t}-`,"")),b=r.targetQueue&&f.includes(r.targetQueue)?r.targetQueue:f[0];if(!b)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let k=new ae(a.region),y=await ym(k,a.slug,t);if(!y)return{operation:"dlq:redrive",ok:!1,error:hm};let{QueueUrl:R}=await k.getQueueUrl(`${a.slug}-${t}-${b}`),T=Math.min(50,Math.max(1,r.max??10)),N=0;while(N<T){let U=(await k.receiveMessages({queueUrl:y,maxMessages:Math.min(10,T-N),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!U.length)break;for(let q of U)await k.sendMessage({queueUrl:R,messageBody:String(q.Body??"")}),await k.deleteMessage(y,q.ReceiptHandle),N++}return{operation:"dlq:redrive",command:`redrive → ${b}`,ok:!0,stdout:`Moved ${N} message(s) from the DLQ to ${b}.`}}catch(a){return{operation:"dlq:redrive",ok:!1,error:Vr(a?.message??String(a))}}}async function $S(e,t){try{let r=await Ar(e,t),a=new ae(r.region),l=await ym(a,r.slug,t);if(!l)return{operation:"dlq:purge",ok:!1,error:hm};return await a.purgeQueue(l),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:Vr(r?.message??String(r))}}}function NS(e,t){let r=mm(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((a)=>({key:a.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:a})):Object.entries(r.secrets).map(([a,l])=>({key:a,secretId:String(l)}))}async function jS(e,t,r,a){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let l=await Ar(e,t),m=new W(l.region);try{await m.putSecretValue({SecretId:r,SecretString:a})}catch{await m.createSecret({Name:r,SecretString:a})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(l){return{operation:"secret:set",ok:!1,error:Vr(l?.message??String(l))}}}async function BS(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let a=await Ar(e,t);return await new W(a.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(a){return{operation:"secret:delete",ok:!1,error:Vr(a?.message??String(a))}}}var E_=new Set(["http","queue","cli"]);async function MS(e,t,r,a){if(!E_.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let l=a.memory==null?void 0:Number(a.memory),m=a.timeout==null?void 0:Number(a.timeout);if(l!=null&&(!Number.isInteger(l)||l<128||l>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(m!=null&&(!Number.isInteger(m)||m<1||m>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(l==null&&m==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let f=await Ar(e,t),b=new E(f.region),k=`${f.slug}-${t}-${r}`;await b.updateFunctionConfiguration({FunctionName:k,...l!=null?{MemorySize:l}:{},...m!=null?{Timeout:m}:{}});let y=[l!=null?`${l} MB`:"",m!=null?`${m}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${k} (${y})`,ok:!0,stdout:`Updated ${k}: ${y}.`}}catch(f){return{operation:"function:config",ok:!1,error:Vr(f?.message??String(f))}}}var gm=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function R_(e){return gm.find((t)=>t.key===e)}async function LS(e,t){try{let r=await Ar(e,t);return{ok:!0,alarms:await new ce(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:gm}}catch(r){return{ok:!1,alarms:[],presets:gm,error:Vr(r?.message??String(r))}}}async function FS(e,t,r,a){let l=R_(r);if(!l)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(a)||a<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let m=await Ar(e,t),f=new ce(m.region),b=`${m.slug}-${t}-${l.key}`,k=l.fnMode?[{Name:"FunctionName",Value:`${m.slug}-${t}-${l.fnMode}`}]:[];return await f.putMetricAlarm({AlarmName:b,Namespace:l.namespace,MetricName:l.metricName,ComparisonOperator:l.comparison,Threshold:a,EvaluationPeriods:1,Period:300,Statistic:l.statistic,Dimensions:k,AlarmDescription:`ts-cloud: ${l.label} > ${a} ${l.unit}`}),{operation:"alarm:create",command:`alarm ${b}`,ok:!0,stdout:`Alarm ${b} armed at ${a} ${l.unit}.`}}catch(m){return{operation:"alarm:create",ok:!1,error:Vr(m?.message??String(m))}}}async function zS(e,t,r){try{let a=await Ar(e,t);if(!r.startsWith(`${a.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new ce(a.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(a){return{operation:"alarm:delete",ok:!1,error:Vr(a?.message??String(a))}}}function A_(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function ml(e,t,r=30){try{let a=await Ar(e,t),l=new pm(a.region),m=new Date,f=new Date(m.getTime()-Math.min(360,Math.max(1,r))*60000),b=`${a.slug}-${t}-http`,k=await l.getTraceSummaries({startTime:f,endTime:m,filterExpression:`service("${b}")`});if(!k.summaries.length)k=await l.getTraceSummaries({startTime:f,endTime:m});return{ok:!0,traces:k.summaries.slice(0,100).map(A_)}}catch(a){return{ok:!1,traces:[],error:Vr(a?.message??String(a))}}}async function vm(e,t,r){try{let a=await Ar(e,t),l=`${a.slug}-${t}-scheduler`;if(r==="run"){let f=await rt(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:Vr(f||"Scheduler run triggered.")}}let m=new pr(a.region);if(r==="enable")await m.enableRule({Name:l});else await m.disableRule({Name:l});return{operation:`scheduler:${r}`,command:`${r} ${l}`,ok:!0,stdout:`Scheduler rule ${l} ${r}d.`}}catch(a){return{operation:`scheduler:${r}`,ok:!1,error:Vr(a?.message??String(a))}}}function US(e,t,r){let a=(Array.isArray(r)?r:String(r??"").split(",")).map(String).filter(Boolean);if(!a.length){if(t)return;let m=e.map((f)=>f.id);return m.length?m:["__no_authorized_telemetry_resources__"]}let l=a.map((m)=>e.find((f)=>f.id===m||f.slug===m)?.id).filter((m)=>!!m);if(l.length!==a.length)throw Error("One or more telemetry resources are outside your authorized scope.");return[...new Set(l)]}import{createHash as VS}from"node:crypto";class WS{now;entries=new Map;constructor(e=Date.now){this.now=e}async getOrCreate(e,t,r,a){let l=this.entries.get(e);if(!r&&l&&l.expiresAt>this.now())return{value:await l.promise,cached:!0};let m=a().catch((f)=>{throw this.entries.delete(e),f});return this.entries.set(e,{expiresAt:this.now()+t,promise:m}),{value:await m,cached:!1}}invalidate(e){for(let t of this.entries.keys())if(t.startsWith(e))this.entries.delete(t)}}class HS{now;lastRun=new Map;constructor(e=Date.now){this.now=e}shouldRun(e,t,r=!1){let a=this.now(),l=this.lastRun.get(e);if(!r&&l!=null&&a-l<t)return!1;return this.lastRun.set(e,a),!0}}var KS=new WS,C_=new HS,P_=2000,__=3600000;function T_(e,t){if(e.kind==="log"&&!t.collectLogs)return!1;if(e.kind==="trace"&&!t.collectTraces)return!1;if((e.kind==="request"||e.name.startsWith("request."))&&!t.collectRequestAnalytics)return!1;if(!["log","trace","request"].includes(e.kind)&&!e.name.startsWith("request."))return!0;let r=e.requestId??e.traceId??`${e.source}\x00${e.workloadId??""}\x00${e.timestamp}`;return Number.parseInt(VS("sha256").update(r).digest("hex").slice(0,8),16)/4294967295<=t.samplingRate}function Wr(...e){return`telemetry:${VS("sha256").update(e.map((t)=>String(t??"")).join("\x00")).digest("hex").slice(0,40)}`}function wc(e,t,r,a){if(!a)return;return e.listResources(t,r).find((l)=>l.slug===a)?.id}function x_(e,t){let r=String(t??"").toLowerCase();if(["debug","info","warn","warning","error","fatal"].includes(r))return r==="fatal"?"error":r;return/fatal|panic|exception|error/i.test(e)?"error":/warn|timeout|throttl|retr(?:y|ies)/i.test(e)?"warning":"info"}function qS(e){let t=e.timestamp&&Number.isFinite(new Date(e.timestamp).getTime())?new Date(e.timestamp).toISOString():new Date().toISOString(),r={};try{let q=JSON.parse(e.message);if(q&&typeof q==="object"&&!Array.isArray(q))r=q}catch{}let a=Object.fromEntries(Object.entries(r).filter(([q])=>!/^(?:body|requestBody|responseBody|headers|authorization|cookie|cookies|query|queryString)$/i.test(q))),l=String(r.requestId??r.request_id??r["x-request-id"]??"")||void 0,m=String(r.traceId??r.trace_id??r["x-amzn-trace-id"]??"")||void 0,f=Number(r.durationMs??r.duration_ms??r.latencyMs??r.latency_ms),b=Number(r.statusCode??r.status_code??r.status),k=String(r.method??r.httpMethod??"")||void 0,y=Oi(String(r.pathTemplate??r.path??r.url??"")||void 0),R=String(r.releaseId??r.release_id??"")||void 0,T=String(r.deploymentId??r.deployment_id??"")||void 0,N={projectId:e.projectId,environmentId:e.environmentId,resourceId:e.resourceId,source:e.source,timestamp:t,requestId:l,traceId:m,releaseId:R,deploymentId:T,workloadId:e.workloadId},j=Object.keys(r).length?JSON.stringify(a):e.message,U=[{...N,id:Wr(e.source,e.name,t,j),kind:"log",name:e.name,level:x_(j,r.level),message:j,attributes:a}];if(k&&y&&Number.isFinite(b)){if(U.push({...N,id:Wr("request",l,t,k,y,b),kind:"request",name:"http.request",method:k,pathTemplate:y,host:r.host,statusCode:b,durationMs:Number.isFinite(f)?f:void 0,bytesIn:Number(r.bytesIn)||void 0,bytesOut:Number(r.bytesOut)||void 0,region:r.region,cacheResult:r.cacheResult??r.cache,upstream:r.upstream,attributes:{userAgentFamily:r.userAgentFamily??"",protocol:r.protocol??""}}),Number.isFinite(f))U.push({...N,id:Wr("request-duration",l,t),kind:"metric",name:"request.duration",value:f,unit:"ms",attributes:{method:k,pathTemplate:y,statusCode:b}});if(U.push({...N,id:Wr("request-count",l,t),kind:"metric",name:"request.count",value:1,unit:"count",attributes:{method:k,pathTemplate:y,statusCode:b}}),b>=500)U.push({...N,id:Wr("request-error",l,t),kind:"metric",name:"request.error",value:1,unit:"count",attributes:{method:k,pathTemplate:y,statusCode:b}})}return U}async function D_(e){let t=new At(e.controlPlane),r=Jt(e.controlPlane,e.projectId),a=new Date,l=[],m=[],f={projectId:e.projectId,environmentId:e.environmentId},b=Q(e.config);try{let N=(b==="serverless"?await bn(e.config,e.environment):await Xd(e.config,e.environment,{includeSiteHealth:e.includeSiteHealth,telemetryOnly:e.lightweight}))??{};if(b==="serverless"){for(let U of N.functionsDetail??[]){let q=wc(e.controlPlane,e.projectId,e.environmentId,U.key),Y={...f,resourceId:q,source:"cloudwatch",timestamp:a.toISOString(),workloadId:U.name,attributes:{provider:"aws",functionName:U.name,aggregationWindow:"24h"}};for(let[ee,le,Z]of[["snapshot.traffic.requests_24h",U.invocations,"count"],["snapshot.errors.count_24h",U.errors,"count"],["snapshot.latency.p50_24h",U.p50,"ms"],["snapshot.latency.p95_24h",U.p95,"ms"],["snapshot.latency.p99_24h",U.p99,"ms"],["snapshot.saturation.throttles_24h",U.throttles,"count"],["snapshot.memory.max_24h",U.maxMem,"MB"]])if(Number.isFinite(Number(le)))l.push({...Y,id:Wr("cloudwatch",U.name,ee,a.toISOString()),kind:"metric",name:ee,value:Number(le),unit:Z})}try{let U=await Ar(e.config,e.environment),q=new ce(U.region),Y=new Date(a.getTime()-3600000),ee=300;for(let le of U.functions){let Z=[{Name:"FunctionName",Value:le.name}],[ie,we,Ee,de,je]=await Promise.all([q.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Invocations",Dimensions:Z,StartTime:Y,EndTime:a,Period:300,Statistics:["Sum"]}),q.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Errors",Dimensions:Z,StartTime:Y,EndTime:a,Period:300,Statistics:["Sum"]}),q.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Duration",Dimensions:Z,StartTime:Y,EndTime:a,Period:300,ExtendedStatistics:["p50","p95","p99"]}),q.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"Throttles",Dimensions:Z,StartTime:Y,EndTime:a,Period:300,Statistics:["Sum"]}),q.getMetricStatistics({Namespace:"AWS/Lambda",MetricName:"ConcurrentExecutions",Dimensions:Z,StartTime:Y,EndTime:a,Period:300,Statistics:["Maximum"]})]),ne=wc(e.controlPlane,e.projectId,e.environmentId,le.mode),Me=(Je,gt,zt,it)=>{for(let kt of Je){let Ut=kt.Timestamp&&Number.isFinite(new Date(kt.Timestamp).getTime())?new Date(kt.Timestamp).toISOString():void 0,dt=zt(kt);if(Ut&&dt!=null&&Number.isFinite(dt))l.push({...f,resourceId:ne,id:Wr("cloudwatch-series",le.name,gt,Ut),kind:"metric",source:"cloudwatch",name:gt,timestamp:Ut,value:dt,unit:it,workloadId:le.name,region:U.region,attributes:{provider:"aws",functionName:le.name,aggregationWindow:"300s"}})}};Me(ie,"traffic.requests",(Je)=>Je.Sum,"count"),Me(we,"errors.count",(Je)=>Je.Sum,"count"),Me(Ee,"latency.p50",(Je)=>Je.Percentiles?.p50,"ms"),Me(Ee,"latency.p95",(Je)=>Je.Percentiles?.p95,"ms"),Me(Ee,"latency.p99",(Je)=>Je.Percentiles?.p99,"ms"),Me(de,"saturation.throttles",(Je)=>Je.Sum,"count"),Me(je,"saturation.concurrency",(Je)=>Je.Maximum,"count")}}catch(U){m.push({source:"cloudwatch:series",message:U instanceof Error?U.message:String(U)})}for(let U of(N.serverlessLogs??[]).slice(0,P_))l.push(...qS({...f,source:`cloudwatch:${U.source}`,name:`${U.source}.log`,timestamp:U.timestamp,message:String(U.message),resourceId:wc(e.controlPlane,e.projectId,e.environmentId,U.source)}));for(let U of N.queuesDetail??[]){let q={...f,source:"cloudwatch",timestamp:a.toISOString(),attributes:{queue:U.name}};l.push({...q,id:Wr("queue-depth",U.name,a.toISOString()),kind:"metric",name:"queue.depth",value:Number(U.visible??U.depth??0),unit:"count"}),l.push({...q,id:Wr("queue-inflight",U.name,a.toISOString()),kind:"metric",name:"queue.inflight",value:Number(U.inFlight??0),unit:"count"})}let j=await ml(e.config,e.environment,30);if(!j.ok)m.push({source:"xray",message:j.error??"X-Ray traces are unavailable."});for(let U of j.traces)l.push({...f,id:Wr("xray",U.id),kind:"trace",source:"xray",name:"http.trace",timestamp:U.timestamp??a.toISOString(),traceId:U.id,durationMs:U.durationMs,statusCode:U.httpStatus,method:U.method,pathTemplate:U.url,attributes:{status:U.status,responseMs:U.responseMs}})}else{let j=N.systemMetrics;if(N.metricsUnavailable||!j)m.push({source:"host",message:"The host metrics probe is unavailable."});else{let U=Number(j.memTotalMb)>0?Number(j.memUsedMb)/Number(j.memTotalMb)*100:0,q=Number(j.swapTotalMb)>0?Number(j.swapUsedMb)/Number(j.swapTotalMb)*100:0,Y=[["host.load",Number(j.load),"load"],["host.load.5m",Number(j.load5),"load"],["host.load.15m",Number(j.load15),"load"],["host.cpu.capacity",Number(j.cpus),"count"],["host.cpu.used_percent",Number(j.cpuUsedPct),"percent"],["host.memory.used",Number(j.memUsedMb)*1024*1024,"bytes"],["host.memory.total",Number(j.memTotalMb)*1024*1024,"bytes"],["host.memory.available",Number(j.memAvailableMb)*1024*1024,"bytes"],["host.memory.cache",Number(j.memCacheMb)*1024*1024,"bytes"],["host.memory.used_percent",U,"percent"],["host.swap.used",Number(j.swapUsedMb)*1024*1024,"bytes"],["host.swap.total",Number(j.swapTotalMb)*1024*1024,"bytes"],["host.swap.used_percent",q,"percent"],["host.disk.used_percent",Number(j.diskUsedPct),"percent"],["host.disk.used",Number(j.diskUsedGb)*1073741824,"bytes"],["host.disk.total",Number(j.diskTotalGb)*1073741824,"bytes"],["host.disk.inode_used_percent",Number(j.inodeUsedPct),"percent"],["host.network.rx",Number(j.networkRxBytes),"bytes"],["host.network.tx",Number(j.networkTxBytes),"bytes"],["host.network.rx_rate",Number(j.networkRxBytesPerSec),"bytes_per_second"],["host.network.tx_rate",Number(j.networkTxBytesPerSec),"bytes_per_second"],["host.network.rx_today",Number(j.networkRxBytesToday),"bytes"],["host.network.tx_today",Number(j.networkTxBytesToday),"bytes"],["host.network.rx_month",Number(j.networkRxBytesMonth),"bytes"],["host.network.tx_month",Number(j.networkTxBytesMonth),"bytes"],["host.processes",Number(j.processes),"count"],["host.uptime",Number(j.uptimeSeconds),"seconds"]];for(let[ee,le,Z]of Y)if(Number.isFinite(le))l.push({...f,id:Wr("host",ee,a.toISOString()),kind:"metric",source:"host",name:ee,timestamp:a.toISOString(),value:le,unit:Z});for(let ee of N.siteHealth??[]){let le=String(ee.project??e.config.project.slug),Z=String(ee.name),ie=Z.startsWith(`${le}:`)?Z.slice(le.length+1):Z,we=`site:${le}:${ie}`,Ee=wc(e.controlPlane,e.projectId,e.environmentId,Z),de={...f,resourceId:Ee,source:we,timestamp:ee.checkedAt||a.toISOString(),host:ee.route,attributes:{project:le,site:ie,route:String(ee.route),status:String(ee.status)}},je=[["site.health.up",ee.status==="live"?1:0,"boolean"],["site.http.status",Number(ee.httpStatus),"status"],["site.response.time",Number(ee.responseMs),"ms"]];if(ee.tlsDaysRemaining!=null)je.push(["site.tls.days_remaining",Number(ee.tlsDaysRemaining),"days"]);for(let[ne,Me,Je]of je)if(Number.isFinite(Me))l.push({...de,id:Wr(we,ne,de.timestamp),kind:"metric",name:ne,value:Me,unit:Je})}}}}catch(N){m.push({source:b==="serverless"?"aws":"host",message:N instanceof Error?N.message:String(N)})}{let N=e.config.infrastructure?.compute?.monitoring,j=typeof N==="object"?N?.egressEndpoints:void 0,U=await Oa(j,{now:a.toISOString()});m.push(...U.errors);for(let q of U.metrics)l.push({...f,id:Wr(q.attributes.source,q.name,q.timestamp),kind:"metric",source:`egress:${q.attributes.source}`,name:q.name,timestamp:q.timestamp,value:q.value,unit:q.unit,attributes:q.attributes})}if(!e.lightweight)try{let N=await oe(e.config,e.environment),j=new ye(e.config,e.environment,{inventory:async()=>N});for(let U of N.workloads){let q=wc(e.controlPlane,e.projectId,e.environmentId,U.links.service),Y={...f,resourceId:q,source:`runtime:${U.provider}`,timestamp:a.toISOString(),workloadId:U.id,releaseId:U.links.release,attributes:{status:U.status,provider:U.provider,service:U.links.service??""}};if(l.push({...Y,id:Wr(U.id,"health",a.toISOString()),kind:"metric",name:"health.up",value:U.status==="running"?1:0,unit:"boolean"}),l.push({...Y,id:Wr(U.id,"restarts",a.toISOString()),kind:"metric",name:"saturation.restarts",value:U.restartCount??0,unit:"count"}),U.resources?.memoryBytes!=null)l.push({...Y,id:Wr(U.id,"memory",a.toISOString()),kind:"metric",name:"runtime.memory.used",value:U.resources.memoryBytes,unit:"bytes"});if(!U.capabilities.logs.supported)continue;try{let ee=await j.logs(U.id,{limit:100,since:new Date(a.getTime()-300000)});for(let le of ee.lines)l.push(...qS({...f,resourceId:q,source:`runtime:${U.provider}`,name:`${U.links.service??U.name}.log`,timestamp:le.timestamp,message:le.message,workloadId:U.id}))}catch(ee){m.push({source:`runtime:${U.provider}`,message:ee instanceof Error?ee.message:String(ee)})}}for(let U of N.sources.filter((q)=>q.status!=="fresh"))m.push({source:U.id,message:U.message??`Runtime source is ${U.status}.`})}catch(N){m.push({source:"runtime",message:N instanceof Error?N.message:String(N)})}if(!e.lightweight)for(let N of e.controlPlane.listEvents({projectId:e.projectId,limit:1000})){let j=N.payload;l.push({...f,id:`telemetry:event:${N.id}`,resourceId:N.resourceId,kind:"event",source:"control-plane",name:N.type,timestamp:N.createdAt,level:N.level,message:N.type,deploymentId:N.operationId,releaseId:typeof j.releaseId==="string"?j.releaseId:void 0,traceId:N.correlationId,attributes:j})}let k=l.filter((N)=>T_(N,r)).map((N)=>({...N,sampled:r.samplingRate<1&&(N.kind==="log"||N.kind==="trace"||N.kind==="request"||N.name.startsWith("request."))})),y=t.appendMany(k).length;if(C_.shouldRun(e.projectId,__,!e.lightweight))t.enforceRetention(r,e.projectId);let R=t.status(e.projectId,e.environmentId,r.rawDays,r.samplingRate);for(let N of m)if(!R.some((j)=>j.source===N.source))R.push({source:N.source,freshness:"unavailable",samplingRate:r.samplingRate,retentionDays:r.rawDays,estimatedDailyBytes:0,message:N.message});let T=a.toISOString();return e.controlPlane.setSetting(`telemetry.collection:${e.projectId}:${e.environmentId??"all"}`,{generatedAt:T,errors:m,statuses:R,policy:r}),{collected:y,cached:!1,generatedAt:T,statuses:R,errors:m,policy:r}}async function bm(e){let r=`${`${e.projectId}:${e.environmentId??"all"}:${e.environment}`}:${e.lightweight?"lightweight":"full"}`,a=Q(e.config)==="serverless"?300000:60000,l=await KS.getOrCreate(r,a,!!e.force,()=>D_(e));return{...l.value,cached:l.cached}}function JS(e){KS.invalidate(`${e}:`)}function GS(e,t={}){let r=t.shell||(process.platform==="win32"?"powershell.exe":"bash"),a=Bun.spawn([r,"-i"],{stdin:"pipe",stdout:"pipe",stderr:"pipe",cwd:t.cwd,env:{...process.env,TERM:"xterm-256color",PS1:"\\w $ "}}),l=new TextDecoder,m=async(f)=>{if(!f)return;let b=f.getReader();try{for(;;){let{done:k,value:y}=await b.read();if(k)break;if(y)e(l.decode(y))}}catch{}};if(m(a.stdout),m(a.stderr),t.onExit)a.exited.then((f)=>t.onExit(f)).catch(()=>{});return{write(f){try{a.stdin.write(f),a.stdin.flush()}catch{}},close(){try{a.stdin.end()}catch{}try{a.kill()}catch{}}}}var F_="127.0.0.1",z_=7676,YS=65536,cw="ts-cloud-dashboard-",Gs=$_(L_(import.meta.url));function U_(e){try{return process.kill(e,0),!0}catch(t){return t?.code!=="ESRCH"}}function q_(e=vl(),t=U_){let r=0;for(let a of QS(e,{withFileTypes:!0})){if(!a.isDirectory()||!a.name.startsWith(cw))continue;let l=Bt(e,a.name),m=a.name.match(/^ts-cloud-dashboard-(\d+)-/);if(m){let f=Number(m[1]);if(f===process.pid||t(f))continue}else if(QS(l).length>0)continue;Bo(l,{recursive:!0,force:!0}),r+=1}return r}var V_={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".json":"application/json; charset=utf-8",".svg":"image/svg+xml",".png":"image/png",".jpg":"image/jpeg",".jpeg":"image/jpeg",".webp":"image/webp",".ico":"image/x-icon"};function x(e,t=200,r={}){return new Response(JSON.stringify(e,null,2),{status:t,headers:{"content-type":"application/json; charset=utf-8",...r}})}function W_(e,t,r,a){let l=new TextEncoder,m=Math.max(0,Math.floor(r)),f,b,k=!1,y=new ReadableStream({start(R){let T=()=>{if(k)return;if(k=!0,f?.(),b)clearInterval(b);a.removeEventListener("abort",T);try{R.close()}catch{}},N=(U)=>{if(k)return;if(U.reset)R.enqueue(l.encode(`event: reset
 data: ${JSON.stringify({cursor:U.cursor,droppedBytes:U.droppedBytes})}
@@ -673,7 +673,7 @@ data: ${JSON.stringify({cursor:m,at:new Date().toISOString()})}
 ${b}
 ${k}`);return null}return a}catch(l){if(a)Bo(a,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${l.message}`);return null}}function ms(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:no(Ys(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,a])=>[r,{domain:a.domain,path:a.path,type:a.type,deploy:a.deploy,root:a.root,port:a.port,ssl:a.ssl}]))}}function En(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function fs(e,t){return En(t).find((r)=>r.id===e)}function tw(e){if(e.length<=YS)return e;return`${e.slice(0,YS)}
 
-[output truncated]`}async function rw(e,t,r){let a=e.getReader(),l=new TextDecoder,m="";while(!0){let{done:b,value:k}=await a.read();if(b)break;let y=l.decode(k,{stream:!0});if(m+=y,y)r?.(t,y)}let f=l.decode();if(f)m+=f,r?.(t,f);return m}async function wm(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[l,m,f]=await Promise.all([rw(r.stdout,"stdout",t.onOutput),rw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:f,ok:f===0,stdout:tw(l),stderr:tw(m)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ic(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function nw(e,t){if(t.role==="admin")return!0;let r=Ic(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let l=uT[a];return!!l&&!!t.capabilities?.includes(l)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),l=N_(r===""?"index.html":r);if(l.startsWith("..")||l.includes("/../"))return null;let m=Bt(e,l);if(wi(m)&&!aw(m).isDirectory())return m;if(!Ic(m)&&wi(`${m}.html`))return`${m}.html`;if(!Ic(m)&&wi(Bt(m,"index.html")))return Bt(m,"index.html");return null}async function iw(e,t){let r=pT(e,t);if(!r){let m=Bt(e,"404.html");if(wi(m))return new Response(await ii(m),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return bl("Not found",404)}if(aw(r).isDirectory())return bl("Not found",404);let a=await ii(r),l=V_[Ic(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":l}})}var hl=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],ow=new WeakMap;async function sw(e){let t=ow.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),l={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return ow.set(e,l),l}async function Ka(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,l=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let m=e.config??await Ll(),f=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,b=g(m);if(f&&b&&!b.password)b.password=f;let k=m.infrastructure?.compute?.managedServices?.vitess;if(f&&k&&typeof k==="object"&&!k.password)k.password=f;let y=$u(t,m);if(y.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${y.reconciliation.failed} orphaned operation(s) as failed after restart.`);let R=Object.keys(m.environments??{}),T=Q_(m,e.environment),N=X_(t),j=await No(m,T),U=new Map([[T,j]]),q=new Map([[T,Date.now()]]),Y=new Map([[T,Date.now()]]),ee=new Map,le=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),Z=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ie=Q(m)!=="serverless",we=(D)=>{let Fe=U.get(D);if(Fe&&!ZS(q.get(D),Date.now(),le))return Promise.resolve(Fe);let Ue=ee.get(D);if(Ue)return Ue;let Le=!ie||ZS(Y.get(D),Date.now(),Z),Ge=No(m,D,{includeSiteHealth:Le}).then((bt)=>{let z=U.get(D),Lr=Le?bt:oT(z,bt);if(U.set(D,Lr),q.set(D,Date.now()),Le)Y.set(D,Date.now());if(z?._serverReachable!==Lr._serverReachable||z?._metricsStatus!==Lr._metricsStatus||(z?.sitesDetail?.length??0)!==(Lr.sitesDetail?.length??0))it();return Lr}).finally(()=>ee.delete(D));return ee.set(D,Ge),Ge},Ee=Gt(t),de=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&de!=="0"&&(de==="1"||!m.cloud?.attachTo)){let D=!1,Fe=Date.now()+300000,Ue=async()=>{if(D)return;D=!0;try{let Ge=Date.now(),bt=Ge>=Fe;if(bt)Fe=Ge+300000;let z=y.environments.get(T);await bm({controlPlane:y.store,projectId:y.project.id,environmentId:z?.id,config:m,environment:T,force:!0,lightweight:!0,includeSiteHealth:bt})}catch(Ge){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ge instanceof Error?Ge.message:String(Ge)}`)}finally{D=!1}};Ue(),setInterval(()=>void Ue(),60000).unref?.()}let ne=new Map,Me=new Map,Je=new Set,gt=0;function zt(D,Fe){if(D.role==="admin"&&!y.store.getActorByExternalId("user",`dashboard:${D.username.toLowerCase()}`))return D;let Ue=y.store.getActorByExternalId("user",`dashboard:${D.username.toLowerCase()}`),Le=Ue?y.store.getMembershipForActor(y.organization.id,Ue.id):void 0;if(!Le||Le.status!=="active")return{...D,role:"member",sites:{},capabilities:[]};let Ge=y.store.listGrants(Le.id),bt=y.store.resolveAuthorizationTarget(y.organization.id,Le.scope)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),z=qt({membership:Le,grants:Ge,target:bt});if(Le.roleTemplate==="owner"||Le.roleTemplate==="admin")return{...D,role:"admin",sites:{},organizationRole:Le.roleTemplate,organizationSource:Le.source,capabilities:z};let Lr=y.environments.get(Fe),hr={};for(let at of y.store.listResources(y.project.id,Lr?.id).filter((pt)=>pt.kind==="application")){let pt=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:at.id});if(!pt||!P({membership:Le,grants:Ge,capability:"project:read",target:pt}).allowed)continue;hr[at.slug]=P({membership:Le,grants:Ge,capability:"config:write",target:pt}).allowed?"owner":"collaborator"}return{...D,role:"member",sites:hr,organizationRole:Le.roleTemplate,organizationSource:Le.source,capabilities:z}}function it(){gt+=1,ne.clear();for(let D of Je)Bo(D,{recursive:!0,force:!0});Je.clear()}let kt=(D,Fe)=>`${Fe}:${D.role==="admin"?"admin":`member:${Object.entries(D.sites).sort(([Ue],[Le])=>Ue.localeCompare(Le)).map(([Ue,Le])=>`${Ue}=${Le}`).join(",")}`}:${[...D.capabilities??[]].sort().join(",")}`;async function Ut(D,Fe){let Ue=zt(D,Fe),Le=kt(Ue,Fe),Ge=ne.get(Le);if(Ge)return Ge;let bt=Me.get(Le);if(bt)return bt;let z=gt,Lr=(async()=>{let hr=U.get(Fe)??await No(m,Fe);U.set(Fe,hr);let at={...lm(hr,{user:Ue,slug:m.project.slug}),viewer:{role:Ue.role,organizationRole:Ue.organizationRole,organizationSource:Ue.organizationSource,capabilities:Ue.capabilities??[]}},pt=await aT(t,at);if(pt&&z!==gt)return Bo(pt,{recursive:!0,force:!0}),Ee?.uiRoot;if(pt)Je.add(pt);let xr=pt??Ee?.uiRoot;if(xr)ne.set(Le,xr);return xr})();Me.set(Le,Lr);try{return await Lr}finally{Me.delete(Le)}}let dt=await Ut({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!dt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let K=new WeakMap,ue=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",he=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(he&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Te=!he,mt=$b(t),It=Te?Mb(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Ne=new Xi(y.store,{encryptionKey:Ze(t)}),ht=new Yi(y.store),ut=new ln(y.store),Ke=new Yo(y.store,{encryptionKey:Ze(t)}),Br=new op(y.store),Mo=new dp(y.store,{cwd:t}),Qn=new ap(y.store,{encryptionKey:Ze(t)}),Mt=new c(y.store,{workerId:`dashboard:${process.pid}`}),Kt=new ga(y.store),oi=new ba(y.store,Ze(t)),Ii=new Ga(y.store),Ec=new os(Kt,Mt,oi),Ei=m.project?.region??"us-east-1",Im=Ze(t),rn=new za(Ii,{encryptionKey:Im,backends:[new Cn(y.store,Im),new Va(new W(Ei),Ei),new qa(new Re(Ei),Ei),new ja]});await Zu(rn,y,m);let kl=new J(Ei),dw={aws_rds:new pa(new ya(kl)),aws_aurora:new ma(new Sa(kl)),aws_elasticache:new fa(new Ia(new st(Ei))),server:new ha(new or),container:new Aa(new or)},Em=(D)=>dw[D.provider],yr=new _a(y.store),oo=new ps(yr,Mt),Rm=new La(oi),lw={managed_database:new $a(Kt,kl),logical_database:new Fa(Kt,oi),volume:new Ua,files:new Ma(t),control_plane:new Qa(y.store,t),infrastructure:new Ha(new lr(Ei))},uw=(D)=>lw[D.resourceKind],pw=(D)=>D.provider==="aws_backup"?void 0:Rm,Il=new jt(y.store),El=[new Ur,new so(d(t,"volumes"))],si=new io(Il,El,Mt),Xs=new Ca(y.store),Yn=new Ea(Xs,[new fn("aws"),new fn("hetzner"),new fn("ssh")],Mt),Ai=new va(y.store),Am=new Ta(Ai,Xs),ao=new wa(y.store),Cm=new Ra(ao,Mt),ai=new Pa(y.store),Rl=new Na(ai,Mt),Pm=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((D)=>new ka(D,y.store,y.project.id,y.organization.id)),_r=new da(y.store),_m=new ua(_r,{queue:Mt}),mr=new Fr(y.store),Ci=new Qr(y.store),Dn=new Et(y.store),ot=new ki(y.store,{encryptionKey:Ze(t)}),gw=()=>sw(y.store);for(let D of y.environments.values())la(_r,m,{organization:y.organization,project:y.project,environment:D,resources:y.store.listResources(y.project.id,D.id)});let On=new Bi(ot,{emailImpl:async(D)=>{let{email:Fe}=await import("./chunk-e9z4gzmg.js");return Fe.send(D)}}),Tm=async(D)=>{let Fe=So(ot,y.project.id,D),Ue=[];for(let Le of Fe.filter((Ge)=>Ge.notify&&Ge.alert))Ue.push(...await On.deliverAll(On.enqueue(y.organization.id,Le.alert,Le.transition)));return Ue.push(...await On.deliverAll(On.enqueueRemindersAndEscalations(y.organization.id,ot.listAlerts(y.project.id,{environmentId:D,states:["firing"]})))),Ue.push(...await On.retryDue()),{evaluations:Fe,deliveries:Ue}},Cl=!1,mw=async()=>{if(Cl)return;Cl=!0;try{for(let D of y.environments.values())for(let Fe of ot.listHealthChecks(y.project.id,D.id).filter((Ue)=>Ue.enabled)){let Ue=ot.listHealthResults(Fe.id,1)[0];if(Ue&&Date.now()-new Date(Ue.checkedAt).getTime()<Fe.intervalSeconds*1000)continue;let Le=await new qe(ot).runAndEvaluate(Fe);for(let Ge of Le.evaluations.filter((bt)=>bt.notify&&bt.alert))await On.deliverAll(On.enqueue(y.organization.id,Ge.alert,Ge.transition))}}finally{Cl=!1}},xm=setInterval(()=>{for(let D of y.environments.values())Tm(D.id).catch((Fe)=>console.error("ts-cloud alert evaluation failed:",Fe))},60000);xm.unref?.();let Dm=setInterval(()=>{mw().catch((D)=>console.error("ts-cloud health check evaluation failed:",D))},30000);Dm.unref?.();let Om=setInterval(()=>{try{_m.tick()}catch(D){console.error("ts-cloud scheduled job evaluation failed:",D)}},30000);Om.unref?.();let $m=setInterval(()=>{try{oo.enqueueDue(),oo.enqueueRetention()}catch(D){console.error("ts-cloud backup policy evaluation failed:",D)}},30000);$m.unref?.(),mr.cleanup();let Nm=setInterval(()=>{try{mr.cleanup()}catch(D){console.error("ts-cloud preview cleanup failed:",D)}},3600000);Nm.unref?.();let fw=e.queueWorker??!0,hw=cT(),yw=async(D,Fe)=>{let Le=(D.environmentId?y.store.listEnvironments(D.projectId).find((Ge)=>Ge.id===D.environmentId):void 0)?.slug??String(T);if(Fe.kind==="dashboard_operation"&&Fe.operationId){let Ge=U.get(Le)??j,bt=dm(Fe.operationId,m,Ge);if(!bt||bt.danger||!["scheduler","backup","worker"].includes(bt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let z=await pl(m,Le,bt);return{ok:z.ok,stdout:z.stdout,stderr:z.stderr??z.error,retryable:/temporar|unavailable|timeout|network/i.test(z.stderr??z.error??""),output:{command:z.command??null,operation:z.operation}}}if(Fe.kind==="serverless_scheduler"){let Ge=await vm(m,Le,"run");return{ok:Ge.ok,stdout:Ge.stdout,stderr:Ge.error,retryable:/temporar|unavailable|timeout|network/i.test(Ge.error??""),output:{command:Ge.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Fe.kind}.`}},Rc=fw?new ro(Mt,{...sd({store:y.store,execute:async(D,Fe)=>{let Ue=Fe.operation.input&&typeof Fe.operation.input==="object"&&!Array.isArray(Fe.operation.input)?Fe.operation.input:{},Le=Ue.source&&typeof Ue.source==="object"?Ue.source:void 0,Ge=t,bt,z,Lr;try{if(Le?.bindingId&&Le?.connectionId&&Le?.commitSha){let at=Ke.getBinding(String(Le.bindingId)),pt=Ke.getConnection(String(Le.connectionId));if(!at||!pt||at.connectionId!==pt.id)throw Error("Queued source binding is no longer available");let Rr=(at.repositoryId?Ke.getRepository(at.repositoryId):Ke.listRepositories(pt.id).find((Uo)=>Uo.fullName.toLowerCase()===at.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Rr&&pt.provider==="generic_ssh")Rr=`git@${new URL(pt.host).hostname}:${at.repositoryFullName}.git`;if(!Rr)Rr=new URL(`/${at.repositoryFullName}.git`,pt.host.endsWith("/")?pt.host:`${pt.host}/`).href;let Ce=at.deployKeyId?Ke.getDeployKey(at.deployKeyId):void 0,Yt=Ce&&at.deployKeyId?{...Ce,privateKey:Ke.getDeployPrivateKey(at.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(pt.provider)&&D.target.previewId){let Uo=et(pt,Ke.getCredential(pt.id)),pe=mr.previews.getInstance(D.target.previewId);Lr=async($n,xc)=>{try{await Uo.setCommitStatus(at.repositoryFullName,String(Le.commitSha),{state:$n,url:pe?.url,description:xc})}catch(Ho){Fe.log(`Could not publish source status: ${Ho instanceof Error?Ho.message:String(Ho)}`,{stream:"stderr"})}},await Lr("pending",`Preview deployment started for ${String(Le.commitSha).slice(0,12)}`)}bt=km(Bt(vl(),"ts-cloud-queued-source-")),Fe.log(`Checking out immutable source commit ${Le.commitSha}.`,{stream:"system"}),Ge=(await ea({remote:Rr,binding:at,destination:Bt(bt,"checkout"),ref:String(Le.branch??at.defaultBranch),commitSha:String(Le.commitSha)},{credential:Ke.getCredential(pt.id),deployKey:Yt})).directory}if(Fe.operation.kind!=="preview.destroy"){let at=D.target.previewId?mr.previews.getInstance(D.target.previewId):void 0,pt=at?mr.previews.getDefinition(at.definitionId):void 0,xr=Fe.operation.resourceId?y.store.getResource(Fe.operation.resourceId):void 0;if(z=await rn.resolve({projectId:y.project.id,environmentId:Fe.operation.environmentId,resourceId:Fe.operation.resourceId,functionId:xr?.kind==="function"?xr.id:void 0,previewId:at?.id,trustedPreview:!!at&&!at.fork,allowedPreviewSecrets:pt?.inheritedSecrets}),z.warnings.some((Rr)=>Rr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${z.warnings.filter((Rr)=>Rr.code==="missing_required").map((Rr)=>Rr.key).join(", ")}`);if(Fe.operation.resourceId)for(let Rr of Object.values(z.entries))Ii.setDependency({entryId:Rr.id,resourceId:Fe.operation.resourceId,injectionTarget:"environment",required:Rr.required,requiresRedeploy:!0});Fe.log(`Resolved configuration ${z.configurationHash.slice(0,18)} for ${Object.keys(z.values).length} keys.`,{stream:"system"})}let hr=await wm(D,{cwd:Ge,cliEntry:l,signal:Fe.signal,env:z?.values,onOutput:(at,pt)=>Fe.log(pt,{stream:at,step:"execute",secrets:[...hw,...Object.entries(z?.entries??{}).filter(([,xr])=>xr.kind==="secret").map(([xr])=>z.values[xr]).filter(Boolean)]})});if(hr.ok&&Fe.operation.resourceId&&z)for(let at of Object.values(z.entries))Ii.setDependency({entryId:at.id,resourceId:Fe.operation.resourceId,injectionTarget:"environment",required:at.required,requiresRedeploy:!1,lastDeployedVersion:at.version});return await Lr?.(hr.ok?"success":"failure",hr.ok?`Preview is ready at ${String(Le?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Le?.commitSha).slice(0,12)}`),hr}catch(hr){throw await Lr?.("error",`Preview deployment could not complete at ${String(Le?.commitSha).slice(0,12)}`),hr}finally{if(bt)Bo(bt,{recursive:!0,force:!0})}}}),...Au({store:_r,executor:yw}),...Su({store:Kt,secrets:oi,resolveAdapter:Em}),...Cu(Xs,Yn.drivers),...vu(ao,[new Da("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Pu({store:ai,cleanup:Pm}),...od(Il,El),...Ku({store:yr,queue:Mt,resolveSource:uw,resolveDestination:pw,validateHealth:async(D,Fe)=>{if(!D.healthCheckId)return{healthy:!0,mode:"adapter"};let Ue=ot.getHealthCheck(D.healthCheckId);if(!Ue||Ue.projectId!==D.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Le=await new qe(ot).runAndEvaluate(Ue);return{healthy:Le.result.status==="healthy",healthCheckId:Ue.id,healthResultId:Le.result.id,target:Fe}}}),...Wl({store:y.store,resolveDriver:e.releaseDriver??((D)=>({name:`${y.store.getResource(D.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:D.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(D,Fe)=>{let Ue=ot.listHealthChecks(Fe.projectId,Fe.environmentId).find((Ge)=>Ge.enabled&&Ge.name===D&&(!Ge.resourceId||Ge.resourceId===Fe.resourceId));if(!Ue)return{healthy:!1,message:`Named health gate ${D} was not found for this release.`};let Le=await new qe(ot).runAndEvaluate(Ue);return{healthy:Le.result.status==="healthy",evidence:{healthCheckId:Ue.id,healthResultId:Le.result.id,status:Le.result.status,timings:Le.result.timings},message:Le.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(D)=>console.error("ts-cloud deployment queue worker failed:",D)}):void 0;if(cu(y),ns(ut,se(y,String(T)),j),It)ls(y,It.users),zb(Ne,y,It.users);let er=Lb({cwd:t,enabled:Te,secret:mt,authentication:Ne,authorization:{store:y.store,organizationId:y.organization.id,projectId:y.project.id,defaultEnvironment:String(T)}}),vr=new ca,jm=setInterval(()=>vr.sweep(),60000);jm.unref?.();let Ac=new bc,Pl=new bc(3,900000,900000),Cc=new bc(8,900000,900000),Bm=setInterval(()=>Ac.prune(),300000),Mm=setInterval(()=>Pl.prune(),300000),Lm=setInterval(()=>Cc.prune(),300000);if(Bm.unref?.(),Mm.unref?.(),Lm.unref?.(),Te){if(It?.generated)console.warn(`
+[output truncated]`}async function rw(e,t,r){let a=e.getReader(),l=new TextDecoder,m="";while(!0){let{done:b,value:k}=await a.read();if(b)break;let y=l.decode(k,{stream:!0});if(m+=y,y)r?.(t,y)}let f=l.decode();if(f)m+=f,r?.(t,f);return m}async function wm(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),a=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)a();else t.signal?.addEventListener("abort",a,{once:!0});try{let[l,m,f]=await Promise.all([rw(r.stdout,"stdout",t.onOutput),rw(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:f,ok:f===0,stdout:tw(l),stderr:tw(m)}}finally{t.signal?.removeEventListener("abort",a)}}function cT(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var dT=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function lT(e){let t=Ic(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!dT.has(r)}var uT={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function nw(e,t){if(t.role==="admin")return!0;let r=Ic(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!lT(e);let a=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(a==="/access-denied")return!0;let l=uT[a];return!!l&&!!t.capabilities?.includes(l)}function pT(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),l=N_(r===""?"index.html":r);if(l.startsWith("..")||l.includes("/../"))return null;let m=Bt(e,l);if(wi(m)&&!aw(m).isDirectory())return m;if(!Ic(m)&&wi(`${m}.html`))return`${m}.html`;if(!Ic(m)&&wi(Bt(m,"index.html")))return Bt(m,"index.html");return null}async function iw(e,t){let r=pT(e,t);if(!r){let m=Bt(e,"404.html");if(wi(m))return new Response(await ii(m),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return bl("Not found",404)}if(aw(r).isDirectory())return bl("Not found",404);let a=await ii(r),l=V_[Ic(r)]??"application/octet-stream";return new Response(a,{headers:{"content-type":l}})}var hl=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],ow=new WeakMap;async function sw(e){let t=ow.get(e);if(t)return t;let r=await import("./spend/index.js"),a=new r.SpendStore(e),l={store:a,service:new r.SpendService(a),gate:new r.SpendGate(e)};return ow.set(e,l),l}async function Ka(e={}){q_();let t=e.cwd??process.cwd(),r=e.host??F_,a=e.port??z_,l=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await Z_(t);let m=e.config??await Ll(),f=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,b=g(m);if(f&&b&&!b.password)b.password=f;let k=m.infrastructure?.compute?.managedServices?.vitess;if(f&&k&&typeof k==="object"&&!k.password)k.password=f;let y=$u(t,m);if(y.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${y.reconciliation.failed} orphaned operation(s) as failed after restart.`);let R=Object.keys(m.environments??{}),T=Q_(m,e.environment),N=X_(t),j=await No(m,T),U=new Map([[T,j]]),q=new Map([[T,Date.now()]]),Y=new Map([[T,Date.now()]]),ee=new Map,le=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),Z=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),ie=Q(m)!=="serverless",we=(D)=>{let Fe=U.get(D);if(Fe&&!ZS(q.get(D),Date.now(),le))return Promise.resolve(Fe);let Ue=ee.get(D);if(Ue)return Ue;let Le=!ie||ZS(Y.get(D),Date.now(),Z),Ge=No(m,D,{includeSiteHealth:Le}).then((bt)=>{let z=U.get(D),Lr=Le?bt:oT(z,bt);if(U.set(D,Lr),q.set(D,Date.now()),Le)Y.set(D,Date.now());if(z?._serverReachable!==Lr._serverReachable||z?._metricsStatus!==Lr._metricsStatus||(z?.sitesDetail?.length??0)!==(Lr.sitesDetail?.length??0))it();return Lr}).finally(()=>ee.delete(D));return ee.set(D,Ge),Ge},Ee=Gt(t),de=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&de!=="0"&&(de==="1"||!m.cloud?.attachTo)){let D=!1,Fe=Date.now()+300000,Ue=async()=>{if(D)return;D=!0;try{let Ge=Date.now(),bt=Ge>=Fe;if(bt)Fe=Ge+300000;let z=y.environments.get(T);await bm({controlPlane:y.store,projectId:y.project.id,environmentId:z?.id,config:m,environment:T,force:!0,lightweight:!0,includeSiteHealth:bt})}catch(Ge){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ge instanceof Error?Ge.message:String(Ge)}`)}finally{D=!1}};Ue(),setInterval(()=>void Ue(),60000).unref?.()}let ne=new Map,Me=new Map,Je=new Set,gt=0;function zt(D,Fe){if(D.role==="admin"&&!y.store.getActorByExternalId("user",`dashboard:${D.username.toLowerCase()}`))return D;let Ue=y.store.getActorByExternalId("user",`dashboard:${D.username.toLowerCase()}`),Le=Ue?y.store.getMembershipForActor(y.organization.id,Ue.id):void 0;if(!Le||Le.status!=="active")return{...D,role:"member",sites:{},capabilities:[]};let Ge=y.store.listGrants(Le.id),bt=y.store.resolveAuthorizationTarget(y.organization.id,Le.scope)??y.store.resolveAuthorizationTarget(y.organization.id,{type:"project",id:y.project.id}),z=qt({membership:Le,grants:Ge,target:bt});if(Le.roleTemplate==="owner"||Le.roleTemplate==="admin")return{...D,role:"admin",sites:{},organizationRole:Le.roleTemplate,organizationSource:Le.source,capabilities:z};let Lr=y.environments.get(Fe),hr={};for(let at of y.store.listResources(y.project.id,Lr?.id).filter((pt)=>pt.kind==="application")){let pt=y.store.resolveAuthorizationTarget(y.organization.id,{type:"resource",id:at.id});if(!pt||!P({membership:Le,grants:Ge,capability:"project:read",target:pt}).allowed)continue;hr[at.slug]=P({membership:Le,grants:Ge,capability:"config:write",target:pt}).allowed?"owner":"collaborator"}return{...D,role:"member",sites:hr,organizationRole:Le.roleTemplate,organizationSource:Le.source,capabilities:z}}function it(){gt+=1,ne.clear();for(let D of Je)Bo(D,{recursive:!0,force:!0});Je.clear()}let kt=(D,Fe)=>`${Fe}:${D.role==="admin"?"admin":`member:${Object.entries(D.sites).sort(([Ue],[Le])=>Ue.localeCompare(Le)).map(([Ue,Le])=>`${Ue}=${Le}`).join(",")}`}:${[...D.capabilities??[]].sort().join(",")}`;async function Ut(D,Fe){let Ue=zt(D,Fe),Le=kt(Ue,Fe),Ge=ne.get(Le);if(Ge)return Ge;let bt=Me.get(Le);if(bt)return bt;let z=gt,Lr=(async()=>{let hr=U.get(Fe)??await No(m,Fe);U.set(Fe,hr);let at={...lm(hr,{user:Ue,slug:m.project.slug}),viewer:{role:Ue.role,organizationRole:Ue.organizationRole,organizationSource:Ue.organizationSource,capabilities:Ue.capabilities??[]}},pt=await aT(t,at);if(pt&&z!==gt)return Bo(pt,{recursive:!0,force:!0}),Ee?.uiRoot;if(pt)Je.add(pt);let xr=pt??Ee?.uiRoot;if(xr)ne.set(Le,xr);return xr})();Me.set(Le,Lr);try{return await Lr}finally{Me.delete(Le)}}let dt=await Ut({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!dt)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let K=new WeakMap,ue=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",he=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(he&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Te=!he,mt=$b(t),It=Te?Mb(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,Ne=new Xi(y.store,{encryptionKey:Ze(t)}),ht=new Yi(y.store),ut=new ln(y.store),Ke=new Yo(y.store,{encryptionKey:Ze(t)}),Br=new op(y.store),Mo=new dp(y.store,{cwd:t}),Qn=new ap(y.store,{encryptionKey:Ze(t)}),Mt=new c(y.store,{workerId:`dashboard:${process.pid}`}),Kt=new ga(y.store),oi=new ba(y.store,Ze(t)),Ii=new Ga(y.store),Ec=new os(Kt,Mt,oi),Ei=m.project?.region??"us-east-1",Im=Ze(t),rn=new za(Ii,{encryptionKey:Im,backends:[new Cn(y.store,Im),new Va(new W(Ei),Ei),new qa(new Re(Ei),Ei),new ja]});await Zu(rn,y,m);let kl=new J(Ei),dw={aws_rds:new pa(new ya(kl)),aws_aurora:new ma(new Sa(kl)),aws_elasticache:new fa(new Ia(new st(Ei))),server:new ha(new or),container:new Aa(new or)},Em=(D)=>dw[D.provider],yr=new _a(y.store),oo=new ps(yr,Mt),Rm=new La(oi),lw={managed_database:new $a(Kt,kl),logical_database:new Fa(Kt,oi),volume:new Ua,files:new Ma(t),control_plane:new Qa(y.store,t),infrastructure:new Ha(new lr(Ei))},uw=(D)=>lw[D.resourceKind],pw=(D)=>D.provider==="aws_backup"?void 0:Rm,Il=new jt(y.store),El=[new Ur,new so(d(t,"volumes"))],si=new io(Il,El,Mt),Xs=new Ca(y.store),Yn=new Ea(Xs,[new fn("aws"),new fn("hetzner"),new fn("ssh")],Mt),Ai=new va(y.store),Am=new Ta(Ai,Xs),ao=new wa(y.store),Cm=new Ra(ao,Mt),ai=new Pa(y.store),Rl=new Na(ai,Mt),Pm=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((D)=>new ka(D,y.store,y.project.id,y.organization.id)),_r=new da(y.store),_m=new ua(_r,{queue:Mt}),mr=new Fr(y.store),Ci=new Qr(y.store),Dn=new Et(y.store),ot=new ki(y.store,{encryptionKey:Ze(t)}),gw=()=>sw(y.store);for(let D of y.environments.values())la(_r,m,{organization:y.organization,project:y.project,environment:D,resources:y.store.listResources(y.project.id,D.id)});let On=new Bi(ot,{emailImpl:async(D)=>{let{email:Fe}=await import("./chunk-x7d93rxb.js");return Fe.send(D)}}),Tm=async(D)=>{let Fe=So(ot,y.project.id,D),Ue=[];for(let Le of Fe.filter((Ge)=>Ge.notify&&Ge.alert))Ue.push(...await On.deliverAll(On.enqueue(y.organization.id,Le.alert,Le.transition)));return Ue.push(...await On.deliverAll(On.enqueueRemindersAndEscalations(y.organization.id,ot.listAlerts(y.project.id,{environmentId:D,states:["firing"]})))),Ue.push(...await On.retryDue()),{evaluations:Fe,deliveries:Ue}},Cl=!1,mw=async()=>{if(Cl)return;Cl=!0;try{for(let D of y.environments.values())for(let Fe of ot.listHealthChecks(y.project.id,D.id).filter((Ue)=>Ue.enabled)){let Ue=ot.listHealthResults(Fe.id,1)[0];if(Ue&&Date.now()-new Date(Ue.checkedAt).getTime()<Fe.intervalSeconds*1000)continue;let Le=await new qe(ot).runAndEvaluate(Fe);for(let Ge of Le.evaluations.filter((bt)=>bt.notify&&bt.alert))await On.deliverAll(On.enqueue(y.organization.id,Ge.alert,Ge.transition))}}finally{Cl=!1}},xm=setInterval(()=>{for(let D of y.environments.values())Tm(D.id).catch((Fe)=>console.error("ts-cloud alert evaluation failed:",Fe))},60000);xm.unref?.();let Dm=setInterval(()=>{mw().catch((D)=>console.error("ts-cloud health check evaluation failed:",D))},30000);Dm.unref?.();let Om=setInterval(()=>{try{_m.tick()}catch(D){console.error("ts-cloud scheduled job evaluation failed:",D)}},30000);Om.unref?.();let $m=setInterval(()=>{try{oo.enqueueDue(),oo.enqueueRetention()}catch(D){console.error("ts-cloud backup policy evaluation failed:",D)}},30000);$m.unref?.(),mr.cleanup();let Nm=setInterval(()=>{try{mr.cleanup()}catch(D){console.error("ts-cloud preview cleanup failed:",D)}},3600000);Nm.unref?.();let fw=e.queueWorker??!0,hw=cT(),yw=async(D,Fe)=>{let Le=(D.environmentId?y.store.listEnvironments(D.projectId).find((Ge)=>Ge.id===D.environmentId):void 0)?.slug??String(T);if(Fe.kind==="dashboard_operation"&&Fe.operationId){let Ge=U.get(Le)??j,bt=dm(Fe.operationId,m,Ge);if(!bt||bt.danger||!["scheduler","backup","worker"].includes(bt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let z=await pl(m,Le,bt);return{ok:z.ok,stdout:z.stdout,stderr:z.stderr??z.error,retryable:/temporar|unavailable|timeout|network/i.test(z.stderr??z.error??""),output:{command:z.command??null,operation:z.operation}}}if(Fe.kind==="serverless_scheduler"){let Ge=await vm(m,Le,"run");return{ok:Ge.ok,stdout:Ge.stdout,stderr:Ge.error,retryable:/temporar|unavailable|timeout|network/i.test(Ge.error??""),output:{command:Ge.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Fe.kind}.`}},Rc=fw?new ro(Mt,{...sd({store:y.store,execute:async(D,Fe)=>{let Ue=Fe.operation.input&&typeof Fe.operation.input==="object"&&!Array.isArray(Fe.operation.input)?Fe.operation.input:{},Le=Ue.source&&typeof Ue.source==="object"?Ue.source:void 0,Ge=t,bt,z,Lr;try{if(Le?.bindingId&&Le?.connectionId&&Le?.commitSha){let at=Ke.getBinding(String(Le.bindingId)),pt=Ke.getConnection(String(Le.connectionId));if(!at||!pt||at.connectionId!==pt.id)throw Error("Queued source binding is no longer available");let Rr=(at.repositoryId?Ke.getRepository(at.repositoryId):Ke.listRepositories(pt.id).find((Uo)=>Uo.fullName.toLowerCase()===at.repositoryFullName.toLowerCase()))?.cloneUrl;if(!Rr&&pt.provider==="generic_ssh")Rr=`git@${new URL(pt.host).hostname}:${at.repositoryFullName}.git`;if(!Rr)Rr=new URL(`/${at.repositoryFullName}.git`,pt.host.endsWith("/")?pt.host:`${pt.host}/`).href;let Ce=at.deployKeyId?Ke.getDeployKey(at.deployKeyId):void 0,Yt=Ce&&at.deployKeyId?{...Ce,privateKey:Ke.getDeployPrivateKey(at.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(pt.provider)&&D.target.previewId){let Uo=et(pt,Ke.getCredential(pt.id)),pe=mr.previews.getInstance(D.target.previewId);Lr=async($n,xc)=>{try{await Uo.setCommitStatus(at.repositoryFullName,String(Le.commitSha),{state:$n,url:pe?.url,description:xc})}catch(Ho){Fe.log(`Could not publish source status: ${Ho instanceof Error?Ho.message:String(Ho)}`,{stream:"stderr"})}},await Lr("pending",`Preview deployment started for ${String(Le.commitSha).slice(0,12)}`)}bt=km(Bt(vl(),"ts-cloud-queued-source-")),Fe.log(`Checking out immutable source commit ${Le.commitSha}.`,{stream:"system"}),Ge=(await ea({remote:Rr,binding:at,destination:Bt(bt,"checkout"),ref:String(Le.branch??at.defaultBranch),commitSha:String(Le.commitSha)},{credential:Ke.getCredential(pt.id),deployKey:Yt})).directory}if(Fe.operation.kind!=="preview.destroy"){let at=D.target.previewId?mr.previews.getInstance(D.target.previewId):void 0,pt=at?mr.previews.getDefinition(at.definitionId):void 0,xr=Fe.operation.resourceId?y.store.getResource(Fe.operation.resourceId):void 0;if(z=await rn.resolve({projectId:y.project.id,environmentId:Fe.operation.environmentId,resourceId:Fe.operation.resourceId,functionId:xr?.kind==="function"?xr.id:void 0,previewId:at?.id,trustedPreview:!!at&&!at.fork,allowedPreviewSecrets:pt?.inheritedSecrets}),z.warnings.some((Rr)=>Rr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${z.warnings.filter((Rr)=>Rr.code==="missing_required").map((Rr)=>Rr.key).join(", ")}`);if(Fe.operation.resourceId)for(let Rr of Object.values(z.entries))Ii.setDependency({entryId:Rr.id,resourceId:Fe.operation.resourceId,injectionTarget:"environment",required:Rr.required,requiresRedeploy:!0});Fe.log(`Resolved configuration ${z.configurationHash.slice(0,18)} for ${Object.keys(z.values).length} keys.`,{stream:"system"})}let hr=await wm(D,{cwd:Ge,cliEntry:l,signal:Fe.signal,env:z?.values,onOutput:(at,pt)=>Fe.log(pt,{stream:at,step:"execute",secrets:[...hw,...Object.entries(z?.entries??{}).filter(([,xr])=>xr.kind==="secret").map(([xr])=>z.values[xr]).filter(Boolean)]})});if(hr.ok&&Fe.operation.resourceId&&z)for(let at of Object.values(z.entries))Ii.setDependency({entryId:at.id,resourceId:Fe.operation.resourceId,injectionTarget:"environment",required:at.required,requiresRedeploy:!1,lastDeployedVersion:at.version});return await Lr?.(hr.ok?"success":"failure",hr.ok?`Preview is ready at ${String(Le?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Le?.commitSha).slice(0,12)}`),hr}catch(hr){throw await Lr?.("error",`Preview deployment could not complete at ${String(Le?.commitSha).slice(0,12)}`),hr}finally{if(bt)Bo(bt,{recursive:!0,force:!0})}}}),...Au({store:_r,executor:yw}),...Su({store:Kt,secrets:oi,resolveAdapter:Em}),...Cu(Xs,Yn.drivers),...vu(ao,[new Da("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...Pu({store:ai,cleanup:Pm}),...od(Il,El),...Ku({store:yr,queue:Mt,resolveSource:uw,resolveDestination:pw,validateHealth:async(D,Fe)=>{if(!D.healthCheckId)return{healthy:!0,mode:"adapter"};let Ue=ot.getHealthCheck(D.healthCheckId);if(!Ue||Ue.projectId!==D.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Le=await new qe(ot).runAndEvaluate(Ue);return{healthy:Le.result.status==="healthy",healthCheckId:Ue.id,healthResultId:Le.result.id,target:Fe}}}),...Wl({store:y.store,resolveDriver:e.releaseDriver??((D)=>({name:`${y.store.getResource(D.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:D.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(D,Fe)=>{let Ue=ot.listHealthChecks(Fe.projectId,Fe.environmentId).find((Ge)=>Ge.enabled&&Ge.name===D&&(!Ge.resourceId||Ge.resourceId===Fe.resourceId));if(!Ue)return{healthy:!1,message:`Named health gate ${D} was not found for this release.`};let Le=await new qe(ot).runAndEvaluate(Ue);return{healthy:Le.result.status==="healthy",evidence:{healthCheckId:Ue.id,healthResultId:Le.result.id,status:Le.result.status,timings:Le.result.timings},message:Le.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(D)=>console.error("ts-cloud deployment queue worker failed:",D)}):void 0;if(cu(y),ns(ut,se(y,String(T)),j),It)ls(y,It.users),zb(Ne,y,It.users);let er=Lb({cwd:t,enabled:Te,secret:mt,authentication:Ne,authorization:{store:y.store,organizationId:y.organization.id,projectId:y.project.id,defaultEnvironment:String(T)}}),vr=new ca,jm=setInterval(()=>vr.sweep(),60000);jm.unref?.();let Ac=new bc,Pl=new bc(3,900000,900000),Cc=new bc(8,900000,900000),Bm=setInterval(()=>Ac.prune(),300000),Mm=setInterval(()=>Pl.prune(),300000),Lm=setInterval(()=>Cc.prune(),300000);if(Bm.unref?.(),Mm.unref?.(),Lm.unref?.(),Te){if(It?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${It.generated.username}
     password: ${It.generated.password}
@@ -706,4 +706,4 @@ data: ${JSON.stringify({message:lo instanceof Error?lo.message:String(lo)})}
 data: ${JSON.stringify({cursor:ze,at:new Date().toISOString()})}
 
 `))},5000),ct.unref?.(),D.signal.addEventListener("abort",Ti,{once:!0})},cancel(){if(ft=!0,ct)clearInterval(ct)}});return new Response(Rn,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(z.pathname==="/api/telemetry/series"&&D.method==="GET"){ge(!1);let Pe=Xe(),He=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(ve.aggregation))?ve.aggregation:"avg",_e=X({...ve,kinds:"metric",limit:5000}),ze=A.series({..._e,bucketMs:Number(ve.bucketMs)||60000,aggregation:He,timezone:String(ve.timezone??"UTC"),compareFrom:ve.compareFrom,compareTo:ve.compareTo});return x({ok:!0,collection:{generatedAt:Pe.generatedAt,cached:Pe.cached},query:{aggregation:He,bucketMs:Number(ve.bucketMs)||60000,timezone:String(ve.timezone??"UTC")},series:ze})}if(z.pathname==="/api/telemetry/refresh"&&D.method==="POST")return x({ok:!0,...await ge(!0)});if(z.pathname==="/api/telemetry/export"&&D.method==="POST"){let Pe=await re(D);await ge(!1);let He=A.query({...X(Pe),limit:Math.min(5000,Number(Pe.limit)||5000),cursor:void 0});if((Pe.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:X(Pe),...He},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let ze=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],ct=[ze.join(","),...He.records.map((ft)=>ze.map((_t)=>`"${String(ft[_t]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(ct,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(z.pathname==="/api/telemetry/saved-queries"&&D.method==="GET"){let Pe=We(pe);return x({ok:!0,queries:A.listSavedQueries(y.project.id,Pe.actor?.id)})}if(z.pathname==="/api/telemetry/saved-queries"&&D.method==="POST"){let Pe=await re(D),He=We(pe);return x({ok:!0,query:A.saveQuery(y.project.id,He.actor?.id,String(Pe.name??""),X(Pe.query??Pe))},201)}if(z.pathname==="/api/telemetry/saved-queries"&&D.method==="DELETE"){let Pe=await re(D),He=We(pe),_e=A.deleteSavedQuery(y.project.id,He.actor?.id,String(Pe.id??""));return x({ok:_e},_e?200:404)}}if(z.pathname.startsWith("/api/configuration")){let I=y.environments.get(Ce),A=pe.role==="admin"||!!$n.capabilities?.includes("secrets:read"),M=pe.role==="admin"||!!$n.capabilities?.includes("secrets:write"),F={projectId:y.project.id,environmentId:I?.id},V={"cache-control":"no-store"};if(z.pathname==="/api/configuration"&&D.method==="GET"){let G=Object.fromEntries(z.searchParams),H=G.scopeType||G.scopeId?Js(G,F):void 0,X=["variable","secret"].includes(String(G.kind))?G.kind:void 0,ve=H?.type==="preview"?mr.previews.getInstance(H.id):void 0,ge=ve?mr.previews.getDefinition(ve.definitionId):void 0,Xe=H?await rn.resolve({projectId:y.project.id,environmentId:H.environmentId,resourceId:H.resourceId,functionId:H.type==="function"?H.id:void 0,previewId:H.previewId,trustedPreview:!!ve&&!ve.fork,allowedPreviewSecrets:ge?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:A}):void 0,Pe=y.store.listResources(y.project.id);return x({ok:!0,entries:rn.list({projectId:y.project.id,scope:H,kind:X,search:G.search,canReadSecretMetadata:A}),effectiveEntries:Xe?Object.values(Xe.entries).filter((He)=>!X||He.kind===X).filter((He)=>!G.search||He.key.toLowerCase().includes(String(G.search).toLowerCase())):[],configurationHash:Xe?.configurationHash,warnings:Xe?.warnings??[],scopes:{project:y.project,environments:y.store.listEnvironments(y.project.id),resources:Pe.filter((He)=>He.kind!=="function"),functions:Pe.filter((He)=>He.kind==="function"),previews:mr.previews.listInstances({projectId:y.project.id}).filter((He)=>He.status!=="destroyed").map((He)=>({id:He.id,name:He.name,environmentId:He.baseEnvironmentId,resourceId:He.resourceId,fork:He.fork,status:He.status}))}},200,V)}if(z.pathname==="/api/configuration/export"&&D.method==="GET"){let G=Js(Object.fromEntries(z.searchParams),F);return new Response(rn.exportVariables({projectId:y.project.id,scope:G}),{headers:{...V,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(z.pathname==="/api/configuration/plan"&&D.method==="POST"){let G=await re(D),H=Js(G,F),X=G.values&&typeof G.values==="object"&&!Array.isArray(G.values)?Object.fromEntries(Object.entries(G.values).map(([ve,ge])=>[ve,String(ge)])):{};return x({ok:!0,plan:rn.plan({projectId:y.project.id,scope:H,values:X,removeMissing:G.removeMissing===!0})},200,V)}if(z.pathname==="/api/configuration"&&D.method==="POST"){let G=await re(D),H=Js(G,F),X=G.kind==="secret"?"secret":"variable",ve=String(G.key??"");if(X==="secret"&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);try{let ge=await rn.set({organizationId:y.organization.id,projectId:y.project.id,scope:H,key:ve,kind:X,value:G.value==null?void 0:String(G.value),reference:G.reference==null?void 0:String(G.reference),backend:G.backend,required:G.required===!0,expectedVersion:G.expectedVersion==null?void 0:Number(G.expectedVersion),confirmed:String(G.confirm??"")===ve,idempotencyKey:D.headers.get("idempotency-key")??G.idempotencyKey,actorId:We(pe).actor?.id});return x({ok:!0,entry:rn.list({projectId:y.project.id,scope:H,canReadSecretMetadata:A}).find((Xe)=>Xe.id===ge.entry.id),mutation:ge.mutation,warnings:ge.warnings},ge.mutation.added.length?201:200,V)}catch(ge){return x({ok:!1,error:ge instanceof Error?ge.message:String(ge)},409,V)}}if(z.pathname==="/api/configuration/import"&&D.method==="POST"){let G=await re(D),H=Js(G,F),X=Array.isArray(G.secretKeys)?G.secretKeys.map(String):[];if(X.length&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);try{let ve=await rn.importDotenv({organizationId:y.organization.id,projectId:y.project.id,scope:H,source:String(G.source??""),secretKeys:X,backend:G.backend,confirmed:G.confirm==="import",idempotencyKey:D.headers.get("idempotency-key")??G.idempotencyKey,actorId:We(pe).actor?.id});return x({ok:ve.document.valid,diagnostics:ve.document.diagnostics,mutation:ve.mutation,warnings:ve.warnings},ve.document.valid?200:422,V)}catch(ve){return x({ok:!1,error:ve instanceof Error?ve.message:String(ve)},409,V)}}if(z.pathname==="/api/configuration/dependencies"&&D.method==="POST"){let G=await re(D),H=Ii.get(String(G.entryId??"")),X=y.store.getResource(String(G.resourceId??""));if(!H||H.projectId!==y.project.id||!X||X.projectId!==y.project.id)return x({ok:!1,error:"Configuration entry or dependent resource was not found."},404,V);return x({ok:!0,dependency:Ii.setDependency({entryId:H.id,resourceId:X.id,injectionTarget:["native_reference","file"].includes(String(G.injectionTarget))?G.injectionTarget:"environment",required:G.required!==!1,requiresRedeploy:G.requiresRedeploy!==!1,lastDeployedVersion:G.lastDeployedVersion==null?void 0:Number(G.lastDeployedVersion)})},200,V)}if(z.pathname==="/api/configuration/transfer"&&D.method==="POST"){let G=await re(D),H=Ii.get(String(G.id??"")),X=Js({...G,scopeType:G.targetScopeType,scopeId:G.targetScopeId},F);if(!H||H.projectId!==y.project.id)return x({ok:!1,error:"Configuration entry was not found."},404,V);if(H.kind==="secret"&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);try{let ve=await rn.transfer({entryId:H.id,targetScope:X,mode:G.mode==="move"?"move":"copy",confirmed:G.confirm===H.key,actorId:We(pe).actor?.id,idempotencyKey:D.headers.get("idempotency-key")??G.idempotencyKey});return x({ok:!0,entry:rn.list({projectId:y.project.id,scope:X,canReadSecretMetadata:A}).find((ge)=>ge.id===ve.entry.id),mutation:ve.mutation},200,V)}catch(ve){return x({ok:!1,error:ve instanceof Error?ve.message:String(ve)},409,V)}}if(z.pathname==="/api/configuration/bulk"&&D.method==="POST"){let G=await re(D),H=Array.isArray(G.ids)?G.ids.map(String).slice(0,500):[],X=H.map((ge)=>Ii.get(ge)).filter((ge)=>!!ge&&ge.projectId===y.project.id);if(X.length!==H.length)return x({ok:!1,error:"One or more configuration entries were not found."},404,V);if(X.some((ge)=>ge.kind==="secret")&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);if(G.action!=="delete"||G.confirm!=="bulk")return x({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,V);let ve=[];try{for(let ge of X)ve.push(await rn.remove({entryId:ge.id,expectedVersion:ge.version,confirmed:!0,actorId:We(pe).actor?.id}));return x({ok:!0,removed:ve.flatMap((ge)=>ge.removed),affectedResourceIds:[...new Set(ve.flatMap((ge)=>ge.affectedResourceIds))].sort()},200,V)}catch(ge){return x({ok:!1,error:ge instanceof Error?ge.message:String(ge),partial:ve.flatMap((Xe)=>Xe.removed)},409,V)}}if(z.pathname==="/api/configuration/reveal"&&D.method==="POST"){let G=await re(D),H=er.resolveSession(D);try{return x({ok:!0,value:await rn.reveal({entryId:String(G.id??""),canRevealSecrets:A,recentlyAuthenticated:!Te||!!H&&Ne.isRecentlyAuthenticated(H),actorId:We(pe).actor?.id})},200,V)}catch(X){return x({ok:!1,error:X instanceof Error?X.message:String(X)},403,V)}}if(z.pathname==="/api/configuration"&&D.method==="DELETE"){let G=await re(D),H=Ii.get(String(G.id??""));if(H?.kind==="secret"&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);if(!H||H.projectId!==y.project.id)return x({ok:!1,error:"Configuration entry was not found."},404,V);try{return x({ok:!0,mutation:await rn.remove({entryId:H.id,expectedVersion:Number(G.expectedVersion),confirmed:String(G.confirm??"")===H.key,actorId:We(pe).actor?.id})},200,V)}catch(X){return x({ok:!1,error:X instanceof Error?X.message:String(X)},409,V)}}}if(z.pathname.startsWith("/api/fleet")){let I=We(pe).actor?.id,A=(M,F=409)=>x({ok:!1,error:M instanceof Error?M.message:String(M)},F,{"cache-control":"no-store"});if(z.pathname==="/api/fleet"&&D.method==="GET")return x({ok:!0,servers:Xs.list(y.project.id),resources:y.store.listResources(y.project.id),operations:Mt.list({projectId:y.project.id,limit:200}).filter((M)=>M.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(z.pathname==="/api/fleet"&&D.method==="POST"){let M=await re(D);try{return x({ok:!0,server:Yn.enroll({organizationId:y.organization.id,projectId:y.project.id,name:String(M.name??""),provider:["aws","hetzner"].includes(String(M.provider))?M.provider:"ssh",providerId:M.providerId?String(M.providerId):void 0,region:M.region?String(M.region):void 0,zone:M.zone?String(M.zone):void 0,endpoint:String(M.endpoint??""),sshUser:String(M.sshUser??"deploy"),sshPort:M.sshPort?Number(M.sshPort):22,credentialRef:String(M.credentialRef??""),roles:Array.isArray(M.roles)?M.roles:[],labels:M.labels&&typeof M.labels==="object"?M.labels:{}})},201)}catch(F){return A(F,422)}}if(z.pathname==="/api/fleet/action"&&D.method==="POST"){let M=await re(D),F=String(M.id??""),V=String(M.action??"");try{if(V==="test")return x({ok:!0,server:await Yn.test(F)});if(V==="validate")return x({ok:!0,server:await Yn.validate(F)});if(V==="review_host_key")return x({ok:!0,server:Yn.reviewHostKey(F,String(M.fingerprint??""))});if(V==="bootstrap")return x({ok:!0,...Yn.bootstrap(F,M.confirmed===!0)},M.confirmed===!0?202:200);if(V==="heartbeat")return x({ok:!0,server:Yn.heartbeat(F,{usage:M.usage&&typeof M.usage==="object"?M.usage:{}})});if(V==="drain")return x({ok:!0,server:Yn.drain(F,M.completed===!0)});if(V==="uncordon")return x({ok:!0,server:Yn.uncordon(F)});if(V==="archive")return x({ok:!0,server:Yn.archive(F,String(M.confirmation??""))});return A("Unsupported fleet action.",422)}catch(G){return A(G)}}}if(z.pathname.startsWith("/api/capacity")){let I=(A,M=409)=>x({ok:!1,error:A instanceof Error?A.message:String(A)},M,{"cache-control":"no-store"});if(z.pathname==="/api/capacity"&&D.method==="GET")return x({ok:!0,pools:Ai.listPools(y.project.id),placements:Ai.listPlacements(y.project.id),servers:Xs.list(y.project.id)},200,{"cache-control":"no-store"});if(z.pathname==="/api/capacity"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,pool:Ai.createPool({organizationId:y.organization.id,projectId:y.project.id,name:String(A.name??""),purpose:String(A.purpose??"application"),backend:String(A.backend??"server"),region:A.region?String(A.region):void 0,architecture:A.architecture?String(A.architecture):void 0,labels:A.labels&&typeof A.labels==="object"?A.labels:{},requiredServerLabels:A.requiredServerLabels&&typeof A.requiredServerLabels==="object"?A.requiredServerLabels:{},toleratedTaints:Array.isArray(A.toleratedTaints)?A.toleratedTaints.map(String):[],capacity:A.capacity&&typeof A.capacity==="object"?A.capacity:{},maxWorkloads:Number(A.maxWorkloads??10),costWeight:Number(A.costWeight??1),spreadKey:A.spreadKey?String(A.spreadKey):void 0,concurrency:Number(A.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(M){return I(M,422)}}if(z.pathname==="/api/capacity/member"&&D.method==="POST"){let A=await re(D);try{return Ai.addMember(String(A.poolId??""),String(A.serverId??"")),x({ok:!0,pool:Ai.getPool(String(A.poolId??""))})}catch(M){return I(M,422)}}if(z.pathname==="/api/capacity/explain"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,decisions:Am.explain(y.project.id,{purpose:String(A.purpose??"application"),resources:A.resources&&typeof A.resources==="object"?A.resources:{},region:A.region?String(A.region):void 0,architecture:A.architecture?String(A.architecture):void 0,labels:A.labels&&typeof A.labels==="object"?A.labels:{}})})}catch(M){return I(M,422)}}if(z.pathname==="/api/capacity/action"&&D.method==="POST"){let A=await re(D);try{if(A.action==="drain")return x({ok:!0,...Am.drainPool(String(A.poolId??""))});if(A.action==="enable")return x({ok:!0,pool:Ai.updatePool(String(A.poolId??""),{status:"active"})});if(A.action==="disable")return x({ok:!0,pool:Ai.updatePool(String(A.poolId??""),{status:"disabled"})});return I("Unsupported capacity action.",422)}catch(M){return I(M,422)}}}if(z.pathname.startsWith("/api/regions")){let I=(A,M=409)=>x({ok:!1,error:A instanceof Error?A.message:String(A)},M,{"cache-control":"no-store"});if(z.pathname==="/api/regions"&&D.method==="GET")return x({ok:!0,topologies:ao.list(y.project.id).map((A)=>({topology:A,targets:ao.targets(A.id),channels:ao.channels(A.id),route:ao.route(A.id),executions:ao.executions(A.id)}))},200,{"cache-control":"no-store"});if(z.pathname==="/api/regions"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,topology:Cm.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:y.environments.get(Ce)?.id,name:String(A.name??""),hostname:String(A.hostname??""),regions:Array.isArray(A.regions)?A.regions:[],trafficPolicy:A.trafficPolicy==="weighted"||A.trafficPolicy==="latency"?A.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(A.replicate)?A.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(A.maxLagSeconds??30),retainOnDestroy:A.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:A.cdnEnabled===!0,wafEnabled:A.wafEnabled===!0})},201)}catch(M){return I(M,422)}}if(z.pathname==="/api/regions/action"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,...Cm.enqueue({topologyId:String(A.topologyId??""),kind:String(A.action??""),targetRegion:A.targetRegion?String(A.targetRegion):void 0,revision:A.revision?String(A.revision):void 0,manifest:A.manifest&&typeof A.manifest==="object"?A.manifest:{},confirmation:A.confirmation?String(A.confirmation):void 0,deleteData:A.deleteData===!0})},202)}catch(M){return I(M,422)}}}if(z.pathname.startsWith("/api/maintenance")){let I=(A,M=409)=>x({ok:!1,error:A instanceof Error?A.message:String(A)},M,{"cache-control":"no-store"});if(z.pathname==="/api/maintenance"&&D.method==="GET")return x({ok:!0,manifests:ai.manifests(y.organization.id),windows:ai.windows(y.project.id),campaigns:ai.campaigns(y.project.id).map((A)=>({campaign:A,targets:ai.targets(A.id)})),cleanups:ai.cleanups(y.project.id),drills:ai.drills(y.project.id)},200,{"cache-control":"no-store"});if(z.pathname==="/api/maintenance/cleanup-preview"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,plan:await Rl.previewCleanup({projectId:y.project.id,kind:String(A.kind??"operations"),criteria:{olderThanDays:Number(A.olderThanDays??30)}},Pm)},201)}catch(M){return I(M,422)}}if(z.pathname==="/api/maintenance/cleanup-apply"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,...Rl.enqueueCleanup(String(A.planId??""),String(A.confirmation??""))},202)}catch(M){return I(M,422)}}if(z.pathname==="/api/maintenance/drill"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,drill:ai.createDrill({projectId:y.project.id,scenario:String(A.scenario??"control_plane"),isolatedTarget:String(A.isolatedTarget??""),expectedRpoMinutes:Number(A.expectedRpoMinutes??60),expectedRtoMinutes:Number(A.expectedRtoMinutes??30),recoveryPointId:A.recoveryPointId?String(A.recoveryPointId):void 0,topologyId:A.topologyId?String(A.topologyId):void 0})},201)}catch(M){return I(M,422)}}if(z.pathname==="/api/maintenance/drill-run"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,...Rl.enqueueDrill(String(A.drillId??""))},202)}catch(M){return I(M,422)}}}if(z.pathname.startsWith("/api/volumes")){let I=y.environments.get(Ce),A=We(pe).actor?.id,M=(F,V=409)=>x({ok:!1,error:F instanceof Error?F.message:String(F)},V,{"cache-control":"no-store"});if(z.pathname==="/api/volumes"&&D.method==="GET"){let F=Il.inventory(y.project.id,I?.id),V=y.store.listResources(y.project.id,I?.id).map((G)=>({id:G.id,name:G.name,slug:G.slug,kind:G.kind,provider:G.provider,providerId:G.providerId}));return x({ok:!0,volumes:F,resources:V,operations:Mt.list({projectId:y.project.id,limit:100}).filter((G)=>G.operation.kind.startsWith("volume.")),recoveryPoints:yr.listRecoveryPoints(y.project.id).filter((G)=>G.kind==="volume"),providers:El.map((G)=>({provider:G.provider,type:G.type,capabilities:G.capabilities()}))},200,{"cache-control":"no-store"})}if(z.pathname==="/api/volumes"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:I?.id,resourceId:F.resourceId?String(F.resourceId):void 0,name:String(F.name??""),provider:String(F.provider??"docker"),type:F.type==="docker"?"docker":F.type,capacityBytes:F.capacityBytes==null?void 0:Number(F.capacityBytes),filesystem:F.filesystem?String(F.filesystem):void 0,encrypted:F.encrypted===!0,desiredState:F.desiredState&&typeof F.desiredState==="object"?F.desiredState:{},actorId:A})},202,{"cache-control":"no-store"})}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/attach"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.attach(String(F.volumeId??""),{resourceId:String(F.resourceId??""),targetPath:String(F.targetPath??""),readOnly:F.readOnly===!0,uid:F.uid==null?void 0:Number(F.uid),gid:F.gid==null?void 0:Number(F.gid),mode:F.mode?String(F.mode):void 0,propagation:F.propagation,driverOptions:F.driverOptions&&typeof F.driverOptions==="object"?F.driverOptions:{},actorId:A})},202)}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/detach"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.detach(String(F.volumeId??""),String(F.attachmentId??""),{force:F.force===!0,drained:F.drained===!0,unmounted:F.unmounted===!0,confirmation:F.confirmation?String(F.confirmation):void 0,actorId:A})},202)}catch(V){return M(V)}}if(z.pathname==="/api/volumes/resize"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.resize(String(F.volumeId??""),Number(F.capacityBytes),{drained:F.drained===!0,actorId:A})},202)}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/snapshot"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.snapshot(String(F.volumeId??""),{name:F.name?String(F.name):void 0,actorId:A})},202)}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/restore"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.restore(String(F.snapshotId??""),{name:String(F.name??""),actorId:A})},202)}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/discover"&&D.method==="POST")try{return x({ok:!0,volumes:await si.discover({organizationId:y.organization.id,projectId:y.project.id,environmentId:I?.id,actorId:A})})}catch(F){return M(F,502)}if(z.pathname==="/api/volumes/adopt"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,volume:si.adopt(String(F.volumeId??""),{name:String(F.name??""),actorId:A})})}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes"&&D.method==="DELETE"){let F=await re(D),V=er.resolveSession(D);try{return x({ok:!0,...si.delete(String(F.volumeId??""),{recentAuthAt:!Te||V&&Ne.isRecentlyAuthenticated(V)?new Date().toISOString():void 0,confirmation:F.confirmation?String(F.confirmation):void 0,backupOverride:F.backupOverride===!0,backupOverrideConfirmation:F.backupOverrideConfirmation?String(F.backupOverrideConfirmation):void 0,actorId:A})},202)}catch(G){return M(G)}}}if(z.pathname==="/api/backups"&&D.method==="GET"){let I=y.environments.get(Ce),A=yr.listPolicies(y.project.id,I?.id),M=new Set(A.map((X)=>X.id)),F=yr.listRecoveryPoints(y.project.id).filter((X)=>!X.policyId||M.has(X.policyId)),V=yr.listJobs(y.project.id).filter((X)=>!X.policyId||M.has(X.policyId)),G=(X)=>({...X,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!X.credentialRef,clientEncryptionConfigured:!!X.encryptionKeyRef}),H=await Promise.all(yr.listDestinations(y.project.id).map(async(X)=>({...G(X),credentialStatus:await zu(X,oi)})));return x({ok:!0,destinations:H,policies:A,recoveryPoints:F,jobs:V,coverage:yr.coverage(y.project.id).filter((X)=>M.has(X.policy.id)),resources:I?y.store.listResources(y.project.id,I.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind})):[]})}if(z.pathname==="/api/backups/destinations"&&D.method==="POST"){let I=await re(D),A=String(I.name??"").trim(),M=String(I.provider??""),F=String(I.encryption??"provider"),V=`secret://data-services/backups/${y.project.id}/${A}`,G=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(M))return x({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(F))return x({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let H,X;if(I.credentials&&typeof I.credentials==="object"&&!Array.isArray(I.credentials))H=`${V}/credentials`,await oi.put(H,JSON.stringify(I.credentials)),G.push(H);if(F!=="provider"){let ge=String(I.encryptionKey??"");if(ge.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");X=`${V}/encryption-key`,await oi.put(X,ge),G.push(X)}let ve=yr.createDestination({organizationId:y.organization.id,projectId:y.project.id,name:A,provider:M,endpoint:I.endpoint?String(I.endpoint):void 0,endpointPolicy:I.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:I.bucket?String(I.bucket):void 0,prefix:String(I.prefix??""),region:I.region?String(I.region):Ei,forcePathStyle:I.forcePathStyle===!0,credentialRef:H,encryption:F,encryptionKeyRef:X,immutability:I.immutability&&typeof I.immutability==="object"&&!Array.isArray(I.immutability)?I.immutability:{},status:"untested"});return x({ok:!0,destination:{...ve,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!H,clientEncryptionConfigured:!!X}},201)}catch(H){for(let X of G)await oi.remove(X).catch(()=>{});return x({ok:!1,error:H instanceof Error?H.message:String(H)},422)}}if(z.pathname==="/api/backups/destinations/test"&&D.method==="POST"){let I=await re(D),A=yr.getDestination(String(I.id??""));if(!A||A.projectId!==y.project.id)return x({ok:!1,error:"Backup destination was not found."},404);if(A.provider==="aws_backup")return x({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Rm.test(A),x({ok:!0,destination:yr.recordDestinationTest(A.id,{ok:!0})})}catch(M){let F=M instanceof Error?M.message:String(M);return yr.recordDestinationTest(A.id,{ok:!1,error:F}),x({ok:!1,error:F},502)}}if(z.pathname==="/api/backups/policies"&&D.method==="POST"){let I=await re(D),A=y.environments.get(Ce),M=yr.getDestination(String(I.destinationId??"")),F=String(I.resourceKind??""),V=I.dataServiceId?String(I.dataServiceId):void 0,G=V?Kt.get(V):void 0,H=I.resourceId?String(I.resourceId):void 0,X=H?y.store.getResource(H):void 0;if(!A)return x({ok:!1,error:"Environment was not found."},404);if(!M||M.projectId!==y.project.id)return x({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(F))return x({ok:!1,error:"A supported backup resource kind is required."},422);if(V&&(!G||G.projectId!==y.project.id||G.environmentId!==A.id))return x({ok:!1,error:"Data service was not found in this environment."},404);if(H&&(!X||X.projectId!==y.project.id||X.environmentId!==A.id))return x({ok:!1,error:"Resource was not found in this environment."},404);if(F==="managed_database"&&!G)return x({ok:!1,error:"Managed database policies require a data service."},422);if(F==="logical_database"&&(!G||!["container","server"].includes(G.provider)))return x({ok:!1,error:"Logical database policies require an on-box data service."},422);if(F==="volume"&&(!X||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(I.volumeName??""))))return x({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let ve=Array.isArray(I.includePatterns)?I.includePatterns.map(String).filter(Boolean):[];if(F==="files"&&(!X||!ve.length))return x({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(F==="control_plane"&&M.encryption==="provider")return x({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(F==="infrastructure"&&(M.provider!=="aws_backup"||!ve.some((ge)=>ge.startsWith("resource:arn:"))||!ve.some((ge)=>ge.startsWith("role:arn:"))))return x({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let ge=yr.createPolicy({organizationId:y.organization.id,projectId:y.project.id,environmentId:A.id,resourceId:H,dataServiceId:V,destinationId:M.id,name:String(I.name??"").trim(),resourceKind:F,schedule:String(I.schedule??"daily"),timezone:String(I.timezone??"UTC"),retention:I.retention&&typeof I.retention==="object"&&!Array.isArray(I.retention)?I.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(I.compression))?I.compression:"gzip",encryption:["destination","client_side","both"].includes(String(I.encryption))?I.encryption:"destination",includePatterns:F==="volume"?[String(I.volumeName),...ve]:ve,excludePatterns:Array.isArray(I.excludePatterns)?I.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(I.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(I.expectedRtoMinutes)||120),healthCheckId:I.healthCheckId?String(I.healthCheckId):void 0,enabled:I.enabled!==!1});return x({ok:!0,policy:ge},201)}catch(ge){return x({ok:!1,error:ge instanceof Error?ge.message:String(ge)},422)}}if(z.pathname==="/api/backups/run"&&D.method==="POST"){let I=await re(D),A=yr.getPolicy(String(I.policyId??"")),M=y.environments.get(Ce);if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Backup policy was not found in this environment."},404);try{let F=oo.enqueueBackup(A,new Date().toISOString(),We(pe).actor?.id);return x({ok:!0,job:F},202)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:String(F)},409)}}if(z.pathname==="/api/backups/verify"&&D.method==="POST"){let I=await re(D),A=yr.getRecoveryPoint(String(I.recoveryPointId??""));if(!A||A.projectId!==y.project.id)return x({ok:!1,error:"Recovery point was not found."},404);return x({ok:!0,job:oo.enqueueVerification(A)},202)}if(z.pathname==="/api/backups/restore"&&D.method==="POST"){let I=await re(D),A=yr.getRecoveryPoint(String(I.recoveryPointId??"")),M=I.mode==="in_place"?"in_place":"isolated",F=I.target&&typeof I.target==="object"&&!Array.isArray(I.target)?{...I.target,inPlace:M==="in_place"}:{inPlace:M==="in_place"},V=er.resolveSession(D),G={mode:M,target:F,targetName:String(I.targetName??""),confirm:I.confirm?String(I.confirm):void 0,recentAuth:!Te||!!V&&Ne.isRecentlyAuthenticated(V),downtimeAcknowledged:I.downtimeAcknowledged===!0,safetyBackupId:I.safetyBackupId?String(I.safetyBackupId):void 0};if(!A||A.projectId!==y.project.id)return x({ok:!1,error:"Recovery point was not found."},404);if(I.drill===!0&&M!=="isolated")return x({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let H=oo.planRestore(A,G);if(I.execute!==!0)return x({ok:!0,plan:H,executionCreated:!1});let X=oo.enqueueRestore(A,{...G,drill:I.drill===!0,actorId:We(pe).actor?.id});return x({ok:!0,plan:H,job:X},202)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:String(H)},409)}}if(z.pathname==="/api/backups/recovery-points"&&D.method==="POST"){let I=await re(D),A=yr.getRecoveryPoint(String(I.id??""));if(!A||A.projectId!==y.project.id)return x({ok:!1,error:"Recovery point was not found."},404);if(I.held==null&&I.pinned==null)return x({ok:!1,error:"held or pinned must be provided."},422);return x({ok:!0,recoveryPoint:yr.updateRecoveryPoint(A.id,{held:I.held==null?A.held:I.held===!0,pinned:I.pinned==null?A.pinned:I.pinned===!0})})}if(z.pathname==="/api/backups/retention"&&D.method==="POST")return x({ok:!0,jobs:oo.enqueueRetention()},202);if(z.pathname==="/api/data-services/capabilities"&&D.method==="GET"){let I=String(z.searchParams.get("engine")??""),A=String(z.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(I)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(A))return x({ok:!1,error:"A supported engine and provider are required."},422);return x({ok:!0,engine:I,provider:A,capabilities:mn(I,A)})}if(z.pathname==="/api/data-services"&&D.method==="GET"){let I=y.environments.get(Ce),A=Kt.list(y.project.id,I?.id).map((M)=>{let F=Kt.credential(M.id);return{...M,credentialRef:void 0,credential:F?{configured:!0,username:F.username,version:F.version,rotatedAt:F.rotatedAt}:void 0,dependencies:Kt.dependencies(M.id).map((V)=>({resourceId:V.resourceId,requiresRedeploy:V.requiresRedeploy}))}});return x({ok:!0,services:A})}if(z.pathname==="/api/data-services/preview"&&D.method==="POST"){let I=await re(D);if(I.id){let F=Kt.get(String(I.id)),V=y.environments.get(Ce),G=String(I.action??"");if(!F||F.projectId!==y.project.id||F.environmentId!==V?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!hl.includes(G))return x({ok:!1,error:`Action must be one of: ${hl.join(", ")}.`},422);try{return x({ok:!0,plan:Ec.plan(F,G,I.changes??{})})}catch(H){return x({ok:!1,error:H instanceof Error?H.message:String(H)},422)}}let A=String(I.engine??""),M=String(I.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(A)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(M))return x({ok:!1,error:"A supported engine and provider are required."},422);return x({ok:!0,capabilities:mn(A,M),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(z.pathname==="/api/data-services"&&D.method==="POST"){let I=await re(D),A=String(I.engine??""),M=String(I.provider??""),F=y.environments.get(Ce),V=We(pe);if(!F)return x({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(A)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(M))return x({ok:!1,error:"A supported engine and provider are required."},422);let G={organizationId:y.organization.id,projectId:y.project.id,environmentId:F.id,resourceId:I.resourceId?String(I.resourceId):void 0,name:String(I.name??"").trim(),engine:A,provider:M,placement:String(I.placement??I.name??"").trim(),engineVersion:I.engineVersion?String(I.engineVersion):void 0,plan:String(I.plan??(M==="aws_elasticache"?"cache.t4g.micro":M==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:I.storageGb==null?void 0:Number(I.storageGb),highAvailability:I.highAvailability===!0,publicExposure:I.publicExposure===!0,allowedCidrs:Array.isArray(I.allowedCidrs)?I.allowedCidrs.map(String):[],desiredState:I.desiredState&&typeof I.desiredState==="object"&&!Array.isArray(I.desiredState)?I.desiredState:{},observedState:{},origin:I.adopt===!0?"adopted":"managed",managementEnabled:I.adopt!==!0,ownerActorId:V.actor?.id,username:I.username?String(I.username):void 0};try{if(I.adopt===!0){let X=Kt.create({...G,status:"adopted",credentialRef:void 0});return x({ok:!0,service:X,readOnly:!0},201)}if(!Em({provider:M,engine:A}))return x({ok:!1,error:`No ${M}/${A} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let H=await Ec.create(G);return x({ok:!0,service:H.service,operationId:H.operationId,oneTimeCredential:H.credential},201)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:String(H)},422)}}if(z.pathname==="/api/data-services/connections"&&D.method==="GET"){let I=Kt.get(String(z.searchParams.get("id")??"")),A=y.environments.get(Ce);if(!I||I.projectId!==y.project.id||I.environmentId!==A?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);let M=typeof I.observedState.endpoint==="string"?I.observedState.endpoint:void 0,F=typeof I.observedState.readerEndpoint==="string"?I.observedState.readerEndpoint:void 0,V=Number(I.observedState.port)||(I.engine==="postgres"?5432:I.engine==="redis"?6379:I.engine==="mongodb"?27017:I.engine==="libsql"?8080:3306),G=typeof I.observedState.database==="string"?I.observedState.database:void 0,H=typeof I.observedState.tls==="boolean"?I.observedState.tls:I.provider.startsWith("aws_"),X=[...M?[{type:I.publicExposure?"external":"internal",host:M,port:V,database:G,tls:H}]:[],...F?[{type:"internal",host:F,port:V,database:G,tls:H}]:[],{type:"tunnel",host:M??I.placement,port:V,database:G,tls:H}];return x({ok:!0,serviceId:I.id,guidance:yu(I,X)})}if(z.pathname==="/api/data-services/action"&&D.method==="POST"){let I=await re(D),A=Kt.get(String(I.id??"")),M=y.environments.get(Ce),F=String(I.action??"");if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!hl.includes(F))return x({ok:!1,error:`Action must be one of: ${hl.join(", ")}.`},422);let V=I.changes&&typeof I.changes==="object"&&!Array.isArray(I.changes)?I.changes:{};try{let G=Ec.plan(A,F,V);if(I.execute!==!0)return x({ok:!0,plan:G,productionExecutionCreated:!1});let H=Ec.enqueue(A,F,V,We(pe).actor?.id);return x({ok:!0,plan:G,operationId:H},202)}catch(G){return x({ok:!1,error:G instanceof Error?G.message:String(G)},409)}}if(z.pathname==="/api/data-services/dependencies"&&D.method==="POST"){let I=await re(D),A=Kt.get(String(I.id??"")),M=y.environments.get(Ce),F=y.store.getResource(String(I.resourceId??""));if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!F||F.projectId!==y.project.id||F.environmentId!==M?.id)return x({ok:!1,error:"Dependent resource was not found in this environment."},404);if(I.remove===!0)return x({ok:Kt.removeDependency(A.id,F.id)});return Kt.addDependency({serviceId:A.id,resourceId:F.id,secretRef:A.credentialRef??`secret://data-services/${A.projectId}/${A.name}`,requiresRedeploy:I.requiresRedeploy!==!1}),x({ok:!0,dependencies:Kt.dependencies(A.id).map((V)=>({resourceId:V.resourceId,requiresRedeploy:V.requiresRedeploy}))})}if(z.pathname==="/api/data-services/management"&&D.method==="POST"){let I=await re(D),A=Kt.get(String(I.id??"")),M=y.environments.get(Ce);if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(A.origin!=="adopted"||I.reviewed!==!0||I.confirm!==A.name)return x({ok:!1,error:`Enabling management requires reviewed=true and typing ${A.name}.`},409);return x({ok:!0,service:Kt.update(A.id,A.version,{managementEnabled:!0})})}if(z.pathname==="/api/data-services/reveal"&&D.method==="POST"){let I=await re(D),A=Kt.get(String(I.id??"")),M=y.environments.get(Ce),F=A?Kt.credential(A.id):void 0;if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!F)return x({ok:!1,error:"No managed credential is configured."},404);return x({ok:!0,credential:{username:F.username,password:await oi.resolve(F.secretRef),version:F.version}},200,{"cache-control":"no-store"})}if(z.pathname==="/api/databases"&&D.method==="GET")return x(await yb(m,Ce));if(z.pathname==="/api/databases"&&D.method==="POST"){let I=await re(D),A=String(I.name??"").trim();if(!Si(A))return x({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return x({...await vb(m,Ce,A),name:A})}if(z.pathname==="/api/databases/vitess"&&D.method==="GET"){let I=await kb(m,Ce);return x({...I,unhealthy:Ib(I.tablets),missingPrimary:Eb(I)})}if(z.pathname==="/api/databases/vitess/provision"&&D.method==="POST"){let I=await re(D);try{return x(await Ob(m,Ce,{keyspace:String(I.keyspace??""),username:String(I.username??""),password:String(I.password??""),sharded:I.sharded===!0,confirm:String(I.confirm??"")}))}catch(A){return x({ok:!1,error:A instanceof Error?A.message:String(A)},422)}}if(z.pathname==="/api/databases/vitess/migrations"&&D.method==="GET"){let I=z.searchParams.get("keyspace")??void 0;return x(await xb(m,Ce,I))}if(z.pathname==="/api/databases/vitess/migrations/action"&&D.method==="POST"){let I=await re(D),A=String(I.uuid??"").trim(),M=String(I.action??"");if(!["retry","cancel","cleanup","complete"].includes(M))return x({ok:!1,error:"Unknown migration action."},422);return x(await Db(m,Ce,A,M))}if(z.pathname==="/api/databases/vitess/keyspaces"&&D.method==="POST"){let I=await re(D),A=String(I.name??"").trim(),M=I.sharded===!0;return x(await Pb(m,Ce,A,{sharded:M}))}if(z.pathname==="/api/databases/vitess/vschema"&&D.method==="POST"){let I=await re(D),A=String(I.keyspace??"").trim(),M=typeof I.vschema==="string"?I.vschema:JSON.stringify(I.vschema??null);return x(await _b(m,Ce,A,M))}if(z.pathname==="/api/databases/vitess/schema"&&D.method==="POST"){let I=await re(D),A=String(I.sql??"");return x(await Tb(m,Ce,A))}if(z.pathname==="/api/databases/vitess/install-client"&&D.method==="POST")return x(await Cb(m,Ce));if(z.pathname==="/api/databases/backups"&&D.method==="GET")return x(await wb(m,Ce));if(z.pathname==="/api/databases/backup"&&D.method==="POST"){let I=await re(D),A=String(I.database??"").trim();if(!Si(A))return x({ok:!1,error:"Database name must be a valid identifier."},422);if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to back up this database.`},409);return x(await Sb(m,Ce,A))}if(z.pathname==="/api/databases/users"&&D.method==="POST"){let I=await re(D),A=String(I.username??"").trim(),M=String(I.password??""),F=String(I.database??"").trim()||void 0,V=I.access==="readonly"?"readonly":"all";if(!Si(A))return x({ok:!1,error:"Username must be a valid identifier."},422);if(!M)return x({ok:!1,error:"Password is required."},422);if(F&&!Si(F))return x({ok:!1,error:"Database must be a valid identifier."},422);return x({...await bb(m,Ce,{username:A,password:M,database:F,access:V}),username:A})}if(z.pathname==="/api/dashboard-data")return Yt=U.get(Ce)??await we(Ce),we(Ce),x(lm(Yt,{user:$n,slug:m.project.slug}));if(z.pathname==="/api/users"&&D.method==="GET")return x({ok:!0,users:en(t).map(Hs)});if(z.pathname==="/api/users"&&D.method==="POST"){let I=await re(D),A=String(I.username??"").trim();if(!cl(A))return x({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let M=I.sites&&typeof I.sites==="object"?I.sites:{},F=new Set(Object.keys(m.sites??{})),V={};for(let[X,ve]of Object.entries(M)){if(!F.has(X))return x({ok:!1,error:`Site '${X}' was not found.`},404);if(ve!=="owner"&&ve!=="collaborator")return x({ok:!1,error:`Unknown site role '${ve}'. Use 'owner' or 'collaborator'.`},422);V[X]=ve}let G=typeof I.password==="string"&&I.password.trim()?I.password.trim():void 0;if(G&&G.length<12)return x({ok:!1,error:"Password must be at least 12 characters."},422);let H=yc(t,{username:A,password:G,name:typeof I.name==="string"?I.name:void 0,sites:V});return ls(y,en(t)),it(),x({ok:!0,user:Hs(H.user),password:H.password})}if(z.pathname==="/api/users"&&D.method==="DELETE"){let I=await re(D),A=String(I.username??"").trim();if(A.toLowerCase()===pe.username.toLowerCase())return x({ok:!1,error:"You cannot remove your own account."},409);let M=Fn(en(t),A),F=M?y.store.getActorByExternalId("user",`dashboard:${M.username.toLowerCase()}`):void 0,V=F?y.store.getMembershipForActor(y.organization.id,F.id):void 0;if(V&&V.source!=="legacy")return x({ok:!1,error:"Organization members must be removed from Organization access."},409);let G=am(t,A);if(!G.ok)return x(G,409);return ls(y,en(t)),ne.clear(),x({ok:!0,username:A})}if(z.pathname==="/api/actions/run"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=I.action?fs(I.action,Ce):void 0;if(!A)return x({ok:!1,error:"Unknown dashboard action."},404);if(A.mutates&&I.confirm!==A.confirm)return x({ok:!1,error:`Type "${A.confirm}" to run this action.`},409);let M=await xe({controlPlane:y,environment:Ce,actor:pe,kind:`dashboard.action.${A.id}`,input:{action:A.id},execute:()=>wm(A,{cwd:t,cliEntry:l})});return x({...M.result,controlPlaneOperation:M.operation})}if(z.pathname==="/api/server/operations/run"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=I.operation?dm(I.operation,m,Yt):void 0;if(!A)return x({ok:!1,error:"Unknown or unavailable server operation."},404);if(A.mutates&&I.confirm!==A.confirm)return x({ok:!1,error:`Type "${A.confirm}" to run this operation.`},409);let M=se(y,String(Ce));await new vt(ut).run(new gn,{...M,artifactRoot:t});let F=is(ut,{scope:M,desiredConfigHash:y.project.desiredConfigHash});if(F.decision.outcome==="block")return x({ok:!1,error:`Operation blocked by security policy: ${F.decision.explanation}`,securityReview:F},409);let V=await xe({controlPlane:y,environment:Ce,actor:pe,kind:`dashboard.server.${A.id}`,resourceSlug:A.target,input:{operation:A.id,target:A.target,to:I.to??null},execute:()=>pl(m,Ce,A,{to:I.to})});return x({...V.result,controlPlaneOperation:V.operation,securityReview:F})}if(z.pathname==="/api/server/command"&&D.method==="POST"){let I=await D.json().catch(()=>({}));if(I.confirm!=="run")return x({ok:!1,error:'Type "run" to execute this command on the server.'},409);let A=await xe({controlPlane:y,environment:Ce,actor:pe,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>vc(m,Ce,String(I.command??""))});return x({...A.result,controlPlaneOperation:A.operation})}if(z.pathname==="/api/serverless/operations")return x(fm(m,Ce,Yt));if(z.pathname==="/api/serverless/operations/run"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=I.operation?PS(I.operation,m,Ce,Yt):void 0;if(!A)return x({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(A.mutates&&I.confirm!==A.confirm)return x({ok:!1,error:`Type "${A.confirm}" to run this operation.`},409);let M=await xe({controlPlane:y,environment:Ce,actor:pe,kind:`dashboard.serverless.${A.id}`,input:{operation:A.id,min:I.min??null,max:I.max??null},execute:()=>_S(m,Ce,A,{min:I.min,max:I.max})});return Yt=await No(m,Ce),U.set(Ce,Yt),x({...M.result,controlPlaneOperation:M.operation})}if(z.pathname==="/api/serverless/command"&&D.method==="POST"){let I=await D.json().catch(()=>({}));if(I.confirm!=="run")return x({ok:!1,error:'Type "run" to execute this command.'},409);return x(await xS(m,Ce,String(I.command??"")))}if(z.pathname==="/api/serverless/dlq"&&D.method==="GET"){let I=Number(z.searchParams.get("max"))||10;return x(await DS(m,Ce,I))}if(z.pathname==="/api/serverless/dlq/redrive"&&D.method==="POST"){let I=await D.json().catch(()=>({}));if(I.confirm!=="redrive")return x({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return x(await OS(m,Ce,{max:I.max,targetQueue:I.targetQueue}))}if(z.pathname==="/api/serverless/dlq/purge"&&D.method==="POST"){if((await D.json().catch(()=>({}))).confirm!=="purge")return x({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return x(await $S(m,Ce))}if(z.pathname==="/api/serverless/secrets"&&D.method==="GET")return x({secrets:NS(m,Ce)});if(z.pathname==="/api/serverless/secrets"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=String(I.secretId??"").trim();if(!A)return x({ok:!1,error:"A secret id is required."},422);if(typeof I.value!=="string"||I.value==="")return x({ok:!1,error:"A non-empty value is required."},422);return x(await jS(m,Ce,A,I.value))}if(z.pathname==="/api/serverless/secrets"&&D.method==="DELETE"){let I=await D.json().catch(()=>({})),A=String(I.secretId??"").trim();if(!A)return x({ok:!1,error:"A secret id is required."},422);if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to delete this secret.`},409);return x(await BS(m,Ce,A))}if(z.pathname==="/api/serverless/functions/config"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=String(I.mode??"").trim();if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to update this function.`},409);return x(await MS(m,Ce,A,{memory:I.memory,timeout:I.timeout}))}if(z.pathname==="/api/serverless/alarms"&&D.method==="GET")return x(await LS(m,Ce));if(z.pathname==="/api/serverless/alarms"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=String(I.preset??"").trim(),M=Number(I.threshold);if(!A)return x({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(M))return x({ok:!1,error:"A numeric threshold is required."},422);return x(await FS(m,Ce,A,M))}if(z.pathname==="/api/serverless/alarms"&&D.method==="DELETE"){let I=await D.json().catch(()=>({})),A=String(I.name??"").trim();if(!A)return x({ok:!1,error:"An alarm name is required."},422);if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to delete this alarm.`},409);return x(await zS(m,Ce,A))}if(z.pathname==="/api/serverless/traces"&&D.method==="GET"){let I=Number(z.searchParams.get("minutes"))||30;return x(await ml(m,Ce,I))}if(z.pathname==="/api/serverless/scheduler"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=String(I.action??"").trim();if(A!=="enable"&&A!=="disable"&&A!=="run")return x({ok:!1,error:"Unknown scheduler action."},422);if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to ${A} the scheduler.`},409);return x(await vm(m,Ce,A))}if(!nw(z.pathname,$n))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(Ce)}`}});let Ho=await Ut(pe,Ce);if(!Ho)return bl("ts-cloud dashboard UI is unavailable.",503);return iw(Ho,z.pathname)}catch(co){if(e.verbose)console.error(co);return x({ok:!1,error:co?.message??String(co)},500)}})();if(!hr)return hr;if(bt&&(z.pathname.startsWith("/api/")||z.pathname.startsWith("/auth/"))){let at;if((Le.headers.get("content-type")||"").includes("application/json"))at=await Le.json().catch(()=>{return});let xr=er.resolveUser(D),Rr=xr?We(xr).actor:void 0;y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,actorId:Rr?.id,correlationId:Ge,type:hr.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:hr.status<400?"info":"warning",payload:K_(D.method,z.pathname,at,hr.status,Date.now()-Ue)})}return hr.headers.set("x-request-id",Ge),hr}});Rc?.start();let bw=e.spendLoop??!0,zm;if(bw)(async()=>{let{SpendRunner:D,SpendLoopLease:Fe,startSpendLoop:Ue}=await import("./spend/index.js"),{store:Le}=await sw(y.store),Ge=new D({controlPlane:y.store,store:Le,alerts:ot});zm=Ue(Ge,{lease:new Fe(y.store,{owner:`dashboard:${process.pid}`}),onError:(bt)=>console.error(`[ts-cloud] spend cycle failed: ${bt instanceof Error?bt.message:String(bt)}`)})})();let Sw=Fo.stop.bind(Fo);return Fo.stop=(D)=>{clearInterval(Bm),clearInterval(Mm),clearInterval(Lm),clearInterval(jm),clearInterval(Nm),clearInterval(xm),clearInterval(Dm),clearInterval(Om),clearInterval($m),it(),vr.clear(),Rc?.stop(),zm?.();let Fe=Sw(D);if(Rc)Rc.settled().finally(()=>y.store.close());else y.store.close();return Fe},{server:Fo,url:`http://${r}:${Fo.port}/`}}export{Vo,Af,Ll,lS,Ji,$l,qo,yf,Sf,on,jo,Ml,Ye,Fl,Ul,Ql,Xi,an,If,Ze,Hl,zo,Ko,Wo,Gl,Vl,ql,Yi,Jo,jl,cn,Zi,Xo,Et,bf,zl,Kl,Cf,Wl,Yo,ir,Jl,Xl,Yl,Zl,et,Ef,eu,sr,Zo,ea,ta,es,ts,dn,tu,rs,ra,na,ln,ru,un,vf,Tf,vt,gn,ia,wf,nu,iu,sa,su,ou,au,uS,se,cu,gS,pS,ns,is,mS,Ae,Rf,Tt,ke,Be,wt,du,lu,uu,gu,Df,Pf,oa,Nf,kf,aa,pu,mu,Bf,oe,xf,fu,ye,ca,tt,Rt,Dt,pn,ss,hu,fS,da,Of,_f,Lf,$f,la,ua,Au,mn,ga,yu,os,Su,pa,ma,fa,ha,Aa,ya,Sa,Ia,Iu,or,ba,bu,fn,Cu,Ca,Ea,Eu,ar,va,Ta,Mf,hS,as,AS,yS,SS,wa,Ra,vu,Ff,Da,hn,Tu,cs,wu,Ru,Du,Pa,Uf,Na,Pu,Qf,ka,Hf,An,yn,Nu,ds,ku,Bu,xu,Ba,Ou,_u,Gf,Lu,C,$u,ls,xe,Mu,Fu,IS,Uu,Qu,Hu,Gu,Vu,Vf,bS,CS,ES,qf,jf,vS,TS,zf,Kf,wS,us,cr,xa,Sn,In,dr,rt,Pt,gs,Wf,bn,qu,ju,Oa,Jf,_a,Xf,Yf,zu,La,ps,Ku,$a,Nt,Oe,Wu,Ma,Fa,Ju,Ua,Qa,Ha,Ga,Xu,Yu,Cn,Va,qa,ja,za,Zu,ms,En,fs,Ka};
+`);return new Response(ct,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(z.pathname==="/api/telemetry/saved-queries"&&D.method==="GET"){let Pe=We(pe);return x({ok:!0,queries:A.listSavedQueries(y.project.id,Pe.actor?.id)})}if(z.pathname==="/api/telemetry/saved-queries"&&D.method==="POST"){let Pe=await re(D),He=We(pe);return x({ok:!0,query:A.saveQuery(y.project.id,He.actor?.id,String(Pe.name??""),X(Pe.query??Pe))},201)}if(z.pathname==="/api/telemetry/saved-queries"&&D.method==="DELETE"){let Pe=await re(D),He=We(pe),_e=A.deleteSavedQuery(y.project.id,He.actor?.id,String(Pe.id??""));return x({ok:_e},_e?200:404)}}if(z.pathname.startsWith("/api/configuration")){let I=y.environments.get(Ce),A=pe.role==="admin"||!!$n.capabilities?.includes("secrets:read"),M=pe.role==="admin"||!!$n.capabilities?.includes("secrets:write"),F={projectId:y.project.id,environmentId:I?.id},V={"cache-control":"no-store"};if(z.pathname==="/api/configuration"&&D.method==="GET"){let G=Object.fromEntries(z.searchParams),H=G.scopeType||G.scopeId?Js(G,F):void 0,X=["variable","secret"].includes(String(G.kind))?G.kind:void 0,ve=H?.type==="preview"?mr.previews.getInstance(H.id):void 0,ge=ve?mr.previews.getDefinition(ve.definitionId):void 0,Xe=H?await rn.resolve({projectId:y.project.id,environmentId:H.environmentId,resourceId:H.resourceId,functionId:H.type==="function"?H.id:void 0,previewId:H.previewId,trustedPreview:!!ve&&!ve.fork,allowedPreviewSecrets:ge?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:A}):void 0,Pe=y.store.listResources(y.project.id);return x({ok:!0,entries:rn.list({projectId:y.project.id,scope:H,kind:X,search:G.search,canReadSecretMetadata:A}),effectiveEntries:Xe?Object.values(Xe.entries).filter((He)=>!X||He.kind===X).filter((He)=>!G.search||He.key.toLowerCase().includes(String(G.search).toLowerCase())):[],configurationHash:Xe?.configurationHash,warnings:Xe?.warnings??[],scopes:{project:y.project,environments:y.store.listEnvironments(y.project.id),resources:Pe.filter((He)=>He.kind!=="function"),functions:Pe.filter((He)=>He.kind==="function"),previews:mr.previews.listInstances({projectId:y.project.id}).filter((He)=>He.status!=="destroyed").map((He)=>({id:He.id,name:He.name,environmentId:He.baseEnvironmentId,resourceId:He.resourceId,fork:He.fork,status:He.status}))}},200,V)}if(z.pathname==="/api/configuration/export"&&D.method==="GET"){let G=Js(Object.fromEntries(z.searchParams),F);return new Response(rn.exportVariables({projectId:y.project.id,scope:G}),{headers:{...V,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(z.pathname==="/api/configuration/plan"&&D.method==="POST"){let G=await re(D),H=Js(G,F),X=G.values&&typeof G.values==="object"&&!Array.isArray(G.values)?Object.fromEntries(Object.entries(G.values).map(([ve,ge])=>[ve,String(ge)])):{};return x({ok:!0,plan:rn.plan({projectId:y.project.id,scope:H,values:X,removeMissing:G.removeMissing===!0})},200,V)}if(z.pathname==="/api/configuration"&&D.method==="POST"){let G=await re(D),H=Js(G,F),X=G.kind==="secret"?"secret":"variable",ve=String(G.key??"");if(X==="secret"&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);try{let ge=await rn.set({organizationId:y.organization.id,projectId:y.project.id,scope:H,key:ve,kind:X,value:G.value==null?void 0:String(G.value),reference:G.reference==null?void 0:String(G.reference),backend:G.backend,required:G.required===!0,expectedVersion:G.expectedVersion==null?void 0:Number(G.expectedVersion),confirmed:String(G.confirm??"")===ve,idempotencyKey:D.headers.get("idempotency-key")??G.idempotencyKey,actorId:We(pe).actor?.id});return x({ok:!0,entry:rn.list({projectId:y.project.id,scope:H,canReadSecretMetadata:A}).find((Xe)=>Xe.id===ge.entry.id),mutation:ge.mutation,warnings:ge.warnings},ge.mutation.added.length?201:200,V)}catch(ge){return x({ok:!1,error:ge instanceof Error?ge.message:String(ge)},409,V)}}if(z.pathname==="/api/configuration/import"&&D.method==="POST"){let G=await re(D),H=Js(G,F),X=Array.isArray(G.secretKeys)?G.secretKeys.map(String):[];if(X.length&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);try{let ve=await rn.importDotenv({organizationId:y.organization.id,projectId:y.project.id,scope:H,source:String(G.source??""),secretKeys:X,backend:G.backend,confirmed:G.confirm==="import",idempotencyKey:D.headers.get("idempotency-key")??G.idempotencyKey,actorId:We(pe).actor?.id});return x({ok:ve.document.valid,diagnostics:ve.document.diagnostics,mutation:ve.mutation,warnings:ve.warnings},ve.document.valid?200:422,V)}catch(ve){return x({ok:!1,error:ve instanceof Error?ve.message:String(ve)},409,V)}}if(z.pathname==="/api/configuration/dependencies"&&D.method==="POST"){let G=await re(D),H=Ii.get(String(G.entryId??"")),X=y.store.getResource(String(G.resourceId??""));if(!H||H.projectId!==y.project.id||!X||X.projectId!==y.project.id)return x({ok:!1,error:"Configuration entry or dependent resource was not found."},404,V);return x({ok:!0,dependency:Ii.setDependency({entryId:H.id,resourceId:X.id,injectionTarget:["native_reference","file"].includes(String(G.injectionTarget))?G.injectionTarget:"environment",required:G.required!==!1,requiresRedeploy:G.requiresRedeploy!==!1,lastDeployedVersion:G.lastDeployedVersion==null?void 0:Number(G.lastDeployedVersion)})},200,V)}if(z.pathname==="/api/configuration/transfer"&&D.method==="POST"){let G=await re(D),H=Ii.get(String(G.id??"")),X=Js({...G,scopeType:G.targetScopeType,scopeId:G.targetScopeId},F);if(!H||H.projectId!==y.project.id)return x({ok:!1,error:"Configuration entry was not found."},404,V);if(H.kind==="secret"&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);try{let ve=await rn.transfer({entryId:H.id,targetScope:X,mode:G.mode==="move"?"move":"copy",confirmed:G.confirm===H.key,actorId:We(pe).actor?.id,idempotencyKey:D.headers.get("idempotency-key")??G.idempotencyKey});return x({ok:!0,entry:rn.list({projectId:y.project.id,scope:X,canReadSecretMetadata:A}).find((ge)=>ge.id===ve.entry.id),mutation:ve.mutation},200,V)}catch(ve){return x({ok:!1,error:ve instanceof Error?ve.message:String(ve)},409,V)}}if(z.pathname==="/api/configuration/bulk"&&D.method==="POST"){let G=await re(D),H=Array.isArray(G.ids)?G.ids.map(String).slice(0,500):[],X=H.map((ge)=>Ii.get(ge)).filter((ge)=>!!ge&&ge.projectId===y.project.id);if(X.length!==H.length)return x({ok:!1,error:"One or more configuration entries were not found."},404,V);if(X.some((ge)=>ge.kind==="secret")&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);if(G.action!=="delete"||G.confirm!=="bulk")return x({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,V);let ve=[];try{for(let ge of X)ve.push(await rn.remove({entryId:ge.id,expectedVersion:ge.version,confirmed:!0,actorId:We(pe).actor?.id}));return x({ok:!0,removed:ve.flatMap((ge)=>ge.removed),affectedResourceIds:[...new Set(ve.flatMap((ge)=>ge.affectedResourceIds))].sort()},200,V)}catch(ge){return x({ok:!1,error:ge instanceof Error?ge.message:String(ge),partial:ve.flatMap((Xe)=>Xe.removed)},409,V)}}if(z.pathname==="/api/configuration/reveal"&&D.method==="POST"){let G=await re(D),H=er.resolveSession(D);try{return x({ok:!0,value:await rn.reveal({entryId:String(G.id??""),canRevealSecrets:A,recentlyAuthenticated:!Te||!!H&&Ne.isRecentlyAuthenticated(H),actorId:We(pe).actor?.id})},200,V)}catch(X){return x({ok:!1,error:X instanceof Error?X.message:String(X)},403,V)}}if(z.pathname==="/api/configuration"&&D.method==="DELETE"){let G=await re(D),H=Ii.get(String(G.id??""));if(H?.kind==="secret"&&!M)return x({ok:!1,error:"Secret write permission is required."},403,V);if(!H||H.projectId!==y.project.id)return x({ok:!1,error:"Configuration entry was not found."},404,V);try{return x({ok:!0,mutation:await rn.remove({entryId:H.id,expectedVersion:Number(G.expectedVersion),confirmed:String(G.confirm??"")===H.key,actorId:We(pe).actor?.id})},200,V)}catch(X){return x({ok:!1,error:X instanceof Error?X.message:String(X)},409,V)}}}if(z.pathname.startsWith("/api/fleet")){let I=We(pe).actor?.id,A=(M,F=409)=>x({ok:!1,error:M instanceof Error?M.message:String(M)},F,{"cache-control":"no-store"});if(z.pathname==="/api/fleet"&&D.method==="GET")return x({ok:!0,servers:Xs.list(y.project.id),resources:y.store.listResources(y.project.id),operations:Mt.list({projectId:y.project.id,limit:200}).filter((M)=>M.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(z.pathname==="/api/fleet"&&D.method==="POST"){let M=await re(D);try{return x({ok:!0,server:Yn.enroll({organizationId:y.organization.id,projectId:y.project.id,name:String(M.name??""),provider:["aws","hetzner"].includes(String(M.provider))?M.provider:"ssh",providerId:M.providerId?String(M.providerId):void 0,region:M.region?String(M.region):void 0,zone:M.zone?String(M.zone):void 0,endpoint:String(M.endpoint??""),sshUser:String(M.sshUser??"deploy"),sshPort:M.sshPort?Number(M.sshPort):22,credentialRef:String(M.credentialRef??""),roles:Array.isArray(M.roles)?M.roles:[],labels:M.labels&&typeof M.labels==="object"?M.labels:{}})},201)}catch(F){return A(F,422)}}if(z.pathname==="/api/fleet/action"&&D.method==="POST"){let M=await re(D),F=String(M.id??""),V=String(M.action??"");try{if(V==="test")return x({ok:!0,server:await Yn.test(F)});if(V==="validate")return x({ok:!0,server:await Yn.validate(F)});if(V==="review_host_key")return x({ok:!0,server:Yn.reviewHostKey(F,String(M.fingerprint??""))});if(V==="bootstrap")return x({ok:!0,...Yn.bootstrap(F,M.confirmed===!0)},M.confirmed===!0?202:200);if(V==="heartbeat")return x({ok:!0,server:Yn.heartbeat(F,{usage:M.usage&&typeof M.usage==="object"?M.usage:{}})});if(V==="drain")return x({ok:!0,server:Yn.drain(F,M.completed===!0)});if(V==="uncordon")return x({ok:!0,server:Yn.uncordon(F)});if(V==="archive")return x({ok:!0,server:Yn.archive(F,String(M.confirmation??""))});return A("Unsupported fleet action.",422)}catch(G){return A(G)}}}if(z.pathname.startsWith("/api/capacity")){let I=(A,M=409)=>x({ok:!1,error:A instanceof Error?A.message:String(A)},M,{"cache-control":"no-store"});if(z.pathname==="/api/capacity"&&D.method==="GET")return x({ok:!0,pools:Ai.listPools(y.project.id),placements:Ai.listPlacements(y.project.id),servers:Xs.list(y.project.id)},200,{"cache-control":"no-store"});if(z.pathname==="/api/capacity"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,pool:Ai.createPool({organizationId:y.organization.id,projectId:y.project.id,name:String(A.name??""),purpose:String(A.purpose??"application"),backend:String(A.backend??"server"),region:A.region?String(A.region):void 0,architecture:A.architecture?String(A.architecture):void 0,labels:A.labels&&typeof A.labels==="object"?A.labels:{},requiredServerLabels:A.requiredServerLabels&&typeof A.requiredServerLabels==="object"?A.requiredServerLabels:{},toleratedTaints:Array.isArray(A.toleratedTaints)?A.toleratedTaints.map(String):[],capacity:A.capacity&&typeof A.capacity==="object"?A.capacity:{},maxWorkloads:Number(A.maxWorkloads??10),costWeight:Number(A.costWeight??1),spreadKey:A.spreadKey?String(A.spreadKey):void 0,concurrency:Number(A.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(M){return I(M,422)}}if(z.pathname==="/api/capacity/member"&&D.method==="POST"){let A=await re(D);try{return Ai.addMember(String(A.poolId??""),String(A.serverId??"")),x({ok:!0,pool:Ai.getPool(String(A.poolId??""))})}catch(M){return I(M,422)}}if(z.pathname==="/api/capacity/explain"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,decisions:Am.explain(y.project.id,{purpose:String(A.purpose??"application"),resources:A.resources&&typeof A.resources==="object"?A.resources:{},region:A.region?String(A.region):void 0,architecture:A.architecture?String(A.architecture):void 0,labels:A.labels&&typeof A.labels==="object"?A.labels:{}})})}catch(M){return I(M,422)}}if(z.pathname==="/api/capacity/action"&&D.method==="POST"){let A=await re(D);try{if(A.action==="drain")return x({ok:!0,...Am.drainPool(String(A.poolId??""))});if(A.action==="enable")return x({ok:!0,pool:Ai.updatePool(String(A.poolId??""),{status:"active"})});if(A.action==="disable")return x({ok:!0,pool:Ai.updatePool(String(A.poolId??""),{status:"disabled"})});return I("Unsupported capacity action.",422)}catch(M){return I(M,422)}}}if(z.pathname.startsWith("/api/regions")){let I=(A,M=409)=>x({ok:!1,error:A instanceof Error?A.message:String(A)},M,{"cache-control":"no-store"});if(z.pathname==="/api/regions"&&D.method==="GET")return x({ok:!0,topologies:ao.list(y.project.id).map((A)=>({topology:A,targets:ao.targets(A.id),channels:ao.channels(A.id),route:ao.route(A.id),executions:ao.executions(A.id)}))},200,{"cache-control":"no-store"});if(z.pathname==="/api/regions"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,topology:Cm.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:y.environments.get(Ce)?.id,name:String(A.name??""),hostname:String(A.hostname??""),regions:Array.isArray(A.regions)?A.regions:[],trafficPolicy:A.trafficPolicy==="weighted"||A.trafficPolicy==="latency"?A.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(A.replicate)?A.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(A.maxLagSeconds??30),retainOnDestroy:A.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:A.cdnEnabled===!0,wafEnabled:A.wafEnabled===!0})},201)}catch(M){return I(M,422)}}if(z.pathname==="/api/regions/action"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,...Cm.enqueue({topologyId:String(A.topologyId??""),kind:String(A.action??""),targetRegion:A.targetRegion?String(A.targetRegion):void 0,revision:A.revision?String(A.revision):void 0,manifest:A.manifest&&typeof A.manifest==="object"?A.manifest:{},confirmation:A.confirmation?String(A.confirmation):void 0,deleteData:A.deleteData===!0})},202)}catch(M){return I(M,422)}}}if(z.pathname.startsWith("/api/maintenance")){let I=(A,M=409)=>x({ok:!1,error:A instanceof Error?A.message:String(A)},M,{"cache-control":"no-store"});if(z.pathname==="/api/maintenance"&&D.method==="GET")return x({ok:!0,manifests:ai.manifests(y.organization.id),windows:ai.windows(y.project.id),campaigns:ai.campaigns(y.project.id).map((A)=>({campaign:A,targets:ai.targets(A.id)})),cleanups:ai.cleanups(y.project.id),drills:ai.drills(y.project.id)},200,{"cache-control":"no-store"});if(z.pathname==="/api/maintenance/cleanup-preview"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,plan:await Rl.previewCleanup({projectId:y.project.id,kind:String(A.kind??"operations"),criteria:{olderThanDays:Number(A.olderThanDays??30)}},Pm)},201)}catch(M){return I(M,422)}}if(z.pathname==="/api/maintenance/cleanup-apply"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,...Rl.enqueueCleanup(String(A.planId??""),String(A.confirmation??""))},202)}catch(M){return I(M,422)}}if(z.pathname==="/api/maintenance/drill"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,drill:ai.createDrill({projectId:y.project.id,scenario:String(A.scenario??"control_plane"),isolatedTarget:String(A.isolatedTarget??""),expectedRpoMinutes:Number(A.expectedRpoMinutes??60),expectedRtoMinutes:Number(A.expectedRtoMinutes??30),recoveryPointId:A.recoveryPointId?String(A.recoveryPointId):void 0,topologyId:A.topologyId?String(A.topologyId):void 0})},201)}catch(M){return I(M,422)}}if(z.pathname==="/api/maintenance/drill-run"&&D.method==="POST"){let A=await re(D);try{return x({ok:!0,...Rl.enqueueDrill(String(A.drillId??""))},202)}catch(M){return I(M,422)}}}if(z.pathname.startsWith("/api/volumes")){let I=y.environments.get(Ce),A=We(pe).actor?.id,M=(F,V=409)=>x({ok:!1,error:F instanceof Error?F.message:String(F)},V,{"cache-control":"no-store"});if(z.pathname==="/api/volumes"&&D.method==="GET"){let F=Il.inventory(y.project.id,I?.id),V=y.store.listResources(y.project.id,I?.id).map((G)=>({id:G.id,name:G.name,slug:G.slug,kind:G.kind,provider:G.provider,providerId:G.providerId}));return x({ok:!0,volumes:F,resources:V,operations:Mt.list({projectId:y.project.id,limit:100}).filter((G)=>G.operation.kind.startsWith("volume.")),recoveryPoints:yr.listRecoveryPoints(y.project.id).filter((G)=>G.kind==="volume"),providers:El.map((G)=>({provider:G.provider,type:G.type,capabilities:G.capabilities()}))},200,{"cache-control":"no-store"})}if(z.pathname==="/api/volumes"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.create({organizationId:y.organization.id,projectId:y.project.id,environmentId:I?.id,resourceId:F.resourceId?String(F.resourceId):void 0,name:String(F.name??""),provider:String(F.provider??"docker"),type:F.type==="docker"?"docker":F.type,capacityBytes:F.capacityBytes==null?void 0:Number(F.capacityBytes),filesystem:F.filesystem?String(F.filesystem):void 0,encrypted:F.encrypted===!0,desiredState:F.desiredState&&typeof F.desiredState==="object"?F.desiredState:{},actorId:A})},202,{"cache-control":"no-store"})}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/attach"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.attach(String(F.volumeId??""),{resourceId:String(F.resourceId??""),targetPath:String(F.targetPath??""),readOnly:F.readOnly===!0,uid:F.uid==null?void 0:Number(F.uid),gid:F.gid==null?void 0:Number(F.gid),mode:F.mode?String(F.mode):void 0,propagation:F.propagation,driverOptions:F.driverOptions&&typeof F.driverOptions==="object"?F.driverOptions:{},actorId:A})},202)}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/detach"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.detach(String(F.volumeId??""),String(F.attachmentId??""),{force:F.force===!0,drained:F.drained===!0,unmounted:F.unmounted===!0,confirmation:F.confirmation?String(F.confirmation):void 0,actorId:A})},202)}catch(V){return M(V)}}if(z.pathname==="/api/volumes/resize"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.resize(String(F.volumeId??""),Number(F.capacityBytes),{drained:F.drained===!0,actorId:A})},202)}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/snapshot"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.snapshot(String(F.volumeId??""),{name:F.name?String(F.name):void 0,actorId:A})},202)}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/restore"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,...si.restore(String(F.snapshotId??""),{name:String(F.name??""),actorId:A})},202)}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes/discover"&&D.method==="POST")try{return x({ok:!0,volumes:await si.discover({organizationId:y.organization.id,projectId:y.project.id,environmentId:I?.id,actorId:A})})}catch(F){return M(F,502)}if(z.pathname==="/api/volumes/adopt"&&D.method==="POST"){let F=await re(D);try{return x({ok:!0,volume:si.adopt(String(F.volumeId??""),{name:String(F.name??""),actorId:A})})}catch(V){return M(V,422)}}if(z.pathname==="/api/volumes"&&D.method==="DELETE"){let F=await re(D),V=er.resolveSession(D);try{return x({ok:!0,...si.delete(String(F.volumeId??""),{recentAuthAt:!Te||V&&Ne.isRecentlyAuthenticated(V)?new Date().toISOString():void 0,confirmation:F.confirmation?String(F.confirmation):void 0,backupOverride:F.backupOverride===!0,backupOverrideConfirmation:F.backupOverrideConfirmation?String(F.backupOverrideConfirmation):void 0,actorId:A})},202)}catch(G){return M(G)}}}if(z.pathname==="/api/backups"&&D.method==="GET"){let I=y.environments.get(Ce),A=yr.listPolicies(y.project.id,I?.id),M=new Set(A.map((X)=>X.id)),F=yr.listRecoveryPoints(y.project.id).filter((X)=>!X.policyId||M.has(X.policyId)),V=yr.listJobs(y.project.id).filter((X)=>!X.policyId||M.has(X.policyId)),G=(X)=>({...X,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!X.credentialRef,clientEncryptionConfigured:!!X.encryptionKeyRef}),H=await Promise.all(yr.listDestinations(y.project.id).map(async(X)=>({...G(X),credentialStatus:await zu(X,oi)})));return x({ok:!0,destinations:H,policies:A,recoveryPoints:F,jobs:V,coverage:yr.coverage(y.project.id).filter((X)=>M.has(X.policy.id)),resources:I?y.store.listResources(y.project.id,I.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind})):[]})}if(z.pathname==="/api/backups/destinations"&&D.method==="POST"){let I=await re(D),A=String(I.name??"").trim(),M=String(I.provider??""),F=String(I.encryption??"provider"),V=`secret://data-services/backups/${y.project.id}/${A}`,G=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(M))return x({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(F))return x({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let H,X;if(I.credentials&&typeof I.credentials==="object"&&!Array.isArray(I.credentials))H=`${V}/credentials`,await oi.put(H,JSON.stringify(I.credentials)),G.push(H);if(F!=="provider"){let ge=String(I.encryptionKey??"");if(ge.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");X=`${V}/encryption-key`,await oi.put(X,ge),G.push(X)}let ve=yr.createDestination({organizationId:y.organization.id,projectId:y.project.id,name:A,provider:M,endpoint:I.endpoint?String(I.endpoint):void 0,endpointPolicy:I.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:I.bucket?String(I.bucket):void 0,prefix:String(I.prefix??""),region:I.region?String(I.region):Ei,forcePathStyle:I.forcePathStyle===!0,credentialRef:H,encryption:F,encryptionKeyRef:X,immutability:I.immutability&&typeof I.immutability==="object"&&!Array.isArray(I.immutability)?I.immutability:{},status:"untested"});return x({ok:!0,destination:{...ve,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!H,clientEncryptionConfigured:!!X}},201)}catch(H){for(let X of G)await oi.remove(X).catch(()=>{});return x({ok:!1,error:H instanceof Error?H.message:String(H)},422)}}if(z.pathname==="/api/backups/destinations/test"&&D.method==="POST"){let I=await re(D),A=yr.getDestination(String(I.id??""));if(!A||A.projectId!==y.project.id)return x({ok:!1,error:"Backup destination was not found."},404);if(A.provider==="aws_backup")return x({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await Rm.test(A),x({ok:!0,destination:yr.recordDestinationTest(A.id,{ok:!0})})}catch(M){let F=M instanceof Error?M.message:String(M);return yr.recordDestinationTest(A.id,{ok:!1,error:F}),x({ok:!1,error:F},502)}}if(z.pathname==="/api/backups/policies"&&D.method==="POST"){let I=await re(D),A=y.environments.get(Ce),M=yr.getDestination(String(I.destinationId??"")),F=String(I.resourceKind??""),V=I.dataServiceId?String(I.dataServiceId):void 0,G=V?Kt.get(V):void 0,H=I.resourceId?String(I.resourceId):void 0,X=H?y.store.getResource(H):void 0;if(!A)return x({ok:!1,error:"Environment was not found."},404);if(!M||M.projectId!==y.project.id)return x({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(F))return x({ok:!1,error:"A supported backup resource kind is required."},422);if(V&&(!G||G.projectId!==y.project.id||G.environmentId!==A.id))return x({ok:!1,error:"Data service was not found in this environment."},404);if(H&&(!X||X.projectId!==y.project.id||X.environmentId!==A.id))return x({ok:!1,error:"Resource was not found in this environment."},404);if(F==="managed_database"&&!G)return x({ok:!1,error:"Managed database policies require a data service."},422);if(F==="logical_database"&&(!G||!["container","server"].includes(G.provider)))return x({ok:!1,error:"Logical database policies require an on-box data service."},422);if(F==="volume"&&(!X||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(I.volumeName??""))))return x({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let ve=Array.isArray(I.includePatterns)?I.includePatterns.map(String).filter(Boolean):[];if(F==="files"&&(!X||!ve.length))return x({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(F==="control_plane"&&M.encryption==="provider")return x({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(F==="infrastructure"&&(M.provider!=="aws_backup"||!ve.some((ge)=>ge.startsWith("resource:arn:"))||!ve.some((ge)=>ge.startsWith("role:arn:"))))return x({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let ge=yr.createPolicy({organizationId:y.organization.id,projectId:y.project.id,environmentId:A.id,resourceId:H,dataServiceId:V,destinationId:M.id,name:String(I.name??"").trim(),resourceKind:F,schedule:String(I.schedule??"daily"),timezone:String(I.timezone??"UTC"),retention:I.retention&&typeof I.retention==="object"&&!Array.isArray(I.retention)?I.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(I.compression))?I.compression:"gzip",encryption:["destination","client_side","both"].includes(String(I.encryption))?I.encryption:"destination",includePatterns:F==="volume"?[String(I.volumeName),...ve]:ve,excludePatterns:Array.isArray(I.excludePatterns)?I.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(I.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(I.expectedRtoMinutes)||120),healthCheckId:I.healthCheckId?String(I.healthCheckId):void 0,enabled:I.enabled!==!1});return x({ok:!0,policy:ge},201)}catch(ge){return x({ok:!1,error:ge instanceof Error?ge.message:String(ge)},422)}}if(z.pathname==="/api/backups/run"&&D.method==="POST"){let I=await re(D),A=yr.getPolicy(String(I.policyId??"")),M=y.environments.get(Ce);if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Backup policy was not found in this environment."},404);try{let F=oo.enqueueBackup(A,new Date().toISOString(),We(pe).actor?.id);return x({ok:!0,job:F},202)}catch(F){return x({ok:!1,error:F instanceof Error?F.message:String(F)},409)}}if(z.pathname==="/api/backups/verify"&&D.method==="POST"){let I=await re(D),A=yr.getRecoveryPoint(String(I.recoveryPointId??""));if(!A||A.projectId!==y.project.id)return x({ok:!1,error:"Recovery point was not found."},404);return x({ok:!0,job:oo.enqueueVerification(A)},202)}if(z.pathname==="/api/backups/restore"&&D.method==="POST"){let I=await re(D),A=yr.getRecoveryPoint(String(I.recoveryPointId??"")),M=I.mode==="in_place"?"in_place":"isolated",F=I.target&&typeof I.target==="object"&&!Array.isArray(I.target)?{...I.target,inPlace:M==="in_place"}:{inPlace:M==="in_place"},V=er.resolveSession(D),G={mode:M,target:F,targetName:String(I.targetName??""),confirm:I.confirm?String(I.confirm):void 0,recentAuth:!Te||!!V&&Ne.isRecentlyAuthenticated(V),downtimeAcknowledged:I.downtimeAcknowledged===!0,safetyBackupId:I.safetyBackupId?String(I.safetyBackupId):void 0};if(!A||A.projectId!==y.project.id)return x({ok:!1,error:"Recovery point was not found."},404);if(I.drill===!0&&M!=="isolated")return x({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let H=oo.planRestore(A,G);if(I.execute!==!0)return x({ok:!0,plan:H,executionCreated:!1});let X=oo.enqueueRestore(A,{...G,drill:I.drill===!0,actorId:We(pe).actor?.id});return x({ok:!0,plan:H,job:X},202)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:String(H)},409)}}if(z.pathname==="/api/backups/recovery-points"&&D.method==="POST"){let I=await re(D),A=yr.getRecoveryPoint(String(I.id??""));if(!A||A.projectId!==y.project.id)return x({ok:!1,error:"Recovery point was not found."},404);if(I.held==null&&I.pinned==null)return x({ok:!1,error:"held or pinned must be provided."},422);return x({ok:!0,recoveryPoint:yr.updateRecoveryPoint(A.id,{held:I.held==null?A.held:I.held===!0,pinned:I.pinned==null?A.pinned:I.pinned===!0})})}if(z.pathname==="/api/backups/retention"&&D.method==="POST")return x({ok:!0,jobs:oo.enqueueRetention()},202);if(z.pathname==="/api/data-services/capabilities"&&D.method==="GET"){let I=String(z.searchParams.get("engine")??""),A=String(z.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(I)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(A))return x({ok:!1,error:"A supported engine and provider are required."},422);return x({ok:!0,engine:I,provider:A,capabilities:mn(I,A)})}if(z.pathname==="/api/data-services"&&D.method==="GET"){let I=y.environments.get(Ce),A=Kt.list(y.project.id,I?.id).map((M)=>{let F=Kt.credential(M.id);return{...M,credentialRef:void 0,credential:F?{configured:!0,username:F.username,version:F.version,rotatedAt:F.rotatedAt}:void 0,dependencies:Kt.dependencies(M.id).map((V)=>({resourceId:V.resourceId,requiresRedeploy:V.requiresRedeploy}))}});return x({ok:!0,services:A})}if(z.pathname==="/api/data-services/preview"&&D.method==="POST"){let I=await re(D);if(I.id){let F=Kt.get(String(I.id)),V=y.environments.get(Ce),G=String(I.action??"");if(!F||F.projectId!==y.project.id||F.environmentId!==V?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!hl.includes(G))return x({ok:!1,error:`Action must be one of: ${hl.join(", ")}.`},422);try{return x({ok:!0,plan:Ec.plan(F,G,I.changes??{})})}catch(H){return x({ok:!1,error:H instanceof Error?H.message:String(H)},422)}}let A=String(I.engine??""),M=String(I.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(A)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(M))return x({ok:!1,error:"A supported engine and provider are required."},422);return x({ok:!0,capabilities:mn(A,M),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(z.pathname==="/api/data-services"&&D.method==="POST"){let I=await re(D),A=String(I.engine??""),M=String(I.provider??""),F=y.environments.get(Ce),V=We(pe);if(!F)return x({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(A)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(M))return x({ok:!1,error:"A supported engine and provider are required."},422);let G={organizationId:y.organization.id,projectId:y.project.id,environmentId:F.id,resourceId:I.resourceId?String(I.resourceId):void 0,name:String(I.name??"").trim(),engine:A,provider:M,placement:String(I.placement??I.name??"").trim(),engineVersion:I.engineVersion?String(I.engineVersion):void 0,plan:String(I.plan??(M==="aws_elasticache"?"cache.t4g.micro":M==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:I.storageGb==null?void 0:Number(I.storageGb),highAvailability:I.highAvailability===!0,publicExposure:I.publicExposure===!0,allowedCidrs:Array.isArray(I.allowedCidrs)?I.allowedCidrs.map(String):[],desiredState:I.desiredState&&typeof I.desiredState==="object"&&!Array.isArray(I.desiredState)?I.desiredState:{},observedState:{},origin:I.adopt===!0?"adopted":"managed",managementEnabled:I.adopt!==!0,ownerActorId:V.actor?.id,username:I.username?String(I.username):void 0};try{if(I.adopt===!0){let X=Kt.create({...G,status:"adopted",credentialRef:void 0});return x({ok:!0,service:X,readOnly:!0},201)}if(!Em({provider:M,engine:A}))return x({ok:!1,error:`No ${M}/${A} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let H=await Ec.create(G);return x({ok:!0,service:H.service,operationId:H.operationId,oneTimeCredential:H.credential},201)}catch(H){return x({ok:!1,error:H instanceof Error?H.message:String(H)},422)}}if(z.pathname==="/api/data-services/connections"&&D.method==="GET"){let I=Kt.get(String(z.searchParams.get("id")??"")),A=y.environments.get(Ce);if(!I||I.projectId!==y.project.id||I.environmentId!==A?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);let M=typeof I.observedState.endpoint==="string"?I.observedState.endpoint:void 0,F=typeof I.observedState.readerEndpoint==="string"?I.observedState.readerEndpoint:void 0,V=Number(I.observedState.port)||(I.engine==="postgres"?5432:I.engine==="redis"?6379:I.engine==="mongodb"?27017:I.engine==="libsql"?8080:3306),G=typeof I.observedState.database==="string"?I.observedState.database:void 0,H=typeof I.observedState.tls==="boolean"?I.observedState.tls:I.provider.startsWith("aws_"),X=[...M?[{type:I.publicExposure?"external":"internal",host:M,port:V,database:G,tls:H}]:[],...F?[{type:"internal",host:F,port:V,database:G,tls:H}]:[],{type:"tunnel",host:M??I.placement,port:V,database:G,tls:H}];return x({ok:!0,serviceId:I.id,guidance:yu(I,X)})}if(z.pathname==="/api/data-services/action"&&D.method==="POST"){let I=await re(D),A=Kt.get(String(I.id??"")),M=y.environments.get(Ce),F=String(I.action??"");if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!hl.includes(F))return x({ok:!1,error:`Action must be one of: ${hl.join(", ")}.`},422);let V=I.changes&&typeof I.changes==="object"&&!Array.isArray(I.changes)?I.changes:{};try{let G=Ec.plan(A,F,V);if(I.execute!==!0)return x({ok:!0,plan:G,productionExecutionCreated:!1});let H=Ec.enqueue(A,F,V,We(pe).actor?.id);return x({ok:!0,plan:G,operationId:H},202)}catch(G){return x({ok:!1,error:G instanceof Error?G.message:String(G)},409)}}if(z.pathname==="/api/data-services/dependencies"&&D.method==="POST"){let I=await re(D),A=Kt.get(String(I.id??"")),M=y.environments.get(Ce),F=y.store.getResource(String(I.resourceId??""));if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!F||F.projectId!==y.project.id||F.environmentId!==M?.id)return x({ok:!1,error:"Dependent resource was not found in this environment."},404);if(I.remove===!0)return x({ok:Kt.removeDependency(A.id,F.id)});return Kt.addDependency({serviceId:A.id,resourceId:F.id,secretRef:A.credentialRef??`secret://data-services/${A.projectId}/${A.name}`,requiresRedeploy:I.requiresRedeploy!==!1}),x({ok:!0,dependencies:Kt.dependencies(A.id).map((V)=>({resourceId:V.resourceId,requiresRedeploy:V.requiresRedeploy}))})}if(z.pathname==="/api/data-services/management"&&D.method==="POST"){let I=await re(D),A=Kt.get(String(I.id??"")),M=y.environments.get(Ce);if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(A.origin!=="adopted"||I.reviewed!==!0||I.confirm!==A.name)return x({ok:!1,error:`Enabling management requires reviewed=true and typing ${A.name}.`},409);return x({ok:!0,service:Kt.update(A.id,A.version,{managementEnabled:!0})})}if(z.pathname==="/api/data-services/reveal"&&D.method==="POST"){let I=await re(D),A=Kt.get(String(I.id??"")),M=y.environments.get(Ce),F=A?Kt.credential(A.id):void 0;if(!A||A.projectId!==y.project.id||A.environmentId!==M?.id)return x({ok:!1,error:"Data service was not found in this environment."},404);if(!F)return x({ok:!1,error:"No managed credential is configured."},404);return x({ok:!0,credential:{username:F.username,password:await oi.resolve(F.secretRef),version:F.version}},200,{"cache-control":"no-store"})}if(z.pathname==="/api/databases"&&D.method==="GET")return x(await yb(m,Ce));if(z.pathname==="/api/databases"&&D.method==="POST"){let I=await re(D),A=String(I.name??"").trim();if(!Si(A))return x({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return x({...await vb(m,Ce,A),name:A})}if(z.pathname==="/api/databases/vitess"&&D.method==="GET"){let I=await kb(m,Ce);return x({...I,unhealthy:Ib(I.tablets),missingPrimary:Eb(I)})}if(z.pathname==="/api/databases/vitess/provision"&&D.method==="POST"){let I=await re(D);try{return x(await Ob(m,Ce,{keyspace:String(I.keyspace??""),username:String(I.username??""),password:String(I.password??""),sharded:I.sharded===!0,confirm:String(I.confirm??"")}))}catch(A){return x({ok:!1,error:A instanceof Error?A.message:String(A)},422)}}if(z.pathname==="/api/databases/vitess/migrations"&&D.method==="GET"){let I=z.searchParams.get("keyspace")??void 0;return x(await xb(m,Ce,I))}if(z.pathname==="/api/databases/vitess/migrations/action"&&D.method==="POST"){let I=await re(D),A=String(I.uuid??"").trim(),M=String(I.action??"");if(!["retry","cancel","cleanup","complete"].includes(M))return x({ok:!1,error:"Unknown migration action."},422);return x(await Db(m,Ce,A,M))}if(z.pathname==="/api/databases/vitess/keyspaces"&&D.method==="POST"){let I=await re(D),A=String(I.name??"").trim(),M=I.sharded===!0;return x(await Pb(m,Ce,A,{sharded:M}))}if(z.pathname==="/api/databases/vitess/vschema"&&D.method==="POST"){let I=await re(D),A=String(I.keyspace??"").trim(),M=typeof I.vschema==="string"?I.vschema:JSON.stringify(I.vschema??null);return x(await _b(m,Ce,A,M))}if(z.pathname==="/api/databases/vitess/schema"&&D.method==="POST"){let I=await re(D),A=String(I.sql??"");return x(await Tb(m,Ce,A))}if(z.pathname==="/api/databases/vitess/install-client"&&D.method==="POST")return x(await Cb(m,Ce));if(z.pathname==="/api/databases/backups"&&D.method==="GET")return x(await wb(m,Ce));if(z.pathname==="/api/databases/backup"&&D.method==="POST"){let I=await re(D),A=String(I.database??"").trim();if(!Si(A))return x({ok:!1,error:"Database name must be a valid identifier."},422);if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to back up this database.`},409);return x(await Sb(m,Ce,A))}if(z.pathname==="/api/databases/users"&&D.method==="POST"){let I=await re(D),A=String(I.username??"").trim(),M=String(I.password??""),F=String(I.database??"").trim()||void 0,V=I.access==="readonly"?"readonly":"all";if(!Si(A))return x({ok:!1,error:"Username must be a valid identifier."},422);if(!M)return x({ok:!1,error:"Password is required."},422);if(F&&!Si(F))return x({ok:!1,error:"Database must be a valid identifier."},422);return x({...await bb(m,Ce,{username:A,password:M,database:F,access:V}),username:A})}if(z.pathname==="/api/dashboard-data")return Yt=U.get(Ce)??await we(Ce),we(Ce),x(lm(Yt,{user:$n,slug:m.project.slug}));if(z.pathname==="/api/users"&&D.method==="GET")return x({ok:!0,users:en(t).map(Hs)});if(z.pathname==="/api/users"&&D.method==="POST"){let I=await re(D),A=String(I.username??"").trim();if(!cl(A))return x({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let M=I.sites&&typeof I.sites==="object"?I.sites:{},F=new Set(Object.keys(m.sites??{})),V={};for(let[X,ve]of Object.entries(M)){if(!F.has(X))return x({ok:!1,error:`Site '${X}' was not found.`},404);if(ve!=="owner"&&ve!=="collaborator")return x({ok:!1,error:`Unknown site role '${ve}'. Use 'owner' or 'collaborator'.`},422);V[X]=ve}let G=typeof I.password==="string"&&I.password.trim()?I.password.trim():void 0;if(G&&G.length<12)return x({ok:!1,error:"Password must be at least 12 characters."},422);let H=yc(t,{username:A,password:G,name:typeof I.name==="string"?I.name:void 0,sites:V});return ls(y,en(t)),it(),x({ok:!0,user:Hs(H.user),password:H.password})}if(z.pathname==="/api/users"&&D.method==="DELETE"){let I=await re(D),A=String(I.username??"").trim();if(A.toLowerCase()===pe.username.toLowerCase())return x({ok:!1,error:"You cannot remove your own account."},409);let M=Fn(en(t),A),F=M?y.store.getActorByExternalId("user",`dashboard:${M.username.toLowerCase()}`):void 0,V=F?y.store.getMembershipForActor(y.organization.id,F.id):void 0;if(V&&V.source!=="legacy")return x({ok:!1,error:"Organization members must be removed from Organization access."},409);let G=am(t,A);if(!G.ok)return x(G,409);return ls(y,en(t)),ne.clear(),x({ok:!0,username:A})}if(z.pathname==="/api/actions/run"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=I.action?fs(I.action,Ce):void 0;if(!A)return x({ok:!1,error:"Unknown dashboard action."},404);if(A.mutates&&I.confirm!==A.confirm)return x({ok:!1,error:`Type "${A.confirm}" to run this action.`},409);let M=await xe({controlPlane:y,environment:Ce,actor:pe,kind:`dashboard.action.${A.id}`,input:{action:A.id},execute:()=>wm(A,{cwd:t,cliEntry:l})});return x({...M.result,controlPlaneOperation:M.operation})}if(z.pathname==="/api/server/operations/run"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=I.operation?dm(I.operation,m,Yt):void 0;if(!A)return x({ok:!1,error:"Unknown or unavailable server operation."},404);if(A.mutates&&I.confirm!==A.confirm)return x({ok:!1,error:`Type "${A.confirm}" to run this operation.`},409);let M=se(y,String(Ce));await new vt(ut).run(new gn,{...M,artifactRoot:t});let F=is(ut,{scope:M,desiredConfigHash:y.project.desiredConfigHash});if(F.decision.outcome==="block")return x({ok:!1,error:`Operation blocked by security policy: ${F.decision.explanation}`,securityReview:F},409);let V=await xe({controlPlane:y,environment:Ce,actor:pe,kind:`dashboard.server.${A.id}`,resourceSlug:A.target,input:{operation:A.id,target:A.target,to:I.to??null},execute:()=>pl(m,Ce,A,{to:I.to})});return x({...V.result,controlPlaneOperation:V.operation,securityReview:F})}if(z.pathname==="/api/server/command"&&D.method==="POST"){let I=await D.json().catch(()=>({}));if(I.confirm!=="run")return x({ok:!1,error:'Type "run" to execute this command on the server.'},409);let A=await xe({controlPlane:y,environment:Ce,actor:pe,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>vc(m,Ce,String(I.command??""))});return x({...A.result,controlPlaneOperation:A.operation})}if(z.pathname==="/api/serverless/operations")return x(fm(m,Ce,Yt));if(z.pathname==="/api/serverless/operations/run"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=I.operation?PS(I.operation,m,Ce,Yt):void 0;if(!A)return x({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(A.mutates&&I.confirm!==A.confirm)return x({ok:!1,error:`Type "${A.confirm}" to run this operation.`},409);let M=await xe({controlPlane:y,environment:Ce,actor:pe,kind:`dashboard.serverless.${A.id}`,input:{operation:A.id,min:I.min??null,max:I.max??null},execute:()=>_S(m,Ce,A,{min:I.min,max:I.max})});return Yt=await No(m,Ce),U.set(Ce,Yt),x({...M.result,controlPlaneOperation:M.operation})}if(z.pathname==="/api/serverless/command"&&D.method==="POST"){let I=await D.json().catch(()=>({}));if(I.confirm!=="run")return x({ok:!1,error:'Type "run" to execute this command.'},409);return x(await xS(m,Ce,String(I.command??"")))}if(z.pathname==="/api/serverless/dlq"&&D.method==="GET"){let I=Number(z.searchParams.get("max"))||10;return x(await DS(m,Ce,I))}if(z.pathname==="/api/serverless/dlq/redrive"&&D.method==="POST"){let I=await D.json().catch(()=>({}));if(I.confirm!=="redrive")return x({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return x(await OS(m,Ce,{max:I.max,targetQueue:I.targetQueue}))}if(z.pathname==="/api/serverless/dlq/purge"&&D.method==="POST"){if((await D.json().catch(()=>({}))).confirm!=="purge")return x({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return x(await $S(m,Ce))}if(z.pathname==="/api/serverless/secrets"&&D.method==="GET")return x({secrets:NS(m,Ce)});if(z.pathname==="/api/serverless/secrets"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=String(I.secretId??"").trim();if(!A)return x({ok:!1,error:"A secret id is required."},422);if(typeof I.value!=="string"||I.value==="")return x({ok:!1,error:"A non-empty value is required."},422);return x(await jS(m,Ce,A,I.value))}if(z.pathname==="/api/serverless/secrets"&&D.method==="DELETE"){let I=await D.json().catch(()=>({})),A=String(I.secretId??"").trim();if(!A)return x({ok:!1,error:"A secret id is required."},422);if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to delete this secret.`},409);return x(await BS(m,Ce,A))}if(z.pathname==="/api/serverless/functions/config"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=String(I.mode??"").trim();if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to update this function.`},409);return x(await MS(m,Ce,A,{memory:I.memory,timeout:I.timeout}))}if(z.pathname==="/api/serverless/alarms"&&D.method==="GET")return x(await LS(m,Ce));if(z.pathname==="/api/serverless/alarms"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=String(I.preset??"").trim(),M=Number(I.threshold);if(!A)return x({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(M))return x({ok:!1,error:"A numeric threshold is required."},422);return x(await FS(m,Ce,A,M))}if(z.pathname==="/api/serverless/alarms"&&D.method==="DELETE"){let I=await D.json().catch(()=>({})),A=String(I.name??"").trim();if(!A)return x({ok:!1,error:"An alarm name is required."},422);if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to delete this alarm.`},409);return x(await zS(m,Ce,A))}if(z.pathname==="/api/serverless/traces"&&D.method==="GET"){let I=Number(z.searchParams.get("minutes"))||30;return x(await ml(m,Ce,I))}if(z.pathname==="/api/serverless/scheduler"&&D.method==="POST"){let I=await D.json().catch(()=>({})),A=String(I.action??"").trim();if(A!=="enable"&&A!=="disable"&&A!=="run")return x({ok:!1,error:"Unknown scheduler action."},422);if(I.confirm!==A)return x({ok:!1,error:`Type "${A}" to ${A} the scheduler.`},409);return x(await vm(m,Ce,A))}if(!nw(z.pathname,$n))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(Ce)}`}});let Ho=await Ut(pe,Ce);if(!Ho)return bl("ts-cloud dashboard UI is unavailable.",503);return iw(Ho,z.pathname)}catch(co){if(e.verbose)console.error(co);return x({ok:!1,error:co?.message??String(co)},500)}})();if(!hr)return hr;if(bt&&(z.pathname.startsWith("/api/")||z.pathname.startsWith("/auth/"))){let at;if((Le.headers.get("content-type")||"").includes("application/json"))at=await Le.json().catch(()=>{return});let xr=er.resolveUser(D),Rr=xr?We(xr).actor:void 0;y.store.appendEvent({organizationId:y.organization.id,projectId:y.project.id,actorId:Rr?.id,correlationId:Ge,type:hr.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:hr.status<400?"info":"warning",payload:K_(D.method,z.pathname,at,hr.status,Date.now()-Ue)})}return hr.headers.set("x-request-id",Ge),hr}});Rc?.start();let bw=e.spendLoop??!0,zm;if(bw)(async()=>{let{SpendRunner:D,SpendLoopLease:Fe,startSpendLoop:Ue}=await import("./spend/index.js"),{store:Le}=await sw(y.store),Ge=new D({controlPlane:y.store,store:Le,alerts:ot});zm=Ue(Ge,{lease:new Fe(y.store,{owner:`dashboard:${process.pid}`}),onError:(bt)=>console.error(`[ts-cloud] spend cycle failed: ${bt instanceof Error?bt.message:String(bt)}`)})})();let Sw=Fo.stop.bind(Fo);return Fo.stop=(D)=>{clearInterval(Bm),clearInterval(Mm),clearInterval(Lm),clearInterval(jm),clearInterval(Nm),clearInterval(xm),clearInterval(Dm),clearInterval(Om),clearInterval($m),it(),vr.clear(),Rc?.stop(),zm?.();let Fe=Sw(D);if(Rc)Rc.settled().finally(()=>y.store.close());else y.store.close();return Fe},{server:Fo,url:`http://${r}:${Fo.port}/`}}export{Vo,yf,Ll,uS,Ji,$l,qo,Sf,If,on,jo,Ml,Ye,Fl,Ul,Ql,Xi,an,bf,Ze,Hl,zo,Ko,Wo,Gl,Vl,ql,Yi,Jo,jl,cn,Zi,Xo,Et,Cf,zl,Kl,Ef,Wl,Yo,ir,Jl,Xl,Yl,Zl,et,vf,eu,sr,Zo,ea,ta,es,ts,dn,tu,rs,ra,na,ln,ru,un,Tf,wf,vt,gn,ia,Rf,nu,iu,sa,su,ou,au,gS,se,cu,pS,mS,ns,is,fS,Ae,Df,Tt,ke,Be,wt,du,lu,uu,gu,Pf,Nf,oa,kf,Bf,aa,pu,mu,xf,oe,Of,fu,ye,ca,tt,Rt,Dt,pn,ss,hu,hS,da,_f,Lf,$f,Mf,la,ua,Au,mn,ga,yu,os,Su,pa,ma,fa,ha,Aa,ya,Sa,Ia,Iu,or,ba,bu,fn,Cu,Ca,Ea,Eu,ar,va,Ta,Ff,AS,as,yS,SS,IS,wa,Ra,vu,Uf,Da,hn,Tu,cs,wu,Ru,Du,Pa,Qf,Na,Pu,Hf,ka,Gf,An,yn,Nu,ds,ku,Bu,xu,Ba,Ou,_u,Vf,Lu,C,$u,ls,xe,Mu,Fu,bS,Uu,Qu,Hu,Gu,Vu,qf,CS,ES,vS,jf,zf,TS,wS,Kf,Wf,RS,us,cr,xa,Sn,In,dr,rt,Pt,gs,Jf,bn,qu,ju,Oa,Xf,_a,Yf,Zf,zu,La,ps,Ku,$a,Nt,Oe,Wu,Ma,Fa,Ju,Ua,Qa,Ha,Ga,Xu,Yu,Cn,Va,qa,ja,za,Zu,ms,En,fs,Ka};