@stacksjs/ts-cloud 0.16.47 → 0.16.48

package/dist/bin/{chunk-nmr484r7.js → chunk-g2kmr82n.js}

@@ -1,4 +1,4 @@
-import{ia,Fe,A,H,w,B,xe,Jt}from"./chunk-dj03v81n.js";import{ae,fn,re,hn,h,Or,ra}from"./chunk-znd507q9.js";import{Le,S,gs,hr,mi,gi,mt,nn,vc,$t,on,Je,Me,Xe,Cc,ft,yr,Ue,Qe,fi,hi,io,oo,Ye,sn,vr,ht,m,go,Ps,Ds}from"./chunk-ym9h629y.js";import{zt,p}from"./chunk-psvqpztv.js";import{g}from"./chunk-12x968en.js";import{me}from"./chunk-z8k9mcn5.js";import{Dr,Tt,kr,Nr,xr,_r,gn}from"./chunk-cz2wq0tf.js";import{qe,ur,Yi,O,tn,mc,gc,_t,li,di}from"./chunk-rxy9fa64.js";import{v}from"./chunk-xdk0gmxt.js";import{oe,G,si}from"./chunk-nhqz2j90.js";import{E}from"./chunk-01w4zbex.js";import{V}from"./chunk-xx9mrcfs.js";import{I}from"./chunk-de69nra4.js";import{J,P,U,Ir,xo,Pr,un}from"./chunk-yp3a0j9n.js";import{wo}from"./chunk-gyvkravq.js";import{K,Os,$s,Po,Bt,z,Ls}from"./chunk-qq1f07te.js";import{js,Vs}from"./chunk-her9ny96.js";import{ms}from"./chunk-nj9x0tb8.js";import{rn}from"./chunk-5nmt4s5w.js";import{_,N,ea}from"./chunk-kbwm0sqv.js";import{createHash as jT}from"node:crypto";import{existsSync as uo,mkdtempSync as cp,readdirSync as cb,rmSync as fs,statSync as Sb}from"node:fs";import{readFile as Li,writeFile as ls}from"node:fs/promises";import{tmpdir as kd}from"node:os";import{dirname as UT,extname as Fa,join as Ct,normalize as zT,relative as VT,resolve as qT,sep as GT}from"node:path";import{fileURLToPath as JT}from"node:url";class $d extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class Gi{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new $d(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as TS}from"node:crypto";import{lstatSync as Nb,readdirSync as Mb,readFileSync as $b}from"node:fs";import{relative as Lb,resolve as xp,sep as Bb}from"node:path";function Fb(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function zo(e,t,r){return{path:e,reason:t,weight:r}}function Dp(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function ws(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function kt(e){let t=Fb(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(ws("dockerfile","dockerfile",0.99,[zo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=Dp(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(ws("laravel","server",0.98,[zo("artisan","Laravel Artisan entrypoint is present.",0.45),zo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(ws("php","server",0.82,[zo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=Dp(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",u=[zo("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)u.push(zo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,f=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(ws(c,f.kind,Math.min(0.94,u.reduce((T,R)=>T+R.weight,0)),u,f,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(ws("static","static",0.78,[zo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(ws("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function Jn(e,t={}){let r=xp(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),u=(a)=>{for(let f of Mb(a).sort()){if(c.has(f))continue;let T=xp(a,f),R=Lb(r,T).split(Bb).join("/");if(!R||R.startsWith("../"))throw Error("Detection path escaped the application root");let D=Nb(T);if(D.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${R}`);if(D.isDirectory())u(T);else if(D.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let W={path:R,size:D.size};if(s.has(R)&&D.size<=i)W.content=$b(T,"utf8");o.push(W)}}};return u(r),o}function Bd(e){if(Array.isArray(e))return`[${e.map(Bd).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${Bd(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function pa(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function pn(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function Ld(e){return JSON.parse(JSON.stringify(e))}function jb(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return Ld({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return Ld({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return Ld({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function ce(e,t=[]){let r=[],n=(W)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(W),i=Object.fromEntries(Object.entries(e.environment??{}).map(([W,Y])=>{if(typeof Y==="string"&&n(W))return r.push(pn(`environment.${W}`,"write_only_secret_required",`${W} must be supplied through the write-only secrets boundary.`)),[W,{secretRef:W}];return[W,Y]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let W=Object.fromEntries(Object.entries(e.build.buildArgs).map(([Y,ee])=>{if(n(Y))return r.push(pn(`build.buildArgs.${Y}`,"write_only_build_secret_required",`${Y} must be declared in secretNames instead of buildArgs.`)),[Y,"[REDACTED]"];return[Y,ee]}));o={...e.build,buildArgs:W}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(pn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!pa((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(pn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((W)=>!pa(W)))r.push(pn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!pa(e.build.context)||!pa(e.build.dockerfile)))r.push(pn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!pa(e.build.publishDirectory))r.push(pn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(pn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(pn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(pn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(pn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(pn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(pn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(pn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((W)=>typeof W==="object"?[W.secretRef]:[]),u=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),f=u.filter((W)=>!a.has(W)),T={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},R=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),D=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&f.length===0,issues:r,missingSecrets:f,manifest:T,configPatch:jb({...e,build:o,environment:i}),capabilityRequirements:R,costDrivers:D,serializedManifest:`${Bd(T)}
+import{ia,Fe,A,H,w,B,xe,Jt}from"./chunk-dj03v81n.js";import{ae,fn,re,hn,h,Or,ra}from"./chunk-znd507q9.js";import{Le,S,gs,hr,mi,gi,mt,nn,vc,$t,on,Je,Me,Xe,Cc,ft,yr,Ue,Qe,fi,hi,io,oo,Ye,sn,vr,ht,m,go,Ps,Ds}from"./chunk-ym9h629y.js";import{zt,p}from"./chunk-psvqpztv.js";import{g}from"./chunk-12x968en.js";import{me}from"./chunk-z8k9mcn5.js";import{Dr,Tt,kr,Nr,xr,_r,gn}from"./chunk-cz2wq0tf.js";import{qe,ur,Yi,O,tn,mc,gc,_t,li,di}from"./chunk-nd8vnqk5.js";import{v}from"./chunk-xdk0gmxt.js";import{oe,G,si}from"./chunk-cf3jn2ey.js";import{E}from"./chunk-01w4zbex.js";import{V}from"./chunk-xx9mrcfs.js";import{P}from"./chunk-vhyp4xj0.js";import{J,I,U,Ir,xo,Pr,un}from"./chunk-3pazrfsf.js";import{wo}from"./chunk-gyvkravq.js";import{K,Os,$s,Po,Bt,z,Ls}from"./chunk-4mecfcjk.js";import{js,Vs}from"./chunk-psmpw0ap.js";import{ms}from"./chunk-nj9x0tb8.js";import{rn}from"./chunk-5nmt4s5w.js";import{_,N,ea}from"./chunk-kbwm0sqv.js";import{createHash as jT}from"node:crypto";import{existsSync as uo,mkdtempSync as cp,readdirSync as cb,rmSync as fs,statSync as Sb}from"node:fs";import{readFile as Li,writeFile as ls}from"node:fs/promises";import{tmpdir as kd}from"node:os";import{dirname as UT,extname as Fa,join as Ct,normalize as zT,relative as VT,resolve as qT,sep as GT}from"node:path";import{fileURLToPath as JT}from"node:url";class $d extends Error{status;code;requestId;constructor(e,t,r,n){super(r);this.status=e;this.code=t;this.requestId=n}}class Gi{options;baseUrl;fetchFn;constructor(e){this.options=e;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.fetchFn=e.fetch??fetch}async request(e,t={}){let r=await this.fetchFn(`${this.baseUrl}${e}`,{...t,headers:{accept:"application/json",authorization:`Bearer ${this.options.token}`,...t.headers}}),n=await r.json().catch(()=>({}));if(!r.ok)throw new $d(r.status,n.error?.code??"api_error",n.error?.message??"API request failed.",n.error?.requestId??r.headers.get("x-request-id")??void 0);return n}listProjects(e={}){return this.request(`/api/v1/projects?${new URLSearchParams(Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,String(r)])))}`)}listEnvironments(e,t={}){return this.request(`/api/v1/projects/${encodeURIComponent(e)}/environments?${new URLSearchParams(Object.fromEntries(Object.entries(t).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)])))}`)}listServices(e,t){return this.request(`/api/v1/services?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}listOperations(e){return this.request(`/api/v1/operations${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listComposeTemplates(){return this.request("/api/v1/compose-templates")}listComposeApplications(e,t){return this.request(`/api/v1/compose-applications?${new URLSearchParams({projectId:e,...t?{environmentId:t}:{}})}`)}previewCompose(e){return this.request("/api/v1/compose-applications/preview",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createComposeApplication(e){return this.request("/api/v1/compose-applications",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}composeServices(e){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/services`)}composeAction(e,t,r={}){return this.request(`/api/v1/compose-applications/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}releaseCapabilities(e,t={}){return this.request(`/api/v1/releases/capabilities?${new URLSearchParams({kind:e,health:String(!!t.health),replicas:String(t.replicas??1)})}`)}listReleases(e,t={}){return this.request(`/api/v1/releases?${new URLSearchParams({projectId:e,...t})}`)}createReleaseArtifact(e){return this.request("/api/v1/release-artifacts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createRelease(e){return this.request("/api/v1/releases",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}releaseAction(e,t,r={}){return this.request(`/api/v1/releases/${encodeURIComponent(e)}/${t}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)})}createDeployment(e,t){return this.request("/api/v1/deployments",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}detectApplication(e){return this.request("/api/v1/application-detections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}planApplication(e){return this.request("/api/v1/application-plans",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}listApplicationDrafts(e){return this.request(`/api/v1/application-drafts?projectId=${encodeURIComponent(e)}`)}createApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateApplicationDraft(e){return this.request("/api/v1/application-drafts",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createApplication(e,t){return this.request("/api/v1/applications",{method:"POST",headers:{"content-type":"application/json","idempotency-key":t},body:JSON.stringify(e)})}uploadApplicationArtifact(e,t,r){return this.request("/api/v1/application-artifacts",{method:"POST",headers:{"content-type":"application/octet-stream","x-project-id":e,"x-artifact-filename":t},body:r})}listRegistryConnections(){return this.request("/api/v1/registry-connections")}createRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}updateRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}disconnectRegistryConnection(e){return this.request("/api/v1/registry-connections",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({id:e})})}listQueue(e={}){let t=new URLSearchParams(Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>[r,String(n)]));return this.request(`/api/v1/queue?${t}`)}operationLogs(e,t={}){let r=new URLSearchParams(Object.entries(t).filter(([,n])=>n!==void 0).map(([n,i])=>[n,String(i)]));return this.request(`/api/v1/operations/${encodeURIComponent(e)}/logs?${r}`)}streamOperationLogs(e,t=0){return this.fetchFn(`${this.baseUrl}/api/v1/operations/${encodeURIComponent(e)}/logs/stream`,{headers:{accept:"text/event-stream",authorization:`Bearer ${this.options.token}`,"last-event-id":String(t)}})}cancelOperation(e){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/cancel`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}retryOperation(e,t,r=0){return this.request(`/api/v1/operations/${encodeURIComponent(e)}/retry`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({errorClass:t,delayMs:r})})}queueSettings(){return this.request("/api/v1/queue/settings")}updateQueueSettings(e){return this.request("/api/v1/queue/settings",{method:"PATCH",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"update queue limits",concurrency:e})})}listPreviews(e){return this.request(`/api/v1/previews${e?`?projectId=${encodeURIComponent(e)}`:""}`)}listPreviewDefinitions(e){return this.request(`/api/v1/preview-definitions?projectId=${encodeURIComponent(e)}`)}createPreviewDefinition(e){return this.request("/api/v1/preview-definitions",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}createPreview(e){return this.request("/api/v1/previews",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(e)})}destroyPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/destroy`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:t})})}extendPreview(e,t){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/extend`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({hours:t})})}rebuildPreview(e){return this.request(`/api/v1/previews/${encodeURIComponent(e)}/rebuild`,{method:"POST",headers:{"content-type":"application/json"},body:"{}"})}usage(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/usage${t.size>0?`?${t}`:""}`)}usageRollups(e){let t=new URLSearchParams({from:e.from,to:e.to});if(e.projectId)t.set("projectId",e.projectId);if(e.environmentId)t.set("environmentId",e.environmentId);if(e.limit)t.set("limit",String(e.limit));for(let r of e.meters??[])t.append("meter",r);return this.request(`/api/v1/usage/rollups?${t}`)}allowance(e="deploy",t={}){let r=new URLSearchParams({operation:e});if(t.projectId)r.set("projectId",t.projectId);if(t.environmentId)r.set("environmentId",t.environmentId);return this.request(`/api/v1/spend/allowance?${r}`)}budgets(e={}){let t=new URLSearchParams;for(let[r,n]of Object.entries(e))if(n)t.set(r,String(n));return this.request(`/api/v1/spend/budgets${t.size>0?`?${t}`:""}`)}anomalies(e={}){let t=new URLSearchParams;if(e.projectId)t.set("projectId",e.projectId);if(e.since)t.set("since",e.since);if(e.unacknowledged)t.set("unacknowledged","true");return this.request(`/api/v1/spend/anomalies${t.size>0?`?${t}`:""}`)}}import{createHash as TS}from"node:crypto";import{lstatSync as Nb,readdirSync as Mb,readFileSync as $b}from"node:fs";import{relative as Lb,resolve as xp,sep as Bb}from"node:path";function Fb(e){return new Map(e.map((t)=>[t.path.replace(/^\.\//,"").replace(/\\/g,"/"),t]))}function zo(e,t,r){return{path:e,reason:t,weight:r}}function Dp(e){try{return e?.content?JSON.parse(e.content):{}}catch{return{}}}function ws(e,t,r,n,i,o){return{framework:e,strategy:t,confidence:r,evidence:n,defaults:{build:i,runtime:{target:t==="static"?"serverless":t==="serverless"?"serverless":t==="dockerfile"||t==="prebuilt_image"?"container":"server",architecture:"x86_64",port:t==="static"||t==="serverless"?void 0:3000,healthCheck:t==="static"?void 0:{protocol:"http",path:"/health"}}},description:o}}function kt(e){let t=Fb(e.slice(0,1e4)),r=[];if(t.has("Dockerfile"))r.push(ws("dockerfile","dockerfile",0.99,[zo("Dockerfile","A root Dockerfile defines an explicit reproducible build.",1)],{kind:"dockerfile",context:".",dockerfile:"Dockerfile"},"Build the repository with its Dockerfile and run the resulting OCI image."));let n=Dp(t.get("composer.json"));if(t.has("artisan")&&n.require?.["laravel/framework"])r.push(ws("laravel","server",0.98,[zo("artisan","Laravel Artisan entrypoint is present.",0.45),zo("composer.json","Requires laravel/framework.",0.55)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",buildCommand:"php artisan config:cache && php artisan route:cache && php artisan view:cache",startCommand:"php artisan serve --host=0.0.0.0 --port=$PORT"},"Install a production Composer tree, warm Laravel caches, and run the HTTP application."));else if(t.has("composer.json"))r.push(ws("php","server",0.82,[zo("composer.json","Composer metadata identifies a PHP application.",0.8)],{kind:"server",runtime:"php",runtimeVersion:"8.3",installCommand:"composer install --no-dev --prefer-dist --optimize-autoloader",startCommand:"php -S 0.0.0.0:$PORT -t public"},"Install Composer dependencies and run the configured PHP document root."));let i=Dp(t.get("package.json"));if(t.has("package.json")){let o=t.has("bun.lock")||t.has("bun.lockb")||i.engines?.bun,s=o?"bun":"node",c=o?"bun":"node",u=[zo("package.json",`Defines ${i.scripts?.build?"build and ":""}${i.scripts?.start?"start ":""}scripts.`,0.55)];if(o)u.push(zo(t.has("bun.lock")?"bun.lock":t.has("bun.lockb")?"bun.lockb":"package.json","Pins the Bun package manager/runtime.",0.35));let a=!!(i.dependencies?.vite||i.devDependencies?.vite||i.dependencies?.["@stacksjs/bunpress"]||i.devDependencies?.["@stacksjs/bunpress"])&&!i.scripts?.start,f=a?{kind:"static",installCommand:`${s} install --frozen-lockfile`,buildCommand:`${s} run build`,publishDirectory:"dist"}:{kind:"server",runtime:s,installCommand:`${s} install --frozen-lockfile`,buildCommand:i.scripts?.build?`${s} run build`:void 0,startCommand:i.scripts?.start?`${s} run start`:s==="bun"?"bun run index.ts":"node index.js"};r.push(ws(c,f.kind,Math.min(0.94,u.reduce((T,R)=>T+R.weight,0)),u,f,a?"Install dependencies, build static assets, and publish the output directory.":`Install dependencies, build if configured, and start the ${s} server.`))}if(!r.length&&(t.has("index.html")||t.has("public/index.html")))r.push(ws("static","static",0.78,[zo(t.has("index.html")?"index.html":"public/index.html","A static HTML entrypoint is present.",0.78)],{kind:"static",publishDirectory:t.has("index.html")?".":"public"},"Publish the static directory without a runtime process."));if(!r.length)r.push(ws("unknown","buildpack",0.2,[],{kind:"buildpack",runtime:"node"},"No supported framework signature was conclusive; choose commands and runtime manually."));return r.sort((o,s)=>s.confidence-o.confidence||o.framework.localeCompare(s.framework))}function Jn(e,t={}){let r=xp(e),n=t.maxFiles??1e4,i=t.maxContentBytes??262144,o=[],s=new Set(["Dockerfile","package.json","composer.json","index.html","public/index.html","bun.lock","bun.lockb","artisan"]),c=new Set([".git",".ts-cloud",".cache",".next",".nuxt",".output",".turbo",".bun","node_modules","vendor","pantry","dist","build","coverage"]),u=(a)=>{for(let f of Mb(a).sort()){if(c.has(f))continue;let T=xp(a,f),R=Lb(r,T).split(Bb).join("/");if(!R||R.startsWith("../"))throw Error("Detection path escaped the application root");let D=Nb(T);if(D.isSymbolicLink())throw Error(`Detection refuses symbolic links: ${R}`);if(D.isDirectory())u(T);else if(D.isFile()){if(o.length>=n)throw Error("Application file-count limit exceeded");let W={path:R,size:D.size};if(s.has(R)&&D.size<=i)W.content=$b(T,"utf8");o.push(W)}}};return u(r),o}function Bd(e){if(Array.isArray(e))return`[${e.map(Bd).join(",")}]`;if(e&&typeof e==="object")return`{${Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>`${JSON.stringify(t)}:${Bd(r)}`).join(",")}}`;return JSON.stringify(e)??"null"}function pa(e){return!!e&&!e.startsWith("/")&&!e.split("/").includes("..")&&!/[\0\r\n]/.test(e)}function pn(e,t,r,n){return{path:e,code:t,message:r,alternatives:n}}function Ld(e){return JSON.parse(JSON.stringify(e))}function jb(e){let t=Object.fromEntries(Object.entries(e.environment??{}).map(([r,n])=>[r,typeof n==="string"?n:`\${${n.secretRef}}`]));if(e.build.kind==="prebuilt_image"||e.build.kind==="dockerfile")return Ld({infrastructure:{containers:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,cpu:e.runtime.cpu,memory:e.runtime.memoryMb,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,environment:t}}}});if(e.runtime.target==="serverless"||e.build.kind==="serverless")return Ld({serverless:{apps:{[e.slug]:{source:e.source,build:e.build,architecture:e.runtime.architecture,environment:t,domain:e.domain}}}});return Ld({sites:{[e.slug]:{source:e.source,build:e.build,port:e.runtime.port,architecture:e.runtime.architecture,healthCheck:e.runtime.healthCheck,env:t,domain:e.domain?.hostname}}})}function ce(e,t=[]){let r=[],n=(W)=>/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(W),i=Object.fromEntries(Object.entries(e.environment??{}).map(([W,Y])=>{if(typeof Y==="string"&&n(W))return r.push(pn(`environment.${W}`,"write_only_secret_required",`${W} must be supplied through the write-only secrets boundary.`)),[W,{secretRef:W}];return[W,Y]})),o=e.build;if(e.build.kind==="dockerfile"&&e.build.buildArgs){let W=Object.fromEntries(Object.entries(e.build.buildArgs).map(([Y,ee])=>{if(n(Y))return r.push(pn(`build.buildArgs.${Y}`,"write_only_build_secret_required",`${Y} must be declared in secretNames instead of buildArgs.`)),[Y,"[REDACTED]"];return[Y,ee]}));o={...e.build,buildArgs:W}}if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.slug))r.push(pn("slug","invalid_slug","Slug must contain 2-63 lowercase letters, numbers, or hyphens."));if(!pa((e.source.kind==="git"?e.source.monorepoRoot:e.source.kind==="local"?e.source.root:".")??"."))r.push(pn("source","unsafe_source_root","Source root must stay inside the source tree."));if(e.source.kind==="git"&&e.source.sparsePaths?.some((W)=>!pa(W)))r.push(pn("source.sparsePaths","unsafe_sparse_path","Sparse checkout paths must stay inside the repository."));if(e.build.kind==="dockerfile"&&(!pa(e.build.context)||!pa(e.build.dockerfile)))r.push(pn("build","unsafe_docker_path","Docker context and Dockerfile must stay inside the source tree."));if(e.build.kind==="static"&&!pa(e.build.publishDirectory))r.push(pn("build.publishDirectory","invalid_publish_directory","A safe static publish directory is required."));if(e.build.kind==="server"&&!e.build.startCommand.trim())r.push(pn("build.startCommand","missing_start_command","A server start command is required.",["Use static output","Use a Dockerfile"]));if(e.source.kind==="image"&&e.build.kind!=="prebuilt_image")r.push(pn("build.kind","image_requires_prebuilt","An OCI image source must use the prebuilt-image strategy.",["Select prebuilt image"]));if(e.build.kind==="prebuilt_image"&&e.runtime.target!=="container")r.push(pn("runtime.target","image_requires_container","Prebuilt images require the container runtime target.",["Select container target"]));if(e.runtime.target==="serverless"&&e.build.kind==="dockerfile")r.push(pn("runtime.target","unsupported_serverless_dockerfile","Dockerfile builds currently target the container service path.",["Select container target","Select serverless package"]));if(e.runtime.port!==void 0&&(!Number.isInteger(e.runtime.port)||e.runtime.port<1||e.runtime.port>65535))r.push(pn("runtime.port","invalid_port","Port must be an integer from 1 to 65535."));let s=e.runtime.healthCheck;if(s&&s.protocol!=="tcp"&&(!s.path||!s.path.startsWith("/")||/[\r\n]/.test(s.path)))r.push(pn("runtime.healthCheck.path","invalid_health_path","HTTP health checks require a path beginning with /."));if(e.domain?.hostname&&(!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(e.domain.hostname)||e.domain.hostname.includes("..")))r.push(pn("domain.hostname","invalid_domain","Domain must be a valid DNS hostname."));let c=Object.values(i).flatMap((W)=>typeof W==="object"?[W.secretRef]:[]),u=[...new Set([...e.requiredSecretNames??[],...e.build.kind==="dockerfile"?e.build.secretNames??[]:[],...c])].sort(),a=new Set(t),f=u.filter((W)=>!a.has(W)),T={apiVersion:"ts-cloud.dev/v1",kind:"Application",metadata:{name:e.name,slug:e.slug,projectId:e.projectId,environmentId:e.environmentId},spec:{source:e.source,build:o,runtime:e.runtime,environment:i,domain:e.domain}},R=[...new Set([e.source.kind==="git"?"git:read":e.source.kind==="image"?"registry:pull":e.source.kind==="artifact"?"artifact:inspect":"filesystem:read",e.runtime.target==="container"?"containers":e.runtime.target==="serverless"?"serverless":"servers",e.domain?"dns":""])].filter(Boolean).sort(),D=[...new Set([e.runtime.target,e.runtime.cpu?`${e.runtime.cpu} vCPU`:"",e.runtime.memoryMb?`${e.runtime.memoryMb} MB memory`:"",(e.runtime.minInstances??0)>0?`${e.runtime.minInstances} minimum instances`:"scales from zero where supported",e.domain?"managed DNS/TLS":""])].filter(Boolean);return{valid:r.length===0&&f.length===0,issues:r,missingSecrets:f,manifest:T,configPatch:jb({...e,build:o,environment:i}),capabilityRequirements:R,costDrivers:D,serializedManifest:`${Bd(T)}
 `}}function Op(e){let t=e.replace(/\\/g,"/");return!!t&&!t.startsWith("/")&&!/^[A-Za-z]:\//.test(t)&&!t.split("/").includes("..")&&!/[\0\r\n]/.test(t)}function _p(e,t,r={}){let n=r.maxBytes??104857600,i=r.maxEntries??1e4,o=r.maxExpandedBytes??524288000;if(e.byteLength>n)throw Error("Archive exceeds the compressed size limit");let s=new DataView(e.buffer,e.byteOffset,e.byteLength),c=[],u=0;if(t.toLowerCase().endsWith(".zip")||e[0]===80&&e[1]===75){let f=0;while(f+30<=e.length){let T=s.getUint32(f,!0);if(T===33639248||T===101010256)break;if(T!==67324752)throw Error("Malformed ZIP local header");let R=s.getUint16(f+6,!0),D=s.getUint32(f+18,!0),W=s.getUint32(f+22,!0),Y=s.getUint16(f+26,!0),ee=s.getUint16(f+28,!0);if(R&8)throw Error("ZIP data descriptors are not accepted for uploaded artifacts");let ne=new TextDecoder().decode(e.subarray(f+30,f+30+Y));if(!Op(ne))throw Error(`Unsafe archive path: ${ne}`);if(c.push(ne),u+=W,c.length>i||u>o)throw Error("Archive expansion limit exceeded");f+=30+Y+ee+D}return{format:"zip",entries:c.length,expandedBytes:u,paths:c}}if(!t.toLowerCase().match(/\.(?:tar|tar\.gz|tgz)$/))throw Error("Only ZIP and uncompressed TAR artifacts are supported");let a=0;while(a+512<=e.length){let f=e.subarray(a,a+512);if(f.every((Y)=>Y===0))break;let T=(Y,ee)=>new TextDecoder().decode(f.subarray(Y,Y+ee)).replace(/\0.*$/,""),R=`${T(345,155)}${T(345,155)?"/":""}${T(0,100)}`,D=Number.parseInt(T(124,12).trim()||"0",8),W=String.fromCharCode(f[156]??0);if(!Op(R))throw Error(`Unsafe archive path: ${R}`);if(W==="1"||W==="2")throw Error(`Archive links are not accepted: ${R}`);if(!Number.isFinite(D)||D<0)throw Error("Malformed TAR entry size");if(c.push(R),u+=D,c.length>i||u>o)throw Error("Archive expansion limit exceeded");a+=512+Math.ceil(D/512)*512}return{format:"tar",entries:c.length,expandedBytes:u,paths:c}}var Np=new Set(["source","build","runtime","environment","domain","review"]);function Mp(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function $p(e){return/(?:secret|token|password|passwd|private[_-]?key|api[_-]?key)/i.test(e)}function Lp(e){for(let[r,n]of Object.entries(e.environment??{}))if(typeof n==="string"&&$p(r)&&n)throw Error(`${r} must be stored through the write-only secrets boundary`);if(e.build.kind==="dockerfile"){for(let[r,n]of Object.entries(e.build.buildArgs??{}))if($p(r)&&n)throw Error(`${r} must be declared as a build secret name`)}let t=JSON.stringify(e);if(/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Drafts cannot contain credential-bearing URLs")}function Bp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),schemaVersion:Number(e.schema_version),name:String(e.name),step:String(e.step),input:Mp(e.input,{}),suppliedSecretNames:Mp(e.supplied_secret_names,[]),status:String(e.status),version:Number(e.version),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Xn{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}create(e){if(Lp(e.draft),e.draft.projectId!==e.projectId)throw Error("Draft project does not match its storage scope");let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Draft project was not found");let r=this.idFn(),n=this.now(),i=e.step??"source";if(!Np.has(i))throw Error("Invalid draft step");let o=[...new Set(e.suppliedSecretNames??[])].sort(),s=ce(e.draft,o).valid?"ready":"draft";return this.controlPlane.database.run("INSERT INTO application_drafts (id, organization_id, project_id, schema_version, name, step, input, supplied_secret_names, status, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.projectId,e.name.trim().slice(0,100),i,JSON.stringify(e.draft),JSON.stringify(o),s,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.draft.created",payload:{draftId:r,step:i,status:s,requiredSecretNames:e.draft.requiredSecretNames??[]}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_drafts WHERE id=?").get(e);return t?Bp(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_drafts WHERE project_id=? ORDER BY updated_at DESC").all(e).map(Bp)}update(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);if(!Np.has(r.step))throw Error("Invalid draft step");if(r.draft.projectId!==n.projectId)throw Error("Draft project cannot be changed");Lp(r.draft);let i=[...new Set(r.suppliedSecretNames??n.suppliedSecretNames)].sort(),o=ce(r.draft,i).valid?"ready":"draft",s=this.now();if(this.controlPlane.database.run("UPDATE application_drafts SET name=?, step=?, input=?, supplied_secret_names=?, status=?, version=version+1, updated_at=? WHERE id=? AND version=?",[r.draft.name.slice(0,100),r.step,JSON.stringify(r.draft),JSON.stringify(i),o,s,e,t]).changes!==1)throw Error(`Application draft ${e} changed since version ${t}`);return this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r.actorId,type:"application.draft.updated",payload:{draftId:e,fromVersion:t,toVersion:t+1,step:r.step,status:o}}),this.get(e)}markApplied(e,t,r){let n=this.get(e);if(!n||n.version!==t)throw Error(`Application draft ${e} changed since version ${t}`);let i=ce(n.input,n.suppliedSecretNames);if(!i.valid)throw Error(`Draft is not deployable: ${[...i.issues.map((s)=>s.message),...i.missingSecrets.map((s)=>`Missing secret ${s}`)].join("; ")}`);let o=this.now();return this.controlPlane.database.run("UPDATE application_drafts SET status='applied', step='review', version=version+1, updated_at=? WHERE id=? AND version=?",[o,e,t]),this.controlPlane.appendEvent({organizationId:n.organizationId,projectId:n.projectId,actorId:r,type:"application.draft.applied",payload:h({draftId:e,manifest:i.manifest})}),this.get(e)}}import{createCipheriv as Ub,createDecipheriv as zb,createHash as Up,randomBytes as Vb}from"node:crypto";function ga(e){return typeof e==="string"&&e?e:void 0}function Fd(e){return Up("sha256").update(e).digest("hex").slice(0,16)}function Fp(e){let t=new URL(e.includes("://")?e:`https://${e}`);if(t.protocol!=="https:"&&!["localhost","127.0.0.1","::1"].includes(t.hostname))throw Error("Registry host must use HTTPS");if(t.username||t.password||t.search||t.hash)throw Error("Registry host cannot contain credentials");return`${t.protocol}//${t.host}`}function qb(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:ga(e.credential_fingerprint),credentialExpiresAt:ga(e.credential_expires_at),status:String(e.status),healthMessage:ga(e.health_message),lastTestedAt:ga(e.last_tested_at),version:Number(e.version),createdByActorId:ga(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class Qn{controlPlane;key;nowFn;idFn;constructor(e,t){this.controlPlane=e;if(!t.encryptionKey)throw Error("Registry encryption key is required");this.key=Up("sha256").update(`ts-cloud:registry:${t.encryptionKey}`).digest(),this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}encrypt(e){let t=Vb(12),r=Ub("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Registry credential envelope is invalid");let o=zb("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}current(e){let t=qb(e);return t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime()?{...t,status:"expired",healthMessage:"Registry credential expired; rotate it before pulling images."}:t}create(e){if(!["docker_hub","ghcr","ecr","gcr","generic"].includes(e.provider))throw Error("A supported registry provider is required");let t=e.credential?JSON.stringify(e.credential):void 0,r=this.idFn(),n=this.now();return this.controlPlane.database.run("INSERT INTO registry_connections (id, organization_id, provider, name, host, credential_ciphertext, credential_fingerprint, credential_expires_at, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.provider,e.name.trim().slice(0,80),Fp(e.host),t?this.encrypt(t):null,t?Fd(t):null,e.credentialExpiresAt??null,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.actorId,type:"registry.connection.created",payload:{connectionId:r,provider:e.provider,host:Fp(e.host),credentialConfigured:!!t}}),this.get(r)}get(e){let t=this.controlPlane.database.query("SELECT * FROM registry_connections WHERE id=?").get(e);return t?this.current(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM registry_connections WHERE organization_id=? ORDER BY name").all(e).map((t)=>this.current(t))}credential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM registry_connections WHERE id=?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotate(e,t,r={}){let n=this.get(e);if(!n||n.status==="disconnected")throw Error("Registry connection was not found");let i=JSON.stringify(t);return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=?, credential_fingerprint=?, credential_expires_at=?, status='pending', health_message=NULL, version=version+1, updated_at=? WHERE id=?",[this.encrypt(i),Fd(i),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"registry.credential.rotated",payload:{connectionId:e,fingerprint:Fd(i),expiresAt:r.expiresAt??null}}),this.get(e)}disconnect(e,t){let r=this.get(e);if(!r)throw Error("Registry connection was not found");return this.controlPlane.database.run("UPDATE registry_connections SET credential_ciphertext=NULL, credential_fingerprint=NULL, status='disconnected', health_message='Disconnected by an administrator', version=version+1, updated_at=? WHERE id=?",[this.now(),e]),this.controlPlane.appendEvent({organizationId:r.organizationId,actorId:t,type:"registry.connection.disconnected",level:"warning",payload:{connectionId:e}}),this.get(e)}async test(e,t={}){let r=this.get(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active registry connection was not found");let n=this.credential(e),i=t.fetch??fetch,o=new AbortController,s=setTimeout(()=>o.abort(),t.timeoutMs??15000),c=n?.token?`Bearer ${n.token}`:n?.username||n?.password?`Basic ${Buffer.from(`${n.username??""}:${n.password??""}`).toString("base64")}`:void 0;try{let u=await i(`${r.host}/v2/`,{method:"GET",redirect:"error",signal:o.signal,headers:c?{Authorization:c}:void 0}),a=u.headers.get("www-authenticate")??"";if(u.status===401&&a.startsWith("Bearer ")&&n){let R=Object.fromEntries([...a.slice(7).matchAll(/(\w+)="([^"]+)"/g)].map((ne)=>[ne[1],ne[2]])),D=new URL(R.realm??"");if(D.protocol!=="https:")throw Error("Registry authentication realm must use HTTPS");if(R.service)D.searchParams.set("service",R.service);if(t.image)D.searchParams.set("scope",`repository:${zp(t.image).repository}:pull`);let W=await i(D,{signal:o.signal,redirect:"error",headers:c?{Authorization:c}:void 0});if(!W.ok)throw Error(`Registry authentication failed (${W.status})`);let Y=await W.json(),ee=Y.token??Y.access_token;if(!ee)throw Error("Registry did not return an access token");u=t.image?await jp(i,r.host,t.image,ee,o.signal):await i(`${r.host}/v2/`,{signal:o.signal,redirect:"error",headers:{Authorization:`Bearer ${ee}`}})}else if(u.ok&&t.image)u=await jp(i,r.host,t.image,n?.token,o.signal,c);let f=u.ok?"healthy":"degraded",T=u.ok?t.image?"Registry image is readable.":"Registry connection is healthy.":`Registry request failed (${u.status})`;return this.controlPlane.database.run("UPDATE registry_connections SET status=?, health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[f,T,this.now(),this.now(),e]),this.get(e)}catch(u){let a=o.signal.aborted?"Registry request timed out.":u instanceof Error?u.message:"Registry test failed";return this.controlPlane.database.run("UPDATE registry_connections SET status='degraded', health_message=?, last_tested_at=?, version=version+1, updated_at=? WHERE id=?",[a.slice(0,1000),this.now(),this.now(),e]),this.get(e)}finally{clearTimeout(s)}}}function zp(e){let t=e.replace(/^https?:\/\//,""),r=t.indexOf("/");if(r<1)throw Error("Image must include registry/repository");let n=t.slice(r+1),i=n.lastIndexOf("@"),o=n.lastIndexOf(":"),s=i>=0?i:o>n.lastIndexOf("/")?o:-1,c=s>=0?n.slice(0,s):n,u=s>=0?n.slice(s+1):"latest";if(!/^[A-Za-z0-9_.\/-]+$/.test(c)||!/^[A-Za-z0-9_.:+-]+$/.test(u))throw Error("Image reference is invalid");return{repository:c,reference:u}}async function jp(e,t,r,n,i,o){let s=zp(r);return e(`${t}/v2/${s.repository}/manifests/${encodeURIComponent(s.reference)}`,{method:"HEAD",redirect:"error",signal:i,headers:{Accept:"application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json",...n?{Authorization:`Bearer ${n}`}:o?{Authorization:o}:{}}})}import{createHash as Gb}from"node:crypto";import{chmodSync as Vp,existsSync as qp,mkdirSync as Jb,renameSync as Hb,unlinkSync as Gp,writeFileSync as Wb}from"node:fs";import{basename as Kb,join as Qb}from"node:path";function jd(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),filename:String(e.filename),sha256:String(e.sha256),size:Number(e.size),format:String(e.format),entryCount:Number(e.entry_count),expandedBytes:Number(e.expanded_bytes),createdByActorId:e.created_by_actor_id?String(e.created_by_actor_id):void 0,createdAt:String(e.created_at)}}class Yn{controlPlane;root;idFn;nowFn;constructor(e,t){this.controlPlane=e;this.root=A(t.cwd,"artifacts"),this.idFn=t.id??(()=>crypto.randomUUID()),this.nowFn=t.now??(()=>new Date)}create(e){let t=this.controlPlane.getProject(e.projectId);if(!t||t.organizationId!==e.organizationId)throw Error("Artifact project was not found");let r=Kb(e.filename).slice(0,200);if(!r||r!==e.filename)throw Error("Artifact filename must not contain a path");let n=_p(e.bytes,r),i=Gb("sha256").update(e.bytes).digest("hex"),o=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? AND sha256=?").get(e.projectId,i);if(o)return jd(o);let s=this.idFn();Jb(this.root,{recursive:!0,mode:448}),Vp(this.root,448);let c=Qb(this.root,`${s}.archive`),u=`${c}.partial`;try{Wb(u,e.bytes,{mode:384,flag:"wx"}),Hb(u,c),Vp(c,384),this.controlPlane.database.run("INSERT INTO application_artifacts (id, organization_id, project_id, filename, storage_path, sha256, size, format, entry_count, expanded_bytes, created_by_actor_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[s,e.organizationId,e.projectId,r,c,i,e.bytes.byteLength,n.format,n.entries,n.expandedBytes,e.actorId??null,this.nowFn().toISOString()])}catch(a){if(qp(u))Gp(u);if(qp(c))Gp(c);throw a}return this.controlPlane.appendEvent({organizationId:e.organizationId,projectId:e.projectId,actorId:e.actorId,type:"application.artifact.created",payload:{artifactId:s,filename:r,sha256:i,size:e.bytes.byteLength,entries:n.entries}}),this.get(s)}get(e){let t=this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE id=?").get(e);return t?jd(t):void 0}list(e){return this.controlPlane.database.query("SELECT * FROM application_artifacts WHERE project_id=? ORDER BY created_at DESC").all(e).map(jd)}}function zr(e){let t=e.drafts.get(e.draftId);if(!t||t.version!==e.expectedVersion)throw Error(`Application draft ${e.draftId} changed since version ${e.expectedVersion}`);if(t.status==="applied")throw Error("Application draft was already applied");let r=e.controlPlane.getProject(t.projectId),n=r?e.controlPlane.listEnvironments(r.id).find((a)=>a.id===t.input.environmentId):void 0;if(!r||!n||n.projectId!==r.id||r.organizationId!==t.organizationId)throw Error("Draft deployment scope was not found");if(e.confirmEnvironment!==n.slug)throw Error(`Type ${n.slug} to confirm this deployment target`);let i=ce(t.input,t.suppliedSecretNames);if(!i.valid)throw Error(`Application plan is invalid: ${[...i.issues.map((a)=>a.message),...i.missingSecrets.map((a)=>`Missing secret ${a}`)].join("; ")}`);let o=e.controlPlane.listResources(r.id,n.id).find((a)=>a.kind==="application"&&a.slug===t.input.slug),s=JSON.parse(JSON.stringify({manifest:i.manifest,configPatch:i.configPatch})),c=o?e.controlPlane.updateResource(o.id,o.version,{name:t.input.name,desiredState:s}):e.controlPlane.createResource({projectId:r.id,environmentId:n.id,kind:"application",slug:t.input.slug,name:t.input.name,desiredState:s,metadata:{source:"application-onboarding",draftId:t.id}}),u=new S(e.controlPlane).enqueue({projectId:r.id,environmentId:n.id,resourceId:c.id,actorId:e.actorId,kind:"application.create",idempotencyKey:`application-draft:${t.id}:v${t.version}`,correlationId:`application-draft:${t.id}`,input:s,lockKey:`resource:${c.id}`,providerKey:c.provider??"default",buildSlot:t.input.build.kind!=="prebuilt_image",maxAttempts:3,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:90}).operation;return e.drafts.markApplied(t.id,t.version,e.actorId),e.controlPlane.appendEvent({organizationId:t.organizationId,projectId:r.id,resourceId:c.id,operationId:u.id,actorId:e.actorId,type:"application.create.queued",payload:{draftId:t.id,environment:n.slug,strategy:t.input.build.kind,costDrivers:i.costDrivers}}),{plan:i,resource:c,operation:u}}function sr(e){let t=["static","compute","serverless_zip","serverless_image"].includes(e.kind),r=["container","compose"].includes(e.kind)&&(e.replicas??1)>1,n=e.kind==="container"||e.kind==="serverless_zip"||e.kind==="serverless_image",i=(o,s)=>s&&(o==="atomic"?e.kind==="static"||e.hasHealthGate:e.hasHealthGate);return[{strategy:"atomic",supported:i("atomic",t),explanation:t?e.hasHealthGate||e.kind==="static"?"Activate an immutable version with an atomic pointer/alias switch.":"Atomic activation needs a readiness gate for this runtime.":"This driver has no atomic pointer or alias primitive.",capacityMultiplier:1,costImpact:"none",rollback:"Switch the pointer/alias back to the previous immutable release."},{strategy:"rolling",supported:i("rolling",r),explanation:r?e.hasHealthGate?"Replace healthy replicas within the configured capacity envelope.":"Rolling activation requires a health/readiness gate.":"Rolling activation requires a capable container/Compose driver and at least two replicas.",capacityMultiplier:1.5,costImpact:"temporary",rollback:"Stop replacement and restore the prior task/service definition."},{strategy:"blue_green",supported:i("blue_green",n),explanation:n?e.hasHealthGate?"Provision a complete green target and switch traffic after health passes.":"Blue-green requires a health gate before traffic can switch.":"The provider does not expose two traffic-addressable revisions.",capacityMultiplier:2,costImpact:"temporary",rollback:"Return all traffic to the preserved blue target."},{strategy:"canary",supported:i("canary",n),explanation:n?e.hasHealthGate?"Shift bounded traffic steps while evaluating health.":"Canary requires a health gate and measurable traffic target.":"The provider does not expose weighted traffic primitives.",capacityMultiplier:1.25,costImpact:"temporary",rollback:"Set canary weight to zero and preserve its diagnostics."}]}function Ha(e,t){let r=sr(e).find((n)=>n.strategy===t);if(!r.supported)throw Error(`${t} is unavailable: ${r.explanation}`);return r}import{createHash as Yb}from"node:crypto";var Xb=/^sha256:[a-f0-9]{64}$/,Zb=/^[a-f0-9]{40,64}$/i;function Di(e){return typeof e==="string"&&e?e:void 0}function Vo(e,t){try{return JSON.parse(String(e))}catch{return t}}function Jp(e){return{id:String(e.id),organizationId:String(e.organization_id),digest:String(e.digest),kind:String(e.kind),uri:String(e.uri),size:Number(e.size),mediaType:String(e.media_type),provenance:Vo(e.provenance,{}),attestation:Vo(e.attestation,{}),verifiedAt:String(e.verified_at),createdAt:String(e.created_at)}}function Hp(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),resourceId:String(e.resource_id),artifactId:String(e.artifact_id),kind:String(e.kind),sourceSha:Di(e.source_sha),configHash:String(e.config_hash),manifest:Vo(e.manifest,{}),provenance:Vo(e.provenance,{}),strategy:String(e.strategy),status:String(e.status),healthGate:e.health_gate==null?void 0:Vo(e.health_gate,void 0),hooks:Vo(e.hooks,{migrations:"none",preActivate:[],postActivate:[]}),drainSeconds:Number(e.drain_seconds),graceSeconds:Number(e.grace_seconds),automaticRollback:Number(e.automatic_rollback)===1,rollbackAttempts:Number(e.rollback_attempts),previousReleaseId:Di(e.previous_release_id),promotedFromReleaseId:Di(e.promoted_from_release_id),actorId:Di(e.actor_id),trigger:String(e.trigger),pinned:Number(e.pinned)===1,pinReason:Di(e.pin_reason),activatedAt:Di(e.activated_at),failedAt:Di(e.failed_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function eS(e){return{sequence:Number(e.sequence),id:String(e.id),releaseId:String(e.release_id),fromStatus:Di(e.from_status),toStatus:String(e.to_status),trafficPercent:e.traffic_percent==null?void 0:Number(e.traffic_percent),health:Vo(e.health,{}),message:String(e.message),operationId:Di(e.operation_id),createdAt:String(e.created_at)}}function tS(e,t){let r=[],n=(i,o,s)=>{if(JSON.stringify(o)===JSON.stringify(s))return;if(o&&s&&typeof o==="object"&&typeof s==="object"&&!Array.isArray(o)&&!Array.isArray(s)){for(let c of[...new Set([...Object.keys(o),...Object.keys(s)])].sort())n(i?`${i}.${c}`:c,o[c],s[c]);return}r.push({path:i,...o!==void 0?{before:o}:{},...s!==void 0?{after:s}:{}})};return n("",e,t),r}class Ud{controlPlane;now;id;constructor(e,t={}){this.controlPlane=e;this.now=t.now??(()=>new Date),this.id=t.id??(()=>crypto.randomUUID())}registerArtifact(e){if(!Xb.test(e.digest)||!/^(?:s3|https|oci|file):/.test(e.uri)||!Number.isInteger(e.size)||e.size<0)throw Error("Artifact requires a SHA-256 digest, supported immutable URI, and non-negative byte size");let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE organization_id=? AND digest=?").get(e.organizationId,e.digest);if(t)return Jp(t);let r=this.id(),n=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_artifacts (id, organization_id, digest, kind, uri, size, media_type, provenance, attestation, verified_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.organizationId,e.digest,e.kind,e.uri,e.size,e.mediaType??"application/octet-stream",JSON.stringify(h(e.provenance??{})),JSON.stringify(h(e.attestation??{})),n,n]),this.getArtifact(r)}getArtifact(e){let t=this.controlPlane.database.query("SELECT * FROM release_artifacts WHERE id=?").get(e);return t?Jp(t):void 0}create(e){let t=this.getArtifact(e.artifactId),r=this.controlPlane.getResource(e.resourceId),n=this.controlPlane.listEnvironments(e.projectId).find((T)=>T.id===e.environmentId);if(!t||t.organizationId!==e.organizationId||t.kind!==e.kind)throw Error("Release artifact does not match the organization and deployable kind");if(!r||r.projectId!==e.projectId||r.environmentId!==e.environmentId||!n)throw Error("Release target scope does not match the resource");if(e.sourceSha&&!Zb.test(e.sourceSha))throw Error("Release source must be an immutable commit SHA");Ha({kind:e.kind,provider:r.provider,hasHealthGate:!!e.healthGate,replicas:e.replicas},e.strategy);let i=h(e.config),o=Yb("sha256").update(JSON.stringify(i)).digest("hex"),s=this.active(e.resourceId),c=this.id(),u=this.now().toISOString(),a=e.approvalRequired?"awaiting_approval":"built",f=e.hooks??{migrations:"none",preActivate:[],postActivate:[]};return this.controlPlane.database.run("INSERT INTO releases (id, organization_id, project_id, environment_id, resource_id, artifact_id, kind, source_sha, config_hash, manifest, provenance, strategy, status, health_gate, hooks, drain_seconds, grace_seconds, automatic_rollback, previous_release_id, promoted_from_release_id, actor_id, trigger, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[c,e.organizationId,e.projectId,e.environmentId,e.resourceId,e.artifactId,e.kind,e.sourceSha??null,o,JSON.stringify(h(e.manifest)),JSON.stringify(h(e.provenance??{})),e.strategy,a,e.healthGate?JSON.stringify(e.healthGate):null,JSON.stringify(f),Math.max(0,Math.min(3600,Math.floor(e.drainSeconds??30))),Math.max(0,Math.min(3600,Math.floor(e.graceSeconds??30))),e.automaticRollback===!1?0:1,s?.id??null,e.promotedFromReleaseId??null,e.actorId??null,e.trigger??"manual",u,u]),this.recordTransition(c,void 0,a,{message:e.promotedFromReleaseId?"Immutable artifact promoted without rebuild.":"Immutable release record created."}),this.get(c)}get(e){let t=this.controlPlane.database.query("SELECT * FROM releases WHERE id=?").get(e);return t?Hp(t):void 0}list(e={}){return this.controlPlane.database.query("SELECT * FROM releases ORDER BY created_at DESC, rowid DESC").all().map(Hp).filter((t)=>(!e.projectId||t.projectId===e.projectId)&&(!e.environmentId||t.environmentId===e.environmentId)&&(!e.resourceId||t.resourceId===e.resourceId)&&(!e.status||t.status===e.status))}active(e){return this.list({resourceId:e,status:"active"})[0]}transitions(e){return this.controlPlane.database.query("SELECT * FROM release_transitions WHERE release_id=? ORDER BY sequence").all(e).map(eS)}recordTransition(e,t,r,n){this.controlPlane.database.run("INSERT INTO release_transitions (id, release_id, from_status, to_status, traffic_percent, health, message, operation_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",[this.id(),e,t??null,r,n.trafficPercent??null,JSON.stringify(h(n.health??{})),n.message.slice(0,1000),n.operationId??null,this.now().toISOString()])}progress(e,t){let r=this.get(e);if(!r)throw Error(`Release ${e} was not found`);return this.recordTransition(e,r.status,r.status,t),this.transitions(e).at(-1)}transition(e,t,r){let n=this.get(e);if(!n)throw Error(`Release ${e} was not found`);if(!{built:["awaiting_approval","activating","failed"],awaiting_approval:["built","failed"],activating:["active","failed","rolled_back"],active:["superseded","failed","rolled_back"],failed:["activating","rolled_back"],rolled_back:["activating"],superseded:["activating"]}[n.status].includes(t))throw Error(`Invalid release transition ${n.status} → ${t}`);let o=this.now().toISOString();if(t==="active"){let s=this.active(n.resourceId);if(s&&s.id!==e)this.controlPlane.database.run("UPDATE releases SET status='superseded', updated_at=? WHERE id=?",[o,s.id]),this.recordTransition(s.id,"active","superseded",{message:`Superseded by ${e}.`,operationId:r.operationId})}return this.controlPlane.database.run("UPDATE releases SET status=?, rollback_attempts=rollback_attempts+?, activated_at=CASE WHEN ?='active' THEN ? ELSE activated_at END, failed_at=CASE WHEN ?='failed' THEN ? ELSE failed_at END, updated_at=? WHERE id=?",[t,t==="rolled_back"?1:0,t,o,t,o,o,e]),this.recordTransition(e,n.status,t,r),this.get(e)}approve(e,t){let r=this.get(e);if(!r||r.status!=="awaiting_approval")throw Error("Release is not awaiting approval");let n=this.id(),i=this.now().toISOString();return this.controlPlane.database.run("INSERT INTO release_approvals (id, release_id, environment_id, decision, actor_id, comment, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[n,e,r.environmentId,t.decision,t.actorId,t.comment?.slice(0,1000)??null,i]),this.transition(e,t.decision==="approved"?"built":"failed",{message:t.decision==="approved"?"Environment gate approved.":"Environment gate rejected."})}approvals(e){return this.controlPlane.database.query("SELECT * FROM release_approvals WHERE release_id=? ORDER BY created_at").all(e).map((t)=>({id:String(t.id),releaseId:String(t.release_id),environmentId:String(t.environment_id),decision:String(t.decision),actorId:String(t.actor_id),comment:Di(t.comment),createdAt:String(t.created_at)}))}promote(e,t){let r=this.get(e);if(!r||!["active","superseded"].includes(r.status))throw Error("Only a tested active/superseded release can be promoted");return this.create({organizationId:r.organizationId,projectId:r.projectId,environmentId:t.targetEnvironmentId,resourceId:t.targetResourceId,artifactId:r.artifactId,kind:r.kind,sourceSha:r.sourceSha,config:t.config,manifest:r.manifest,provenance:r.provenance,strategy:t.strategy??r.strategy,healthGate:t.healthGate??r.healthGate,hooks:r.hooks,drainSeconds:r.drainSeconds,graceSeconds:r.graceSeconds,automaticRollback:r.automaticRollback,promotedFromReleaseId:r.id,actorId:t.actorId,trigger:"promotion",approvalRequired:t.approvalRequired})}compare(e,t){let r=this.get(e),n=this.get(t);if(!r||!n)throw Error("Both releases are required for comparison");return{artifactChanged:r.artifactId!==n.artifactId,sourceChanged:r.sourceSha!==n.sourceSha,configChanged:r.configHash!==n.configHash,manifestChanges:tS(r.manifest,n.manifest),dataCaveat:n.hooks.migrations==="none"?"No database migration is recorded.":`Database hooks are ${n.hooks.migrations}; release rollback does not roll back data.`}}pin(e,t,r){if(!this.get(e))throw Error("Release was not found");return this.controlPlane.database.run("UPDATE releases SET pinned=?, pin_reason=?, updated_at=? WHERE id=?",[t?1:0,t?r?.slice(0,500)??"operator":null,this.now().toISOString(),e]),this.get(e)}retentionCandidates(e){let t=Math.max(1,Math.min(100,Math.floor(e.keepPerResource??10))),r=new Map;for(let n of this.list()){let i=r.get(n.resourceId)??[];i.push(n),r.set(n.resourceId,i)}return[...r.values()].flatMap((n)=>n.slice(t)).filter((n)=>new Date(n.createdAt)<e.before&&!n.pinned&&!["active","activating","awaiting_approval"].includes(n.status)&&!this.list().some((i)=>i.previousReleaseId===n.id&&["active","activating"].includes(i.status)))}}class st{controlPlane;releases;queue;constructor(e){this.controlPlane=e;this.releases=new Ud(e),this.queue=new S(e)}enqueueActivation(e,t={}){let r=this.releases.get(e.id);if(!r)throw Error("Release was not found");if(!["built","failed","rolled_back","superseded"].includes(r.status))throw Error(`Release ${r.status} cannot be activated`);let n=t.action??"activate",i=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:`release.${n}`,idempotencyKey:`release:${r.id}:${n}:${r.rollbackAttempts}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:t.targetReleaseId??null},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:r.automaticRollback?2:1,retryClasses:["network","provider_throttled","provider_unavailable"],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return this.releases.transition(r.id,"activating",{message:`${n} queued.`,operationId:i.id,trafficPercent:0}),i}completeHealthGate(e,t){let r=this.releases.get(e);if(!r||r.status!=="activating")throw Error("Release is not activating");if(t.healthy)return{release:this.releases.transition(r.id,"active",{message:t.message??"Health gate passed; activation completed.",operationId:t.operationId,trafficPercent:100,health:t.health})};let n=this.releases.transition(r.id,"failed",{message:t.message??"Health gate failed.",operationId:t.operationId,trafficPercent:0,health:t.health}),i=r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!r.automaticRollback||r.rollbackAttempts>=1||!i)return{release:n};let o=this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,kind:"release.rollback",idempotencyKey:`release:${r.id}:automatic-rollback`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:i.id,automatic:!0},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation;return{release:n,rollbackOperation:o}}enqueueRollback(e,t={}){let r=this.releases.get(e.id);if(!r||r.status!=="active")throw Error("Only the active release can be rolled back");let n=t.targetReleaseId?this.releases.get(t.targetReleaseId):r.previousReleaseId?this.releases.get(r.previousReleaseId):void 0;if(!n||n.resourceId!==r.resourceId||!["superseded","active"].includes(n.status))throw Error("Rollback requires a preserved prior release for the same resource");return this.queue.enqueue({projectId:r.projectId,environmentId:r.environmentId,resourceId:r.resourceId,actorId:t.actorId,kind:"release.rollback",idempotencyKey:`release:${r.id}:manual-rollback:${n.id}`,correlationId:`release:${r.id}`,input:{releaseId:r.id,targetReleaseId:n.id,automatic:!1},lockKey:`resource:${r.resourceId}`,providerKey:this.controlPlane.getResource(r.resourceId)?.provider??"default",maxAttempts:1,retryClasses:[],resumePolicy:"fail",cancellationMode:"provider_non_cancellable",retentionDays:365}).operation}}function rS(e){if(e.strategy==="canary")return[5,25,50,100].map((t,r)=>({step:`canary-${t}`,trafficPercent:t,waitSeconds:r===3?e.drainSeconds:e.graceSeconds,requiresHealth:!0}));if(e.strategy==="blue_green")return[{step:"green-health",trafficPercent:0,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"traffic-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];if(e.strategy==="rolling")return[{step:"rolling-replacement",trafficPercent:50,waitSeconds:e.graceSeconds,requiresHealth:!0},{step:"rolling-complete",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!0}];return[{step:"immutable-switch",trafficPercent:100,waitSeconds:e.drainSeconds,requiresHealth:!!e.healthGate}]}async function Wp(e,t){if(t.release.artifactId!==t.artifact.id)throw Error("Release activation artifact identity changed");Ha({kind:t.release.kind,hasHealthGate:!!t.release.healthGate,replicas:Number(t.release.manifest?.replicas)||void 0},t.release.strategy);let r=e.capability(t);if(!r.supported)throw Error(`${t.release.strategy} is unavailable in ${e.name}: ${r.explanation}`);return e.activate({...t,transitions:rS(t.release)})}async function Kp(e,t){if(!t.previous)throw Error("Rollback requires the preserved previous release");return e.rollback({...t,transitions:[{step:"rollback",trafficPercent:0,waitSeconds:t.release.drainSeconds,requiresHealth:!0}]})}var nS=["release.activate","release.rollback"];function iS(e){return e&&typeof e==="object"&&!Array.isArray(e)?e:{}}function Qp(e){let t=new st(e.store),r=async(n)=>{let i=iS(n.operation.input),o=typeof i.releaseId==="string"?i.releaseId:"",s=t.releases.get(o);if(!s)throw Error(`Queued release ${o||"(missing)"} was not found`);if(s.projectId!==n.operation.projectId||s.environmentId!==n.operation.environmentId||s.resourceId!==n.operation.resourceId)throw Error("Queued release does not match the operation scope");let c=t.releases.getArtifact(s.artifactId);if(!c||c.digest!==t.releases.getArtifact(s.artifactId)?.digest)throw Error("Immutable release artifact is unavailable");let u=typeof i.targetReleaseId==="string"&&i.targetReleaseId?i.targetReleaseId:s.previousReleaseId,a=u?t.releases.get(u):void 0;if(a&&(a.resourceId!==s.resourceId||a.artifactId===s.artifactId&&a.id===s.id))throw Error("Rollback target does not match the release resource");let f=await e.resolveDriver(s);n.checkpoint("verify",`Verifying ${c.digest} and ${s.configHash} for ${f.name}.`),n.log(`Artifact ${c.digest}; source ${s.sourceSha??"not recorded"}; config ${s.configHash}.`,{stream:"system"}),n.throwIfCancellationRequested();let T;try{T=n.operation.kind==="release.rollback"?await Kp(f,{release:s,artifact:c,previous:a}):await Wp(f,{release:s,artifact:c,previous:a})}catch(R){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:R instanceof Error?R.message:String(R)});throw R}for(let R of T.transitions)t.releases.progress(s.id,{message:`${n.operation.kind==="release.rollback"?"Rollback":"Activation"} traffic at ${R.trafficPercent}%.`,trafficPercent:R.trafficPercent,health:R.observed,operationId:n.operation.id}),n.log(`Traffic ${R.trafficPercent}%: ${R.healthy?"healthy":"unhealthy"}.`,{stream:R.healthy?"step":"stderr",step:"health"});if(n.checkpoint("health","Evaluating the provider health result."),!T.activated||!T.healthy){if(n.operation.kind==="release.activate"&&t.releases.get(s.id)?.status==="activating")t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:{resourceVersions:T.resourceVersions},message:T.error??"Provider health gate failed."});throw Error(T.error??`${f.name} reported an unhealthy release`)}if(n.operation.kind==="release.activate"&&s.healthGate?.name){if(!e.resolveHealthGate)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,message:`Named health gate ${s.healthGate.name} is not available to this worker.`}),Error(`Named health gate ${s.healthGate.name} is unavailable`);n.checkpoint("named-health-gate",`Waiting on ${s.healthGate.name}.`);let R=await e.resolveHealthGate(s.healthGate.name,s);if(n.log(`${s.healthGate.name}: ${R.healthy?"healthy":"unhealthy"}${R.message?` — ${R.message}`:""}.`,{stream:R.healthy?"step":"stderr",step:"health"}),!R.healthy)throw t.completeHealthGate(s.id,{healthy:!1,operationId:n.operation.id,health:R.evidence,message:R.message??`Named health gate ${s.healthGate.name} failed.`}),Error(R.message??`Named health gate ${s.healthGate.name} failed`)}if(n.operation.kind==="release.rollback"){let R=t.releases.get(s.id);if(R.status!=="rolled_back")t.releases.transition(R.id,"rolled_back",{message:`Traffic restored through ${f.name}.`,operationId:n.operation.id,trafficPercent:0,health:{resourceVersions:T.resourceVersions}});if(a&&a.status!=="active"){let D=a.status==="activating"?a:t.releases.transition(a.id,"activating",{message:"Rollback target restoring traffic.",operationId:n.operation.id,trafficPercent:0});t.releases.transition(D.id,"active",{message:"Previous immutable release restored.",operationId:n.operation.id,trafficPercent:100,health:{resourceVersions:T.resourceVersions}})}}else t.completeHealthGate(s.id,{healthy:!0,operationId:n.operation.id,health:{providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions},message:"Provider activation and health gates completed."});return n.checkpoint("finalize","Persisted the terminal release state."),{releaseId:s.id,artifactDigest:c.digest,provider:f.name,providerVersion:T.providerVersion??null,resourceVersions:T.resourceVersions,status:t.releases.get(s.id).status}};return Object.fromEntries(nS.map((n)=>[n,r]))}import{createCipheriv as oS,createDecipheriv as sS,createHash as tg,randomBytes as zd}from"node:crypto";var rg={github:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitlab:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},bitbucket:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!0,deployKeys:!0},gitea:{repositories:!0,branches:!0,tags:!0,webhooks:!0,pullRequests:!0,tokenRefresh:!1,deployKeys:!0},generic_https:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!1},generic_ssh:{repositories:!1,branches:!0,tags:!0,webhooks:!1,pullRequests:!1,tokenRefresh:!1,deployKeys:!0}};function Rt(e){return typeof e==="string"&&e?e:void 0}function Go(e,t){try{return typeof e==="string"?JSON.parse(e):t}catch{return t}}function Oi(e){return JSON.stringify(h(e))}function qo(e){return tg("sha256").update(e).digest("hex")}function Yp(e){let t=e.trim().replace(/\/$/,""),r=new URL(t.includes("://")?t:`https://${t}`);if(r.username||r.password||r.search||r.hash)throw Error("Source host cannot contain credentials, a query, or a fragment");if(r.protocol!=="https:"&&!(r.protocol==="http:"&&["localhost","127.0.0.1","::1"].includes(r.hostname)))throw Error("Source host must use HTTPS");return`${r.protocol}//${r.host}${r.pathname.replace(/\/$/,"")}`}function Xp(e){let t=e.trim();if(t.length<2||t.length>80)throw Error("Connection name must contain 2-80 characters");return t}function Vd(e){let t=e.trim().replace(/^\/+|\/+$/g,"");if(!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(t))throw Error("Repository must use owner/name format");return t}function Zp(e){let t=e.trim()||".";if(t.startsWith("/")||t.split("/").includes("..")||/[\0\r\n]/.test(t))throw Error("Monorepo root must stay inside the repository");return t.replace(/^\.\//,"")||"."}function Wa(e){return[...new Set((e??[]).map((t)=>t.trim()).filter(Boolean))].slice(0,100)}function aS(e){let t=e.trim();if(/\r|\n/.test(t)||/https?:\/\/[^/@\s]+:[^/@\s]+@/i.test(t))throw Error("Clone URL cannot contain credentials or control characters");if(!/^(?:https?:\/\/|ssh:\/\/|git@[A-Za-z0-9.-]+:)/.test(t))throw Error("Clone URL must use HTTPS or SSH");return t}function cS(e){return{id:String(e.id),organizationId:String(e.organization_id),provider:String(e.provider),name:String(e.name),host:String(e.host),owner:Rt(e.owner),authKind:String(e.auth_kind),credentialConfigured:!!e.credential_ciphertext,credentialFingerprint:Rt(e.credential_fingerprint),grantedScopes:Go(e.granted_scopes,[]),capabilities:Go(e.capabilities,rg[String(e.provider)]),status:String(e.status),healthMessage:Rt(e.health_message),lastTestedAt:Rt(e.last_tested_at),lastSyncedAt:Rt(e.last_synced_at),credentialExpiresAt:Rt(e.credential_expires_at),version:Number(e.version),createdByActorId:Rt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function qd(e){return{id:String(e.id),connectionId:String(e.connection_id),providerRepositoryId:String(e.provider_repository_id),fullName:String(e.full_name),cloneUrl:String(e.clone_url),defaultBranch:String(e.default_branch),visibility:String(e.visibility),archived:Number(e.archived)===1,metadata:Go(e.metadata,{}),syncedAt:String(e.synced_at)}}function eg(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:Rt(e.environment_id),resourceId:Rt(e.resource_id),connectionId:String(e.connection_id),repositoryId:Rt(e.repository_id),repositoryFullName:String(e.repository_full_name),defaultBranch:String(e.default_branch),branchRule:Rt(e.branch_rule),tagRule:Rt(e.tag_rule),monorepoRoot:String(e.monorepo_root),includePaths:Go(e.include_paths,[]),excludePaths:Go(e.exclude_paths,[]),submodules:Number(e.submodules)===1,cloneDepth:e.clone_depth==null?void 0:Number(e.clone_depth),deployKeyId:Rt(e.deploy_key_id),autoDeploy:Number(e.auto_deploy)===1,pullRequestPreviews:Number(e.pull_request_previews)===1,status:String(e.status),disabledReason:Rt(e.disabled_reason),version:Number(e.version),createdByActorId:Rt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Gd(e){return{id:String(e.id),connectionId:String(e.connection_id),name:String(e.name),publicKey:String(e.public_key),publicKeyFingerprint:String(e.public_key_fingerprint),host:String(e.host),hostKey:String(e.host_key),hostKeyFingerprint:String(e.host_key_fingerprint),createdByActorId:Rt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Jd(e){return{id:String(e.id),connectionId:String(e.connection_id),repositoryId:Rt(e.repository_id),repositoryFullName:String(e.repository_full_name),providerWebhookId:Rt(e.provider_webhook_id),events:Go(e.events,[]),status:String(e.status),healthMessage:Rt(e.health_message),lastDeliveryAt:Rt(e.last_delivery_at),lastReconciledAt:Rt(e.last_reconciled_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Hd(e){return{id:String(e.id),connectionId:String(e.connection_id),webhookId:String(e.webhook_id),providerDeliveryId:String(e.provider_delivery_id),event:String(e.event),action:Rt(e.action),commitSha:Rt(e.commit_sha),signatureStatus:String(e.signature_status),status:String(e.status),payloadSummary:Go(e.payload_summary,{}),operationId:Rt(e.operation_id),error:Rt(e.error),receivedAt:String(e.received_at),processedAt:Rt(e.processed_at)}}class rr{controlPlane;key;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.key=t.encryptionKey?tg("sha256").update(t.encryptionKey).digest():void 0,this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let t=zd(12),r=oS("aes-256-gcm",this.key,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.key)throw Error("Source credential encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted source credential is unavailable");let o=sS("aes-256-gcm",this.key,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createConnection(e){if(!this.controlPlane.getOrganization(e.organizationId))throw Error("Source connection organization was not found");let t=this.now(),r=this.idFn(),n=e.credential?JSON.stringify(e.credential):void 0;return this.run(`INSERT INTO source_connections (id, organization_id, provider, name, host, owner, auth_kind, credential_ciphertext, credential_fingerprint, granted_scopes, capabilities, status, credential_expires_at, created_by_actor_id, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?, ?)`,[r,e.organizationId,e.provider,Xp(e.name),Yp(e.host),e.owner?.trim()||null,e.authKind??(n?"access_token":"none"),n?this.encrypt(n):null,n?qo(n).slice(0,16):null,Oi([...new Set(e.grantedScopes??[])].sort()),Oi(rg[e.provider]),e.credentialExpiresAt??null,e.createdByActorId??null,t,t]),this.controlPlane.appendEvent({organizationId:e.organizationId,actorId:e.createdByActorId,type:"source.connection.created",payload:{connectionId:r,provider:e.provider,host:Yp(e.host),owner:e.owner??null,scopes:e.grantedScopes??[]}}),this.getConnection(r)}getConnection(e){let t=this.controlPlane.database.query("SELECT * FROM source_connections WHERE id = ?").get(e);return t?this.currentConnection(t):void 0}listConnections(e){return this.controlPlane.database.query("SELECT * FROM source_connections WHERE organization_id = ? ORDER BY name").all(e).map((t)=>this.currentConnection(t))}currentConnection(e){let t=cS(e);if(t.status!=="disconnected"&&t.credentialExpiresAt&&new Date(t.credentialExpiresAt).getTime()<=this.nowFn().getTime())return{...t,status:"expired",healthMessage:"Source credential expired; rotate it before deploying."};return t}getCredential(e){let t=this.controlPlane.database.query("SELECT credential_ciphertext FROM source_connections WHERE id = ?").get(e);return t?.credential_ciphertext?JSON.parse(this.decrypt(String(t.credential_ciphertext))):void 0}rotateCredential(e,t,r={}){let n=this.getConnection(e);if(!n||n.status==="disconnected")throw Error("Active source connection was not found");let i=JSON.stringify(t);return this.run("UPDATE source_connections SET credential_ciphertext = ?, credential_fingerprint = ?, credential_expires_at = ?, status = 'pending', health_message = NULL, version = version + 1, updated_at = ? WHERE id = ?",[this.encrypt(i),qo(i).slice(0,16),r.expiresAt??null,this.now(),e]),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:r.actorId,type:"source.credential.rotated",payload:{connectionId:e,fingerprint:qo(i).slice(0,16),expiresAt:r.expiresAt??null}}),this.getConnection(e)}updateHealth(e,t){let r=this.getConnection(e);if(!r||["disconnected","expired"].includes(r.status))throw Error("Active source connection was not found");let n=this.now(),i=t.grantedScopes?[...new Set(t.grantedScopes.map((o)=>o.trim()).filter(Boolean))].sort():void 0;if(this.run("UPDATE source_connections SET status = ?, health_message = ?, granted_scopes = COALESCE(?, granted_scopes), last_tested_at = COALESCE(?, last_tested_at), last_synced_at = COALESCE(?, last_synced_at), version = version + 1, updated_at = ? WHERE id = ?",[t.status,t.message?.slice(0,1000)??null,i?Oi(i):null,t.tested?n:null,t.synced?n:null,n,e]),i&&JSON.stringify(i)!==JSON.stringify([...r.grantedScopes].sort()))this.controlPlane.appendEvent({organizationId:r.organizationId,type:"source.connection.scopes_updated",payload:{connectionId:e,grantedScopes:i}});return this.getConnection(e)}upsertRepository(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");let r=this.now(),n=this.controlPlane.database.query("SELECT id FROM source_repositories WHERE connection_id = ? AND provider_repository_id = ?").get(e.connectionId,e.providerRepositoryId),i=n?String(n.id):this.idFn();return this.run(`INSERT INTO source_repositories (id, connection_id, provider_repository_id, full_name, clone_url, default_branch, visibility, archived, metadata, synced_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(connection_id, provider_repository_id) DO UPDATE SET full_name=excluded.full_name, clone_url=excluded.clone_url, default_branch=excluded.default_branch, visibility=excluded.visibility, archived=excluded.archived, metadata=excluded.metadata, synced_at=excluded.synced_at`,[i,e.connectionId,e.providerRepositoryId,Vd(e.fullName),aS(e.cloneUrl),e.defaultBranch.trim()||"main",e.visibility,e.archived?1:0,Oi(e.metadata),r]),qd(this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(i))}listRepositories(e,t,r=100){let n=t?.trim().toLowerCase();return(n?this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? AND lower(full_name) LIKE ? ORDER BY full_name LIMIT ?").all(e,`%${n}%`,Math.min(500,r)):this.controlPlane.database.query("SELECT * FROM source_repositories WHERE connection_id = ? ORDER BY full_name LIMIT ?").all(e,Math.min(500,r))).map(qd)}getRepository(e){let t=this.controlPlane.database.query("SELECT * FROM source_repositories WHERE id = ?").get(e);return t?qd(t):void 0}createDeployKey(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status)||!t.capabilities.deployKeys)throw Error("An active deploy-key capable source connection is required");if(!/^ssh-(?:ed25519|rsa)\s+[A-Za-z0-9+/=]+/.test(e.publicKey.trim()))throw Error("A valid SSH public key is required");if(!/BEGIN (?:OPENSSH|RSA) PRIVATE KEY/.test(e.privateKey))throw Error("A valid SSH private key is required");if(!/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp\d+)\s+[A-Za-z0-9+/=]+/.test(e.hostKey.trim()))throw Error("A pinned SSH host key is required");let r=this.idFn(),n=this.now(),i=`sha256:${qo(e.publicKey.trim())}`,o=`sha256:${qo(e.hostKey.trim())}`;return this.run("INSERT INTO source_deploy_keys (id, connection_id, name, public_key, public_key_fingerprint, private_key_ciphertext, host, host_key, host_key_fingerprint, created_by_actor_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",[r,e.connectionId,Xp(e.name),e.publicKey.trim(),i,this.encrypt(e.privateKey),e.host.trim().toLowerCase(),e.hostKey.trim(),o,e.actorId??null,n,n]),this.controlPlane.appendEvent({organizationId:t.organizationId,actorId:e.actorId,type:"source.deploy_key.created",payload:{connectionId:e.connectionId,deployKeyId:r,publicFingerprint:i,hostFingerprint:o}}),Gd(this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(r))}getDeployKey(e){let t=this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE id = ?").get(e);return t?Gd(t):void 0}listDeployKeys(e){return this.controlPlane.database.query("SELECT * FROM source_deploy_keys WHERE connection_id = ? ORDER BY name, created_at").all(e).map(Gd)}revokeDeployKey(e,t){let r=this.getDeployKey(e),n=r?this.getConnection(r.connectionId):void 0;if(!r||!n)throw Error("Deploy key was not found");let i=this.listBindings({connectionId:n.id}).filter((s)=>s.deployKeyId===e),o=this.now();return this.controlPlane.database.transaction(()=>{this.run("UPDATE source_bindings SET deploy_key_id=NULL, status='disabled', auto_deploy=0, disabled_reason='Source deploy key was revoked', version=version+1, updated_at=? WHERE deploy_key_id=?",[o,e]),this.run("DELETE FROM source_deploy_keys WHERE id=?",[e])})(),this.controlPlane.appendEvent({organizationId:n.organizationId,actorId:t,type:"source.deploy_key.revoked",level:"warning",payload:{connectionId:n.id,deployKeyId:e,affectedBindingIds:i.map((s)=>s.id)}}),{affectedBindings:i}}getDeployPrivateKey(e){let t=this.controlPlane.database.query("SELECT private_key_ciphertext FROM source_deploy_keys WHERE id = ?").get(e);if(!t)throw Error("Deploy key was not found");return this.decrypt(String(t.private_key_ciphertext))}createBinding(e){let t=this.getConnection(e.connectionId);if(!t||["disconnected","expired"].includes(t.status))throw Error("Active source connection was not found");if(e.repositoryId&&this.getRepository(e.repositoryId)?.connectionId!==t.id)throw Error("Repository does not belong to this connection");if(e.deployKeyId&&this.getDeployKey(e.deployKeyId)?.connectionId!==t.id)throw Error("Deploy key does not belong to this connection");let r=this.idFn(),n=this.now();return this.run(`INSERT INTO source_bindings (id, project_id, environment_id, resource_id, connection_id, repository_id, repository_full_name, default_branch, branch_rule, tag_rule, monorepo_root, include_paths, exclude_paths, submodules, clone_depth, deploy_key_id, auto_deploy, pull_request_previews, status, created_by_actor_id, created_at, updated_at)
@@ -117,7 +117,7 @@ export type ConfigOf = Config
 `,r+=`|----------|------|-------------|----------|
 `;for(let n of e)r+=`| \`${n.key}\` | ${n.type} | ${n.description} | \`${n.example}\` |
 `;return r}}function VI(e,t,r={}){return _f(e,t,r,new WeakMap)}function _f(e,t,r,n){let{arrayMergeMode:i="replace",skipNullish:o=!1,customMerger:s}=r;if(t===null||t===void 0)return o?e:t;if(s){let c=s(e,t);if(c!==void 0)return c}if(Array.isArray(t)||Array.isArray(e))return Nf(e,t,i,n);if(!Fn(t)||!Fn(e))return t;return HI(e,t,r,n)}function Nf(e,t,r,n){if(Array.isArray(t)&&!Array.isArray(e))return t;if(Array.isArray(e)&&!Array.isArray(t))return t;if(Array.isArray(t)&&Array.isArray(e))switch(r){case"replace":return t;case"concat":return qI(e,t);case"smart":return GI(e,t,n);default:return t}return t}function qI(e,t){let r=[...t];for(let n of e)if(!r.some((i)=>ol(i,n)))r.push(n);return r}function GI(e,t,r){if(t.length===0)return e;if(e.length===0)return t;if(Fn(t[0])&&Fn(e[0]))return JI(e,t,r);if(t.every((n)=>typeof n==="string")&&e.every((n)=>typeof n==="string")){let n=[...t];for(let i of e)if(!n.includes(i))n.push(i);return n}return t}function JI(e,t,r){let n=[...t];for(let i of e){if(!Fn(i)){n.push(i);continue}let o=["id","name","key","path","type"],s=!1;for(let c of o)if(c in i){if(n.find((a)=>Fn(a)&&(c in a)&&a[c]===i[c])){s=!0;break}}if(!s)n.push(i)}return n}function HI(e,t,r,n){let i=t;if(Fn(i)&&n.has(i))return n.get(i);let o={...e};if(Fn(i))n.set(i,o);for(let s in i){if(!Object.prototype.hasOwnProperty.call(i,s))continue;let c=i[s],u=o[s];if(r.skipNullish&&(c===null||c===void 0))continue;if(c===null||c===void 0){o[s]=c;continue}if(Fn(c)&&Fn(u))o[s]=_f(u,c,r,n);else if(Array.isArray(c)||Array.isArray(u))o[s]=Nf(u,c,r.arrayMergeMode||"smart",n);else o[s]=c}return o}function Mf(e,t,r="replace"){return VI(e,t,{arrayMergeMode:r==="replace"?"replace":"smart",skipNullish:!0})}function ol(e,t){if(e===t)return!0;if(Array.isArray(e)&&Array.isArray(t)){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(!ol(e[r],t[r]))return!1;return!0}if(Fn(e)&&Fn(t)){let r=Object.keys(e),n=Object.keys(t);if(r.length!==n.length)return!1;for(let i of r){if(!Object.prototype.hasOwnProperty.call(t,i))return!1;if(!ol(e[i],t[i]))return!1}return!0}return!1}function Fn(e){return Boolean(e&&typeof e==="object"&&!Array.isArray(e))}class $f{extensions=rf;async loadFromPath(e,t,r={}){let{arrayStrategy:n="replace",useCache:i=!0,cacheTtl:o,trackPerformance:s=!0,verbose:c=!1}=r;if(i){let a=Fc.getWithFileCheck("file",e);if(a){if(c)console.log(`Configuration loaded from cache: ${e}`);return a}}let u=async()=>{if(!_c(e))return null;try{let a=`?t=${Date.now()}`,f=await import(e+a),T=f.default||f,R="default"in f,D=Object.keys(f).length>0;if(!R&&!D)throw new Yc(e,Error("Configuration file is empty and exports nothing"),"unknown");if(typeof T!=="object"||T===null||Array.isArray(T))throw new Yc(e,Error("Configuration must export a valid object"),"unknown");let ee={config:Mf(t,T,n),source:{type:"file",path:e,priority:100,timestamp:new Date}};if(i)Fc.setWithFileCheck("file",ee,e,o);return ee}catch(a){throw a instanceof Error?Xo.configLoad(e,a):Xo.configLoad(e,Error(String(a)))}};if(s)return sl.track("loadFromPath",u,{path:e});return u()}async tryLoadFromPaths(e,t,r={}){for(let n of e)try{let i=await this.loadFromPath(n,t,r);if(i)return i}catch(i){if(i instanceof Error&&i.name==="ConfigLoadError")throw i;if(r.verbose)console.warn(`Failed to load config from ${n}:`,i)}return null}generateConfigPaths(e,t,r){return Uv({name:e,directory:t,alias:r})}generateNamePatterns(e,t){return nf({name:e,alias:t})}checkFileAccess(e){return zI(async()=>_c(e),{maxRetries:2,retryDelay:100,fallback:!1})}async discoverConfigFiles(e,t,r){let n=[];if(!_c(e))return n;if(t||r){let i=this.generateNamePatterns(t||"",r);for(let o of i)for(let s of this.extensions){let c=Zm(e,`${o}${s}`);if(await this.checkFileAccess(c))n.push(c)}}else try{let{readdirSync:i}=await import("fs"),o=i(e);for(let s of o)if(this.looksLikeConfigFile(s)){let c=Zm(e,s);if(await this.checkFileAccess(c))n.push(c)}}catch{return[]}return n}looksLikeConfigFile(e){return[/\.config\.(ts|js|mjs|cjs|json|mts|cts)$/,/^\..*\.(ts|js|mjs|cjs|json|mts|cts)$/,/config\.(ts|js|mjs|cjs|json|mts|cts)$/].some((r)=>r.test(e))}async validateConfigFile(e){let t=[];try{if(!_c(e))return t.push("Configuration file does not exist"),t;let r=await import(e),n=r.default||r;if(n===void 0)t.push("Configuration file must export a default value or named exports");else if(typeof n!=="object"||n===null)t.push("Configuration must be an object");else if(Array.isArray(n))t.push("Configuration cannot be an array at the root level");if(e.endsWith(".json"))try{let{readFileSync:i}=await import("fs"),o=i(e,"utf8");JSON.parse(o)}catch(i){t.push(`Invalid JSON syntax: ${i}`)}}catch(r){t.push(`Failed to load configuration file: ${r}`)}return t}async getFileModificationTime(e){try{let{statSync:t}=await import("fs");return t(e).mtime}catch{return null}}async preloadConfigurations(e,t={}){let r=new Map;return await Promise.allSettled(e.map(async(n)=>{try{let i=await this.loadFromPath(n,{},t);if(i)r.set(n,i.config)}catch(i){if(t.verbose)console.warn(`Failed to preload ${n}:`,i)}})),r}}var KI=/^https?:\/\//;class Lf{async validateConfiguration(e,t,r={}){let{stopOnFirstError:n=!1,validateRequired:i=!0,validateTypes:o=!0,customRules:s=[],trackPerformance:c=!0,verbose:u=!1}=r,a=async()=>{let f=[],T=[],R={stopOnFirstError:n,validateRequired:i,validateTypes:o,customRules:s,trackPerformance:c,verbose:u};try{if(typeof t==="string")return await this.validateWithSchemaFile(e,t,R);else if(Array.isArray(t))return this.validateWithRules(e,[...t,...s],R);else return this.validateWithJSONSchema(e,t,R)}catch(D){return f.push({path:"",message:`Validation failed: ${D}`,rule:"system"}),{isValid:!1,errors:f,warnings:T}}};if(c)return await sl.track("validateConfiguration",a);return a()}async validateWithSchemaFile(e,t,r){try{if(!WI(t))throw new Xc(t,[{path:"",message:"Schema file does not exist"}]);let n=await import(t),i=n.default||n;if(Array.isArray(i))return this.validateWithRules(e,i,r);else return this.validateWithJSONSchema(e,i,r)}catch(n){throw new Xc(t,[{path:"",message:`Failed to load schema: ${n}`}])}}validateWithJSONSchema(e,t,r){let n=[],i=[];return this.validateObjectAgainstSchema(e,t,"",n,i,r),{isValid:n.length===0,errors:n,warnings:i}}validateObjectAgainstSchema(e,t,r,n,i,o){if(o.validateTypes&&t.type){let s=Array.isArray(e)?"array":typeof e,c=Array.isArray(t.type)?t.type:[t.type];if(!c.includes(s)){if(n.push({path:r,message:`Expected type ${c.join(" or ")}, got ${s}`,expected:c.join(" or "),actual:s,rule:"type"}),o.stopOnFirstError)return}}if(t.enum&&!t.enum.includes(e)){if(n.push({path:r,message:`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"}),o.stopOnFirstError)return}if(typeof e==="string"){if(t.minLength!==void 0&&e.length<t.minLength)n.push({path:r,message:`String length must be at least ${t.minLength}`,expected:`>= ${t.minLength}`,actual:e.length,rule:"minLength"});if(t.maxLength!==void 0&&e.length>t.maxLength)n.push({path:r,message:`String length must not exceed ${t.maxLength}`,expected:`<= ${t.maxLength}`,actual:e.length,rule:"maxLength"});if(t.pattern){if(!new RegExp(t.pattern).test(e))n.push({path:r,message:`String does not match pattern ${t.pattern}`,expected:t.pattern,actual:e,rule:"pattern"})}}if(typeof e==="number"){if(t.minimum!==void 0&&e<t.minimum)n.push({path:r,message:`Value must be at least ${t.minimum}`,expected:`>= ${t.minimum}`,actual:e,rule:"minimum"});if(t.maximum!==void 0&&e>t.maximum)n.push({path:r,message:`Value must not exceed ${t.maximum}`,expected:`<= ${t.maximum}`,actual:e,rule:"maximum"})}if(Array.isArray(e)&&t.items)for(let s=0;s<e.length;s++){let c=r?`${r}[${s}]`:`[${s}]`;if(this.validateObjectAgainstSchema(e[s],t.items,c,n,i,o),o.stopOnFirstError&&n.length>0)return}if(e&&typeof e==="object"&&!Array.isArray(e)){let s=e;if(o.validateRequired&&t.required){for(let c of t.required)if(!(c in s)){if(n.push({path:r?`${r}.${c}`:c,message:`Missing required property '${c}'`,expected:"required",rule:"required"}),o.stopOnFirstError)return}}if(t.properties){for(let[c,u]of Object.entries(t.properties))if(c in s){let a=r?`${r}.${c}`:c;if(this.validateObjectAgainstSchema(s[c],u,a,n,i,o),o.stopOnFirstError&&n.length>0)return}}if(t.additionalProperties===!1){let c=new Set(Object.keys(t.properties||{}));for(let u of Object.keys(s))if(!c.has(u))i.push({path:r?`${r}.${u}`:u,message:`Additional property '${u}' is not allowed`,rule:"additionalProperties"})}}}validateWithRules(e,t,r){let n=[],i=[];for(let o of t)try{let s=this.getValueByPath(e,o.path),c=this.validateWithRule(s,o,o.path);if(n.push(...c),r.stopOnFirstError&&n.length>0)break}catch(s){n.push({path:o.path,message:`Rule validation failed: ${s}`,rule:"system"})}return{isValid:n.length===0,errors:n,warnings:i}}validateWithRule(e,t,r){let n=[];if(t.required&&(e===void 0||e===null))return n.push({path:r,message:t.message||`Property '${r}' is required`,expected:"required",rule:"required"}),n;if(e===void 0||e===null)return n;if(t.type){let i=Array.isArray(e)?"array":typeof e;if(i!==t.type)n.push({path:r,message:t.message||`Expected type ${t.type}, got ${i}`,expected:t.type,actual:i,rule:"type"})}if(t.min!==void 0){let i=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(i<t.min)n.push({path:r,message:t.message||`Value must be at least ${t.min}`,expected:`>= ${t.min}`,actual:i,rule:"min"})}if(t.max!==void 0){let i=Array.isArray(e)?e.length:typeof e==="string"?e.length:typeof e==="number"?e:0;if(i>t.max)n.push({path:r,message:t.message||`Value must not exceed ${t.max}`,expected:`<= ${t.max}`,actual:i,rule:"max"})}if(t.pattern&&typeof e==="string"){if(!t.pattern.test(e))n.push({path:r,message:t.message||`Value does not match pattern ${t.pattern}`,expected:t.pattern.toString(),actual:e,rule:"pattern"})}if(t.enum&&!t.enum.includes(e))n.push({path:r,message:t.message||`Value must be one of: ${t.enum.join(", ")}`,expected:t.enum.join(", "),actual:e,rule:"enum"});if(t.validator){let i=t.validator(e);if(i)n.push({path:r,message:t.message||i,rule:"custom"})}return n}getValueByPath(e,t){if(!t)return e;let r=t.split("."),n=e;for(let i of r)if(n&&typeof n==="object"&&i in n)n=n[i];else return;return n}generateRulesFromInterface(e){let t=[],r=e.matchAll(/(\w+)(\?)?:\s*(\w+)/g);for(let n of r){let[,i,o,s]=n;t.push({path:i,required:!o,type:this.mapTypeScriptType(s)})}return t}mapTypeScriptType(e){switch(e.toLowerCase()){case"string":return"string";case"number":return"number";case"boolean":return"boolean";case"array":return"array";case"object":return"object";default:return"object"}}static createCommonRules(){return{server:[{path:"port",required:!0,type:"number",min:1,max:65535},{path:"host",required:!0,type:"string",min:1},{path:"ssl",type:"boolean"}],database:[{path:"url",required:!0,type:"string",min:1},{path:"pool",type:"number",min:1,max:100},{path:"timeout",type:"number",min:0}],api:[{path:"baseUrl",required:!0,type:"string",pattern:KI},{path:"timeout",type:"number",min:0},{path:"retries",type:"number",min:0,max:10}]}}}var bi=new rd("bunfig",{showTags:!0});function QI(e){if(!e)return"";let t=Array.isArray(e)?e.filter(Boolean):[e];if(t.length===0)return"";if(t.length===1)return` or alias "${t[0]}"`;return` or aliases ${t.map((r)=>`"${r}"`).join(", ")}`}class Bf{fileLoader=new $f;envProcessor=new fl;validator=new Lf;async loadConfig(e){let t=Date.now(),{cache:r,performance:n,schema:i,validate:o,...s}=e;try{if(r?.enabled){let u=this.checkCache(s.name||"",s);if(u)return u}let c;try{c=await this.loadConfigurationStrategies(s,!0,r)}catch(u){if(s.configFile)throw u;let a=s.__strictErrorHandling;if(u instanceof Error&&u.name==="ConfigNotFoundError"){if(a)throw u;c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:[`No configuration file found for "${s.name||"config"}", using defaults with environment variables`]}}else if(u instanceof Error&&u.name==="ConfigLoadError"){let f=u.message.includes("EACCES")||u.message.includes("EPERM")||u.message.includes("permission denied"),T=!f&&(u.message.includes("syntax")||u.message.includes("Expected")||u.message.includes("Unexpected")||u.message.includes("BuildMessage")||u.message.includes("errors building")),R=u.message.includes("Configuration must export a valid object")||u.message.includes("Configuration file is empty and exports nothing");if(a&&(R||f))throw u;if(T&&(!a||!R))c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:["Configuration file has syntax errors, using defaults with environment variables"]};else if(!a)c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:[`Configuration loading error, using defaults: ${u.message}`]};else throw u}else c={...await this.applyEnvironmentVariables(s.name||"",s.defaultConfig,s.checkEnv!==!1,s.verbose||!1),warnings:[`Configuration loading failed, using defaults: ${u instanceof Error?u.message:String(u)}`]}}if(i||o)await this.validateConfiguration(c.config,i,o,s.name);if(r?.enabled&&c)this.cacheResult(s.name||"",c,r,s);if(n?.enabled){let u={operation:"loadConfig",duration:Date.now()-t,configName:s.name,timestamp:new Date};if(n.onMetrics)n.onMetrics(u);if(n.slowThreshold&&u.duration>n.slowThreshold)bi.warn(`Slow configuration loading detected: ${u.duration}ms for ${s.name}`);c.metrics=u}return c}catch(c){if(c instanceof Error&&c.name==="ConfigNotFoundError")throw c;let u=Date.now()-t;throw bi.error(`Configuration loading failed after ${u}ms:`,[c instanceof Error?c:Error(String(c))]),c}}async loadConfigurationStrategies(e,t=!1,r){let{name:n="",alias:i,configFile:o,cwd:s,configDir:c,defaultConfig:u,checkEnv:a=!0,arrayStrategy:f="replace",verbose:T=!1}=e,R=s||Zc.cwd(),D=[];if(o){let he=_i(R,o);D.push(he);let te=a?Ia(n,u,T):u,De=await this.fileLoader.tryLoadFromPaths([he],te,{arrayStrategy:f,verbose:T,cacheTtl:r?.ttl,useCache:!r?.ttl||r.ttl>100});if(!De)throw Xo.configNotFound(n||o,D,i);if(T)bi.success(`Configuration loaded from explicit path: ${he}`);return this.finalizeResult(De,D,a,n,T)}let W=await this.loadLocalConfiguration(n,i,R,c,u,f,T,a,r);if(W)return D.push(...this.getLocalSearchPaths(n,i,R,c)),this.finalizeResult(W,D,a,n,T);let Y=await this.loadHomeConfiguration(n,i,u,f,T,a);if(Y)return D.push(...this.getHomeSearchPaths(n,i)),this.finalizeResult(Y,D,a,n,T);let ee=await this.loadPackageJsonConfiguration(n,i,R,u,f,T,a);if(ee)return D.push(_i(R,"package.json")),this.finalizeResult(ee,D,a,n,T);if(D.push(...this.getAllSearchPaths(n,i,R,c)),t)throw Xo.configNotFound(n,D,i);return{...await this.applyEnvironmentVariables(n,u,a,T),warnings:[`No configuration file found for "${n}"${QI(i)}, using defaults with environment variables`]}}async loadLocalConfiguration(e,t,r,n,i,o,s,c,u){let a=c?Ia(e,i,s):i,f=this.getLocalDirectories(r,n);for(let T of f){if(s)bi.info(`Searching for configuration in: ${T}`);let R=this.fileLoader.generateConfigPaths(e,T,t),D=await this.fileLoader.tryLoadFromPaths(R,a,{arrayStrategy:o,verbose:s,cacheTtl:u?.ttl,useCache:!u?.ttl||u.ttl>100});if(D){if(s)bi.success(`Configuration loaded from: ${D.source.path}`);return D}}return null}async loadHomeConfiguration(e,t,r,n,i,o){if(!e)return null;let s=o?Ia(e,r,i):r,c=[_i(_s(),".config",e),_i(_s(),".config"),_s()];for(let u of c){if(i)bi.info(`Checking home directory: ${u}`);let a=this.fileLoader.generateConfigPaths(e,u,t),f=await this.fileLoader.tryLoadFromPaths(a,s,{arrayStrategy:n,verbose:i});if(f){if(i)bi.success(`Configuration loaded from home directory: ${f.source.path}`);return f}}return null}async loadPackageJsonConfiguration(e,t,r,n,i,o,s){let c=s?Ia(e,n,o):n;try{let u=_i(r,"package.json");if(!Vv(u))return null;let a={};try{a=JSON.parse(qv(u,"utf8"))}catch(R){if(o)bi.warn("Failed to parse package.json:",[R instanceof Error?R:Error(String(R))]);return null}let f=a[e],T=e;if(!f&&t){let R=Array.isArray(t)?t:[t];for(let D of R){if(!D)continue;if(a[D]){f=a[D],T=D;break}}}if(f&&typeof f==="object"&&!Array.isArray(f)){if(o)bi.success(`Configuration loaded from package.json: ${T}`);return{config:Mf(c,f,i),source:{type:"package.json",path:u,priority:30,timestamp:new Date}}}}catch(u){if(o)bi.warn("Failed to load package.json:",[u instanceof Error?u:Error(String(u))])}return null}async applyEnvironmentVariables(e,t,r,n){if(!r||!e||typeof t!=="object"||t===null||Array.isArray(t))return{config:t,source:{type:"default",priority:10,timestamp:new Date}};return{config:Ia(e,t,n),source:{type:"environment",priority:20,timestamp:new Date}}}async finalizeResult(e,t,r,n,i){return{config:e.config,source:e.source,path:e.source.path}}async validateConfiguration(e,t,r,n){let i=[];if(r){let o=r(e);if(o)i.push(...o)}if(t){let o=await this.validator.validateConfiguration(e,t);if(!o.isValid)i.push(...o.errors.map((s)=>s.path?`${s.path}: ${s.message}`:s.message))}if(i.length>0)throw Xo.configValidation(n||"unknown",i,n)}checkCache(e,t){let r=this.generateCacheKey(e,t);return Fc.get(r)||null}cacheResult(e,t,r,n){let i=this.generateCacheKey(e,n);Fc.set(i,t,void 0,r.ttl)}generateCacheKey(e,t){let r=[e];if(t.alias){let n=Array.isArray(t.alias)?t.alias.join(","):t.alias;r.push(`alias:${n}`)}if(t.cwd)r.push(`cwd:${t.cwd}`);if(t.configFile)r.push(`configFile:${t.configFile}`);if(t.configDir)r.push(`configDir:${t.configDir}`);if("checkEnv"in t)r.push(`checkEnv:${t.checkEnv}`);return r.join("|")}getLocalDirectories(e,t){return zv({cwd:e,configDir:t})}getAllSearchPaths(e,t,r,n){let i=[];return i.push(...this.getLocalSearchPaths(e,t,r,n)),i.push(...this.getHomeSearchPaths(e,t)),i.push(_i(r,"package.json")),i}getLocalSearchPaths(e,t,r,n){let i=this.getLocalDirectories(r,n),o=[];for(let s of i)o.push(...this.fileLoader.generateConfigPaths(e,s,t));return o}getHomeSearchPaths(e,t){if(!e)return[];let r=[_i(_s(),".config",e),_i(_s(),".config"),_s()],n=[];for(let i of r)n.push(...this.fileLoader.generateConfigPaths(e,i,t));return n}async loadConfigWithResult(e){return this.loadConfig(e)}}var Hu=new Bf;async function Ff(e){let t="defaultConfig"in e&&e.defaultConfig!==void 0?e.defaultConfig:{},r="cache"in e||"performance"in e||"schema"in e||"validate"in e;try{let n;if(r)n=await Hu.loadConfig(e);else n=await Hu.loadConfig({...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}});return n?.config??t}catch(n){if(e.configFile)throw n;let i=n instanceof Error?n.name:"UnknownError",o=n instanceof Error?n.message:String(n);if(!(i==="ConfigNotFoundError"||i==="ConfigLoadError"||i==="ConfigValidationError"||o.includes("config"))&&e.verbose)bi.warn("Unexpected error loading config, using defaults:",[n instanceof Error?n:Error(String(n))]);let c=r?{...e,defaultConfig:t}:{...e,defaultConfig:t,cache:{enabled:!0},performance:{enabled:!1}};if("checkEnv"in e?e.checkEnv!==!1:!0)return(await Hu.applyEnvironmentVariables(c.name||"",t,!0,c.verbose||!1))?.config??t;return t}}function Ia(e,t,r=!1){let n=new fl,i=e.toUpperCase().replace(/[^A-Z0-9]/g,"_");function o(s,c=[]){let u={...s};for(let[a,f]of Object.entries(s)){let T=[...c,a],R=[`${i}_${T.join("_").toUpperCase()}`,`${i}_${T.map((Y)=>Y.toUpperCase()).join("")}`,`${i}_${T.map((Y)=>Y.replace(/([A-Z])/g,"_$1").toUpperCase()).join("")}`],D,W;for(let Y of R)if(D=Zc.env[Y],D!==void 0){W=Y;break}if(D!==void 0&&W)if(typeof f==="boolean")u[a]=["true","1","yes"].includes(D.toLowerCase());else if(typeof f==="number"){let Y=Number(D);if(!Number.isNaN(Y))u[a]=Y}else if(Array.isArray(f))try{u[a]=JSON.parse(D)}catch{u[a]=D.split(",").map((Y)=>Y.trim())}else u[a]=D;else if(f&&typeof f==="object"&&!Array.isArray(f))u[a]=o(f,T)}return u}return o(t)}var aO=_i(Zc.cwd(),"config"),cO=_i(Zc.cwd(),"src/generated");var Dn={project:{name:"my-project",slug:"my-project",region:"us-east-1"},environments:{production:{type:"production"}}},rs=null;function ZI(e){return e.project?.slug===Dn.project?.slug&&Object.keys(e.environments??{}).length===1&&!!e.environments?.production}async function eC(){let e=[jf(process.cwd(),"config","cloud.ts"),jf(process.cwd(),"config","cloud.js")];for(let t of e){if(!YI(t))continue;let r=await import(`${XI(t).href}?t=${Date.now()}`),n=r.tsCloud??r.default?.tsCloud??r.default??r.cloud??r.config;if(n)return n}return null}async function tC(){if(!rs){if(rs=await Ff({name:"cloud",defaultConfig:Dn}),ZI(rs))rs=await eC()??rs;ia(rs.stateDir)}return rs}var Hi=tC;var rC=async(e)=>{let t=Bun.spawn(e,{stdout:"pipe",stderr:"pipe"}),[r,n,i]=await Promise.all([t.exited,new Response(t.stdout).text(),new Response(t.stderr).text()]);return{code:r,stdout:n,stderr:i}};class Br{async scan(e,t){return Yi(e,t)}async exec(e,t){if(e.trustState!=="pinned")throw Error("SSH host key must be pinned before remote execution.");return rC(["ssh","-p",String(e.sshPort),"-o","BatchMode=yes","-o","StrictHostKeyChecking=yes","-o","ConnectTimeout=10",`${e.sshUser}@${e.endpoint}`,t])}}var nC=ur,iC=`set -eu; printf '{'; printf '"os":"%s",' "$(. /etc/os-release 2>/dev/null; printf %s "\${PRETTY_NAME:-Linux}")"; printf '"arch":"%s",' "$(uname -m)"; printf '"cpuCores":%s,' "$(getconf _NPROCESSORS_ONLN)"; printf '"memoryBytes":%s,' "$(awk '/MemTotal/{print $2*1024}' /proc/meminfo)"; printf '"diskBytes":%s,' "$(df -B1 / | awk 'NR==2{print $2}')"; printf '"diskFreeBytes":%s,' "$(df -B1 / | awk 'NR==2{print $4}')"; printf '"dnsOk":'; getent hosts example.com >/dev/null && printf true || printf false; printf ',"timeSkewSeconds":0,"tools":{"curl":"'; command -v curl >/dev/null && printf installed; printf '","tar":"'; command -v tar >/dev/null && printf installed; printf '"},"privilege":"'; sudo -n true >/dev/null 2>&1 && printf sudo || printf user; printf '"}'`;class it{provider;transport;discoverer;constructor(e,t=new Br,r){this.provider=e;this.transport=t;this.discoverer=r}discover(e){return this.discoverer?.(e)??Promise.resolve([])}async test(e){try{let t=await this.transport.scan(e.endpoint,e.sshPort);return{reachable:!0,hostKeyAlgorithm:t.algorithm,hostKeyFingerprint:nC(t.key),latencyMs:0}}catch{return{reachable:!1,hostKeyAlgorithm:"unknown",hostKeyFingerprint:"",latencyMs:0}}}async validate(e){let t=await this.transport.exec(e,iC);if(t.code!==0)throw Error(`Fleet validation failed: ${t.stderr.trim()||t.code}`);try{return JSON.parse(t.stdout)}catch{throw Error("Fleet validation returned malformed facts.")}}async bootstrap(e,t){let r=await this.transport.exec(e,`sudo -n ts-cloud-agent bootstrap --version 1 --steps ${t.length}`);if(r.code!==0)throw Error(`Fleet bootstrap failed: ${r.stderr.trim()||r.code}`);return{version:"1"}}capabilities(){return{document:{supported:!0,reason:"fleet-capabilities/v1; sha256:driver-contract"},validate:{supported:!0},bootstrap:{supported:!0},heartbeat:{supported:!0},drain:{supported:!0},archive:{supported:!0},terminate:{supported:!1,reason:"Inventory removal never terminates provider infrastructure."}}}}function Uf(e,t){return{"fleet.bootstrap":async(r)=>{let n=r.operation.input&&typeof r.operation.input==="object"&&!Array.isArray(r.operation.input)?r.operation.input:{},i=e.get(String(n.serverId??""));if(!i)throw Error("Queued fleet server was not found.");let o=t.find((u)=>u.provider===i.provider);if(!o)throw Error(`No ${i.provider} fleet driver is configured.`);let s=Array.isArray(n.steps)?n.steps.map(String):[];if(r.checkpoint("preflight","Rechecking pinned trust and healthy validation."),i.trustState!=="pinned"||!i.validation?.valid)throw Error("Fleet bootstrap requires pinned trust and a healthy validation report.");r.checkpoint("bootstrap","Applying the reviewed idempotent bootstrap plan.");let c=await o.bootstrap(i,s);return e.update(i.id,{bootstrapVersion:c.version,status:"ready"}),r.checkpoint("verify","Bootstrap completed; heartbeat can now establish freshness."),{serverId:i.id,bootstrapVersion:c.version,steps:s.length}}}}var Ni=(e)=>e==null?void 0:String(e),ns=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},hl=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),resourceId:String(e.resource_id),name:String(e.name),provider:String(e.provider),providerId:Ni(e.provider_id),region:Ni(e.region),zone:Ni(e.zone),endpoint:String(e.endpoint),sshUser:String(e.ssh_user),sshPort:Number(e.ssh_port),credentialRef:String(e.credential_ref),hostKeyAlgorithm:Ni(e.host_key_algorithm),hostKeyFingerprint:Ni(e.host_key_fingerprint),pendingHostKey:Ni(e.pending_host_key),roles:ns(e.roles,[]),labels:ns(e.labels,{}),taints:ns(e.taints,[]),capacity:ns(e.capacity,{}),usage:ns(e.usage,{}),capabilities:ns(e.capabilities,{}),status:String(e.status),trustState:String(e.trust_state),validation:ns(e.validation,void 0),bootstrapVersion:Ni(e.bootstrap_version),heartbeatAt:Ni(e.heartbeat_at),lastSeenAt:Ni(e.last_seen_at),archivedAt:Ni(e.archived_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class ke{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}get(e){let t=this.control.database.query("SELECT * FROM fleet_servers WHERE id=?").get(e);return t?hl(t):void 0}list(e,t=!1){return this.control.database.query("SELECT * FROM fleet_servers WHERE project_id=? ORDER BY name").all(e).map(hl).filter((r)=>t||r.status!=="archived")}findProvider(e,t,r){let n=this.control.database.query("SELECT * FROM fleet_servers WHERE organization_id=? AND provider=? AND provider_id=? AND archived_at IS NULL").get(e,t,r);return n?hl(n):void 0}create(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO fleet_servers (id,organization_id,project_id,resource_id,name,provider,provider_id,region,zone,endpoint,ssh_user,ssh_port,credential_ref,host_key_algorithm,host_key_fingerprint,pending_host_key,roles,labels,taints,capacity,usage,capabilities,status,trust_state,validation,bootstrap_version,heartbeat_at,last_seen_at,archived_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.resourceId,e.name,e.provider,e.providerId??null,e.region??null,e.zone??null,e.endpoint,e.sshUser,e.sshPort,e.credentialRef,e.hostKeyAlgorithm??null,e.hostKeyFingerprint??null,e.pendingHostKey??null,JSON.stringify(e.roles),JSON.stringify(e.labels),JSON.stringify(e.taints),JSON.stringify(e.capacity),JSON.stringify(e.usage),JSON.stringify(e.capabilities),e.status,e.trustState,JSON.stringify(e.validation??{}),e.bootstrapVersion??null,e.heartbeatAt??null,e.lastSeenAt??null,e.archivedAt??null,r,r]),this.get(t)}update(e,t){let r=this.get(e);if(!r)throw Error("Server was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE fleet_servers SET name=?,provider_id=?,region=?,zone=?,endpoint=?,ssh_user=?,ssh_port=?,credential_ref=?,host_key_algorithm=?,host_key_fingerprint=?,pending_host_key=?,roles=?,labels=?,taints=?,capacity=?,usage=?,capabilities=?,status=?,trust_state=?,validation=?,bootstrap_version=?,heartbeat_at=?,last_seen_at=?,archived_at=?,version=version+1,updated_at=? WHERE id=?",[n.name,n.providerId??null,n.region??null,n.zone??null,n.endpoint,n.sshUser,n.sshPort,n.credentialRef,n.hostKeyAlgorithm??null,n.hostKeyFingerprint??null,n.pendingHostKey??null,JSON.stringify(n.roles),JSON.stringify(n.labels),JSON.stringify(n.taints),JSON.stringify(n.capacity),JSON.stringify(n.usage),JSON.stringify(n.capabilities),n.status,n.trustState,JSON.stringify(n.validation??{}),n.bootstrapVersion??null,n.heartbeatAt??null,n.lastSeenAt??null,n.archivedAt??null,i,e]),this.get(e)}}var oC=/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?|\[[0-9a-fA-F:]+\])$/;class Nn{store;drivers;now;queue;constructor(e,t,r,n=()=>new Date){this.store=e;this.drivers=t;this.now=n;this.queue=r??new S(e.control)}driver(e){let t=this.drivers.find((r)=>r.provider===e);if(!t)throw Error(`No ${e} fleet driver is configured.`);return t}enroll(e){if(!/^[a-z0-9][a-z0-9-]{1,62}$/.test(e.name))throw Error("Server name is invalid.");if(!oC.test(e.endpoint)||e.sshUser==="root"||!e.credentialRef.startsWith("secret://"))throw Error("Enrollment requires a valid endpoint, non-root SSH user, and secret credential reference.");let t=e.providerId?this.store.findProvider(e.organizationId,e.provider,e.providerId):void 0;if(t)return this.store.update(t.id,{endpoint:e.endpoint,region:e.region,zone:e.zone});let r=this.store.control.createResource({projectId:e.projectId,kind:"server",slug:e.name,name:e.name,provider:e.provider,providerId:e.providerId}),n=this.driver(e.provider);return this.store.create({...e,resourceId:r.id,sshPort:e.sshPort??22,labels:e.labels??{},taints:[],capacity:{},usage:{},capabilities:n.capabilities(),status:"pending",trustState:"unverified"})}async test(e){let t=this.store.get(e);if(!t)throw Error("Server was not found.");let r=await this.driver(t.provider).test(t);if(!r.reachable)return this.store.update(e,{status:"unreachable"});if(t.hostKeyFingerprint&&t.hostKeyFingerprint!==r.hostKeyFingerprint)return this.store.update(e,{status:"degraded",trustState:"rotation_pending",pendingHostKey:r.hostKeyFingerprint});return this.store.update(e,{hostKeyAlgorithm:r.hostKeyAlgorithm,hostKeyFingerprint:r.hostKeyFingerprint,pendingHostKey:void 0,trustState:"pinned",status:"validating",lastSeenAt:this.now().toISOString()})}reviewHostKey(e,t){let r=this.store.get(e);if(!r||r.pendingHostKey!==t)throw Error("Pending host key does not match.");return this.store.update(e,{hostKeyFingerprint:t,pendingHostKey:void 0,trustState:"pinned",status:"validating"})}async validate(e){let t=this.store.get(e);if(!t||t.trustState!=="pinned")throw Error("Pin the SSH host key before validation.");let r=await this.driver(t.provider).validate(t),n=[];if(!["x64","arm64","x86_64","aarch64"].includes(r.arch??""))n.push({code:"arch.unsupported",severity:"error",message:"Unsupported architecture.",remediation:"Use x86_64 or arm64 Linux."});for(let s of["curl","tar"])if(!r.tools?.[s])n.push({code:`tool.${s}`,severity:"error",message:`${s} is missing.`,remediation:`Install ${s} before bootstrap.`});if(Math.abs(r.timeSkewSeconds??0)>60)n.push({code:"time.skew",severity:"error",message:"Clock skew exceeds 60 seconds.",remediation:"Enable NTP synchronization."});if(!r.dnsOk)n.push({code:"dns.failed",severity:"error",message:"DNS validation failed.",remediation:"Repair resolver configuration."});let i={valid:!n.some((s)=>s.severity==="error"),facts:r,findings:n,validatedAt:this.now().toISOString(),validatorVersion:"1"},o={cpu:r.cpuCores??0,memoryBytes:r.memoryBytes??0,diskBytes:r.diskBytes??0};return this.store.update(e,{validation:i,capacity:o,status:i.valid?"ready":"degraded"})}bootstrap(e,t=!1){let r=this.store.get(e);if(!r?.validation?.valid)throw Error("A healthy validation report is required.");let n=["install runtime dependencies","install ts-cloud agent","configure heartbeat","verify least-privilege access"];if(!t)return{preview:!0,steps:n};let i=this.queue.enqueue({projectId:r.projectId,resourceId:r.resourceId,kind:"fleet.bootstrap",input:{serverId:e,steps:n},lockKey:`server:${e}`,providerKey:r.provider}).operation;return{preview:!1,steps:n,operation:i}}heartbeat(e,t){let r=this.store.get(e);if(!r)throw Error("Server was not found.");let n=this.now().toISOString();return this.store.update(e,{usage:t.usage,capabilities:t.capabilities??r.capabilities,heartbeatAt:n,lastSeenAt:n,status:r.status==="draining"||r.status==="drained"?r.status:"ready"})}drain(e,t=!1){return this.store.update(e,{status:t?"drained":"draining"})}uncordon(e){return this.store.update(e,{status:"ready"})}archive(e,t){let r=this.store.get(e);if(!r||t!==r.name)throw Error("Exact server name confirmation is required.");return this.store.update(e,{status:"archived",archivedAt:this.now().toISOString()})}}import{createHash as yl,createPublicKey as qf,verify as sC}from"node:crypto";function Pa(e){if(e===null||typeof e!=="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(Pa).join(",")}]`;return`{${Object.keys(e).sort().map((t)=>`${JSON.stringify(t)}:${Pa(e[t])}`).join(",")}}`}var Gf=(e)=>yl("sha256").update(Pa(e)).digest("hex"),nd=(e)=>yl("sha256").update(Pa(e)).digest("hex"),Jf=(e)=>yl("sha256").update(qf(e).export({type:"spki",format:"der"})).digest("hex");function Hf(e,t,r){try{return sC(null,Buffer.from(Pa(e)),qf(r),Buffer.from(t,"base64"))}catch{return!1}}var zf=(e)=>e.replace(/^v/,"").split(/[.-]/).slice(0,3).map((t)=>Number(t)||0),Vf=(e,t)=>{let r=zf(e),n=zf(t);for(let i=0;i<3;i++){let o=(r[i]??0)-(n[i]??0);if(o)return o}return 0};function Wf(e,t){let r=[];if(t.schemaVersion<e.minimumSchema)r.push(`schema ${t.schemaVersion} is below ${e.minimumSchema}`);if(t.schemaVersion>e.maximumSchema)r.push(`schema ${t.schemaVersion} is above ${e.maximumSchema}`);if(e.minimumVersion&&Vf(t.currentVersion,e.minimumVersion)<0)r.push(`platform ${t.currentVersion} is below ${e.minimumVersion}`);if(Vf(e.version,t.currentVersion)<=0)r.push(`version ${e.version} is not newer than ${t.currentVersion}`);if(!e.artifacts.some((n)=>n.platform===t.platform&&n.architecture===t.architecture))r.push(`no artifact for ${t.platform}/${t.architecture}`);return{compatible:r.length===0,reasons:r}}var to=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},Rr=(e)=>e==null?void 0:String(e),aC=(e)=>({id:String(e.id),organizationId:String(e.organization_id),name:String(e.name),algorithm:"ed25519",publicKeyPem:String(e.public_key_pem),fingerprint:String(e.fingerprint),revokedAt:Rr(e.revoked_at),createdAt:String(e.created_at)}),Kf=(e)=>({id:String(e.id),organizationId:String(e.organization_id),version:String(e.version),channel:String(e.channel),publishedAt:String(e.published_at),keyId:String(e.key_id),digest:String(e.digest),document:to(e.document,{}),signature:String(e.signature),verificationStatus:String(e.verification_status),compatibility:to(e.compatibility,{compatible:!1,reasons:[]}),createdAt:String(e.created_at)}),Qf=(e)=>({id:String(e.id),projectId:String(e.project_id),name:String(e.name),schedule:String(e.schedule),timezone:String(e.timezone),durationMinutes:Number(e.duration_minutes),allowedOperations:to(e.allowed_operations,[]),requireApproval:Number(e.require_approval)===1,enabled:Number(e.enabled)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Yf=(e)=>({id:String(e.id),projectId:String(e.project_id),manifestId:String(e.manifest_id),windowId:Rr(e.window_id),fromVersion:String(e.from_version),strategy:String(e.strategy),batchSize:Number(e.batch_size),healthGate:to(e.health_gate,{}),status:String(e.status),currentStage:Rr(e.current_stage),backupId:Rr(e.backup_id),approvedBy:Rr(e.approved_by),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),bl=(e)=>({id:String(e.id),campaignId:String(e.campaign_id),serverId:Rr(e.server_id),target:String(e.target),cohort:Number(e.cohort),previousVersion:String(e.previous_version),status:String(e.status),evidence:to(e.evidence,{}),error:Rr(e.error),startedAt:Rr(e.started_at),finishedAt:Rr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Xf=(e)=>({id:String(e.id),projectId:String(e.project_id),kind:String(e.kind),criteria:to(e.criteria,{}),candidates:to(e.candidates,[]),candidateDigest:String(e.candidate_digest),estimatedBytes:Number(e.estimated_bytes),status:String(e.status),confirmation:Rr(e.confirmation),expiresAt:String(e.expires_at),result:to(e.result,{}),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Zf=(e)=>({id:String(e.id),projectId:String(e.project_id),backupPolicyId:Rr(e.backup_policy_id),recoveryPointId:Rr(e.recovery_point_id),topologyId:Rr(e.topology_id),scenario:String(e.scenario),isolatedTarget:String(e.isolated_target),expectedRpoMinutes:Number(e.expected_rpo_minutes),expectedRtoMinutes:Number(e.expected_rto_minutes),status:String(e.status),operationId:Rr(e.operation_id),evidence:to(e.evidence,{}),measuredRpoMinutes:e.measured_rpo_minutes==null?void 0:Number(e.measured_rpo_minutes),measuredRtoMinutes:e.measured_rto_minutes==null?void 0:Number(e.measured_rto_minutes),cleanupVerified:Number(e.cleanup_verified)===1,error:Rr(e.error),startedAt:Rr(e.started_at),finishedAt:Rr(e.finished_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class Ln{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}addTrustedKey(e){let t=this.id(),r=this.now().toISOString(),n=Jf(e.publicKeyPem);return this.control.database.run("INSERT INTO platform_trusted_keys (id,organization_id,name,algorithm,public_key_pem,fingerprint,created_at) VALUES (?,?,?,'ed25519',?,?,?)",[t,e.organizationId,e.name,e.publicKeyPem,n,r]),this.key(t)}key(e){let t=this.control.database.query("SELECT * FROM platform_trusted_keys WHERE id=?").get(e);return t?aC(t):void 0}revokeKey(e){return this.control.database.run("UPDATE platform_trusted_keys SET revoked_at=? WHERE id=?",[this.now().toISOString(),e]),this.key(e)}importManifest(e){let t=this.key(e.keyId);if(!t||t.organizationId!==e.organizationId)throw Error("Trusted update key was not found.");if(t.revokedAt)throw Error("Update signing key is revoked.");if(!Hf(e.document,e.signature,t.publicKeyPem))throw Error("Update manifest signature is invalid.");let r=Wf(e.document,e.current),n=Gf(e.document),i=this.id(),o=this.now().toISOString();return this.control.database.run("INSERT INTO platform_update_manifests (id,organization_id,version,channel,published_at,key_id,digest,document,signature,verification_status,compatibility,created_at) VALUES (?,?,?,?,?,?,?,?,?,'verified',?,?)",[i,e.organizationId,e.document.version,e.document.channel,new Date(e.document.publishedAt).toISOString(),e.keyId,n,JSON.stringify(e.document),e.signature,JSON.stringify(r),o]),this.manifest(i)}manifest(e){let t=this.control.database.query("SELECT * FROM platform_update_manifests WHERE id=?").get(e);return t?Kf(t):void 0}manifests(e){return this.control.database.query("SELECT * FROM platform_update_manifests WHERE organization_id=? ORDER BY published_at DESC").all(e).map(Kf)}createWindow(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO maintenance_windows (id,project_id,name,schedule,timezone,duration_minutes,allowed_operations,require_approval,enabled,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,1,?,?)",[t,e.projectId,e.name,e.schedule,e.timezone,e.durationMinutes,JSON.stringify(e.allowedOperations),e.requireApproval===!1?0:1,r,r]),this.window(t)}window(e){let t=this.control.database.query("SELECT * FROM maintenance_windows WHERE id=?").get(e);return t?Qf(t):void 0}windows(e){return this.control.database.query("SELECT * FROM maintenance_windows WHERE project_id=? ORDER BY name").all(e).map(Qf)}createCampaign(e){return this.control.transaction(()=>{let t=this.manifest(e.manifestId);if(!t?.compatibility.compatible||t.verificationStatus!=="verified")throw Error("A verified compatible update manifest is required.");if(!e.backupId)throw Error("A verified pre-upgrade backup is required.");let r=this.id(),n=this.now().toISOString();return this.control.database.run("INSERT INTO platform_upgrade_campaigns (id,project_id,manifest_id,window_id,from_version,strategy,batch_size,health_gate,status,backup_id,approved_by,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'planned',?,?,?,?)",[r,e.projectId,e.manifestId,e.windowId??null,e.fromVersion,e.strategy,e.batchSize,JSON.stringify(e.healthGate),e.backupId,e.approvedBy??null,n,n]),e.targets.forEach((i,o)=>this.control.database.run("INSERT INTO platform_upgrade_targets (id,campaign_id,server_id,target,cohort,previous_version,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,i.serverId??null,i.target,e.strategy==="canary"?o===0?0:1+Math.floor((o-1)/e.batchSize):Math.floor(o/e.batchSize),i.previousVersion,n,n])),this.campaign(r)})}campaign(e){let t=this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE id=?").get(e);return t?Yf(t):void 0}campaigns(e){return this.control.database.query("SELECT * FROM platform_upgrade_campaigns WHERE project_id=? ORDER BY created_at DESC").all(e).map(Yf)}targets(e){return this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE campaign_id=? ORDER BY cohort,target").all(e).map(bl)}updateCampaign(e,t){let r=this.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let n={...r,...t};return this.control.database.run("UPDATE platform_upgrade_campaigns SET status=?,current_stage=?,updated_at=? WHERE id=?",[n.status,n.currentStage??null,this.now().toISOString(),e]),this.campaign(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e);if(!r)throw Error("Upgrade target was not found.");let n={...bl(r),...t};return this.control.database.run("UPDATE platform_upgrade_targets SET status=?,evidence=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[n.status,JSON.stringify(n.evidence),n.error??null,n.startedAt??null,n.finishedAt??null,this.now().toISOString(),e]),bl(this.control.database.query("SELECT * FROM platform_upgrade_targets WHERE id=?").get(e))}createCleanup(e){let t=[...e.candidates].sort((s,c)=>s.id.localeCompare(c.id)),r=nd(t),n=this.id(),i=this.now().toISOString(),o=new Date(this.now().getTime()+(e.ttlMinutes??60)*60000).toISOString();return this.control.database.run("INSERT INTO cleanup_plans (id,project_id,kind,criteria,candidates,candidate_digest,estimated_bytes,status,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'preview',?,?,?)",[n,e.projectId,e.kind,JSON.stringify(e.criteria),JSON.stringify(t),r,t.reduce((s,c)=>s+c.bytes,0),o,i,i]),this.cleanup(n)}cleanup(e){let t=this.control.database.query("SELECT * FROM cleanup_plans WHERE id=?").get(e);return t?Xf(t):void 0}cleanups(e){return this.control.database.query("SELECT * FROM cleanup_plans WHERE project_id=? ORDER BY created_at DESC").all(e).map(Xf)}updateCleanup(e,t){let r=this.cleanup(e);if(!r)throw Error("Cleanup plan was not found.");let n={...r,...t};return this.control.database.run("UPDATE cleanup_plans SET status=?,confirmation=?,result=?,updated_at=? WHERE id=?",[n.status,n.confirmation??null,JSON.stringify(n.result),this.now().toISOString(),e]),this.cleanup(e)}createDrill(e){if(!/^isolated:\/\//.test(e.isolatedTarget))throw Error("DR drills require an isolated target.");let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO disaster_recovery_drills (id,project_id,backup_policy_id,recovery_point_id,topology_id,scenario,isolated_target,expected_rpo_minutes,expected_rto_minutes,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'planned',?,?)",[t,e.projectId,e.backupPolicyId??null,e.recoveryPointId??null,e.topologyId??null,e.scenario,e.isolatedTarget,e.expectedRpoMinutes,e.expectedRtoMinutes,r,r]),this.drill(t)}drill(e){let t=this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE id=?").get(e);return t?Zf(t):void 0}drills(e){return this.control.database.query("SELECT * FROM disaster_recovery_drills WHERE project_id=? ORDER BY created_at DESC").all(e).map(Zf)}updateDrill(e,t){let r=this.drill(e);if(!r)throw Error("DR drill was not found.");let n={...r,...t};return this.control.database.run("UPDATE disaster_recovery_drills SET status=?,operation_id=?,evidence=?,measured_rpo_minutes=?,measured_rto_minutes=?,cleanup_verified=?,error=?,started_at=?,finished_at=?,updated_at=? WHERE id=?",[n.status,n.operationId??null,JSON.stringify(n.evidence),n.measuredRpoMinutes??null,n.measuredRtoMinutes??null,n.cleanupVerified?1:0,n.error??null,n.startedAt??null,n.finishedAt??null,this.now().toISOString(),e]),this.drill(e)}}function cC(e,t=new Date){if(!e.enabled)return!1;let r=new Date(e.schedule);if(!Number.isNaN(r.getTime()))return t>=r&&t.getTime()<=r.getTime()+e.durationMinutes*60000;let n=/^(\d{2}):(\d{2})$/.exec(e.schedule);if(!n)return!1;let i=new Intl.DateTimeFormat("en-US",{timeZone:e.timezone,hour:"2-digit",minute:"2-digit",hourCycle:"h23"}).formatToParts(t),o=Number(i.find((c)=>c.type==="hour")?.value)*60+Number(i.find((c)=>c.type==="minute")?.value),s=Number(n[1])*60+Number(n[2]);return o>=s&&o<s+e.durationMinutes}class Mn{store;now;queue;constructor(e,t,r=()=>new Date){this.store=e;this.now=r;this.queue=t??new S(e.control)}enqueueCampaign(e,t={}){let r=this.store.campaign(e);if(!r)throw Error("Upgrade campaign was not found.");let n=r.windowId?this.store.window(r.windowId):void 0;if(n&&!n.allowedOperations.includes("platform.upgrade"))throw Error("Maintenance window does not permit platform upgrades.");if(n&&!t.overrideWindow&&!cC(n,this.now()))throw Error("Upgrade is outside its maintenance window.");if(n?.requireApproval&&!t.approvedBy&&!r.approvedBy)throw Error("Maintenance approval is required.");let i=this.queue.enqueue({projectId:r.projectId,actorId:t.approvedBy,kind:"maintenance.upgrade",input:{campaignId:e},lockKey:"platform-upgrade",providerKey:"platform",timeoutSeconds:7200,cancellationMode:"cooperative",resumePolicy:"fail"}).operation;return{campaign:this.store.updateCampaign(e,{status:"queued"}),operation:i}}async previewCleanup(e,t){let r=t.find((n)=>n.kind===e.kind);if(!r)throw Error(`No ${e.kind} cleanup driver is configured.`);return this.store.createCleanup({...e,candidates:await r.discover(e.criteria)})}enqueueCleanup(e,t){let r=this.store.cleanup(e);if(!r||r.status!=="preview")throw Error("A current cleanup preview is required.");if(new Date(r.expiresAt)<=this.now())throw Error("Cleanup preview expired; generate it again.");let n=`DELETE ${r.candidates.length} ${r.kind}`;if(t!==n)throw Error(`Exact confirmation ${n} is required.`);let i=this.queue.enqueue({projectId:r.projectId,kind:"maintenance.cleanup",input:{planId:e},lockKey:`cleanup:${r.kind}`,providerKey:"cleanup",timeoutSeconds:3600,cancellationMode:"cooperative"}).operation;return{plan:this.store.updateCleanup(e,{status:"approved",confirmation:t}),operation:i}}enqueueDrill(e){let t=this.store.drill(e);if(!t||t.status!=="planned")throw Error("A planned DR drill is required.");let r=this.queue.enqueue({projectId:t.projectId,kind:"maintenance.drill",input:{drillId:e},lockKey:`drill:${t.scenario}:${t.id}`,providerKey:"recovery",timeoutSeconds:7200,cancellationMode:"cooperative"}).operation;return{drill:this.store.updateDrill(e,{status:"queued",operationId:r.id}),operation:r}}}var Sl=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function eh(e){return{"maintenance.upgrade":async(i)=>{let o=e.store.campaign(String(Sl(i.operation.input).campaignId??""));if(!o||!e.platform)throw Error("Upgrade campaign or platform maintenance driver is unavailable.");let s=e.store.manifest(o.manifestId);if(!s?.compatibility.compatible||s.verificationStatus!=="verified")throw Error("Update manifest is no longer verified and compatible.");let c=s.document.artifacts.find((a)=>a.platform===process.platform&&a.architecture===process.arch)??s.document.artifacts[0];if(!c)throw Error("No update artifact matches this platform.");e.store.updateCampaign(o.id,{status:"running",currentStage:"preflight"});let u=[];try{for(let a of[...new Set(e.store.targets(o.id).map((f)=>f.cohort))].sort((f,T)=>f-T)){e.store.updateCampaign(o.id,{currentStage:`cohort:${a}`});for(let f of e.store.targets(o.id).filter((T)=>T.cohort===a)){i.throwIfCancellationRequested(),i.checkpoint(`download:${f.target}`,"Downloading signed platform artifact."),e.store.updateTarget(f.id,{status:"downloading",startedAt:new Date().toISOString()});let T=await e.platform.download({target:f,artifact:c,signal:i.signal});if(T.sha256!==c.sha256)throw Error(`Artifact checksum mismatch for ${f.target}.`);i.checkpoint(`install:${f.target}`,"Installing verified artifact."),e.store.updateTarget(f.id,{status:"installing"}),await e.platform.install({target:f,path:T.path,version:s.version,signal:i.signal}),u.push(f);let R=await e.platform.health({target:f,gate:o.healthGate});if(!R.healthy)throw Error(`Upgrade health gate failed for ${f.target}.`);e.store.updateTarget(f.id,{status:"healthy",evidence:R.evidence,finishedAt:new Date().toISOString()})}}return e.store.updateCampaign(o.id,{status:"succeeded",currentStage:void 0}),{campaignId:o.id,version:s.version,targets:u.length}}catch(a){e.store.updateCampaign(o.id,{status:"rolling_back",currentStage:"rollback"});for(let f of u.reverse())e.store.updateTarget(f.id,{status:"rolling_back"}),await e.platform.rollback({target:f,version:f.previousVersion,signal:i.signal}),e.store.updateTarget(f.id,{status:"rolled_back",finishedAt:new Date().toISOString()});throw e.store.updateCampaign(o.id,{status:"rolled_back",currentStage:void 0}),a}},"maintenance.cleanup":async(i)=>{let o=e.store.cleanup(String(Sl(i.operation.input).planId??""));if(!o||o.status!=="approved")throw Error("Approved cleanup plan was not found.");if(nd([...o.candidates].sort((f,T)=>f.id.localeCompare(T.id)))!==o.candidateDigest)throw Error("Cleanup candidate set changed after preview.");let s=e.cleanup?.find((f)=>f.kind===o.kind);if(!s)throw Error(`No ${o.kind} cleanup driver is configured.`);e.store.updateCleanup(o.id,{status:"running"});let c=[],u=[];for(let f of o.candidates){i.throwIfCancellationRequested();try{await s.remove(f),c.push(f.id)}catch(T){u.push({id:f.id,error:T instanceof Error?T.message:String(T)})}}let a=u.length?c.length?"partial":"failed":"succeeded";if(e.store.updateCleanup(o.id,{status:a,result:{removed:c,failed:u,reclaimedBytes:o.candidates.filter((f)=>c.includes(f.id)).reduce((f,T)=>f+T.bytes,0)}}),u.length)throw Error(`Cleanup failed for ${u.length} candidate(s).`);return{planId:o.id,removed:c.length,reclaimedBytes:o.estimatedBytes}},"maintenance.drill":async(i)=>{let o=e.store.drill(String(Sl(i.operation.input).drillId??""));if(!o)throw Error("DR drill was not found.");let s=e.recovery?.find((T)=>T.scenario===o.scenario);if(!s)throw Error(`No ${o.scenario} recovery driver is configured.`);let c=new Date;e.store.updateDrill(o.id,{status:"restoring",startedAt:c.toISOString()});let u=o.isolatedTarget,a={},f={};try{i.checkpoint("restore","Restoring into isolated drill target.");let T=await s.restore({drill:o,signal:i.signal});if(!T.target.startsWith("isolated://"))throw Error("Recovery driver attempted a non-isolated target.");u=T.target,a=T.evidence;let R=(c.getTime()-new Date(T.recoveryPointAt).getTime())/60000;e.store.updateDrill(o.id,{status:"verifying",measuredRpoMinutes:R,evidence:{restore:a}}),i.checkpoint("verify","Running recovery health checks without production traffic.");let D=await s.verify({drill:o,target:u});f=D.evidence;let W=(Date.now()-c.getTime())/60000;if(!D.healthy||R>o.expectedRpoMinutes||W>o.expectedRtoMinutes)throw Error("DR drill failed its health, RPO, or RTO objective.");e.store.updateDrill(o.id,{measuredRpoMinutes:R,measuredRtoMinutes:W,evidence:{restore:a,verify:f}})}catch(T){throw e.store.updateDrill(o.id,{status:"failed",error:T instanceof Error?T.message:String(T),evidence:{restore:a,verify:f}}),T}finally{e.store.updateDrill(o.id,{status:"cleaning"});try{await s.cleanup({drill:o,target:u});let T=e.store.drill(o.id);e.store.updateDrill(o.id,{status:T.error?"failed":"passed",cleanupVerified:!0,finishedAt:new Date().toISOString()})}catch(T){e.store.updateDrill(o.id,{status:"cleanup_required",cleanupVerified:!1,error:T instanceof Error?T.message:String(T),finishedAt:new Date().toISOString()})}}return{drillId:o.id,status:e.store.drill(o.id).status}}}}var th={releases:{select:"SELECT id,created_at,0 bytes FROM releases WHERE project_id=? AND pinned=0 AND status IN ('failed','rolled_back','superseded') AND created_at<?",remove:"DELETE FROM releases WHERE id=?"},artifacts:{select:"SELECT a.id,a.created_at,a.size bytes FROM release_artifacts a WHERE a.organization_id=? AND NOT EXISTS(SELECT 1 FROM releases r WHERE r.artifact_id=a.id) AND a.created_at<?",remove:"DELETE FROM release_artifacts WHERE id=?"},operations:{select:"SELECT id,created_at,0 bytes FROM operations WHERE project_id=? AND state IN ('succeeded','failed','cancelled','timed_out') AND updated_at<?",remove:"DELETE FROM operations WHERE id=?"},logs:{select:"SELECT l.id,l.created_at,length(l.message) bytes FROM operation_logs l JOIN operations o ON o.id=l.operation_id WHERE o.project_id=? AND o.state IN ('succeeded','failed','cancelled','timed_out') AND l.created_at<?",remove:"DELETE FROM operation_logs WHERE id=?"},previews:{select:"SELECT id,created_at,0 bytes FROM preview_instances WHERE project_id=? AND status IN ('destroyed','failed') AND updated_at<?",remove:"DELETE FROM preview_instances WHERE id=?"},snapshots:{select:"SELECT id,created_at,size_bytes bytes FROM recovery_points WHERE project_id=? AND pinned=0 AND held=0 AND status IN ('failed','deleted') AND created_at<?",remove:"DELETE FROM recovery_points WHERE id=?"},orphaned_resources:{select:"SELECT id,created_at,COALESCE(capacity_bytes,0) bytes FROM persistent_volumes WHERE project_id=? AND status='orphaned' AND orphaned_at<?",remove:"UPDATE persistent_volumes SET status='deleted',deleted_at=datetime('now'),updated_at=datetime('now') WHERE id=? AND status='orphaned'"}};class Un{kind;control;projectId;organizationId;constructor(e,t,r,n){this.kind=e;this.control=t;this.projectId=r;this.organizationId=n}async discover(e){let t=Math.max(1,Math.min(3650,Number(e.olderThanDays??30))),r=new Date(Date.now()-t*86400000).toISOString(),n=th[this.kind],i=this.kind==="artifacts"?this.organizationId:this.projectId;return this.control.database.query(n.select).all(i,r).map((s)=>({id:String(s.id),kind:this.kind,label:`${this.kind}:${String(s.id)}`,bytes:Number(s.bytes??0),metadata:{createdAt:String(s.created_at)}}))}async remove(e){if(this.control.database.run(th[this.kind].remove,[e.id]).changes!==1)throw Error(`${e.label} changed or is no longer removable.`)}}var wi=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},yn=(e)=>e==null?void 0:String(e),ih=()=>({cpu:0,memoryBytes:0,diskBytes:0,gpu:0}),Ks=(e={})=>({...ih(),...e});function rh(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),name:String(e.name),purpose:String(e.purpose),backend:String(e.backend),region:yn(e.region),architecture:yn(e.architecture),labels:wi(e.labels,{}),requiredServerLabels:wi(e.required_server_labels,{}),toleratedTaints:wi(e.tolerated_taints,[]),capacity:Ks(wi(e.capacity,{})),reserved:wi(e.reserved,{}),maxWorkloads:Number(e.max_workloads),costWeight:Number(e.cost_weight),spreadKey:yn(e.spread_key),concurrency:Number(e.concurrency),ephemeralWorkspaces:Number(e.ephemeral_workspaces)===1,allowProductionSecrets:Number(e.allow_production_secrets)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function nh(e){return{id:String(e.id),projectId:String(e.project_id),environmentId:yn(e.environment_id),resourceId:String(e.resource_id),releaseId:yn(e.release_id),poolId:String(e.pool_id),serverId:yn(e.server_id),purpose:String(e.purpose),requirements:wi(e.requirements,{}),decision:wi(e.decision,{}),stateful:Number(e.stateful)===1,autoReschedule:Number(e.auto_reschedule)===1,status:String(e.status),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function dC(e){return{id:String(e.id),projectId:String(e.project_id),resourceId:yn(e.resource_id),poolId:String(e.pool_id),placementId:yn(e.placement_id),operationId:yn(e.operation_id),sourceSha:String(e.source_sha),buildSpec:wi(e.build_spec,{}),credentialPolicy:wi(e.credential_policy,{productionSecrets:!1,shortLivedTokenExpiresAt:""}),workspace:yn(e.workspace),cacheKey:yn(e.cache_key),artifactUri:yn(e.artifact_uri),artifactDigest:yn(e.artifact_digest),status:String(e.status),cleanupAt:yn(e.cleanup_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}class xn{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}createPool(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO capacity_pools (id,organization_id,project_id,name,purpose,backend,region,architecture,labels,required_server_labels,tolerated_taints,capacity,reserved,max_workloads,cost_weight,spread_key,concurrency,ephemeral_workspaces,allow_production_secrets,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",[t,e.organizationId,e.projectId,e.name,e.purpose,e.backend,e.region??null,e.architecture??null,JSON.stringify(e.labels),JSON.stringify(e.requiredServerLabels),JSON.stringify(e.toleratedTaints),JSON.stringify(Ks(e.capacity)),"{}",e.maxWorkloads,e.costWeight,e.spreadKey??null,e.concurrency,e.ephemeralWorkspaces?1:0,e.allowProductionSecrets?1:0,e.status,r,r]),this.getPool(t)}getPool(e){let t=this.control.database.query("SELECT * FROM capacity_pools WHERE id=?").get(e);return t?rh(t):void 0}listPools(e){return this.control.database.query("SELECT * FROM capacity_pools WHERE project_id=? ORDER BY name").all(e).map(rh)}updatePool(e,t){let r=this.getPool(e);if(!r)throw Error("Capacity pool was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE capacity_pools SET status=?,reserved=?,capacity=?,concurrency=?,version=version+1,updated_at=? WHERE id=?",[n.status,JSON.stringify(n.reserved),JSON.stringify(n.capacity),n.concurrency,i,e]),this.getPool(e)}addMember(e,t,r={}){let n=this.now().toISOString();this.control.database.run("INSERT INTO capacity_pool_members (pool_id,server_id,capacity_override,status,created_at,updated_at) VALUES (?,?,?,'active',?,?) ON CONFLICT(pool_id,server_id) DO UPDATE SET capacity_override=excluded.capacity_override,status='active',updated_at=excluded.updated_at",[e,t,JSON.stringify(r),n,n])}members(e){return this.control.database.query("SELECT * FROM capacity_pool_members WHERE pool_id=? ORDER BY server_id").all(e).map((t)=>({serverId:String(t.server_id),status:String(t.status),capacityOverride:wi(t.capacity_override,{})}))}memberStatus(e,t,r){this.control.database.run("UPDATE capacity_pool_members SET status=?,updated_at=? WHERE pool_id=? AND server_id=?",[r,this.now().toISOString(),e,t])}listPlacements(e,t){let r=this.control.database.query("SELECT * FROM workload_placements WHERE project_id=? ORDER BY created_at,id").all(e).map(nh);return t?.length?r.filter((n)=>t.includes(n.status)):r}getPlacement(e){let t=this.control.database.query("SELECT * FROM workload_placements WHERE id=?").get(e);return t?nh(t):void 0}activeUsage(e,t){let r=this.control.database.query("SELECT l.resources,l.server_id FROM capacity_leases l WHERE l.pool_id=? AND l.state='active' AND l.expires_at>?").all(e,this.now().toISOString()),n=t?r.filter((i)=>String(i.server_id)===t):r;return{resources:n.reduce((i,o)=>{let s=Ks(wi(o.resources,{}));for(let c of Object.keys(i))i[c]+=s[c];return i},ih()),count:n.length}}expireLeases(){return this.control.database.run("UPDATE capacity_leases SET state='expired',updated_at=? WHERE state='active' AND expires_at<=?",[this.now().toISOString(),this.now().toISOString()]).changes}reserve(e){return this.control.transaction(()=>{this.expireLeases();let t=this.id(),r=this.id(),n=this.now().toISOString(),i=new Date(this.now().getTime()+(e.requirements.leaseSeconds??300)*1000).toISOString();return this.control.database.run("INSERT INTO workload_placements (id,project_id,environment_id,resource_id,release_id,pool_id,server_id,purpose,requirements,decision,stateful,auto_reschedule,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'reserved',?,?)",[t,e.projectId,e.environmentId??null,e.resourceId,e.releaseId??null,e.decision.poolId,e.decision.serverId??null,e.requirements.purpose,JSON.stringify(e.requirements),JSON.stringify(e.decision),e.requirements.stateful?1:0,e.requirements.autoReschedule&&!e.requirements.stateful?1:0,n,n]),this.control.database.run("INSERT INTO capacity_leases (id,placement_id,pool_id,server_id,resources,state,expires_at,created_at,updated_at) VALUES (?,?,?,?,?,'active',?,?,?)",[r,t,e.decision.poolId,e.decision.serverId??null,JSON.stringify(Ks(e.requirements.resources)),i,n,n]),this.getPlacement(t)})}transitionPlacement(e,t){if(!this.getPlacement(e))throw Error("Placement was not found.");let n=this.now().toISOString();if(this.control.database.run("UPDATE workload_placements SET status=?,version=version+1,updated_at=? WHERE id=?",[t,n,e]),["released","failed","blocked"].includes(t))this.control.database.run("UPDATE capacity_leases SET state='released',updated_at=? WHERE placement_id=? AND state='active'",[n,e]);return this.getPlacement(e)}createBuild(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO remote_builds (id,project_id,resource_id,pool_id,placement_id,operation_id,source_sha,build_spec,credential_policy,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,'queued',?,?)",[t,e.projectId,e.resourceId??null,e.poolId,e.placementId??null,e.operationId??null,e.sourceSha,JSON.stringify(e.buildSpec),JSON.stringify({productionSecrets:!1,shortLivedTokenExpiresAt:e.tokenExpiresAt}),r,r]),this.getBuild(t)}getBuild(e){let t=this.control.database.query("SELECT * FROM remote_builds WHERE id=?").get(e);return t?dC(t):void 0}updateBuild(e,t){let r=this.getBuild(e);if(!r)throw Error("Remote build was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE remote_builds SET operation_id=?,workspace=?,cache_key=?,artifact_uri=?,artifact_digest=?,status=?,cleanup_at=?,updated_at=? WHERE id=?",[n.operationId??null,n.workspace??null,n.cacheKey??null,n.artifactUri??null,n.artifactDigest??null,n.status,n.cleanupAt??null,i,e]),this.getBuild(e)}}var id=["cpu","memoryBytes","diskBytes","gpu"],oh=(e,t={})=>Object.entries(t).every(([r,n])=>e[r]===n),uC=(e,t,r)=>Object.fromEntries(id.map((n)=>[n,Math.max(0,e[n]-t[n]-(r[n]??0))])),lC=(e,t)=>id.every((r)=>e[r]>=(t[r]??0)),pC=(e,t)=>id.reduce((r,n)=>r+(t[n]??0)/(e[n]||1),0);class _n{store;fleet;constructor(e,t){this.store=e;this.fleet=t}poolCandidates(e,t,r){let n=[];for(let i of this.store.listPools(e)){if(i.id===r)continue;let o=[];if(i.status!=="active")o.push(`pool is ${i.status}`);if(i.purpose!==t.purpose)o.push(`purpose is ${i.purpose}`);if(t.region&&i.region!==t.region)o.push(`region is ${i.region??"unset"}`);if(t.architecture&&i.architecture!==t.architecture)o.push(`architecture is ${i.architecture??"unset"}`);if(!oh(i.labels,t.labels))o.push("pool labels do not match");if(i.backend==="server"){let s=this.store.members(i.id);if(!s.length)n.push(this.decision(i,void 0,t,[...o,"pool has no servers"]));for(let c of s){let u=this.fleet.get(c.serverId),a=[...o];if(!u)a.push("server is missing");else this.serverReasons(i,u,c.status,t,a);n.push(this.decision(i,u,t,a,c.capacityOverride))}}else n.push(this.decision(i,void 0,t,o))}return n.sort((i,o)=>Number(o.eligible)-Number(i.eligible)||i.score.cost-o.score.cost||i.score.spread-o.score.spread||i.score.fit-o.score.fit||i.poolName.localeCompare(o.poolName)||(i.serverId??"").localeCompare(o.serverId??""))}serverReasons(e,t,r,n,i){if(r!=="active")i.push(`member is ${r}`);if(t.status!=="ready")i.push(`server is ${t.status}`);if(!t.roles.includes(n.purpose==="build"?"build":n.purpose))i.push(`server lacks ${n.purpose} role`);if(!oh(t.labels,e.requiredServerLabels))i.push("server labels do not match pool selector");for(let o of t.taints)if(!e.toleratedTaints.includes(o))i.push(`taint ${o} is not tolerated`)}decision(e,t,r,n,i={}){let o=Ks({...t?.capacity,...i}),s=t?Object.fromEntries(id.map((a)=>[a,Math.min(e.capacity[a],o[a])])):e.capacity,c=this.store.activeUsage(e.id,t?.id),u=uC(s,c.resources,e.reserved);if(c.count>=e.maxWorkloads)n.push("workload limit reached");if(r.purpose==="build"&&c.count>=e.concurrency)n.push("build concurrency reached");if(!lC(u,r.resources))n.push("insufficient capacity");return{poolId:e.id,poolName:e.name,serverId:t?.id,eligible:n.length===0,reasons:n,available:u,score:{fit:pC(u,r.resources),spread:c.count,cost:e.costWeight}}}explain(e,t){return this.poolCandidates(e,t)}place(e){return this.store.control.transaction(()=>{let t=this.poolCandidates(e.projectId,e.requirements).find((r)=>r.eligible);if(!t)throw Error(`No eligible capacity: ${this.explain(e.projectId,e.requirements).flatMap((r)=>r.reasons).join("; ")}`);return this.store.reserve({...e,decision:t})})}activate(e){return this.store.transitionPlacement(e,"active")}release(e){return this.store.transitionPlacement(e,"released")}drainPool(e){let t=this.store.updatePool(e,{status:"draining"}),r=[],n=[];for(let i of this.store.listPlacements(t.projectId,["reserved","active"]).filter((o)=>o.poolId===e)){if(i.stateful){n.push(this.store.transitionPlacement(i.id,"blocked"));continue}this.store.transitionPlacement(i.id,"moving");let o=this.place({projectId:i.projectId,environmentId:i.environmentId,resourceId:i.resourceId,releaseId:i.releaseId,requirements:i.requirements});r.push(this.activate(o.id)),this.store.transitionPlacement(i.id,"released")}return{pool:t,moved:r,blocked:n}}drainServer(e,t){this.store.memberStatus(e,t,"draining");let r=this.store.getPool(e);if(!r)throw Error("Capacity pool was not found.");let n=[],i=[];for(let o of this.store.listPlacements(r.projectId,["reserved","active"]).filter((s)=>s.poolId===e&&s.serverId===t)){if(o.stateful){i.push(this.store.transitionPlacement(o.id,"blocked"));continue}this.store.transitionPlacement(o.id,"moving");let s=this.poolCandidates(o.projectId,o.requirements).find((u)=>u.eligible);if(!s){i.push(this.store.transitionPlacement(o.id,"blocked"));continue}let c=this.store.reserve({projectId:o.projectId,environmentId:o.environmentId,resourceId:o.resourceId,releaseId:o.releaseId,requirements:o.requirements,decision:s});n.push(this.activate(c.id)),this.store.transitionPlacement(o.id,"released")}return{moved:n,blocked:i}}reconcileFailure(e){let t=this.fleet.get(e);if(!t)throw Error("Server was not found.");let r=[],n=[];for(let i of this.store.listPlacements(t.projectId,["active"]).filter((o)=>o.serverId===e)){if(i.stateful||!i.autoReschedule){n.push(this.store.transitionPlacement(i.id,"blocked"));continue}this.store.transitionPlacement(i.id,"failed");let o=this.place({projectId:i.projectId,environmentId:i.environmentId,resourceId:i.resourceId,releaseId:i.releaseId,requirements:i.requirements});r.push(this.activate(o.id))}return{rescheduled:r,blocked:n}}}var ro=(e,t)=>{try{return JSON.parse(String(e))}catch{return t}},ai=(e)=>e==null?void 0:String(e),sh=(e)=>({id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:ai(e.environment_id),name:String(e.name),hostname:String(e.hostname),homeRegion:String(e.home_region),regions:ro(e.regions,[]),trafficPolicy:String(e.traffic_policy),dataPolicy:ro(e.data_policy,{replicate:[],maxLagSeconds:60,retainOnDestroy:!0}),status:String(e.status),activeRegion:String(e.active_region),revision:ai(e.revision),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),vl=(e)=>({id:String(e.id),topologyId:String(e.topology_id),region:String(e.region),role:String(e.role),provider:String(e.provider),stackId:ai(e.stack_id),stackRevision:ai(e.stack_revision),status:String(e.status),health:ro(e.health,{}),lastHealthyAt:ai(e.last_healthy_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),wl=(e)=>({id:String(e.id),topologyId:String(e.topology_id),kind:String(e.kind),sourceRegion:String(e.source_region),targetRegion:String(e.target_region),config:ro(e.config,{}),status:String(e.status),checkpoint:ai(e.checkpoint),lagSeconds:e.lag_seconds==null?void 0:Number(e.lag_seconds),lastVerifiedAt:ai(e.last_verified_at),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),Il=(e)=>({id:String(e.id),topologyId:String(e.topology_id),hostname:String(e.hostname),dnsProvider:String(e.dns_provider),cdnEnabled:Number(e.cdn_enabled)===1,wafEnabled:Number(e.waf_enabled)===1,weights:ro(e.weights,{}),desiredWeights:ro(e.desired_weights,{}),status:String(e.status),providerState:ro(e.provider_state,{}),version:Number(e.version),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}),ah=(e)=>({id:String(e.id),topologyId:String(e.topology_id),operationId:ai(e.operation_id),kind:String(e.kind),requestedRegion:ai(e.requested_region),revision:ai(e.revision),plan:ro(e.plan,[]),currentStep:ai(e.current_step),completedSteps:ro(e.completed_steps,[]),status:String(e.status),error:ai(e.error),createdAt:String(e.created_at),updatedAt:String(e.updated_at)});class On{control;now;id;constructor(e,t=()=>new Date,r=()=>crypto.randomUUID()){this.control=e;this.now=t;this.id=r}create(e){return this.control.transaction(()=>{if(e.regions.length<2||new Set(e.regions.map((o)=>o.region)).size!==e.regions.length||e.regions.filter((o)=>o.role==="primary").length!==1)throw Error("A topology requires unique regions and exactly one primary.");let t=e.regions.find((o)=>o.role==="primary"),r=this.id(),n=this.now().toISOString();this.control.database.run("INSERT INTO regional_topologies (id,organization_id,project_id,environment_id,name,hostname,home_region,regions,traffic_policy,data_policy,status,active_region,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?,?)",[r,e.organizationId,e.projectId,e.environmentId??null,e.name,e.hostname,t.region,JSON.stringify(e.regions),e.trafficPolicy,JSON.stringify(e.dataPolicy),t.region,n,n]);for(let o of e.regions)this.control.database.run("INSERT INTO regional_targets (id,topology_id,region,role,provider,status,created_at,updated_at) VALUES (?,?,?,?,?,'pending',?,?)",[this.id(),r,o.region,o.role,o.provider,n,n]);for(let o of e.dataPolicy.replicate)for(let s of e.regions)for(let c of e.regions.filter((u)=>u.region!==s.region))this.control.database.run("INSERT INTO regional_replication_channels (id,topology_id,kind,source_region,target_region,config,status,created_at,updated_at) VALUES (?,?,?,?,?,?,'pending',?,?)",[this.id(),r,o,s.region,c.region,"{}",n,n]);let i=Object.fromEntries(e.regions.map((o)=>[o.region,o.region===t.region?100:0]));return this.control.database.run("INSERT INTO regional_traffic_routes (id,topology_id,hostname,dns_provider,cdn_enabled,waf_enabled,weights,desired_weights,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?, 'pending',?,?)",[this.id(),r,e.hostname,e.dnsProvider??"route53",e.cdnEnabled?1:0,e.wafEnabled?1:0,JSON.stringify(i),JSON.stringify(i),n,n]),this.get(r)})}get(e){let t=this.control.database.query("SELECT * FROM regional_topologies WHERE id=?").get(e);return t?sh(t):void 0}list(e){return this.control.database.query("SELECT * FROM regional_topologies WHERE project_id=? ORDER BY name").all(e).map(sh)}targets(e){return this.control.database.query("SELECT * FROM regional_targets WHERE topology_id=? ORDER BY role,region").all(e).map(vl)}channels(e){return this.control.database.query("SELECT * FROM regional_replication_channels WHERE topology_id=? ORDER BY kind,target_region").all(e).map(wl)}route(e){let t=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE topology_id=?").get(e);return t?Il(t):void 0}updateTopology(e,t){let r=this.get(e);if(!r)throw Error("Regional topology was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE regional_topologies SET status=?,active_region=?,revision=?,regions=?,version=version+1,updated_at=? WHERE id=?",[n.status,n.activeRegion,n.revision??null,JSON.stringify(n.regions),i,e]),this.get(e)}updateTarget(e,t){let r=this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e);if(!r)throw Error("Regional target was not found.");let n=vl(r),i={...n,...t},o=this.now().toISOString();return this.control.database.run("UPDATE regional_targets SET role=?,stack_id=?,stack_revision=?,status=?,health=?,last_healthy_at=?,version=version+1,updated_at=? WHERE id=?",[i.role,i.stackId??null,i.stackRevision??null,i.status,JSON.stringify(i.health),i.lastHealthyAt??null,o,e]),vl(this.control.database.query("SELECT * FROM regional_targets WHERE id=?").get(e))}updateChannel(e,t){let r=this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e);if(!r)throw Error("Replication channel was not found.");let n=wl(r),i={...n,...t},o=this.now().toISOString();return this.control.database.run("UPDATE regional_replication_channels SET status=?,checkpoint=?,lag_seconds=?,last_verified_at=?,version=version+1,updated_at=? WHERE id=?",[i.status,i.checkpoint??null,i.lagSeconds??null,i.lastVerifiedAt??null,o,e]),wl(this.control.database.query("SELECT * FROM regional_replication_channels WHERE id=?").get(e))}updateRoute(e,t){let r=this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e);if(!r)throw Error("Traffic route was not found.");let n=Il(r),i={...n,...t},o=this.now().toISOString();return this.control.database.run("UPDATE regional_traffic_routes SET weights=?,desired_weights=?,status=?,provider_state=?,version=version+1,updated_at=? WHERE id=?",[JSON.stringify(i.weights),JSON.stringify(i.desiredWeights),i.status,JSON.stringify(i.providerState),o,e]),Il(this.control.database.query("SELECT * FROM regional_traffic_routes WHERE id=?").get(e))}createExecution(e){let t=this.id(),r=this.now().toISOString();return this.control.database.run("INSERT INTO regional_executions (id,topology_id,operation_id,kind,requested_region,revision,plan,status,created_at,updated_at) VALUES (?,?,?,?,?,?,?,'queued',?,?)",[t,e.topologyId,e.operationId??null,e.kind,e.requestedRegion??null,e.revision??null,JSON.stringify(e.plan),r,r]),this.execution(t)}execution(e){let t=this.control.database.query("SELECT * FROM regional_executions WHERE id=?").get(e);return t?ah(t):void 0}executions(e){return this.control.database.query("SELECT * FROM regional_executions WHERE topology_id=? ORDER BY created_at DESC").all(e).map(ah)}updateExecution(e,t){let r=this.execution(e);if(!r)throw Error("Regional execution was not found.");let n={...r,...t},i=this.now().toISOString();return this.control.database.run("UPDATE regional_executions SET operation_id=?,current_step=?,completed_steps=?,status=?,error=?,updated_at=? WHERE id=?",[n.operationId??null,n.currentStep??null,JSON.stringify(n.completedSteps),n.status,n.error??null,i,e]),this.execution(e)}}class $n{store;queue;constructor(e,t){this.store=e;this.queue=t??new S(e.control)}create(e){return this.store.create(e)}plan(e,t,r){if(!this.store.get(e))throw Error("Regional topology was not found.");let i=this.store.targets(e),o=this.store.channels(e);if(t==="rollout")return[...i.filter((s)=>s.role==="secondary").map((s)=>`apply:${s.region}`),...i.filter((s)=>s.role==="primary").map((s)=>`apply:${s.region}`),...o.map((s)=>`replicate:${s.kind}:${s.targetRegion}`),"traffic:activate"];if(t==="failover"||t==="failback")return[`health:${r}`,`replication:${r}`,`traffic:${r}`,`roles:${r}`];if(t==="destroy")return["traffic:drain",...i.filter((s)=>s.role==="secondary").map((s)=>`delete:${s.region}`),...i.filter((s)=>s.role==="primary").map((s)=>`delete:${s.region}`),"complete"];return["observe","repair"]}enqueue(e){let t=this.store.get(e.topologyId);if(!t)throw Error("Regional topology was not found.");if(["failover","failback"].includes(e.kind)&&(!e.targetRegion||!t.regions.some((o)=>o.region===e.targetRegion)))throw Error("A topology target region is required.");if(e.kind==="failover"&&e.targetRegion===t.activeRegion)throw Error("Target region is already active.");if((e.kind==="destroy"||e.deleteData)&&e.confirmation!==t.name)throw Error("Exact topology name confirmation is required.");if(e.deleteData&&t.dataPolicy.retainOnDestroy)throw Error("Topology policy requires regional data retention.");if(e.kind==="rollout"&&!/^[A-Za-z0-9._:@/-]{7,200}$/.test(e.revision??""))throw Error("An immutable revision is required.");let r=this.plan(t.id,e.kind,e.targetRegion),n=this.store.createExecution({topologyId:t.id,kind:e.kind,requestedRegion:e.targetRegion,revision:e.revision,plan:r}),i=this.queue.enqueue({projectId:t.projectId,environmentId:t.environmentId,kind:`region.${e.kind}`,input:{executionId:n.id,manifest:e.manifest??{},deleteData:e.deleteData===!0},lockKey:`regional-topology:${t.id}`,providerKey:"multi-region",timeoutSeconds:7200,cancellationMode:"provider_non_cancellable",resumePolicy:"requeue",maxAttempts:3}).operation;return this.store.updateExecution(n.id,{operationId:i.id}),{execution:this.store.execution(n.id),operation:i}}}var gC=(e)=>e&&typeof e==="object"&&!Array.isArray(e)?e:{};function ch(e,t){let r=(a)=>{let f=t.find((T)=>T.provider===a.provider);if(!f)throw Error(`No ${a.provider} regional driver is configured.`);return f},n=(a,f,T)=>{a.throwIfCancellationRequested(),a.checkpoint(T,T),e.updateExecution(f.id,{status:"running",currentStep:T,completedSteps:[...e.execution(f.id).completedSteps,T]})},i=async(a,f)=>{let T=e.route(a.id);if(!T)throw Error("Regional traffic route was not found.");let R=e.targets(a.id).find((W)=>W.region===a.activeRegion)??e.targets(a.id)[0];if(!R)throw Error("Regional traffic target was not found.");e.updateRoute(T.id,{status:"applying",desiredWeights:f});let D=await r(R).applyTraffic({route:e.route(a.id),topology:a,weights:f});e.updateRoute(T.id,{status:Object.values(f).every((W)=>W===0)?"drained":"in_sync",weights:f,providerState:D.providerState})},o=async(a,f,T,R)=>{e.updateTopology(T.id,{status:"provisioning"});let D=f.revision,W=R.manifest??{},Y=e.targets(T.id).sort((ne,he)=>Number(ne.role==="primary")-Number(he.role==="primary"));for(let ne of Y){n(a,f,`apply:${ne.region}`),e.updateTarget(ne.id,{status:"provisioning"});let he=await r(ne).applyStack({target:ne,revision:D,manifest:W,signal:a.signal}),te=await r(ne).health({target:e.updateTarget(ne.id,{stackId:he.stackId,stackRevision:D})});if(!te.healthy)throw Error(`Regional health gate failed in ${ne.region}.`);e.updateTarget(ne.id,{status:"ready",health:te.evidence,lastHealthyAt:new Date().toISOString()})}for(let ne of e.channels(T.id)){n(a,f,`replicate:${ne.kind}:${ne.targetRegion}`),e.updateChannel(ne.id,{status:"configuring"});let he=Y.find((tt)=>tt.region===ne.sourceRegion),te=await r(he).configureReplication({channel:ne,topology:T}),De=await r(he).verifyReplication({channel:e.updateChannel(ne.id,{checkpoint:te.checkpoint,lagSeconds:te.lagSeconds}),topology:T});if(!De.healthy||De.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${ne.kind} replication to ${ne.targetRegion} exceeds the RPO.`);e.updateChannel(ne.id,{status:"in_sync",checkpoint:De.checkpoint,lagSeconds:De.lagSeconds,lastVerifiedAt:new Date().toISOString()})}n(a,f,"traffic:activate");let ee=Object.fromEntries(T.regions.map((ne)=>[ne.region,ne.region===T.activeRegion?100:0]));return await i(T,ee),e.updateTopology(T.id,{status:"ready",revision:D}),{revision:D,activeRegion:T.activeRegion}},s=async(a,f,T)=>{let R=f.requestedRegion,D=e.targets(T.id).find((ee)=>ee.region===R);if(!D)throw Error("Requested regional target was not found.");e.updateTopology(T.id,{status:f.kind==="failover"?"failing_over":"failing_back"}),n(a,f,`health:${R}`);let W=await r(D).health({target:D});if(!W.healthy)throw Error(`Target region ${R} is unhealthy.`);e.updateTarget(D.id,{status:"ready",health:W.evidence,lastHealthyAt:new Date().toISOString()}),n(a,f,`replication:${R}`);for(let ee of e.channels(T.id).filter((ne)=>ne.targetRegion===R)){let ne=await r(D).verifyReplication({channel:ee,topology:T});if(!ne.healthy||ne.lagSeconds>T.dataPolicy.maxLagSeconds)throw Error(`${ee.kind} replication is outside the failover RPO.`);e.updateChannel(ee.id,{status:"in_sync",checkpoint:ne.checkpoint,lagSeconds:ne.lagSeconds,lastVerifiedAt:new Date().toISOString()})}n(a,f,`traffic:${R}`),await i(T,Object.fromEntries(T.regions.map((ee)=>[ee.region,ee.region===R?100:0]))),n(a,f,`roles:${R}`);let Y=T.regions.map((ee)=>({...ee,role:ee.region===R?"primary":"secondary"}));for(let ee of e.targets(T.id))e.updateTarget(ee.id,{role:ee.region===R?"primary":"secondary"});return e.updateTopology(T.id,{status:f.kind==="failover"?"failed_over":"ready",activeRegion:R,regions:Y}),{activeRegion:R}},c=async(a,f,T,R)=>{e.updateTopology(T.id,{status:"destroying"}),n(a,f,"traffic:drain"),await i(T,Object.fromEntries(T.regions.map((W)=>[W.region,0])));let D=R.deleteData!==!0;for(let W of e.targets(T.id).sort((Y,ee)=>Number(Y.role==="primary")-Number(ee.role==="primary")))n(a,f,`delete:${W.region}`),e.updateTarget(W.id,{status:"deleting"}),await r(W).deleteStack({target:W,retainData:D,signal:a.signal}),e.updateTarget(W.id,{status:"deleted"});return n(a,f,"complete"),e.updateTopology(T.id,{status:"destroyed"}),{destroyed:!0,dataRetained:D}},u=async(a)=>{let f=gC(a.operation.input),T=e.execution(String(f.executionId??""));if(!T)throw Error("Regional execution was not found.");let R=e.get(T.topologyId);if(!R)throw Error("Regional topology was not found.");try{let D;if(T.kind==="rollout")D=await o(a,T,R,f);else if(T.kind==="failover"||T.kind==="failback")D=await s(a,T,R);else if(T.kind==="destroy")D=await c(a,T,R,f);else throw Error("Regional reconciliation is not configured.");return e.updateExecution(T.id,{status:"succeeded",currentStep:void 0}),{executionId:T.id,...D}}catch(D){if(e.updateExecution(T.id,{status:a.cancellationRequested()?"cancelled":"failed",error:D instanceof Error?D.message:String(D)}),e.get(R.id)?.status!=="destroyed")e.updateTopology(R.id,{status:"failed"});throw D}};return{"region.rollout":u,"region.failover":u,"region.failback":u,"region.destroy":u,"region.reconcile":u}}class Cl{provider;reason;constructor(e,t="Configure a regional provider transport before executing this operation."){this.provider=e;this.reason=t}fail(){throw Error(this.reason)}async applyStack(){return this.fail()}async deleteStack(){this.fail()}async health(){return this.fail()}async configureReplication(){return this.fail()}async verifyReplication(){return this.fail()}async applyTraffic(){return this.fail()}}function Mi(e,t,r){return[e,t,r].map((n)=>encodeURIComponent(n)).join(":")}function mC(e){return Object.fromEntries(["start","stop","restart","redeploy","scale","logs","exec","inspect","files"].map((t)=>[t,{supported:!1,reason:e}]))}function is(e,t,r=["exec","files"]){let n=mC(t);for(let i of e)n[i]={supported:!0,requiresConfirmation:!["logs","inspect"].includes(i),requiresRecentAuth:r.includes(i)};return n}var fC=/(?:secret|password|passwd|token|api[_-]?key|private[_-]?key|credential|authorization|cookie)/i;function so(e){let t=String(e??"").trim().toLowerCase();if(["active","running","ready","healthy","available","steady","active:running"].includes(t))return"running";if(["activating","pending","provisioning","starting","created","initializing"].includes(t))return"starting";if(["deactivating","stopping","draining","terminating"].includes(t))return"stopping";if(["inactive","stopped","complete","completed","exited","disabled"].includes(t))return"stopped";if(["degraded","unhealthy","warning"].includes(t))return"degraded";if(["failed","dead","error","crashed","oomkilled"].includes(t))return"failed";return"unknown"}function no(e){if(Array.isArray(e))return e.map((r)=>no(r));if(!e||typeof e!=="object")return e;let t={};for(let[r,n]of Object.entries(e))t[r]=fC.test(r)?"[REDACTED]":no(n);return t}function os(e,t=new Date){if(!e)return;let r=new Date(e).getTime();return Number.isFinite(r)?Math.max(0,Math.floor((t.getTime()-r)/1000)):void 0}function dh(e){let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function hC(e){let t=String(e?.message??e);if(/(?:unauthorized|accessdenied|forbidden|credentials)/i.test(t))return"unauthorized";if(/(?:timeout|unreachable|econnrefused|enotfound|network)/i.test(t))return"unreachable";return"error"}async function uh(e,t={},r={}){let n=t.now??new Date,i=Math.max(100,r.timeoutMs??1e4),o=Math.max(1,r.staleAfterSeconds??60),s=await Promise.all(e.map(async(u)=>{try{let a=await Promise.race([u.discover({...t,now:n}),new Promise((f,T)=>setTimeout(()=>T(Error(`Runtime source ${u.id} timed out after ${i}ms`)),i))]);return{workloads:a,source:{id:u.id,provider:u.provider,status:"fresh",discoveredAt:n.toISOString(),staleAfterSeconds:o,itemCount:a.length}}}catch(a){return{workloads:[],source:{id:u.id,provider:u.provider,status:hC(a),discoveredAt:n.toISOString(),staleAfterSeconds:o,itemCount:0,message:String(a?.message??a).slice(0,500)}}}})),c=s.map((u)=>u.source);return{generatedAt:n.toISOString(),workloads:s.flatMap((u)=>u.workloads).sort((u,a)=>u.name.localeCompare(a.name)||u.id.localeCompare(a.id)),sources:c,degraded:c.some((u)=>u.status!=="fresh")}}function yC(e,t){if(!t)return e;return e.startsWith(t)?e.slice(t.length):e}function lh(e,t,r){let n=yC(e,t);return`${r??""}${n}`}function ph(e,t,r){if(r&&r.some((n)=>e.startsWith(n)))return!1;if(t&&t.length>0)return t.some((n)=>e.startsWith(n));return!0}async function bC(e,t,r){let n=0,i=[],o=Math.max(1,Math.min(t,e.length||1));for(let s=0;s<o;s++)i.push((async()=>{while(!0){let c=n++;if(c>=e.length)return;await r(e[c],c)}})());await Promise.all(i)}function gh(e){if(e.client)return e.client;return mh({provider:e.provider,region:e.region,endpoint:e.endpoint,forcePathStyle:e.forcePathStyle,credentials:e.credentials})}async function ts(e){let t=e.concurrency??8,r=gh(e.from),n=gh(e.to),i=await r.listAllObjects({bucket:e.from.bucket,prefix:e.from.prefix}),o={copied:0,skipped:0,excluded:0,bytesCopied:0,errors:[],excludedKeys:[],deleted:[]},s=[];for(let f of i){if(!ph(f.Key,e.include,e.exclude)){o.excluded++,o.excludedKeys.push(f.Key);continue}s.push({source:f,destKey:lh(f.Key,e.from.prefix,e.to.prefix)})}if(e.dryRun){o.plan=s.map(({source:R,destKey:D})=>({key:R.Key,destKey:D,size:R.Size}));let f=i.length,T=0;for(let R of i){T++;let D=!ph(R.Key,e.include,e.exclude);e.onProgress?.({key:R.Key,destKey:D?"":lh(R.Key,e.from.prefix,e.to.prefix),size:R.Size,action:D?"excluded":"planned",index:T,total:f})}return o}let c=s.length,u=0;await bC(s,t,async({source:f,destKey:T})=>{let R=++u;try{if(!e.force){let Y=await n.headObject(e.to.bucket,T);if(Y&&Y.ContentLength===f.Size){o.skipped++,e.onProgress?.({key:f.Key,destKey:T,size:f.Size,action:"skipped",index:R,total:c});return}}let{body:D,contentType:W}=await r.getObjectBytes(e.from.bucket,f.Key);await n.putObject({bucket:e.to.bucket,key:T,body:D,contentType:W}),o.copied++,o.bytesCopied+=D.byteLength,e.onProgress?.({key:f.Key,destKey:T,size:f.Size,action:"copied",index:R,total:c})}catch(D){o.errors.push({key:f.Key,message:D?.message??String(D)}),e.onProgress?.({key:f.Key,destKey:T,size:f.Size,action:"error",index:R,total:c})}});let a=new Set(s.map((f)=>f.destKey));if(e.deleteExtraneous){let T=(await n.listAllObjects({bucket:e.to.bucket,prefix:e.to.prefix})).filter((R)=>!a.has(R.Key)).map((R)=>R.Key);for(let R of T)try{await n.deleteObject(e.to.bucket,R),o.deleted.push(R)}catch(D){o.errors.push({key:R,message:`delete failed: ${D?.message??String(D)}`})}}if(e.verify){let f=await n.listAllObjects({bucket:e.to.bucket,prefix:e.to.prefix}),T=new Map(f.map((Y)=>[Y.Key,Y.Size])),R=[],D=[],W=0;for(let{source:Y,destKey:ee}of s){if(!T.has(ee)){R.push(ee);continue}let ne=T.get(ee);if(ne!==Y.Size){D.push({key:ee,expected:Y.Size,actual:ne});continue}W++}o.verification={ok:R.length===0&&D.length===0,matched:W,missing:R,sizeMismatches:D}}return o}var SC={aws:"us-east-1",backblaze:"us-west-004",hetzner:"fsn1"};function vC(e,t){switch(e){case"backblaze":return`s3.${t}.backblazeb2.com`;case"hetzner":return`${t}.your-objectstorage.com`;case"aws":default:return}}function In(...e){for(let t of e){let r=process.env[t];if(r)return r}return}function wC(e,t){if(t?.accessKeyId&&t.secretAccessKey)return t;let r,n;if(e==="backblaze")r=In("B2_APPLICATION_KEY_ID","B2_KEY_ID","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),n=In("B2_APPLICATION_KEY","B2_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else if(e==="hetzner")r=In("HETZNER_S3_ACCESS_KEY","HETZNER_ACCESS_KEY","S3_ACCESS_KEY_ID","AWS_ACCESS_KEY_ID"),n=In("HETZNER_S3_SECRET_KEY","HETZNER_SECRET_KEY","S3_SECRET_ACCESS_KEY","AWS_SECRET_ACCESS_KEY");else r=In("S3_ACCESS_KEY_ID"),n=In("S3_SECRET_ACCESS_KEY");if(r&&n)return{accessKeyId:r,secretAccessKey:n,sessionToken:In("AWS_SESSION_TOKEN")};return}function IC(e={}){let t=e.provider||In("OBJECT_STORAGE_PROVIDER","STORAGE_PROVIDER")||"aws",r=e.region||(t==="backblaze"?In("B2_REGION"):void 0)||(t==="hetzner"?In("HETZNER_S3_REGION","HETZNER_REGION"):void 0)||In("S3_REGION","AWS_REGION","AWS_DEFAULT_REGION")||SC[t],n=e.endpoint||In("S3_ENDPOINT")||vC(t,r),i=e.forcePathStyle??In("S3_FORCE_PATH_STYLE")==="true",o=wC(t,e.credentials),s=(c)=>{let u=n||`s3.${r}.amazonaws.com`;return i?`https://${u}/${c}`:`https://${c}.${u}`};return{provider:t,region:r,endpoint:n,forcePathStyle:i,credentials:o,profile:e.profile,publicBaseUrl:s}}function mh(e={}){let t=IC(e),r={endpoint:t.endpoint,forcePathStyle:t.forcePathStyle,credentials:t.credentials};return new g(t.region,t.profile,r)}class Nt{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new p(void 0,{profile:t})}async describeServices(e){let t={cluster:e.cluster,services:e.services};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async listServices(e,t={}){let r={cluster:e,...t};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListServices","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async listTasks(e,t,r={}){let n={cluster:e,...r};if(t)n.serviceName=t;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(n)})}async describeTasks(e,t){let r={cluster:e,tasks:t};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTasks","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(r)})}async updateService(e){let t={cluster:e.cluster,service:e.service};if(e.forceNewDeployment!==void 0)t.forceNewDeployment=e.forceNewDeployment;if(e.desiredCount!==void 0)t.desiredCount=e.desiredCount;if(e.taskDefinition)t.taskDefinition=e.taskDefinition;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.UpdateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async createService(e){let t={cluster:e.cluster,serviceName:e.serviceName,taskDefinition:e.taskDefinition,desiredCount:e.desiredCount};if(e.launchType)t.launchType=e.launchType;if(e.networkConfiguration)t.networkConfiguration=e.networkConfiguration;if(e.loadBalancers)t.loadBalancers=e.loadBalancers;if(e.healthCheckGracePeriodSeconds!==void 0)t.healthCheckGracePeriodSeconds=e.healthCheckGracePeriodSeconds;if(e.deploymentConfiguration)t.deploymentConfiguration=e.deploymentConfiguration;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.CreateService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async deleteService(e){let t={cluster:e.cluster,service:e.service};if(e.force!==void 0)t.force=e.force;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeleteService","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async listClusters(e={}){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async describeClusters(e){let t={clusters:e,include:["ATTACHMENTS","CONFIGURATIONS","SETTINGS","STATISTICS","TAGS"]};return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeClusters","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async stopTask(e){let t={cluster:e.cluster,task:e.task};if(e.reason)t.reason=e.reason;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.StopTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async runTask(e){let t={cluster:e.cluster,taskDefinition:e.taskDefinition};if(e.count!==void 0)t.count=e.count;if(e.launchType)t.launchType=e.launchType;if(e.networkConfiguration)t.networkConfiguration=e.networkConfiguration;if(e.overrides)t.overrides=e.overrides;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RunTask","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async registerTaskDefinition(e){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.RegisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(e)})}async deregisterTaskDefinition(e){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DeregisterTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:e})})}async describeTaskDefinition(e){return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.DescribeTaskDefinition","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({taskDefinition:e,include:["TAGS"]})})}async listTaskDefinitionFamilies(e){let t={};if(e?.familyPrefix)t.familyPrefix=e.familyPrefix;if(e?.status)t.status=e.status;return await this.client.request({service:"ecs",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AmazonEC2ContainerServiceV20141113.ListTaskDefinitionFamilies","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})}async waitForServiceStable(e,t,r=40,n=15000){for(let i=0;i<r;i++){let s=(await this.describeServices({cluster:e,services:[t]})).services?.[0];if(s){let c=s.deployments?.find((u)=>u.status==="PRIMARY");if(c&&c.runningCount===c.desiredCount&&s.deployments?.length===1)return!0}await new Promise((c)=>setTimeout(c,n))}return!1}async forceNewDeployment(e,t){return this.updateService({cluster:e,service:t,forceNewDeployment:!0})}async scaleService(e,t,r){return this.updateService({cluster:e,service:t,desiredCount:r})}}class de{client;region;constructor(e="us-east-1"){this.region=e,this.client=new p}buildFormBody(e){return Object.entries(e).filter(([,r])=>r!==void 0).map(([r,n])=>`${encodeURIComponent(r)}=${encodeURIComponent(n)}`).join("&")}async createTopic(e){let t={Action:"CreateTopic",Version:"2010-03-31",Name:e.Name};if(e.DisplayName)t["Attributes.entry.1.key"]="DisplayName",t["Attributes.entry.1.value"]=e.DisplayName;if(e.Tags)e.Tags.forEach((n,i)=>{t[`Tags.member.${i+1}.Key`]=n.Key,t[`Tags.member.${i+1}.Value`]=n.Value});if(e.Attributes){let n=e.DisplayName?2:1;Object.entries(e.Attributes).forEach(([i,o])=>{t[`Attributes.entry.${n}.key`]=i,t[`Attributes.entry.${n}.value`]=o,n++})}let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{TopicArn:_(r,"CreateTopic")?.TopicArn}}async deleteTopic(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteTopic",Version:"2010-03-31",TopicArn:e})})}async listTopics(e){let t={Action:"ListTopics",Version:"2010-03-31"};if(e)t.NextToken=e;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),n=r?.ListTopicsResponse?.ListTopicsResult||r?.ListTopicsResult,i=n?.Topics?.member;return{Topics:Array.isArray(i)?i:i?[i]:[],NextToken:n?.NextToken}}async getTopicAttributes(e){let t=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetTopicAttributes",Version:"2010-03-31",TopicArn:e})}),r=N(_(t,"GetTopicAttributes")?.Attributes?.entry),n={TopicArn:e};for(let i of r)n[i.key]=String(i.value);return n}async setTopicAttributes(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"SetTopicAttributes",Version:"2010-03-31",TopicArn:e.TopicArn,AttributeName:e.AttributeName,AttributeValue:e.AttributeValue})})}async subscribe(e){let t={Action:"Subscribe",Version:"2010-03-31",TopicArn:e.TopicArn,Protocol:e.Protocol,Endpoint:e.Endpoint};if(e.ReturnSubscriptionArn)t.ReturnSubscriptionArn="true";if(e.Attributes){let n=1;Object.entries(e.Attributes).forEach(([i,o])=>{t[`Attributes.entry.${n}.key`]=i,t[`Attributes.entry.${n}.value`]=o,n++})}let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{SubscriptionArn:_(r,"Subscribe")?.SubscriptionArn}}async unsubscribe(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"Unsubscribe",Version:"2010-03-31",SubscriptionArn:e})})}async listSubscriptionsByTopic(e,t){let r={Action:"ListSubscriptionsByTopic",Version:"2010-03-31",TopicArn:e};if(t)r.NextToken=t;let n=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(r)}),i=_(n,"ListSubscriptionsByTopic");return{Subscriptions:N(i?.Subscriptions?.member),NextToken:i?.NextToken||void 0}}async publish(e){let t={Action:"Publish",Version:"2010-03-31",Message:e.Message};if(e.TopicArn)t.TopicArn=e.TopicArn;if(e.TargetArn)t.TargetArn=e.TargetArn;if(e.PhoneNumber)t.PhoneNumber=e.PhoneNumber;if(e.Subject)t.Subject=e.Subject;if(e.MessageStructure)t.MessageStructure=e.MessageStructure;if(e.MessageAttributes){let n=1;Object.entries(e.MessageAttributes).forEach(([i,o])=>{if(t[`MessageAttributes.entry.${n}.Name`]=i,t[`MessageAttributes.entry.${n}.Value.DataType`]=o.DataType,o.StringValue)t[`MessageAttributes.entry.${n}.Value.StringValue`]=o.StringValue;if(o.BinaryValue)t[`MessageAttributes.entry.${n}.Value.BinaryValue`]=o.BinaryValue;n++})}let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)});return{MessageId:_(r,"Publish")?.MessageId}}async publishSMS(e,t,r){let n={};if(r)n["AWS.SNS.SMS.SenderID"]={DataType:"String",StringValue:r};return this.publish({PhoneNumber:e,Message:t,MessageAttributes:Object.keys(n).length>0?n:void 0})}async subscribeEmail(e,t){return this.subscribe({TopicArn:e,Protocol:"email",Endpoint:t})}async subscribeLambda(e,t){return this.subscribe({TopicArn:e,Protocol:"lambda",Endpoint:t})}async subscribeSqs(e,t,r){let n={};if(r)n.RawMessageDelivery="true";return this.subscribe({TopicArn:e,Protocol:"sqs",Endpoint:t,Attributes:Object.keys(n).length>0?n:void 0})}async subscribeHttp(e,t,r){let n=t.startsWith("https")?"https":"http",i={};if(r)i.RawMessageDelivery="true";return this.subscribe({TopicArn:e,Protocol:n,Endpoint:t,Attributes:Object.keys(i).length>0?i:void 0})}async subscribeSms(e,t){return this.subscribe({TopicArn:e,Protocol:"sms",Endpoint:t})}async topicExists(e){try{return await this.getTopicAttributes(e),!0}catch(t){if(t.code==="NotFound"||t.statusCode===404)return!1;throw t}}async getSMSAttributes(){let e=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSAttributes",Version:"2010-03-31"})}),t=N(_(e,"GetSMSAttributes")?.attributes?.entry),r={};for(let n of t)r[n.key]=String(n.value);return r}async setSMSAttributes(e){let t={Action:"SetSMSAttributes",Version:"2010-03-31"},r=1;Object.entries(e).forEach(([n,i])=>{if(i!==void 0)t[`attributes.entry.${r}.key`]=n,t[`attributes.entry.${r}.value`]=i,r++}),await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)})}async checkIfPhoneNumberIsOptedOut(e){let t=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CheckIfPhoneNumberIsOptedOut",Version:"2010-03-31",phoneNumber:e})});return ea(_(t,"CheckIfPhoneNumberIsOptedOut")?.isOptedOut)}async listPhoneNumbersOptedOut(e){let t={Action:"ListPhoneNumbersOptedOut",Version:"2010-03-31"};if(e)t.nextToken=e;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),n=_(r,"ListPhoneNumbersOptedOut");return{phoneNumbers:N(n?.phoneNumbers?.member).map(String),nextToken:n?.nextToken||void 0}}async optInPhoneNumber(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"OptInPhoneNumber",Version:"2010-03-31",phoneNumber:e})})}async listSMSSandboxPhoneNumbers(e){let t={Action:"ListSMSSandboxPhoneNumbers",Version:"2010-03-31"};if(e)t.NextToken=e;let r=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody(t)}),n=_(r,"ListSMSSandboxPhoneNumbers");return{PhoneNumbers:N(n?.PhoneNumbers?.member),NextToken:n?.NextToken||void 0}}async createSMSSandboxPhoneNumber(e,t){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"CreateSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:e,LanguageCode:t||"en-US"})})}async verifySMSSandboxPhoneNumber(e,t){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"VerifySMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:e,OneTimePassword:t})})}async deleteSMSSandboxPhoneNumber(e){await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"DeleteSMSSandboxPhoneNumber",Version:"2010-03-31",PhoneNumber:e})})}async getSMSSandboxAccountStatus(){let e=await this.client.request({service:"sns",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:this.buildFormBody({Action:"GetSMSSandboxAccountStatus",Version:"2010-03-31"})});return{IsInSandbox:ea(_(e,"GetSMSSandboxAccountStatus")?.IsInSandbox)}}}class q{client;region;endpoint;constructor(e="us-east-1",t){this.region=e,this.endpoint=t?.endpoint,this.client=new p}async request(e,t){if(this.endpoint){let r=await fetch(this.endpoint,{method:"POST",headers:{"Content-Type":"application/x-amz-json-1.0","X-Amz-Target":`DynamoDB_20120810.${e}`},body:JSON.stringify(t)});if(!r.ok){let n=await r.text();throw Error(`DynamoDB request failed: ${r.status} ${n}`)}return r.json()}return this.client.request({service:"dynamodb",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.0","X-Amz-Target":`DynamoDB_20120810.${e}`},body:JSON.stringify(t)})}async createTable(e){return this.request("CreateTable",e)}async deleteTable(e){return this.request("DeleteTable",e)}async describeTable(e){return this.request("DescribeTable",e)}async listTables(e){return this.request("ListTables",e||{})}async putItem(e){return this.request("PutItem",e)}async getItem(e){return this.request("GetItem",e)}async updateItem(e){return this.request("UpdateItem",e)}async deleteItem(e){return this.request("DeleteItem",e)}async query(e){return this.request("Query",e)}async scan(e){return this.request("Scan",e)}async batchWriteItem(e){return this.request("BatchWriteItem",e)}async batchGetItem(e){return this.request("BatchGetItem",e)}async updateTimeToLive(e){return this.request("UpdateTimeToLive",e)}static marshal(e){let t={};for(let[r,n]of Object.entries(e))t[r]=q.marshalValue(n);return t}static marshalValue(e){if(e===null||e===void 0)return{NULL:!0};if(typeof e==="string")return{S:e};if(typeof e==="number")return{N:String(e)};if(typeof e==="boolean")return{BOOL:e};if(Array.isArray(e))return{L:e.map((t)=>q.marshalValue(t))};if(typeof e==="object")return{M:q.marshal(e)};return{S:String(e)}}static unmarshal(e){let t={};for(let[r,n]of Object.entries(e))t[r]=q.unmarshalValue(n);return t}static unmarshalValue(e){if(e.S!==void 0)return e.S;if(e.N!==void 0)return Number(e.N);if(e.BOOL!==void 0)return e.BOOL;if(e.NULL!==void 0)return null;if(e.L!==void 0)return e.L.map((t)=>q.unmarshalValue(t));if(e.M!==void 0)return q.unmarshal(e.M);if(e.SS!==void 0)return e.SS;if(e.NS!==void 0)return e.NS.map(Number);return null}}var $_=(()=>{let e=new Uint32Array(256);for(let t=0;t<256;t++){let r=t;for(let n=0;n<8;n++)r=r&1?3988292384^r>>>1:r>>>1;e[t]=r>>>0}return e})();class be{client;region;constructor(e="us-east-1"){this.region=e,this.client=new p}async request(e,t){return this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"Content-Type":"application/x-amz-json-1.1","X-Amz-Target":`AWSEvents.${e}`},body:JSON.stringify(t)})}async putRule(e){return this.request("PutRule",e)}async deleteRule(e){return this.request("DeleteRule",e)}async describeRule(e){return this.request("DescribeRule",e)}async listRules(e){return this.request("ListRules",e||{})}async listEventBuses(e){return this.request("ListEventBuses",e||{})}async enableRule(e){return this.request("EnableRule",e)}async disableRule(e){return this.request("DisableRule",e)}async putTargets(e){return this.request("PutTargets",e)}async removeTargets(e){return this.request("RemoveTargets",e)}async listTargetsByRule(e){return this.request("ListTargetsByRule",e)}async putEvents(e){return this.request("PutEvents",e)}async createSchedule(e){return this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${e.Name}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(e)})}}class $e{client;region;constructor(e="us-east-1",t){this.region=e,this.client=new p}async createRule(e){let t={Action:"PutRule",Name:e.name,ScheduleExpression:e.scheduleExpression,Version:"2015-10-07"};if(e.description)t.Description=e.description;if(e.state)t.State=e.state;else t.State="ENABLED";return{RuleArn:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e.name,ScheduleExpression:e.scheduleExpression,State:e.state||"ENABLED",Description:e.description})})).RuleArn}}async putTargets(e,t){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.PutTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:e,Targets:t})})}async listRules(e){let t={};if(e)t.NamePrefix=e;return{Rules:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListRules","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify(t)})).Rules||[]}}async describeRule(e){let t=await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DescribeRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e})});return{Name:t.Name,Arn:t.Arn,ScheduleExpression:t.ScheduleExpression,State:t.State,Description:t.Description}}async listTargetsByRule(e){return{Targets:(await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.ListTargetsByRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:e})})).Targets||[]}}async deleteRule(e,t){if(t)try{let r=await this.listTargetsByRule(e);if(r.Targets&&r.Targets.length>0)await this.removeTargets(e,r.Targets.map((n)=>n.Id))}catch{}await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DeleteRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e,Force:t||!1})})}async removeTargets(e,t){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.RemoveTargets","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Rule:e,Ids:t})})}async enableRule(e){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.EnableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e})})}async disableRule(e){await this.client.request({service:"events",region:this.region,method:"POST",path:"/",headers:{"X-Amz-Target":"AWSEvents.DisableRule","Content-Type":"application/x-amz-json-1.1"},body:JSON.stringify({Name:e})})}async createLambdaSchedule(e){let t=await this.createRule({name:e.name,scheduleExpression:e.scheduleExpression,description:e.description,state:"ENABLED"});return await this.putTargets(e.name,[{Id:"1",Arn:e.functionArn,Input:e.input}]),t}async createEcsSchedule(e){let t=await this.createRule({name:e.name,scheduleExpression:e.scheduleExpression,description:e.description,state:"ENABLED"});return await this.putTargets(e.name,[{Id:"1",Arn:e.clusterArn,RoleArn:e.roleArn,Input:JSON.stringify({containerOverrides:[]})}]),t}async listSchedules(e){let t={};if(e?.NamePrefix)t.NamePrefix=e.NamePrefix;if(e?.State)t.State=e.State;let r=e?.GroupName||"default";return{Schedules:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedules",queryParams:{...t,ScheduleGroup:r}}))?.Schedules||[]}}async getSchedule(e){try{let t={};if(e.GroupName)t.groupName=e.GroupName;return await this.client.request({service:"scheduler",region:this.region,method:"GET",path:`/schedules/${encodeURIComponent(e.Name)}`,queryParams:Object.keys(t).length>0?t:void 0})}catch(t){if(t.statusCode===404||t.code==="ResourceNotFoundException")return null;throw t}}async createSchedule(e){let t={ScheduleExpression:e.ScheduleExpression,FlexibleTimeWindow:e.FlexibleTimeWindow,Target:e.Target};if(e.GroupName)t.GroupName=e.GroupName;if(e.ScheduleExpressionTimezone)t.ScheduleExpressionTimezone=e.ScheduleExpressionTimezone;if(e.Description)t.Description=e.Description;if(e.State)t.State=e.State;if(e.StartDate)t.StartDate=e.StartDate.toISOString();if(e.EndDate)t.EndDate=e.EndDate.toISOString();return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"POST",path:`/schedules/${encodeURIComponent(e.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)}))?.ScheduleArn||""}}async updateSchedule(e){let t={};if(e.GroupName)t.GroupName=e.GroupName;if(e.ScheduleExpression)t.ScheduleExpression=e.ScheduleExpression;if(e.ScheduleExpressionTimezone)t.ScheduleExpressionTimezone=e.ScheduleExpressionTimezone;if(e.Description!==void 0)t.Description=e.Description;if(e.State)t.State=e.State;if(e.FlexibleTimeWindow)t.FlexibleTimeWindow=e.FlexibleTimeWindow;if(e.Target)t.Target=e.Target;return{ScheduleArn:(await this.client.request({service:"scheduler",region:this.region,method:"PUT",path:`/schedules/${encodeURIComponent(e.Name)}`,headers:{"Content-Type":"application/json"},body:JSON.stringify(t)}))?.ScheduleArn||""}}async deleteSchedule(e){let t={};if(e.GroupName)t.groupName=e.GroupName;await this.client.request({service:"scheduler",region:this.region,method:"DELETE",path:`/schedules/${encodeURIComponent(e.Name)}`,queryParams:Object.keys(t).length>0?t:void 0})}async listScheduleGroups(e){let t={};if(e?.NamePrefix)t.NamePrefix=e.NamePrefix;return{ScheduleGroups:(await this.client.request({service:"scheduler",region:this.region,method:"GET",path:"/schedule-groups",queryParams:Object.keys(t).length>0?t:void 0}))?.ScheduleGroups||[]}}}function Qs(e){return e?.split("/").at(-1)??e?.split(":").at(-1)??"unknown"}function fh(e,t,r,n="ecs:aws",i=[]){let o=r.now??new Date;return e.map((s)=>{let c=s.serviceName??Qs(s.serviceArn),u=t.filter((ne)=>!s.clusterArn||ne.clusterArn===s.clusterArn),a=u.some((ne)=>!!ne.group)?u.filter((ne)=>ne.group===`service:${c}`):u,f=s.status==="ACTIVE"?(s.runningCount??0)<(s.desiredCount??0)?"degraded":"running":so(s.status),T=i.find((ne)=>ne.taskDefinitionArn===s.taskDefinition),R=Array.isArray(T?.containerDefinitions)?T.containerDefinitions:[],D=[...new Set(R.map((ne)=>ne.logConfiguration?.options?.["awslogs-group"]).filter((ne)=>typeof ne==="string"))],W=R.flatMap((ne)=>(ne.mountPoints??[]).map((he)=>({source:he.sourceVolume,target:he.containerPath,type:"volume",readOnly:!!he.readOnly}))),Y=R.flatMap((ne)=>(ne.portMappings??[]).map((he,te)=>({id:`${ne.name??"container"}:${te}`,name:ne.name,mode:T?.networkMode,ports:[{container:he.containerPort,host:he.hostPort,protocol:he.protocol}]}))),ee=r.project&&r.environment&&c.startsWith(`${r.project}-${r.environment}-`)?c.slice(`${r.project}-${r.environment}-`.length):c;return{id:Mi("ecs",n,s.serviceArn??c),provider:"ecs",kind:"service",name:c,status:f,rawStatus:s.status,health:f==="running"?"healthy":f==="failed"||f==="degraded"?"unhealthy":"unknown",desiredReplicas:s.desiredCount,runningReplicas:s.runningCount,image:R[0]?.image,runtime:s.launchType??"ECS",version:Qs(s.taskDefinition),ageSeconds:os(s.deployments?.[0]?.createdAt,o),restartCount:0,tags:{},links:{project:r.project,environment:r.environment,service:ee,release:Qs(s.taskDefinition),providerId:s.serviceArn},replicas:a.map((ne)=>{let he=so(ne.lastStatus);return{id:Mi("ecs",n,ne.taskArn??Qs(ne.taskArn)),name:Qs(ne.taskArn),status:he,rawStatus:ne.lastStatus,createdAt:ne.createdAt,startedAt:ne.startedAt,stoppedAt:ne.stoppedAt,host:ne.containerInstanceArn,containers:(ne.containers??[]).map((te)=>({id:te.containerArn??te.name??"container",name:te.name??"container",image:R.find((De)=>De.name===te.name)?.image,imageDigest:te.imageDigest,status:so(te.lastStatus),rawStatus:te.lastStatus,exitCode:te.exitCode,reason:te.reason,runtime:"ecs"}))}}),networks:Y,mounts:W,capabilities:is(["start","stop","restart","redeploy","scale","inspect",...D.length?["logs"]:[]],"This ECS runtime does not expose exec or file transfer; logs require an awslogs task-definition driver"),config:no({clusterArn:s.clusterArn,taskDefinition:s.taskDefinition,launchType:s.launchType,pendingCount:s.pendingCount,deployments:s.deployments,logGroups:D,executionRoleArn:T?.executionRoleArn,taskRoleArn:T?.taskRoleArn,cpu:T?.cpu,memory:T?.memory}),discoveredAt:o.toISOString(),sourceId:n}})}function hh(e,t,r="lambda:aws"){let n=t.now??new Date;return e.map((i)=>{let o=i.FunctionName??Qs(i.FunctionArn),s=i.State==="Active"?"running":so(i.State);return{id:Mi("lambda",r,i.FunctionArn??o),provider:"lambda",kind:"function",name:o,status:s,rawStatus:i.State,health:s==="running"?"healthy":s==="failed"?"unhealthy":"unknown",desiredReplicas:void 0,runningReplicas:void 0,image:void 0,runtime:i.Runtime,version:i.Version,architecture:i.Architectures?.join(", "),ageSeconds:os(i.LastModified,n),restartCount:0,tags:{},links:{project:t.project,environment:t.environment,service:o,providerId:i.FunctionArn},resources:{memoryLimitBytes:i.MemorySize==null?void 0:i.MemorySize*1024*1024},replicas:[],networks:[],mounts:[],capabilities:is(["logs","inspect"],"Lambda has no persistent process to start, stop, restart, exec, or browse files; deploy a release to replace code"),config:no({handler:i.Handler,timeout:i.Timeout,codeSize:i.CodeSize,stateReason:i.StateReason,environmentKeys:Object.keys(i.Environment?.Variables??{})}),discoveredAt:n.toISOString(),sourceId:r}})}function CC(e){let t=e.trim();if(!t)return[];let r=JSON.parse(t);if(!Array.isArray(r))throw Error("Docker inspect output must be an array");return r.filter((n)=>n&&typeof n.Id==="string")}function EC(e){let t=Object.entries(e.NetworkSettings?.Ports??{}).flatMap(([r,n])=>{let[i,o]=r.split("/");return(n??[]).map((s)=>({container:Number(i)||void 0,host:Number(s.HostPort)||void 0,protocol:o,address:s.HostIp}))});return Object.entries(e.NetworkSettings?.Networks??{}).map(([r,n])=>({id:n.NetworkID||r,name:r,mode:e.HostConfig?.NetworkMode,addresses:[n.IPAddress,n.GlobalIPv6Address].filter(Boolean),ports:t}))}function TC(e){return(e.Mounts??[]).filter((t)=>!!t.Destination).map((t)=>({source:t.Source,target:t.Destination,type:t.Type,readOnly:t.RW===!1}))}function AC(e,t,r=t.server??"local"){let n=t.now??new Date;return e.map((i)=>{let o=i.State?.OOMKilled?"oomkilled":i.State?.Restarting?"starting":i.State?.Status,s=so(o),c=(i.Name??i.Id.slice(0,12)).replace(/^\//,""),u=i.Config?.Labels??{},a=TC(i),f=EC(i),T={id:i.Id,name:c,image:i.Config?.Image,imageDigest:i.Image,runtime:"docker",status:s,rawStatus:o,exitCode:i.State?.ExitCode,reason:i.State?.Error,resources:{memoryLimitBytes:i.HostConfig?.Memory||void 0},networks:f,mounts:a};return{id:Mi("docker",r,i.Id),provider:"docker",kind:"container",name:c,status:s,rawStatus:o,health:s==="running"?"healthy":s==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:s==="running"?1:0,image:i.Config?.Image,runtime:"docker",ageSeconds:os(i.State?.StartedAt,n),restartCount:i.RestartCount??0,tags:u,links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^docker:/,""),service:u["com.docker.compose.service"]??u["ts-cloud.service"]??c,release:u["ts-cloud.release"],providerId:i.Id},resources:T.resources,replicas:[{id:Mi("docker",r,`${i.Id}:0`),name:c,status:s,rawStatus:o,startedAt:i.State?.StartedAt,stoppedAt:i.State?.FinishedAt,restartCount:i.RestartCount,containers:[T],resources:T.resources}],networks:f,mounts:a,capabilities:is(["start","stop","restart","logs","exec","inspect","files"],"Use the owning Compose service for redeploy and scale"),config:no({image:i.Config?.Image,labels:u,environmentKeys:(i.Config?.Env??[]).map((R)=>R.split("=",1)[0]),networkMode:i.HostConfig?.NetworkMode}),discoveredAt:n.toISOString(),sourceId:r}})}class El{inspect;id;provider="docker";constructor(e,t="docker:local"){this.inspect=e;this.id=t}async discover(e){return AC(CC(await this.inspect(e)),e,this.id)}}function kC(e){let t=[];for(let r of e.split(`
-`)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,n,i,o,s,c,u,a,f,T,R,D,W,Y]=r.split("\t");if(!n||!/^[A-Za-z0-9_.@:-]+\.service$/.test(n))continue;t.push({unit:n,load:i,active:o,sub:s,description:c,enabled:u,pid:Number(a)||void 0,memoryBytes:dh(f),restartCount:Number(T)||0,activeSince:R||void 0,fragmentPath:D||void 0,workingDirectory:W?.startsWith("/")?W:void 0,user:Y||void 0})}return t}function RC(e,t,r=t.server??"local"){let n=t.now??new Date;return e.map((i)=>{let o=so(i.active==="active"?i.sub||i.active:i.active),s=i.unit.replace(/\.service$/,""),c=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(i.description??"")?.[1]??(t.project&&s.startsWith(`${t.project}-`)?s.slice(t.project.length+1).split("@",1)[0]:void 0),u=s.includes("@")?s.slice(s.indexOf("@")+1):void 0,a=i.workingDirectory?[{target:i.workingDirectory,type:"working-directory"}]:[],f=["start","stop","restart","logs","exec","inspect",...a.length?["files"]:[]];return{id:Mi("systemd",r,i.unit),provider:"systemd",kind:"service",name:s,displayName:i.description||s,status:o,rawStatus:[i.load,i.active,i.sub].filter(Boolean).join("/"),health:o==="running"?"healthy":o==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:o==="running"?1:0,ageSeconds:os(i.activeSince,n),restartCount:i.restartCount,tags:{enabled:i.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:c,release:u,providerId:i.unit},resources:{memoryBytes:i.memoryBytes},replicas:[{id:Mi("systemd",r,`${i.unit}:main`),name:"main",status:o,pid:i.pid,startedAt:i.activeSince,restartCount:i.restartCount,resources:{memoryBytes:i.memoryBytes}}],networks:[],mounts:a,capabilities:is(f,a.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:no({fragmentPath:i.fragmentPath,workingDirectory:i.workingDirectory,user:i.user,environment:i.environment,enabled:i.enabled}),discoveredAt:n.toISOString(),sourceId:r}})}class Tl{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return RC(kC(await this.read(e)),e,this.id)}}function PC(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function xC(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function DC(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function yh(e,t,r,n,i){let o=`${e}:${r.id}`,s=async()=>PC(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?xC():DC(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:n.project.slug,Environment:i,Role:"app"}}),o);return e==="systemd"?new Tl(s,o):new El(s,o)}async function od(e,t=100){let r=[],n;for(let i=0;i<t;i++){let o=await e(n);if(r.push(...o.items),!o.nextToken)return r;n=o.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class bh{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await od(async(o)=>{let s=await this.client.listClusters({nextToken:o,maxResults:100});return{items:s.clusterArns??[],nextToken:s.nextToken}}),r=[],n=[],i=[];for(let o of t){let s=(await od(async(c)=>{let u=await this.client.listServices(o,{nextToken:c,maxResults:100});return{items:u.serviceArns??[],nextToken:u.nextToken}})).filter((c)=>c.split("/").at(-1)?.startsWith(this.prefix));for(let c=0;c<s.length;c+=10){let u=await this.client.describeServices({cluster:o,services:s.slice(c,c+10)});r.push(...u.services??[])}for(let c of r.filter((u)=>u.clusterArn===o||!u.clusterArn)){let u=await od(async(a)=>{let f=await this.client.listTasks(o,c.serviceName,{nextToken:a,maxResults:100});return{items:f.taskArns??[],nextToken:f.nextToken}});for(let a=0;a<u.length;a+=100){let f=await this.client.describeTasks(o,u.slice(a,a+100));n.push(...f.tasks??[])}}}if(this.client.describeTaskDefinition)for(let o of[...new Set(r.map((s)=>s.taskDefinition).filter((s)=>!!s))]){let s=await this.client.describeTaskDefinition(o);if(s.taskDefinition)i.push(s.taskDefinition)}return fh(r,n,e,this.id,i)}}class Sh{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await od(async(r)=>{let n=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:n.Functions??[],nextToken:n.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return hh(t,e,this.id)}}async function OC(e,t,r={}){let n=[],i=H(e),o=B(e),s=e.aws?.profile,c=e.aws?.region??e.project.region??"us-east-1",u=`${e.project.slug}-${t}`;if(i!=="serverless"){let a=r.driver??O({config:e}),f=await a.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let T of f)n.push(yh("systemd",a,T,e,t)),n.push(yh("docker",a,T,e,t))}if(o==="aws")n.push(new bh(r.ecs??new Nt(c,s),u)),n.push(new Sh(r.lambda??new I(c,s),u));return n}async function Ii(e,t,r={}){let n={project:e.project.slug,environment:t};try{return await uh(await OC(e,t,r),n)}catch(i){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:B(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(i?.message??i).slice(0,500)}],degraded:!0}}}var vh=65536,xa=49152,ad=/^[A-Za-z0-9_.@:-]+\.service$/,cd=/^[a-fA-F0-9]{12,128}$/,_C=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function Ys(e){let t=Buffer.from(e);return t.byteLength<=vh?e:`${t.subarray(0,vh-24).toString("utf8")}
+`)){if(!r.startsWith("TSCLOUD_SYSTEMD\t"))continue;let[,n,i,o,s,c,u,a,f,T,R,D,W,Y]=r.split("\t");if(!n||!/^[A-Za-z0-9_.@:-]+\.service$/.test(n))continue;t.push({unit:n,load:i,active:o,sub:s,description:c,enabled:u,pid:Number(a)||void 0,memoryBytes:dh(f),restartCount:Number(T)||0,activeSince:R||void 0,fragmentPath:D||void 0,workingDirectory:W?.startsWith("/")?W:void 0,user:Y||void 0})}return t}function RC(e,t,r=t.server??"local"){let n=t.now??new Date;return e.map((i)=>{let o=so(i.active==="active"?i.sub||i.active:i.active),s=i.unit.replace(/\.service$/,""),c=/^(.*?) (?:release [^ ]+|queue worker|daemon |scheduler)(?: |$)/.exec(i.description??"")?.[1]??(t.project&&s.startsWith(`${t.project}-`)?s.slice(t.project.length+1).split("@",1)[0]:void 0),u=s.includes("@")?s.slice(s.indexOf("@")+1):void 0,a=i.workingDirectory?[{target:i.workingDirectory,type:"working-directory"}]:[],f=["start","stop","restart","logs","exec","inspect",...a.length?["files"]:[]];return{id:Mi("systemd",r,i.unit),provider:"systemd",kind:"service",name:s,displayName:i.description||s,status:o,rawStatus:[i.load,i.active,i.sub].filter(Boolean).join("/"),health:o==="running"?"healthy":o==="failed"?"unhealthy":"unknown",desiredReplicas:1,runningReplicas:o==="running"?1:0,ageSeconds:os(i.activeSince,n),restartCount:i.restartCount,tags:{enabled:i.enabled??"unknown"},links:{project:t.project,environment:t.environment,server:t.server??r.replace(/^systemd:/,""),service:c,release:u,providerId:i.unit},resources:{memoryBytes:i.memoryBytes},replicas:[{id:Mi("systemd",r,`${i.unit}:main`),name:"main",status:o,pid:i.pid,startedAt:i.activeSince,restartCount:i.restartCount,resources:{memoryBytes:i.memoryBytes}}],networks:[],mounts:a,capabilities:is(f,a.length?"This systemd runtime does not support redeploy or replica scaling through the scoped explorer":"File transfer requires a provider-reported service working directory; redeploy and scaling are unavailable"),config:no({fragmentPath:i.fragmentPath,workingDirectory:i.workingDirectory,user:i.user,environment:i.environment,enabled:i.enabled}),discoveredAt:n.toISOString(),sourceId:r}})}class Tl{read;id;provider="systemd";constructor(e,t="systemd:local"){this.read=e;this.id=t}async discover(e){return RC(kC(await this.read(e)),e,this.id)}}function PC(e,t){if(!e.success)throw Error(e.error||e.perInstance?.[0]?.error||`${t} discovery failed`);return e.perInstance?.[0]?.output??""}function xC(){return["set -uo pipefail",'command -v systemctl >/dev/null 2>&1 || { echo "systemctl is unavailable" >&2; exit 127; }',"systemctl list-units --type=service --all --plain --no-legend 2>/dev/null | awk '{print $1}' | while IFS= read -r unit; do",'  [ -n "$unit" ] || continue','  clean() { printf "%s" "$1" | tr "\\t\\r\\n" "   "; }','  load=$(systemctl show "$unit" -p LoadState --value 2>/dev/null || true)','  active=$(systemctl show "$unit" -p ActiveState --value 2>/dev/null || true)','  sub=$(systemctl show "$unit" -p SubState --value 2>/dev/null || true)','  description=$(systemctl show "$unit" -p Description --value 2>/dev/null || true)','  enabled=$(systemctl is-enabled "$unit" 2>/dev/null || true)','  pid=$(systemctl show "$unit" -p MainPID --value 2>/dev/null || true)','  memory=$(systemctl show "$unit" -p MemoryCurrent --value 2>/dev/null || true)','  restarts=$(systemctl show "$unit" -p NRestarts --value 2>/dev/null || true)','  since=$(systemctl show "$unit" -p ActiveEnterTimestamp --value 2>/dev/null || true)','  fragment=$(systemctl show "$unit" -p FragmentPath --value 2>/dev/null || true)','  working=$(systemctl show "$unit" -p WorkingDirectory --value 2>/dev/null || true)','  user=$(systemctl show "$unit" -p User --value 2>/dev/null || true)','  printf "TSCLOUD_SYSTEMD\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n" "$(clean "$unit")" "$(clean "$load")" "$(clean "$active")" "$(clean "$sub")" "$(clean "$description")" "$(clean "$enabled")" "$(clean "$pid")" "$(clean "$memory")" "$(clean "$restarts")" "$(clean "$since")" "$(clean "$fragment")" "$(clean "$working")" "$(clean "$user")"',"done"]}function DC(){return["set -uo pipefail",'if ! command -v docker >/dev/null 2>&1; then echo "[]"; exit 0; fi',"ids=$(docker ps -aq)",'if [ -z "$ids" ]; then echo "[]"; else docker inspect $ids; fi']}function yh(e,t,r,n,i){let o=`${e}:${r.id}`,s=async()=>PC(await t.runRemoteDeploy({targets:[r],commands:e==="systemd"?xC():DC(),timeoutSeconds:30,comment:`ts-cloud runtime discovery:${e}`,tags:{Project:n.project.slug,Environment:i,Role:"app"}}),o);return e==="systemd"?new Tl(s,o):new El(s,o)}async function od(e,t=100){let r=[],n;for(let i=0;i<t;i++){let o=await e(n);if(r.push(...o.items),!o.nextToken)return r;n=o.nextToken}throw Error(`Provider pagination exceeded ${t} pages`)}class bh{client;prefix;id="ecs:aws";provider="ecs";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=await od(async(o)=>{let s=await this.client.listClusters({nextToken:o,maxResults:100});return{items:s.clusterArns??[],nextToken:s.nextToken}}),r=[],n=[],i=[];for(let o of t){let s=(await od(async(c)=>{let u=await this.client.listServices(o,{nextToken:c,maxResults:100});return{items:u.serviceArns??[],nextToken:u.nextToken}})).filter((c)=>c.split("/").at(-1)?.startsWith(this.prefix));for(let c=0;c<s.length;c+=10){let u=await this.client.describeServices({cluster:o,services:s.slice(c,c+10)});r.push(...u.services??[])}for(let c of r.filter((u)=>u.clusterArn===o||!u.clusterArn)){let u=await od(async(a)=>{let f=await this.client.listTasks(o,c.serviceName,{nextToken:a,maxResults:100});return{items:f.taskArns??[],nextToken:f.nextToken}});for(let a=0;a<u.length;a+=100){let f=await this.client.describeTasks(o,u.slice(a,a+100));n.push(...f.tasks??[])}}}if(this.client.describeTaskDefinition)for(let o of[...new Set(r.map((s)=>s.taskDefinition).filter((s)=>!!s))]){let s=await this.client.describeTaskDefinition(o);if(s.taskDefinition)i.push(s.taskDefinition)}return fh(r,n,e,this.id,i)}}class Sh{client;prefix;id="lambda:aws";provider="lambda";constructor(e,t){this.client=e;this.prefix=t}async discover(e){let t=(await od(async(r)=>{let n=await this.client.listFunctions({Marker:r,MaxItems:50});return{items:n.Functions??[],nextToken:n.NextMarker}})).filter((r)=>r.FunctionName?.startsWith(this.prefix));return hh(t,e,this.id)}}async function OC(e,t,r={}){let n=[],i=H(e),o=B(e),s=e.aws?.profile,c=e.aws?.region??e.project.region??"us-east-1",u=`${e.project.slug}-${t}`;if(i!=="serverless"){let a=r.driver??O({config:e}),f=await a.findComputeTargets({slug:e.project.slug,environment:t,role:"app"});for(let T of f)n.push(yh("systemd",a,T,e,t)),n.push(yh("docker",a,T,e,t))}if(o==="aws")n.push(new bh(r.ecs??new Nt(c,s),u)),n.push(new Sh(r.lambda??new P(c,s),u));return n}async function Ii(e,t,r={}){let n={project:e.project.slug,environment:t};try{return await uh(await OC(e,t,r),n)}catch(i){return{generatedAt:new Date().toISOString(),workloads:[],sources:[{id:"runtime:bootstrap",provider:B(e)==="aws"?"ecs":"systemd",status:"error",discoveredAt:new Date().toISOString(),staleAfterSeconds:60,itemCount:0,message:String(i?.message??i).slice(0,500)}],degraded:!0}}}var vh=65536,xa=49152,ad=/^[A-Za-z0-9_.@:-]+\.service$/,cd=/^[a-fA-F0-9]{12,128}$/,_C=["/boot","/dev","/etc","/proc","/root","/run","/sys","/var/run"];function Ys(e){let t=Buffer.from(e);return t.byteLength<=vh?e:`${t.subarray(0,vh-24).toString("utf8")}
 [output truncated]`}function sd(e){return{success:!1,instanceCount:0,perInstance:[],error:e instanceof Error?e.message:String(e)}}function ci(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function NC(e,t){return Number.isFinite(e)?Math.min(1e4,Math.max(0,Math.floor(e))):t}function MC(e){let t=e.config,r=typeof t.clusterArn==="string"?t.clusterArn:void 0,n=e.links.providerId||e.name;return r&&n?{cluster:r,service:n}:void 0}function $C(e,t){return e.find((r)=>r.id===t.links.server)??(e.length===1?e[0]:void 0)}function LC(e,t){if(e.provider==="systemd"){let r=e.links.providerId;if(!r||!ad.test(r)||!["start","stop","restart"].includes(t))return;return[`systemctl ${t} ${r}`,`systemctl is-active ${r} 2>/dev/null || true`]}if(e.provider==="docker"){let r=e.links.providerId;if(!r||!cd.test(r)||!["start","stop","restart"].includes(t))return;return[`docker ${t} ${r}`,`docker inspect --format '{{.State.Status}}' ${r}`]}return}function BC(e,t){if(!t.startsWith("/")||t.includes("\x00"))return{ok:!1,error:"An absolute path is required."};let r=[];for(let c of t.split("/")){if(!c||c===".")continue;if(c===".."){if(!r.length)return{ok:!1,error:"Path traversal is not allowed."};r.pop()}else r.push(c)}let n=`/${r.join("/")}`;if(_C.some((c)=>n===c||n.startsWith(`${c}/`)))return{ok:!1,error:"Sensitive host paths are not available through runtime file access."};let i=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),o=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");if(![...i&&o?[`/var/www/${i}/${o}`,`/srv/${i}/${o}`]:[],...e.mounts.map((c)=>c.target).filter((c)=>c.startsWith("/"))].some((c)=>n===c||n.startsWith(`${c.replace(/\/$/,"")}/`)))return{ok:!1,error:"Path is outside this service’s owned roots."};return{ok:!0,path:n}}function FC(e,t){let r=e.links.project?.replace(/[^A-Za-z0-9_-]/g,""),n=e.links.service?.replace(/[^A-Za-z0-9_-]/g,"");return[...r&&n?[`/var/www/${r}/${n}`,`/srv/${r}/${n}`]:[],...e.mounts.map((i)=>i.target).filter((i)=>i.startsWith("/"))].sort((i,o)=>o.length-i.length).find((i)=>t===i||t.startsWith(`${i.replace(/\/$/,"")}/`))}var wh={process:["ps","-eo","pid,ppid,user,%cpu,%mem,etime,command","--sort=-%cpu"],sockets:["ss","-lntup"],filesystem:["df","-h"]};class Se{config;environment;dependencies;region;profile;constructor(e,t,r={}){this.config=e;this.environment=t;this.dependencies=r;this.region=e.aws?.region??e.project.region??"us-east-1",this.profile=e.aws?.profile}async inventory(){return this.dependencies.inventory?.()??Ii(this.config,this.environment,{driver:this.dependencies.driver})}async workload(e){return(await this.inventory()).workloads.find((t)=>t.id===e)}async remote(e,t,r,n){let i=this.dependencies.driver??O({config:this.config}),o=await i.findComputeTargets({slug:this.config.project.slug,environment:this.environment,role:"app"}),s=$C(o,e);if(!s)throw Error("The workload server is no longer reachable in this scope.");return i.runRemoteDeploy({targets:[s],commands:t,timeoutSeconds:r,comment:n,tags:{Project:this.config.project.slug,Environment:this.environment,Role:"app"}})}async run(e){let t=await this.workload(e.workloadId),r={workloadId:e.workloadId,action:e.action};if(!t)return{...r,ok:!1,error:"Workload was not found in the current project and environment."};let n=t.capabilities[e.action];if(!n.supported)return{...r,ok:!1,error:n.reason??`${e.action} is unsupported for ${t.provider}.`};if(n.requiresConfirmation&&e.confirm!==t.name)return{...r,ok:!1,error:`Type "${t.name}" to ${e.action} this workload.`};if(n.requiresRecentAuth&&!e.recentAuth)return{...r,ok:!1,error:"Sign in again before using elevated runtime access."};if(e.action==="inspect")return{...r,ok:!0,workload:t};if(t.provider==="systemd"||t.provider==="docker"){let i=LC(t,e.action);if(!i)return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`};let o=await this.remote(t,["set -uo pipefail",...i],60,`ts-cloud runtime:${e.action}`).catch(sd);return{...r,ok:o.success,command:i[0],stdout:Ys(o.perInstance?.[0]?.output??""),stderr:Ys(o.perInstance?.[0]?.error??o.error??""),error:o.success?void 0:o.error??"Runtime operation failed."}}if(t.provider==="ecs"){let i=MC(t);if(!i)return{...r,ok:!1,error:"ECS cluster or service identity is unavailable."};let o=this.dependencies.ecs??new Nt(this.region,this.profile);if(e.action==="scale"){let s=NC(e.replicas,t.desiredReplicas??1);return await o.scaleService(i.cluster,i.service,s),{...r,ok:!0,command:`ecs scale ${t.name} ${s}`}}if(e.action==="start"||e.action==="stop"){let s=e.action==="stop"?0:Math.max(1,t.desiredReplicas??1);return await o.scaleService(i.cluster,i.service,s),{...r,ok:!0,command:`ecs scale ${t.name} ${s}`}}if(e.action==="restart"||e.action==="redeploy")return await o.forceNewDeployment(i.cluster,i.service),{...r,ok:!0,command:`ecs redeploy ${t.name}`}}return{...r,ok:!1,error:`${e.action} is not implemented for ${t.provider}.`}}async exec(e){let t={workloadId:e.workloadId,preset:e.preset},r=await this.workload(e.workloadId);if(!r)return{...t,ok:!1,error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_EXEC==="0")return{...t,ok:!1,error:"Runtime exec is disabled by TS_CLOUD_RUNTIME_EXEC."};if(!r.capabilities.exec.supported)return{...t,ok:!1,error:r.capabilities.exec.reason??"Exec is unsupported for this workload."};if(e.confirm!==r.name)return{...t,ok:!1,error:`Type "${r.name}" to open exec access.`};if(!e.recentAuth)return{...t,ok:!1,error:"Sign in again before using elevated runtime access."};let n=e.preset&&wh[e.preset];if(!n&&!e.command?.trim())return{...t,ok:!1,error:"Choose a diagnostic preset or provide a command."};if(e.command&&r.provider!=="docker")return{...t,ok:!1,error:"Free-form exec is restricted to isolated containers; use a diagnostic preset for system services."};let i=r.links.providerId??"",o;if(r.provider==="docker"&&cd.test(i)){let c=e.command?.trim()||n.map(ci).join(" ");o=`docker exec ${i} sh -lc ${ci(c)}`}else if(r.provider==="systemd"&&ad.test(i)&&e.preset)o=e.preset==="process"?`systemctl status ${i} --no-pager --full`:wh[e.preset].map(ci).join(" ");if(!o)return{...t,ok:!1,error:"Exec target identity is invalid or unsupported."};let s=await this.remote(r,["set -uo pipefail",o],60,"ts-cloud runtime:exec").catch(sd);return{...t,ok:s.success,command:o,stdout:Ys(s.perInstance?.[0]?.output??""),stderr:Ys(s.perInstance?.[0]?.error??s.error??""),error:s.success?void 0:s.error??"Exec command failed."}}async readFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};let{workload:n,path:i,root:o,providerId:s}=r,u=`sh -c ${ci('resolved=$(realpath -m "$1"); root=$(realpath -m "$3"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; test -f "$resolved"; size=$(wc -c < "$resolved"); printf "__TSCLOUD_SIZE__=%s\\n" "$size"; head -c "$2" "$resolved" | base64')} sh ${ci(i)} ${xa} ${ci(o)}`,a=n.provider==="docker"?`docker exec ${s} ${u}`:u,f=await this.remote(n,[a],30,"ts-cloud runtime:file-read").catch(sd);if(!f.success)return{...t,ok:!1,error:f.error??f.perInstance?.[0]?.error??"File read failed."};let T=f.perInstance?.[0]?.output??"",R=/__TSCLOUD_SIZE__=(\d+)\r?\n/.exec(T);if(!R)return{...t,ok:!1,error:"The remote file response was invalid."};let D=Number(R[1]),W=T.slice((R.index??0)+R[0].length).replace(/\s+/g,"");if(Buffer.from(W,"base64").byteLength>xa)return{...t,ok:!1,error:"The remote file exceeded the transfer limit."};return{...t,ok:!0,contentBase64:W,size:D,truncated:D>xa}}async writeFile(e){let t={workloadId:e.workloadId,path:e.path},r=await this.fileTarget(e);if("error"in r)return{...t,ok:!1,error:r.error};if(!/^[A-Za-z0-9+/]*={0,2}$/.test(e.contentBase64))return{...t,ok:!1,error:"File content must be valid base64."};let n=Buffer.from(e.contentBase64,"base64");if(n.toString("base64")!==e.contentBase64)return{...t,ok:!1,error:"File content must be canonical base64."};if(n.byteLength>xa)return{...t,ok:!1,error:`File uploads are limited to ${xa} bytes.`};let{workload:i,path:o,root:s,providerId:c}=r,a=`sh -c ${ci('resolved=$(realpath -m "$1"); root=$(realpath -m "$2"); case "$resolved" in "$root"|"$root"/*) ;; *) exit 73;; esac; mkdir -p "$(dirname "$resolved")"; tmp="$resolved.ts-cloud-$$"; base64 -d > "$tmp"; chmod 600 "$tmp"; mv "$tmp" "$resolved"')} sh ${ci(o)} ${ci(s)}`,f=i.provider==="docker"?`printf %s ${ci(e.contentBase64)} | docker exec -i ${c} ${a}`:`printf %s ${ci(e.contentBase64)} | ${a}`,T=await this.remote(i,[f],30,"ts-cloud runtime:file-write").catch(sd);return{...t,ok:T.success,size:n.byteLength,truncated:!1,error:T.success?void 0:T.error??T.perInstance?.[0]?.error??"File write failed."}}async fileTarget(e){let t=await this.workload(e.workloadId);if(!t)return{error:"Workload was not found in the current project and environment."};if(process.env.TS_CLOUD_RUNTIME_FILE_ACCESS==="0")return{error:"Runtime file access is disabled by TS_CLOUD_RUNTIME_FILE_ACCESS."};if(!t.capabilities.files.supported)return{error:t.capabilities.files.reason??"File access is unsupported for this workload."};if(e.confirm!==t.name)return{error:`Type "${t.name}" to access workload files.`};if(!e.recentAuth)return{error:"Sign in again before using elevated runtime access."};let r=BC(t,e.path);if(!r.ok)return{error:r.error};let n=FC(t,r.path),i=t.links.providerId??"";if(!n||t.provider==="systemd"&&!ad.test(i)||t.provider==="docker"&&!cd.test(i))return{error:"File target identity is invalid or unsupported."};return{workload:t,path:r.path,root:n,providerId:i}}async logs(e,t={}){let r=await this.workload(e);if(!r)throw Error("Workload was not found in the current project and environment.");if(!r.capabilities.logs.supported)throw Error(r.capabilities.logs.reason??"Logs are unsupported for this workload.");let n=Math.min(1000,Math.max(1,Math.floor(t.limit??200)));if(r.provider==="lambda"||r.provider==="ecs"){let f=this.dependencies.logs??new oe(this.region,this.profile),T=r.config.logGroups,R=r.provider==="lambda"?`/aws/lambda/${r.name}`:Array.isArray(T)&&typeof T[0]==="string"?T[0]:void 0;if(!R)throw Error("The ECS task definition does not declare an awslogs group.");let D=await f.filterLogEvents({logGroupName:R,startTime:t.since?.getTime(),limit:n}),W=(D.events??[]).slice(0,n).map((Y)=>({timestamp:Y.timestamp==null?void 0:new Date(Y.timestamp).toISOString(),message:Ys(String(Y.message??""))}));return{workloadId:e,provider:r.provider,lines:W,nextCursor:D.nextToken,truncated:(D.events?.length??0)>=n}}let i=r.links.providerId??"",o=t.since&&Number.isFinite(t.since.getTime())?t.since:void 0,s=r.provider==="systemd"&&ad.test(i)?`journalctl -u ${i} --no-pager -n ${n} -o short-iso${o?` --since ${ci(o.toISOString())}`:""}`:r.provider==="docker"&&cd.test(i)?`docker logs --timestamps --tail ${n}${o?` --since ${Math.floor(o.getTime()/1000)}`:""} ${i} 2>&1`:void 0;if(!s)throw Error("Log target identity is invalid.");let c=await this.remote(r,[s],30,"ts-cloud runtime:logs");if(!c.success)throw Error(c.error??c.perInstance?.[0]?.error??"Log read failed.");let u=Ys(c.perInstance?.[0]?.output??""),a=u.split(`
 `).filter(Boolean).slice(-n).map((f)=>{let T=/^(\d{4}-\d{2}-\d{2}T\S+)\s+(.*)$/.exec(f);return{timestamp:T?.[1],message:T?.[2]??f}});return{workloadId:e,provider:r.provider,lines:a,truncated:u.includes("[output truncated]")||a.length>=n}}}import{randomUUID as jC}from"node:crypto";class Al{records=new Map;maxBufferBytes;ttlMs;now;constructor(e={}){this.maxBufferBytes=Math.max(1024,e.maxBufferBytes??262144),this.ttlMs=Math.max(1000,e.ttlMs??900000),this.now=e.now??(()=>new Date)}create(e,t){this.sweep();let r=this.now().toISOString(),n={id:jC(),workloadId:t,kind:e,state:"open",chunks:[],cursor:0,droppedBytes:0,bufferedBytes:0,createdAt:r,updatedAt:r,abort:new AbortController,listeners:new Set};return this.records.set(n.id,n),this.snapshot(n,0)}signal(e){return this.records.get(e)?.abort.signal}append(e,t,r="stdout"){let n=this.records.get(e);if(!n||n.state!=="open"||!t)return n?this.snapshot(n,n.cursor):void 0;let i=Buffer.from(t),o=i.byteLength>this.maxBufferBytes?i.subarray(i.byteLength-this.maxBufferBytes).toString("utf8"):t,s={cursor:++n.cursor,stream:r,data:o,at:this.now().toISOString()};n.chunks.push(s),n.bufferedBytes+=Buffer.byteLength(o),n.updatedAt=s.at;while(n.bufferedBytes>this.maxBufferBytes&&n.chunks.length>1){let c=n.chunks.shift(),u=Buffer.byteLength(c.data);n.bufferedBytes-=u,n.droppedBytes+=u}return this.publish(n),this.snapshot(n,s.cursor-1)}read(e,t,r=0){let n=this.records.get(e);if(!n||n.workloadId!==t)return;return n.updatedAt=this.now().toISOString(),this.snapshot(n,Math.max(0,Math.floor(r)))}close(e,t="complete",r){let n=this.records.get(e);if(!n||n.state!=="open")return n?this.snapshot(n,n.cursor):void 0;if(n.state=t,n.error=r,n.updatedAt=this.now().toISOString(),t==="cancelled")n.abort.abort();return this.publish(n),this.snapshot(n,n.cursor)}cancel(e,t){let r=this.records.get(e);if(!r||r.workloadId!==t)return;return this.close(e,"cancelled")}subscribe(e,t,r){let n=this.records.get(e);if(!n||n.workloadId!==t)return;return n.listeners.add(r),()=>n.listeners.delete(r)}sweep(){let e=this.now().getTime()-this.ttlMs,t=0;for(let[r,n]of this.records){if(new Date(n.updatedAt).getTime()>e)continue;n.abort.abort(),this.records.delete(r),t++}return t}clear(){for(let e of this.records.values())e.abort.abort();this.records.clear()}snapshot(e,t){let r=e.chunks[0]?.cursor??e.cursor+1,n=t>0&&t<r-1;return{id:e.id,workloadId:e.workloadId,kind:e.kind,state:e.state,chunks:e.chunks.filter((i)=>n||i.cursor>t),cursor:e.cursor,reset:n,droppedBytes:e.droppedBytes,createdAt:e.createdAt,updatedAt:e.updatedAt,error:e.error}}publish(e){let t=this.snapshot(e,0);for(let r of e.listeners)r(t)}}import{createHash as UC}from"node:crypto";var xl={info:0,low:1,medium:2,high:3,critical:4},Dl={record:0,warn:1,block:2},Ih=new Set(["skipped","unavailable","unsupported","stale"]);function Vt(e){return typeof e==="string"?e:void 0}function _o(e,t){try{return JSON.parse(String(e))}catch{return t}}function Ci(e){return JSON.stringify(h(e))}function zC(e){if(!e)return;return String(h(e,2000))}function kl(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:Vt(e.project_id),environmentId:Vt(e.environment_id),resourceId:Vt(e.resource_id),releaseId:Vt(e.release_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),status:String(e.status),error:Vt(e.error),metadata:_o(e.metadata,{}),findingsCount:Number(e.findings_count),startedAt:String(e.started_at),completedAt:String(e.completed_at),durationMs:Number(e.duration_ms)}}function Ch(e){return{id:String(e.id),fingerprint:String(e.fingerprint),organizationId:String(e.organization_id),projectId:Vt(e.project_id),environmentId:Vt(e.environment_id),resourceId:Vt(e.resource_id),releaseId:Vt(e.release_id),scanRunId:String(e.scan_run_id),scannerId:String(e.scanner_id),scannerVersion:String(e.scanner_version),ruleId:String(e.rule_id),severity:String(e.severity),title:String(e.title),description:String(e.description),evidence:_o(e.evidence,{}),remediation:Vt(e.remediation),subject:String(e.subject),status:String(e.status),ownerActorId:Vt(e.owner_actor_id),recurrenceCount:Number(e.recurrence_count),firstSeenAt:String(e.first_seen_at),lastSeenAt:String(e.last_seen_at),resolvedAt:Vt(e.resolved_at),updatedAt:String(e.updated_at)}}function Rl(e){return{id:String(e.id),organizationId:String(e.organization_id),environmentId:Vt(e.environment_id),name:String(e.name),rules:_o(e.rules,[]),requiredScanners:_o(e.required_scanners,[]),scannerFailMode:String(e.scanner_fail_mode),enabled:Number(e.enabled)===1,version:Number(e.version),createdByActorId:Vt(e.created_by_actor_id),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Eh(e,t){let r=Vt(e.revoked_at),n=String(e.expires_at);return{id:String(e.id),findingId:String(e.finding_id),policyId:Vt(e.policy_id),reason:String(e.reason),referenceUrl:Vt(e.reference_url),createdByActorId:String(e.created_by_actor_id),expiresAt:n,revokedAt:r,state:r?"revoked":n<=t?"expired":"active",createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Pl(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:Vt(e.environment_id),releaseId:String(e.release_id),kind:String(e.kind),format:String(e.format),digest:String(e.digest),summary:_o(e.summary,{}),content:Vt(e.content),sensitive:Number(e.sensitive)===1,createdAt:String(e.created_at)}}function Th(e){return{id:String(e.id),organizationId:String(e.organization_id),projectId:String(e.project_id),environmentId:String(e.environment_id),operationId:Vt(e.operation_id),policyId:String(e.policy_id),policyVersion:Number(e.policy_version),outcome:String(e.outcome),scannerVersions:_o(e.scanner_versions,{}),findingIds:_o(e.finding_ids,[]),waiverIds:_o(e.waiver_ids,[]),explanation:String(e.explanation),createdAt:String(e.created_at)}}function VC(e,t){let r=[e.trim().toLowerCase(),t.ruleId.trim().toLowerCase(),t.organizationId,t.projectId??"",t.environmentId??"",t.resourceId??"",t.releaseId??"",t.subject.trim().toLowerCase()].join("\x00");return UC("sha256").update(r).digest("hex")}function Ah(e){if(!e)return;let t=new URL(e);if(t.protocol!=="https:"&&t.protocol!=="http:")throw Error("Security references must use HTTP or HTTPS");return t.toString()}function kh(e){if(!e.length)throw Error("A security policy needs at least one rule");return e.map((t)=>{if(!(t.minimumSeverity in xl))throw Error(`Unknown security severity: ${t.minimumSeverity}`);if(!(t.action in Dl))throw Error(`Unknown security policy action: ${t.action}`);return{minimumSeverity:t.minimumSeverity,action:t.action,...t.scannerId?{scannerId:t.scannerId.trim()}:{}}})}class xt{controlPlane;nowFn;idFn;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID())}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}recordScan(e){if(!e.organizationId||!e.scannerId.trim()||!e.scannerVersion.trim())throw Error("Organization, scanner id, and scanner version are required");let t=e.completedAt??this.now(),r=e.startedAt??t,n=e.durationMs??Math.max(0,new Date(t).getTime()-new Date(r).getTime()),i=e.findings??[],o=this.idFn(),s=new Set,c=[];return this.controlPlane.transaction(()=>{this.run(`INSERT INTO security_scan_runs
         (id, organization_id, project_id, environment_id, resource_id, release_id, scanner_id, scanner_version, status, error, metadata, findings_count, started_at, completed_at, duration_ms)
@@ -427,7 +427,7 @@ export type ConfigOf = Config
 </body>
 </html>`}var lT=["restart","reload","start","stop","enable","disable"],fy=65536;function sa(e){return e.length<=fy?e:`${e.slice(0,fy)}
 
-[output truncated]`}function pT(e){return/^[A-Za-z0-9_.@:-]+$/.test(e)}function Hl(e){return/^[A-Za-z0-9_-]+$/.test(e)}function gT(e){return e.charAt(0).toUpperCase()+e.slice(1)}function Hr(e,t){let r=[],n=t.servicesDetail??t.services??[];for(let s of n){let c=String(s?.name??"");if(!c||!pT(c))continue;for(let u of lT)r.push({id:`${u}:${c}`,label:`${gT(u)} ${c}`,group:"service",target:c,mutates:!0,confirm:c,danger:u==="stop"||u==="disable"})}for(let[s,c]of Object.entries(e.sites??{})){if(!c||!Hl(s))continue;let u=P(c);if(u==="server-app"||u==="server-php")r.push({id:`rollback:${s}`,label:`Rollback ${s}`,group:"deploy",target:s,mutates:!0,confirm:s,danger:!0})}let i=new Set;for(let s of t.workers??[]){let c=String(s?.name??"").split(":")[0];if(c&&Hl(c))i.add(c)}for(let s of i)r.push({id:`worker:restart:${s}`,label:`Restart workers (${s})`,group:"worker",target:s,mutates:!0,confirm:s});for(let[s,c]of Object.entries(e.sites??{})){if(!c||!Hl(s))continue;if(c.scheduler||c.schedule){let u=tn(c)==="laravel";r.push({id:`scheduler:run:${s}`,label:`${u?"Run":"Restart"} scheduler (${s})`,group:"scheduler",target:s,mutates:!0,confirm:s})}}if(e.infrastructure?.compute?.backups?.enabled){if(r.push({id:"backup:run",label:"Run backup now",group:"backup",target:"backup",mutates:!0,confirm:"backup"}),w(e))r.push({id:"backup:restore",label:"Restore latest DB backup",group:"backup",target:"database",mutates:!0,confirm:"restore",danger:!0})}return r}function Zn(e,t,r){return Hr(t,r).find((n)=>n.id===e)}function mT(e,t){let r=e==="enable"||e==="disable"?`systemctl is-enabled ${t} 2>/dev/null || true`:`systemctl is-active ${t} 2>/dev/null || true`;return["set -o pipefail",`systemctl ${e} ${t}`,r]}function fT(){return`eval "$(cd ${U} && pantry env 2>/dev/null)"`}function yy(e,t,r){let n=`${J(e,t)}/current`;return["set -uo pipefail",`[ -d ${n} ] || { echo "site ${t} has no current release" >&2; exit 1; }`,`cd ${n} && ${fT()} && php artisan ${r}`]}function hT(e,t,r){if(e==="laravel")return yy(t,r,"queue:restart");let n=`${t}-${r}-queue-*.service`;return["set -uo pipefail",`units=$(systemctl list-units --type=service --all --no-legend '${n}' 2>/dev/null | awk '{print $1}')`,`[ -n "$units" ] || { echo "no queue-worker units found for ${r} (${n})" >&2; exit 1; }`,"systemctl restart $units",`systemctl --no-legend --type=service list-units '${n}' 2>/dev/null || true`]}function yT(e,t,r){if(e==="laravel")return yy(t,r,"schedule:run");let n=`${t}-${r}-scheduler.service`;return["set -uo pipefail",`systemctl restart ${n}`,`systemctl is-active ${n} 2>/dev/null || true`]}function bT(){return["set -uo pipefail",`[ -x ${un} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,un]}function hy(e,t,r){return{operation:e,command:t,ok:r.success,stdout:sa(r.perInstance?.[0]?.output??""),stderr:sa(r.perInstance?.[0]?.error??r.error??"")}}async function qr(e,t,r,n={}){let i=e.project.slug,o;try{o=O({config:e})}catch(T){return{operation:r.id,ok:!1,error:`Could not initialize the cloud driver: ${T?.message??T}`}}let s={driver:o,slug:i,environment:t,role:"app"};if(r.group==="deploy"){let T=n.to&&/^[A-Za-z0-9._-]+$/.test(n.to)?n.to:void 0,R=await js(s,{siteName:r.target,to:T});return hy(r.id,`rollback ${r.target}${T?` → ${T}`:""}`,R)}if(r.id==="backup:restore"){let T=await Vs(s,{database:w(e)});return hy(r.id,"db restore",T)}let c=await o.findComputeTargets({slug:i,environment:t,role:"app"});if(!c.length)return{operation:r.id,ok:!1,error:"No app server target was found for this environment."};let u,a;if(r.group==="service"){let[T,...R]=r.id.split(":");u=mT(T,R.join(":")),a=`systemctl ${T} ${r.target}`}else if(r.group==="worker"){let T=tn(e.sites?.[r.target]??{});u=hT(T,i,r.target),a=T==="laravel"?`queue:restart (${r.target})`:`restart queue units (${r.target})`}else if(r.group==="scheduler"){let T=tn(e.sites?.[r.target]??{});u=yT(T,i,r.target),a=T==="laravel"?`schedule:run (${r.target})`:`restart scheduler (${r.target})`}else if(r.id==="backup:run")u=bT(),a="ts-cloud backup";else return{operation:r.id,ok:!1,error:"Unknown operation."};let f=await o.runRemoteDeploy({targets:[c[0]],commands:u,comment:`ts-cloud dashboard:${r.id}`,tags:{Project:i,Environment:t,Role:"app"}});return{operation:r.id,command:a,ok:f.success,stdout:sa(f.perInstance?.[0]?.output??""),stderr:sa(f.perInstance?.[0]?.error??f.error??"")}}async function or(e,t,r){let n=r.trim();if(!n)return{operation:"command",ok:!1,error:"A command is required."};let i;try{i=O({config:e})}catch(u){return{operation:"command",ok:!1,error:`Could not initialize the cloud driver: ${u?.message??u}`}}let o=e.project.slug,s=await i.findComputeTargets({slug:o,environment:t,role:"app"});if(!s.length)return{operation:"command",ok:!1,error:"No app server target was found for this environment."};let c=await i.runRemoteDeploy({targets:[s[0]],commands:["set -o pipefail",n],comment:"ts-cloud dashboard:command",tags:{Project:o,Environment:t,Role:"app"}});return{operation:"command",command:n,ok:c.success,stdout:sa(c.perInstance?.[0]?.output??""),stderr:sa(c.perInstance?.[0]?.error??c.error??"")}}var ST=[{id:"server.overview",path:"/",label:"Dashboard",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/server"]},{id:"server.activity",path:"/server/activity",label:"Activity",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/activity"]},{id:"services.list",path:"/server/sites",label:"Services",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/sites","/services"]},{id:"deployments.list",path:"/server/deployments",label:"Deployments",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/deployments"]},{id:"logs.list",path:"/server/logs",label:"Logs",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/logs"]},{id:"sources.integrations",path:"/integrations",label:"Git integrations",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.create",path:"/applications/new",label:"Create application",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.compose",path:"/applications/compose",label:"Compose applications",group:"applications",modes:["server"],adminOnly:!1},{id:"operations.queue",path:"/operations/queue",label:"Deployment queue",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.previews",path:"/operations/previews",label:"Preview environments",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.releases",path:"/operations/releases",label:"Releases & promotion",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"runtime.workloads",path:"/operations/workloads",label:"Workloads",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"observability.overview",path:"/operations/observability",label:"Observability",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"alerts.overview",path:"/operations/alerts",label:"Alerts & health",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"spend.overview",path:"/operations/spend",label:"Spend & budgets",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"automation.jobs",path:"/operations/jobs",label:"Workers & schedules",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/workers","/serverless/scheduler"]},{id:"configuration.entries",path:"/operations/configuration",label:"Environment & secrets",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/serverless/secrets"]},{id:"metrics.overview",path:"/server/metrics",label:"Metrics",group:"operations",modes:["server"],adminOnly:!0},{id:"runtime.services",path:"/server/services",label:"Runtime services",group:"operations",modes:["server"],adminOnly:!0},{id:"backups.list",path:"/data/backups",label:"Backups & recovery",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/backups"]},{id:"volumes.list",path:"/data/volumes",label:"Persistent volumes",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:[]},{id:"fleet.list",path:"/server/fleet",label:"Fleet inventory",group:"operations",modes:["server"],adminOnly:!1,legacyPaths:[]},{id:"operations.run",path:"/server/actions",label:"Run operations",group:"operations",modes:["server"],adminOnly:!0},{id:"infrastructure.topology",path:"/infrastructure/topology",label:"Infrastructure map",group:"infrastructure",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/topology"]},{id:"data.services",path:"/data/services",label:"Data services",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/database","/databases","/server/database","/serverless/data"]},{id:"network.firewall",path:"/server/firewall",label:"Network & firewall",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"security.posture",path:"/security",label:"Security posture",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/security"]},{id:"access.ssh",path:"/server/ssh-keys",label:"SSH keys",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"runtime.terminal",path:"/server/terminal",label:"Terminal",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"organization.people",path:"/server/team",label:"People & access",group:"organization",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/team"]},{id:"organization.automation",path:"/account/automation",label:"API & automation",group:"organization",modes:["server","serverless"],adminOnly:!0},{id:"serverless.overview",path:"/serverless",label:"Dashboard",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.deployments",path:"/serverless/deployments",label:"Deployments",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.logs",path:"/serverless/logs",label:"Logs",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.metrics",path:"/serverless/metrics",label:"Metrics",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.traces",path:"/serverless/traces",label:"Traces",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.functions",path:"/serverless/functions",label:"Functions",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.queues",path:"/serverless/queues",label:"Queues",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.assets",path:"/serverless/assets",label:"Assets",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.network",path:"/serverless/firewall",label:"Network",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.alerts",path:"/serverless/alarms",label:"Alerts",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.cost",path:"/serverless/cost",label:"Costs",group:"settings",modes:["serverless"],adminOnly:!0}],vT=new Map(ST.flatMap((e)=>(e.legacyPaths??[]).map((t)=>[t,e.path])));function by(e){return vT.get(e)}function wT(e,t){return[`${e}-${t}`,`${e}-${t}-queues`,`${e}-${t}-daemons`]}function Sy(e,t,r){return r.some((n)=>wT(t,n).includes(e))}function Wl(e,t){let{user:r,slug:n}=t;if(r.role==="admin")return e;let i=(e.sites??[]).map((W)=>W.name).filter(Boolean),o=Ll(r,i),s=new Set(o),c=(e.sites??[]).filter((W)=>s.has(W.name)),u=(e.sitesDetail??[]).filter((W)=>s.has(W.name)),a=new Set(u.map((W)=>W.domain).filter(Boolean)),f=(e.serverDeploymentsDetail??e.serverDeployments??[]).filter((W)=>s.has(W.site)),T=(e.serverLogs??[]).filter((W)=>Sy(W.source,n,o)),R=(e.security?.tlsCertificates??[]).filter((W)=>a.has(W.domain)),D=(e.activity??[]).filter((W)=>{if(W.type==="deploy")return o.some((Y)=>String(W.title??"").startsWith(`${Y} `));if(W.type==="log")return Sy(String(W.title??"").split(" ")[0],n,o);return!1});return{mode:e.mode,environment:e.environment,environments:e.environments,scoped:!0,server:{name:""},sites:c,sitesDetail:u,workers:(e.workers??[]).filter((W)=>s.has(W.site)),serverDeployments:f.slice(0,5),serverDeploymentsDetail:f.slice(0,50),deploymentsEmptyReason:f.length?void 0:"No deployments have been recorded for your sites yet.",serverLogs:T,serverLogsEmptyReason:T.length?void 0:"No recent log entries for your sites.",security:{tlsCertificates:R,ports:[],firewall:null,authEvents:[]},diagnostics:(e.diagnostics??[]).filter((W)=>["Route conflicts","TLS certificates"].includes(W.name)),activity:D}}function vy(e,t){if(t.role==="admin")return e;let r=new Set(Ll(t,Object.keys(e.sites??{})));return{project:{name:e.project?.name},environment:e.environment,environments:e.environments,sites:Object.fromEntries(Object.entries(e.sites??{}).filter(([n])=>r.has(n)))}}var IT=new Set(["name","ssl","env","redirects","aliases","domain","path"]),wy={build:"build runs as a shell command on the server",start:"start runs as a shell command on the server",root:"root is a filesystem path on the shared server",port:"ports are allocated by the server owner",type:"the deploy type is set by the server owner",php:"the PHP runtime is set by the server owner"};function Cy(e){let t=Object.keys(e).filter((i)=>e[i]!==void 0),r=t.filter((i)=>(i in wy));if(r.length)return{ok:!1,error:`Only the server owner can change ${r.map((o)=>`${o} (${wy[o]})`).join(", ")}.`};let n=t.filter((i)=>!IT.has(i));if(n.length)return{ok:!1,error:`Only the server owner can change ${n.join(", ")}.`};return{ok:!0}}function Id(e){return String(e??"").trim().toLowerCase().replace(/\.$/,"")}function Iy(e){let t=String(e??"/").trim();if(!t||t==="/")return"/";return(t.startsWith("/")?t:`/${t}`).replace(/\/+$/,"")||"/"}function CT(e){let t=[Id(e?.domain)];if(Array.isArray(e?.aliases))t.push(...e.aliases.map(Id));return t.filter(Boolean)}function Ey({siteName:e,body:t,sites:r,ownSites:n}){let i=r[e]??{},o=new Set(n),s=new Set;if(t.domain!==void 0)s.add(Id(t.domain));if(Array.isArray(t.aliases))for(let u of t.aliases)s.add(Id(u));if(s.delete(""),s.size===0)return{ok:!0};let c=Iy(t.path!==void 0?t.path:i.path);for(let[u,a]of Object.entries(r)){if(u===e||o.has(u))continue;let f=Iy(a?.path);for(let T of CT(a)){if(!s.has(T))continue;if(f===c)return{ok:!1,error:`${T}${c==="/"?"":c} is already served by another site on this server.`}}}return{ok:!0}}class Ma{maxAttempts;lockoutMs;windowMs;attempts=new Map;constructor(e=8,t=900000,r=900000){this.maxAttempts=e;this.lockoutMs=t;this.windowMs=r}key(e,t){return`${e.trim().toLowerCase()}\x00${t}`}check(e,t,r=Date.now()){let n=this.attempts.get(this.key(e,t));if(!n?.until)return{allowed:!0};if(r>=n.until)return this.attempts.delete(this.key(e,t)),{allowed:!0};return{allowed:!1,retryAfterSeconds:Math.ceil((n.until-r)/1000)}}recordFailure(e,t,r=Date.now()){let n=this.key(e,t),i=this.attempts.get(n),s=!i||r-i.last>this.windowMs?1:i.count+1,c={count:s,last:r};if(s>=this.maxAttempts)c.until=r+this.lockoutMs;this.attempts.set(n,c)}recordSuccess(e,t){this.attempts.delete(this.key(e,t))}prune(e=Date.now()){for(let[t,r]of this.attempts)if(r.until?e>=r.until:e-r.last>this.windowMs)this.attempts.delete(t)}get size(){return this.attempts.size}}var Ay=new Set([22,80,443]);function $a(e){return Number.isInteger(e)&&e>=1&&e<=65535}function us(e){return[...new Set(e.filter((t)=>$a(t)&&!Ay.has(t)))].sort((t,r)=>t-r)}function ky(e,t,r=[]){if(!$a(t))throw Error("Port must be an integer between 1 and 65535.");if(Ay.has(t))throw Error(`Port ${t} (SSH/HTTP/HTTPS) is always open and is not managed here.`);return Py({configText:e,ports:us([...r,t])})}function Ry(e,t,r=[]){return Py({configText:e,ports:us(r.filter((n)=>n!==t))})}function Ty(e,t,r,n,i){let o=e.slice(t,r),s=new RegExp(`\\b${n}\\s*:\\s*\\${i}`).exec(o);if(!s)return null;let c=t+s.index,u=e.indexOf(i,c);return{propStart:c,open:u,close:li(e,u,i,i==="{"?"}":"]")}}function Kl(e){return`allowedPorts: [${e.join(", ")}]`}function Py(e){let{configText:t}=e,r=us(e.ports),n=/\bcompute\s*:\s*{/.exec(t);if(!n)throw Error("Could not find infrastructure.compute in the cloud config.");let i=t.indexOf("{",n.index),o=li(t,i,"{","}"),s=Ty(t,i+1,o,"firewall","{");if(s){let f=Ty(t,s.open+1,s.close,"allowedPorts","[");if(f){let W=f.propStart;while(W>0&&t[W-1]!==`
+[output truncated]`}function pT(e){return/^[A-Za-z0-9_.@:-]+$/.test(e)}function Hl(e){return/^[A-Za-z0-9_-]+$/.test(e)}function gT(e){return e.charAt(0).toUpperCase()+e.slice(1)}function Hr(e,t){let r=[],n=t.servicesDetail??t.services??[];for(let s of n){let c=String(s?.name??"");if(!c||!pT(c))continue;for(let u of lT)r.push({id:`${u}:${c}`,label:`${gT(u)} ${c}`,group:"service",target:c,mutates:!0,confirm:c,danger:u==="stop"||u==="disable"})}for(let[s,c]of Object.entries(e.sites??{})){if(!c||!Hl(s))continue;let u=I(c);if(u==="server-app"||u==="server-php")r.push({id:`rollback:${s}`,label:`Rollback ${s}`,group:"deploy",target:s,mutates:!0,confirm:s,danger:!0})}let i=new Set;for(let s of t.workers??[]){let c=String(s?.name??"").split(":")[0];if(c&&Hl(c))i.add(c)}for(let s of i)r.push({id:`worker:restart:${s}`,label:`Restart workers (${s})`,group:"worker",target:s,mutates:!0,confirm:s});for(let[s,c]of Object.entries(e.sites??{})){if(!c||!Hl(s))continue;if(c.scheduler||c.schedule){let u=tn(c)==="laravel";r.push({id:`scheduler:run:${s}`,label:`${u?"Run":"Restart"} scheduler (${s})`,group:"scheduler",target:s,mutates:!0,confirm:s})}}if(e.infrastructure?.compute?.backups?.enabled){if(r.push({id:"backup:run",label:"Run backup now",group:"backup",target:"backup",mutates:!0,confirm:"backup"}),w(e))r.push({id:"backup:restore",label:"Restore latest DB backup",group:"backup",target:"database",mutates:!0,confirm:"restore",danger:!0})}return r}function Zn(e,t,r){return Hr(t,r).find((n)=>n.id===e)}function mT(e,t){let r=e==="enable"||e==="disable"?`systemctl is-enabled ${t} 2>/dev/null || true`:`systemctl is-active ${t} 2>/dev/null || true`;return["set -o pipefail",`systemctl ${e} ${t}`,r]}function fT(){return`eval "$(cd ${U} && pantry env 2>/dev/null)"`}function yy(e,t,r){let n=`${J(e,t)}/current`;return["set -uo pipefail",`[ -d ${n} ] || { echo "site ${t} has no current release" >&2; exit 1; }`,`cd ${n} && ${fT()} && php artisan ${r}`]}function hT(e,t,r){if(e==="laravel")return yy(t,r,"queue:restart");let n=`${t}-${r}-queue-*.service`;return["set -uo pipefail",`units=$(systemctl list-units --type=service --all --no-legend '${n}' 2>/dev/null | awk '{print $1}')`,`[ -n "$units" ] || { echo "no queue-worker units found for ${r} (${n})" >&2; exit 1; }`,"systemctl restart $units",`systemctl --no-legend --type=service list-units '${n}' 2>/dev/null || true`]}function yT(e,t,r){if(e==="laravel")return yy(t,r,"schedule:run");let n=`${t}-${r}-scheduler.service`;return["set -uo pipefail",`systemctl restart ${n}`,`systemctl is-active ${n} 2>/dev/null || true`]}function bT(){return["set -uo pipefail",`[ -x ${un} ] || { echo "scheduled backups are not provisioned on this server" >&2; exit 1; }`,un]}function hy(e,t,r){return{operation:e,command:t,ok:r.success,stdout:sa(r.perInstance?.[0]?.output??""),stderr:sa(r.perInstance?.[0]?.error??r.error??"")}}async function qr(e,t,r,n={}){let i=e.project.slug,o;try{o=O({config:e})}catch(T){return{operation:r.id,ok:!1,error:`Could not initialize the cloud driver: ${T?.message??T}`}}let s={driver:o,slug:i,environment:t,role:"app"};if(r.group==="deploy"){let T=n.to&&/^[A-Za-z0-9._-]+$/.test(n.to)?n.to:void 0,R=await js(s,{siteName:r.target,to:T});return hy(r.id,`rollback ${r.target}${T?` → ${T}`:""}`,R)}if(r.id==="backup:restore"){let T=await Vs(s,{database:w(e)});return hy(r.id,"db restore",T)}let c=await o.findComputeTargets({slug:i,environment:t,role:"app"});if(!c.length)return{operation:r.id,ok:!1,error:"No app server target was found for this environment."};let u,a;if(r.group==="service"){let[T,...R]=r.id.split(":");u=mT(T,R.join(":")),a=`systemctl ${T} ${r.target}`}else if(r.group==="worker"){let T=tn(e.sites?.[r.target]??{});u=hT(T,i,r.target),a=T==="laravel"?`queue:restart (${r.target})`:`restart queue units (${r.target})`}else if(r.group==="scheduler"){let T=tn(e.sites?.[r.target]??{});u=yT(T,i,r.target),a=T==="laravel"?`schedule:run (${r.target})`:`restart scheduler (${r.target})`}else if(r.id==="backup:run")u=bT(),a="ts-cloud backup";else return{operation:r.id,ok:!1,error:"Unknown operation."};let f=await o.runRemoteDeploy({targets:[c[0]],commands:u,comment:`ts-cloud dashboard:${r.id}`,tags:{Project:i,Environment:t,Role:"app"}});return{operation:r.id,command:a,ok:f.success,stdout:sa(f.perInstance?.[0]?.output??""),stderr:sa(f.perInstance?.[0]?.error??f.error??"")}}async function or(e,t,r){let n=r.trim();if(!n)return{operation:"command",ok:!1,error:"A command is required."};let i;try{i=O({config:e})}catch(u){return{operation:"command",ok:!1,error:`Could not initialize the cloud driver: ${u?.message??u}`}}let o=e.project.slug,s=await i.findComputeTargets({slug:o,environment:t,role:"app"});if(!s.length)return{operation:"command",ok:!1,error:"No app server target was found for this environment."};let c=await i.runRemoteDeploy({targets:[s[0]],commands:["set -o pipefail",n],comment:"ts-cloud dashboard:command",tags:{Project:o,Environment:t,Role:"app"}});return{operation:"command",command:n,ok:c.success,stdout:sa(c.perInstance?.[0]?.output??""),stderr:sa(c.perInstance?.[0]?.error??c.error??"")}}var ST=[{id:"server.overview",path:"/",label:"Dashboard",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/server"]},{id:"server.activity",path:"/server/activity",label:"Activity",group:"overview",modes:["server"],adminOnly:!0,legacyPaths:["/activity"]},{id:"services.list",path:"/server/sites",label:"Services",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/sites","/services"]},{id:"deployments.list",path:"/server/deployments",label:"Deployments",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/deployments"]},{id:"logs.list",path:"/server/logs",label:"Logs",group:"applications",modes:["server"],adminOnly:!1,legacyPaths:["/logs"]},{id:"sources.integrations",path:"/integrations",label:"Git integrations",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.create",path:"/applications/new",label:"Create application",group:"applications",modes:["server","serverless"],adminOnly:!1},{id:"applications.compose",path:"/applications/compose",label:"Compose applications",group:"applications",modes:["server"],adminOnly:!1},{id:"operations.queue",path:"/operations/queue",label:"Deployment queue",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.previews",path:"/operations/previews",label:"Preview environments",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"operations.releases",path:"/operations/releases",label:"Releases & promotion",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"runtime.workloads",path:"/operations/workloads",label:"Workloads",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"observability.overview",path:"/operations/observability",label:"Observability",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"alerts.overview",path:"/operations/alerts",label:"Alerts & health",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"spend.overview",path:"/operations/spend",label:"Spend & budgets",group:"operations",modes:["server","serverless"],adminOnly:!1},{id:"automation.jobs",path:"/operations/jobs",label:"Workers & schedules",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/workers","/serverless/scheduler"]},{id:"configuration.entries",path:"/operations/configuration",label:"Environment & secrets",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/serverless/secrets"]},{id:"metrics.overview",path:"/server/metrics",label:"Metrics",group:"operations",modes:["server"],adminOnly:!0},{id:"runtime.services",path:"/server/services",label:"Runtime services",group:"operations",modes:["server"],adminOnly:!0},{id:"backups.list",path:"/data/backups",label:"Backups & recovery",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/backups"]},{id:"volumes.list",path:"/data/volumes",label:"Persistent volumes",group:"operations",modes:["server","serverless"],adminOnly:!1,legacyPaths:[]},{id:"fleet.list",path:"/server/fleet",label:"Fleet inventory",group:"operations",modes:["server"],adminOnly:!1,legacyPaths:[]},{id:"operations.run",path:"/server/actions",label:"Run operations",group:"operations",modes:["server"],adminOnly:!0},{id:"infrastructure.topology",path:"/infrastructure/topology",label:"Infrastructure map",group:"infrastructure",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/topology"]},{id:"data.services",path:"/data/services",label:"Data services",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/database","/databases","/server/database","/serverless/data"]},{id:"network.firewall",path:"/server/firewall",label:"Network & firewall",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"security.posture",path:"/security",label:"Security posture",group:"infrastructure",modes:["server","serverless"],adminOnly:!1,legacyPaths:["/server/security"]},{id:"access.ssh",path:"/server/ssh-keys",label:"SSH keys",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"runtime.terminal",path:"/server/terminal",label:"Terminal",group:"infrastructure",modes:["server"],adminOnly:!0},{id:"organization.people",path:"/server/team",label:"People & access",group:"organization",modes:["server","serverless"],adminOnly:!0,legacyPaths:["/team"]},{id:"organization.automation",path:"/account/automation",label:"API & automation",group:"organization",modes:["server","serverless"],adminOnly:!0},{id:"serverless.overview",path:"/serverless",label:"Dashboard",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.deployments",path:"/serverless/deployments",label:"Deployments",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.logs",path:"/serverless/logs",label:"Logs",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.metrics",path:"/serverless/metrics",label:"Metrics",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.traces",path:"/serverless/traces",label:"Traces",group:"overview",modes:["serverless"],adminOnly:!0},{id:"serverless.functions",path:"/serverless/functions",label:"Functions",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.queues",path:"/serverless/queues",label:"Queues",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.assets",path:"/serverless/assets",label:"Assets",group:"compute-data",modes:["serverless"],adminOnly:!0},{id:"serverless.network",path:"/serverless/firewall",label:"Network",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.alerts",path:"/serverless/alarms",label:"Alerts",group:"settings",modes:["serverless"],adminOnly:!0},{id:"serverless.cost",path:"/serverless/cost",label:"Costs",group:"settings",modes:["serverless"],adminOnly:!0}],vT=new Map(ST.flatMap((e)=>(e.legacyPaths??[]).map((t)=>[t,e.path])));function by(e){return vT.get(e)}function wT(e,t){return[`${e}-${t}`,`${e}-${t}-queues`,`${e}-${t}-daemons`]}function Sy(e,t,r){return r.some((n)=>wT(t,n).includes(e))}function Wl(e,t){let{user:r,slug:n}=t;if(r.role==="admin")return e;let i=(e.sites??[]).map((W)=>W.name).filter(Boolean),o=Ll(r,i),s=new Set(o),c=(e.sites??[]).filter((W)=>s.has(W.name)),u=(e.sitesDetail??[]).filter((W)=>s.has(W.name)),a=new Set(u.map((W)=>W.domain).filter(Boolean)),f=(e.serverDeploymentsDetail??e.serverDeployments??[]).filter((W)=>s.has(W.site)),T=(e.serverLogs??[]).filter((W)=>Sy(W.source,n,o)),R=(e.security?.tlsCertificates??[]).filter((W)=>a.has(W.domain)),D=(e.activity??[]).filter((W)=>{if(W.type==="deploy")return o.some((Y)=>String(W.title??"").startsWith(`${Y} `));if(W.type==="log")return Sy(String(W.title??"").split(" ")[0],n,o);return!1});return{mode:e.mode,environment:e.environment,environments:e.environments,scoped:!0,server:{name:""},sites:c,sitesDetail:u,workers:(e.workers??[]).filter((W)=>s.has(W.site)),serverDeployments:f.slice(0,5),serverDeploymentsDetail:f.slice(0,50),deploymentsEmptyReason:f.length?void 0:"No deployments have been recorded for your sites yet.",serverLogs:T,serverLogsEmptyReason:T.length?void 0:"No recent log entries for your sites.",security:{tlsCertificates:R,ports:[],firewall:null,authEvents:[]},diagnostics:(e.diagnostics??[]).filter((W)=>["Route conflicts","TLS certificates"].includes(W.name)),activity:D}}function vy(e,t){if(t.role==="admin")return e;let r=new Set(Ll(t,Object.keys(e.sites??{})));return{project:{name:e.project?.name},environment:e.environment,environments:e.environments,sites:Object.fromEntries(Object.entries(e.sites??{}).filter(([n])=>r.has(n)))}}var IT=new Set(["name","ssl","env","redirects","aliases","domain","path"]),wy={build:"build runs as a shell command on the server",start:"start runs as a shell command on the server",root:"root is a filesystem path on the shared server",port:"ports are allocated by the server owner",type:"the deploy type is set by the server owner",php:"the PHP runtime is set by the server owner"};function Cy(e){let t=Object.keys(e).filter((i)=>e[i]!==void 0),r=t.filter((i)=>(i in wy));if(r.length)return{ok:!1,error:`Only the server owner can change ${r.map((o)=>`${o} (${wy[o]})`).join(", ")}.`};let n=t.filter((i)=>!IT.has(i));if(n.length)return{ok:!1,error:`Only the server owner can change ${n.join(", ")}.`};return{ok:!0}}function Id(e){return String(e??"").trim().toLowerCase().replace(/\.$/,"")}function Iy(e){let t=String(e??"/").trim();if(!t||t==="/")return"/";return(t.startsWith("/")?t:`/${t}`).replace(/\/+$/,"")||"/"}function CT(e){let t=[Id(e?.domain)];if(Array.isArray(e?.aliases))t.push(...e.aliases.map(Id));return t.filter(Boolean)}function Ey({siteName:e,body:t,sites:r,ownSites:n}){let i=r[e]??{},o=new Set(n),s=new Set;if(t.domain!==void 0)s.add(Id(t.domain));if(Array.isArray(t.aliases))for(let u of t.aliases)s.add(Id(u));if(s.delete(""),s.size===0)return{ok:!0};let c=Iy(t.path!==void 0?t.path:i.path);for(let[u,a]of Object.entries(r)){if(u===e||o.has(u))continue;let f=Iy(a?.path);for(let T of CT(a)){if(!s.has(T))continue;if(f===c)return{ok:!1,error:`${T}${c==="/"?"":c} is already served by another site on this server.`}}}return{ok:!0}}class Ma{maxAttempts;lockoutMs;windowMs;attempts=new Map;constructor(e=8,t=900000,r=900000){this.maxAttempts=e;this.lockoutMs=t;this.windowMs=r}key(e,t){return`${e.trim().toLowerCase()}\x00${t}`}check(e,t,r=Date.now()){let n=this.attempts.get(this.key(e,t));if(!n?.until)return{allowed:!0};if(r>=n.until)return this.attempts.delete(this.key(e,t)),{allowed:!0};return{allowed:!1,retryAfterSeconds:Math.ceil((n.until-r)/1000)}}recordFailure(e,t,r=Date.now()){let n=this.key(e,t),i=this.attempts.get(n),s=!i||r-i.last>this.windowMs?1:i.count+1,c={count:s,last:r};if(s>=this.maxAttempts)c.until=r+this.lockoutMs;this.attempts.set(n,c)}recordSuccess(e,t){this.attempts.delete(this.key(e,t))}prune(e=Date.now()){for(let[t,r]of this.attempts)if(r.until?e>=r.until:e-r.last>this.windowMs)this.attempts.delete(t)}get size(){return this.attempts.size}}var Ay=new Set([22,80,443]);function $a(e){return Number.isInteger(e)&&e>=1&&e<=65535}function us(e){return[...new Set(e.filter((t)=>$a(t)&&!Ay.has(t)))].sort((t,r)=>t-r)}function ky(e,t,r=[]){if(!$a(t))throw Error("Port must be an integer between 1 and 65535.");if(Ay.has(t))throw Error(`Port ${t} (SSH/HTTP/HTTPS) is always open and is not managed here.`);return Py({configText:e,ports:us([...r,t])})}function Ry(e,t,r=[]){return Py({configText:e,ports:us(r.filter((n)=>n!==t))})}function Ty(e,t,r,n,i){let o=e.slice(t,r),s=new RegExp(`\\b${n}\\s*:\\s*\\${i}`).exec(o);if(!s)return null;let c=t+s.index,u=e.indexOf(i,c);return{propStart:c,open:u,close:li(e,u,i,i==="{"?"}":"]")}}function Kl(e){return`allowedPorts: [${e.join(", ")}]`}function Py(e){let{configText:t}=e,r=us(e.ports),n=/\bcompute\s*:\s*{/.exec(t);if(!n)throw Error("Could not find infrastructure.compute in the cloud config.");let i=t.indexOf("{",n.index),o=li(t,i,"{","}"),s=Ty(t,i+1,o,"firewall","{");if(s){let f=Ty(t,s.open+1,s.close,"allowedPorts","[");if(f){let W=f.propStart;while(W>0&&t[W-1]!==`
 `&&/\s/.test(t[W-1]))W--;let Y=t.slice(W,f.propStart);return`${t.slice(0,W)}${Y}${Kl(r)}${t.slice(f.close+1)}`}let T=t.slice(0,s.close).trimEnd(),R=t.slice(s.close),D=T.endsWith(",")||T.endsWith("{")?"":",";return`${T}${D}
         ${Kl(r)},
       ${R}`}let c=t.slice(0,o).trimEnd(),u=t.slice(o),a=c.endsWith(",")||c.endsWith("{")?"":",";return`${c}${a}
@@ -437,7 +437,7 @@ export type ConfigOf = Config
       },
     ${u}`}class Ql{client;region;constructor(e="us-east-1"){this.region=e,this.client=new p}async getTraceSummaries(e){let t={StartTime:Math.floor(e.startTime.getTime()/1000),EndTime:Math.floor(e.endTime.getTime()/1000),TimeRangeType:"Event",Sampling:!1};if(e.filterExpression)t.FilterExpression=e.filterExpression;if(e.nextToken)t.NextToken=e.nextToken;let r=await this.client.request({service:"xray",region:this.region,method:"POST",path:"/TraceSummaries",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)});return{summaries:r?.TraceSummaries??[],nextToken:r?.NextToken}}async batchGetTraces(e){if(!e.length)return[];return(await this.client.request({service:"xray",region:this.region,method:"POST",path:"/Traces",headers:{"Content-Type":"application/json"},body:JSON.stringify({TraceIds:e.slice(0,5)})}))?.Traces??[]}}var xy=65536;function Ur(e){return e.length<=xy?e:`${e.slice(0,xy)}
 
-[output truncated]`}function Xl(e,t){return e.environments?.[t]?.app}function Zl(e,t,r){let n=[],i=Xl(e,t);n.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),n.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let o=r.maintenance?.enabled;if(o!==!0)n.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(o!==!1)n.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(i?.assets||r.assetsInfo)n.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(i?.database?.connection==="aurora-serverless")n.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(i.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(i.database.maxCapacity??4)}]});for(let s of r.queues??[]){let c=String(s?.name??"").trim();if(c&&/^[A-Za-z0-9_-]+$/.test(c))n.push({id:`queue:purge:${c}`,label:`Purge queue (${c})`,group:"queue",target:c,mutates:!0,confirm:c,danger:!0})}return n}function Dy(e,t,r,n){return Zl(t,r,n).find((i)=>i.id===e)}async function ET(e,t,r){try{let n=new v(r),{Stacks:i}=await n.describeStacks({stackName:xe(e,t)}),o={};for(let u of i?.[0]?.Outputs??[])if(u.OutputKey)o[u.OutputKey]=u.OutputValue??"";let s=o.AssetsCdnDomain;if(!s)return null;return(await new E(r).findDistributionByDomain(s))?.Id??null}catch{return null}}async function Oy(e,t,r,n={}){try{if(r.id==="redeploy")return await Os(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await $s(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await Po(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await Po(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let i=Number(n.min),o=Number(n.max);if(!Number.isFinite(i)||!Number.isFinite(o)||i<=0||o<i)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await Ls(e,t,i,o),{operation:r.id,command:`db:scale ${i}-${o} ACU`,ok:!0,stdout:`Scaling applied (${i}-${o} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let i=await z(e,t),o=await ET(e,t,i.region);if(!o)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let c=await new E(i.region).invalidateAll(o);return{operation:r.id,command:`cloudfront invalidate ${o} /*`,ok:!0,stdout:`Invalidation ${c?.Id??"created"} for ${o} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let i=r.target,o=await z(e,t),s=new V(o.region),c=`${o.slug}-${t}-${i}`,{QueueUrl:u}=await s.getQueueUrl(c);return await s.purgeQueue(u),{operation:r.id,command:`sqs purge ${c}`,ok:!0,stdout:`Purged queue ${c}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(i){return{operation:r.id,ok:!1,error:Ur(i?.message??String(i))}}}async function _y(e,t,r){let n=r.trim();if(!n)return{operation:"command",ok:!1,error:"A command is required."};try{let i=await Bt(e,t,n);return{operation:"command",command:n,ok:!0,stdout:Ur(i||"(no output)")}}catch(i){return{operation:"command",command:n,ok:!1,error:Ur(i?.message??String(i))}}}var ep="No dead-letter queue is provisioned for this environment.";async function tp(e,t,r){try{let{QueueUrl:n}=await e.getQueueUrl(`${t}-${r}-dlq`);return n}catch{return null}}async function Ny(e,t,r=10){try{let n=await z(e,t),i=new V(n.region),o=await tp(i,n.slug,t);if(!o)return{ok:!1,messages:[],error:ep};return{ok:!0,messages:((await i.receiveMessages({queueUrl:o,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((u)=>({id:u.MessageId,receiptHandle:u.ReceiptHandle,body:Ur(String(u.Body??""))}))}}catch(n){return{ok:!1,messages:[],error:Ur(n?.message??String(n))}}}async function My(e,t,r={}){try{let n=await z(e,t),i=Xl(e,t),s=(i?Jt(i,n.slug,t):[]).map((D)=>D.name.replace(`${n.slug}-${t}-`,"")),c=r.targetQueue&&s.includes(r.targetQueue)?r.targetQueue:s[0];if(!c)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let u=new V(n.region),a=await tp(u,n.slug,t);if(!a)return{operation:"dlq:redrive",ok:!1,error:ep};let{QueueUrl:f}=await u.getQueueUrl(`${n.slug}-${t}-${c}`),T=Math.min(50,Math.max(1,r.max??10)),R=0;while(R<T){let W=(await u.receiveMessages({queueUrl:a,maxMessages:Math.min(10,T-R),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!W.length)break;for(let Y of W)await u.sendMessage({queueUrl:f,messageBody:String(Y.Body??"")}),await u.deleteMessage(a,Y.ReceiptHandle),R++}return{operation:"dlq:redrive",command:`redrive → ${c}`,ok:!0,stdout:`Moved ${R} message(s) from the DLQ to ${c}.`}}catch(n){return{operation:"dlq:redrive",ok:!1,error:Ur(n?.message??String(n))}}}async function $y(e,t){try{let r=await z(e,t),n=new V(r.region),i=await tp(n,r.slug,t);if(!i)return{operation:"dlq:purge",ok:!1,error:ep};return await n.purgeQueue(i),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:Ur(r?.message??String(r))}}}function Ly(e,t){let r=Xl(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((n)=>({key:n.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:n})):Object.entries(r.secrets).map(([n,i])=>({key:n,secretId:String(i)}))}async function By(e,t,r,n){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let i=await z(e,t),o=new K(i.region);try{await o.putSecretValue({SecretId:r,SecretString:n})}catch{await o.createSecret({Name:r,SecretString:n})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(i){return{operation:"secret:set",ok:!1,error:Ur(i?.message??String(i))}}}async function Fy(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let n=await z(e,t);return await new K(n.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(n){return{operation:"secret:delete",ok:!1,error:Ur(n?.message??String(n))}}}var TT=new Set(["http","queue","cli"]);async function jy(e,t,r,n){if(!TT.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let i=n.memory==null?void 0:Number(n.memory),o=n.timeout==null?void 0:Number(n.timeout);if(i!=null&&(!Number.isInteger(i)||i<128||i>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(o!=null&&(!Number.isInteger(o)||o<1||o>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(i==null&&o==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let s=await z(e,t),c=new I(s.region),u=`${s.slug}-${t}-${r}`;await c.updateFunctionConfiguration({FunctionName:u,...i!=null?{MemorySize:i}:{},...o!=null?{Timeout:o}:{}});let a=[i!=null?`${i} MB`:"",o!=null?`${o}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${u} (${a})`,ok:!0,stdout:`Updated ${u}: ${a}.`}}catch(s){return{operation:"function:config",ok:!1,error:Ur(s?.message??String(s))}}}var Yl=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function AT(e){return Yl.find((t)=>t.key===e)}async function Uy(e,t){try{let r=await z(e,t);return{ok:!0,alarms:await new G(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:Yl}}catch(r){return{ok:!1,alarms:[],presets:Yl,error:Ur(r?.message??String(r))}}}async function zy(e,t,r,n){let i=AT(r);if(!i)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(n)||n<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let o=await z(e,t),s=new G(o.region),c=`${o.slug}-${t}-${i.key}`,u=i.fnMode?[{Name:"FunctionName",Value:`${o.slug}-${t}-${i.fnMode}`}]:[];return await s.putMetricAlarm({AlarmName:c,Namespace:i.namespace,MetricName:i.metricName,ComparisonOperator:i.comparison,Threshold:n,EvaluationPeriods:1,Period:300,Statistic:i.statistic,Dimensions:u,AlarmDescription:`ts-cloud: ${i.label} > ${n} ${i.unit}`}),{operation:"alarm:create",command:`alarm ${c}`,ok:!0,stdout:`Alarm ${c} armed at ${n} ${i.unit}.`}}catch(o){return{operation:"alarm:create",ok:!1,error:Ur(o?.message??String(o))}}}async function Vy(e,t,r){try{let n=await z(e,t);if(!r.startsWith(`${n.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new G(n.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(n){return{operation:"alarm:delete",ok:!1,error:Ur(n?.message??String(n))}}}function kT(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function Cd(e,t,r=30){try{let n=await z(e,t),i=new Ql(n.region),o=new Date,s=new Date(o.getTime()-Math.min(360,Math.max(1,r))*60000),c=`${n.slug}-${t}-http`,u=await i.getTraceSummaries({startTime:s,endTime:o,filterExpression:`service("${c}")`});if(!u.summaries.length)u=await i.getTraceSummaries({startTime:s,endTime:o});return{ok:!0,traces:u.summaries.slice(0,100).map(kT)}}catch(n){return{ok:!1,traces:[],error:Ur(n?.message??String(n))}}}async function rp(e,t,r){try{let n=await z(e,t),i=`${n.slug}-${t}-scheduler`;if(r==="run"){let s=await Bt(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:Ur(s||"Scheduler run triggered.")}}let o=new be(n.region);if(r==="enable")await o.enableRule({Name:i});else await o.disableRule({Name:i});return{operation:`scheduler:${r}`,command:`${r} ${i}`,ok:!0,stdout:`Scheduler rule ${i} ${r}d.`}}catch(n){return{operation:`scheduler:${r}`,ok:!1,error:Ur(n?.message??String(n))}}}function kn(e){let t=Ed(e.name),r=ip(e.configText);if(xT(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let n=PT({...e,name:t}),i=e.configText.slice(0,r.end).trimEnd(),o=e.configText.slice(r.end),s=i.endsWith("{")?`
+[output truncated]`}function Xl(e,t){return e.environments?.[t]?.app}function Zl(e,t,r){let n=[],i=Xl(e,t);n.push({id:"redeploy",label:"Redeploy current build",group:"deploy",target:"app",mutates:!0,confirm:"redeploy"}),n.push({id:"rollback",label:"Roll back to previous build",group:"deploy",target:"app",mutates:!0,confirm:"rollback",danger:!0});let o=r.maintenance?.enabled;if(o!==!0)n.push({id:"maintenance:on",label:"Enable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"maintenance",danger:!0});if(o!==!1)n.push({id:"maintenance:off",label:"Disable maintenance mode",group:"maintenance",target:"app",mutates:!0,confirm:"live"});if(i?.assets||r.assetsInfo)n.push({id:"assets:invalidate",label:"Invalidate CDN cache",group:"assets",target:"assets",mutates:!0,confirm:"invalidate"});if(i?.database?.connection==="aurora-serverless")n.push({id:"db:scale",label:"Scale Aurora capacity",group:"database",target:"database",mutates:!0,confirm:"scale",inputs:[{name:"min",label:"Min ACUs",placeholder:String(i.database.minCapacity??0.5)},{name:"max",label:"Max ACUs",placeholder:String(i.database.maxCapacity??4)}]});for(let s of r.queues??[]){let c=String(s?.name??"").trim();if(c&&/^[A-Za-z0-9_-]+$/.test(c))n.push({id:`queue:purge:${c}`,label:`Purge queue (${c})`,group:"queue",target:c,mutates:!0,confirm:c,danger:!0})}return n}function Dy(e,t,r,n){return Zl(t,r,n).find((i)=>i.id===e)}async function ET(e,t,r){try{let n=new v(r),{Stacks:i}=await n.describeStacks({stackName:xe(e,t)}),o={};for(let u of i?.[0]?.Outputs??[])if(u.OutputKey)o[u.OutputKey]=u.OutputValue??"";let s=o.AssetsCdnDomain;if(!s)return null;return(await new E(r).findDistributionByDomain(s))?.Id??null}catch{return null}}async function Oy(e,t,r,n={}){try{if(r.id==="redeploy")return await Os(e,t),{operation:r.id,command:"serverless redeploy",ok:!0,stdout:"Redeploy complete."};if(r.id==="rollback")return await $s(e,t),{operation:r.id,command:"serverless rollback",ok:!0,stdout:"Rollback complete."};if(r.id==="maintenance:on")return await Po(e,t,!0),{operation:r.id,command:"maintenance on",ok:!0,stdout:"Application is now in maintenance mode."};if(r.id==="maintenance:off")return await Po(e,t,!1),{operation:r.id,command:"maintenance off",ok:!0,stdout:"Application is live."};if(r.id==="db:scale"){let i=Number(n.min),o=Number(n.max);if(!Number.isFinite(i)||!Number.isFinite(o)||i<=0||o<i)return{operation:r.id,ok:!1,error:"Provide valid Aurora capacities (0 < min ≤ max)."};return await Ls(e,t,i,o),{operation:r.id,command:`db:scale ${i}-${o} ACU`,ok:!0,stdout:`Scaling applied (${i}-${o} ACUs); takes effect shortly.`}}if(r.id==="assets:invalidate"){let i=await z(e,t),o=await ET(e,t,i.region);if(!o)return{operation:r.id,ok:!1,error:"Could not resolve the asset CloudFront distribution for this environment."};let c=await new E(i.region).invalidateAll(o);return{operation:r.id,command:`cloudfront invalidate ${o} /*`,ok:!0,stdout:`Invalidation ${c?.Id??"created"} for ${o} (/*).`}}if(r.group==="queue"&&r.id.startsWith("queue:purge:")){let i=r.target,o=await z(e,t),s=new V(o.region),c=`${o.slug}-${t}-${i}`,{QueueUrl:u}=await s.getQueueUrl(c);return await s.purgeQueue(u),{operation:r.id,command:`sqs purge ${c}`,ok:!0,stdout:`Purged queue ${c}.`}}return{operation:r.id,ok:!1,error:"Unknown or unavailable serverless operation."}}catch(i){return{operation:r.id,ok:!1,error:Ur(i?.message??String(i))}}}async function _y(e,t,r){let n=r.trim();if(!n)return{operation:"command",ok:!1,error:"A command is required."};try{let i=await Bt(e,t,n);return{operation:"command",command:n,ok:!0,stdout:Ur(i||"(no output)")}}catch(i){return{operation:"command",command:n,ok:!1,error:Ur(i?.message??String(i))}}}var ep="No dead-letter queue is provisioned for this environment.";async function tp(e,t,r){try{let{QueueUrl:n}=await e.getQueueUrl(`${t}-${r}-dlq`);return n}catch{return null}}async function Ny(e,t,r=10){try{let n=await z(e,t),i=new V(n.region),o=await tp(i,n.slug,t);if(!o)return{ok:!1,messages:[],error:ep};return{ok:!0,messages:((await i.receiveMessages({queueUrl:o,maxMessages:Math.min(10,Math.max(1,r)),waitTimeSeconds:1,visibilityTimeout:2})).Messages??[]).map((u)=>({id:u.MessageId,receiptHandle:u.ReceiptHandle,body:Ur(String(u.Body??""))}))}}catch(n){return{ok:!1,messages:[],error:Ur(n?.message??String(n))}}}async function My(e,t,r={}){try{let n=await z(e,t),i=Xl(e,t),s=(i?Jt(i,n.slug,t):[]).map((D)=>D.name.replace(`${n.slug}-${t}-`,"")),c=r.targetQueue&&s.includes(r.targetQueue)?r.targetQueue:s[0];if(!c)return{operation:"dlq:redrive",ok:!1,error:"No source queue is configured to redrive into."};let u=new V(n.region),a=await tp(u,n.slug,t);if(!a)return{operation:"dlq:redrive",ok:!1,error:ep};let{QueueUrl:f}=await u.getQueueUrl(`${n.slug}-${t}-${c}`),T=Math.min(50,Math.max(1,r.max??10)),R=0;while(R<T){let W=(await u.receiveMessages({queueUrl:a,maxMessages:Math.min(10,T-R),waitTimeSeconds:1,visibilityTimeout:30})).Messages??[];if(!W.length)break;for(let Y of W)await u.sendMessage({queueUrl:f,messageBody:String(Y.Body??"")}),await u.deleteMessage(a,Y.ReceiptHandle),R++}return{operation:"dlq:redrive",command:`redrive → ${c}`,ok:!0,stdout:`Moved ${R} message(s) from the DLQ to ${c}.`}}catch(n){return{operation:"dlq:redrive",ok:!1,error:Ur(n?.message??String(n))}}}async function $y(e,t){try{let r=await z(e,t),n=new V(r.region),i=await tp(n,r.slug,t);if(!i)return{operation:"dlq:purge",ok:!1,error:ep};return await n.purgeQueue(i),{operation:"dlq:purge",command:"sqs purge dlq",ok:!0,stdout:"Dead-letter queue purged."}}catch(r){return{operation:"dlq:purge",ok:!1,error:Ur(r?.message??String(r))}}}function Ly(e,t){let r=Xl(e,t);if(!r?.secrets)return[];return Array.isArray(r.secrets)?r.secrets.map((n)=>({key:n.split("/").pop().toUpperCase().replace(/[^A-Z0-9_]/g,"_"),secretId:n})):Object.entries(r.secrets).map(([n,i])=>({key:n,secretId:String(i)}))}async function By(e,t,r,n){if(!r.trim())return{operation:"secret:set",ok:!1,error:"A secret id is required."};try{let i=await z(e,t),o=new K(i.region);try{await o.putSecretValue({SecretId:r,SecretString:n})}catch{await o.createSecret({Name:r,SecretString:n})}return{operation:"secret:set",command:`secret set ${r}`,ok:!0,stdout:`Secret ${r} updated. Redeploy to apply it to the functions.`}}catch(i){return{operation:"secret:set",ok:!1,error:Ur(i?.message??String(i))}}}async function Fy(e,t,r){if(!r.trim())return{operation:"secret:delete",ok:!1,error:"A secret id is required."};try{let n=await z(e,t);return await new K(n.region).deleteSecret({SecretId:r,RecoveryWindowInDays:7}),{operation:"secret:delete",command:`secret delete ${r}`,ok:!0,stdout:`Secret ${r} scheduled for deletion (recoverable for 7 days).`}}catch(n){return{operation:"secret:delete",ok:!1,error:Ur(n?.message??String(n))}}}var TT=new Set(["http","queue","cli"]);async function jy(e,t,r,n){if(!TT.has(r))return{operation:"function:config",ok:!1,error:`Unknown function mode '${r}'.`};let i=n.memory==null?void 0:Number(n.memory),o=n.timeout==null?void 0:Number(n.timeout);if(i!=null&&(!Number.isInteger(i)||i<128||i>10240))return{operation:"function:config",ok:!1,error:"Memory must be an integer between 128 and 10240 MB."};if(o!=null&&(!Number.isInteger(o)||o<1||o>900))return{operation:"function:config",ok:!1,error:"Timeout must be an integer between 1 and 900 seconds."};if(i==null&&o==null)return{operation:"function:config",ok:!1,error:"Provide a memory and/or timeout value."};try{let s=await z(e,t),c=new P(s.region),u=`${s.slug}-${t}-${r}`;await c.updateFunctionConfiguration({FunctionName:u,...i!=null?{MemorySize:i}:{},...o!=null?{Timeout:o}:{}});let a=[i!=null?`${i} MB`:"",o!=null?`${o}s`:""].filter(Boolean).join(", ");return{operation:"function:config",command:`update ${u} (${a})`,ok:!0,stdout:`Updated ${u}: ${a}.`}}catch(s){return{operation:"function:config",ok:!1,error:Ur(s?.message??String(s))}}}var Yl=[{key:"http-errors",label:"HTTP function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"errors / 5 min"},{key:"http-throttles",label:"HTTP function throttles",namespace:"AWS/Lambda",metricName:"Throttles",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"throttles / 5 min"},{key:"http-duration",label:"HTTP function duration (avg)",namespace:"AWS/Lambda",metricName:"Duration",statistic:"Average",comparison:"GreaterThanThreshold",fnMode:"http",unit:"ms"},{key:"http-concurrency",label:"HTTP concurrent executions",namespace:"AWS/Lambda",metricName:"ConcurrentExecutions",statistic:"Maximum",comparison:"GreaterThanThreshold",fnMode:"http",unit:"concurrent"},{key:"queue-errors",label:"Queue function errors",namespace:"AWS/Lambda",metricName:"Errors",statistic:"Sum",comparison:"GreaterThanThreshold",fnMode:"queue",unit:"errors / 5 min"}];function AT(e){return Yl.find((t)=>t.key===e)}async function Uy(e,t){try{let r=await z(e,t);return{ok:!0,alarms:await new G(r.region).describeAlarms({AlarmNamePrefix:`${r.slug}-${t}-`,MaxRecords:100}),presets:Yl}}catch(r){return{ok:!1,alarms:[],presets:Yl,error:Ur(r?.message??String(r))}}}async function zy(e,t,r,n){let i=AT(r);if(!i)return{operation:"alarm:create",ok:!1,error:`Unknown alarm metric '${r}'.`};if(!Number.isFinite(n)||n<0)return{operation:"alarm:create",ok:!1,error:"Provide a non-negative threshold."};try{let o=await z(e,t),s=new G(o.region),c=`${o.slug}-${t}-${i.key}`,u=i.fnMode?[{Name:"FunctionName",Value:`${o.slug}-${t}-${i.fnMode}`}]:[];return await s.putMetricAlarm({AlarmName:c,Namespace:i.namespace,MetricName:i.metricName,ComparisonOperator:i.comparison,Threshold:n,EvaluationPeriods:1,Period:300,Statistic:i.statistic,Dimensions:u,AlarmDescription:`ts-cloud: ${i.label} > ${n} ${i.unit}`}),{operation:"alarm:create",command:`alarm ${c}`,ok:!0,stdout:`Alarm ${c} armed at ${n} ${i.unit}.`}}catch(o){return{operation:"alarm:create",ok:!1,error:Ur(o?.message??String(o))}}}async function Vy(e,t,r){try{let n=await z(e,t);if(!r.startsWith(`${n.slug}-${t}-`))return{operation:"alarm:delete",ok:!1,error:"Refusing to delete an alarm outside this environment."};return await new G(n.region).deleteAlarms([r]),{operation:"alarm:delete",command:`delete alarm ${r}`,ok:!0,stdout:`Alarm ${r} deleted.`}}catch(n){return{operation:"alarm:delete",ok:!1,error:Ur(n?.message??String(n))}}}function kT(e){let t=e.HasFault?"fault":e.HasError?"error":e.HasThrottle?"throttle":"ok";return{id:String(e.Id??""),timestamp:Number.isFinite(Number(e.StartTime))?new Date(Number(e.StartTime)*1000).toISOString():void 0,durationMs:Math.round((e.Duration??0)*1000),responseMs:Math.round((e.ResponseTime??0)*1000),status:t,method:e.Http?.HttpMethod??"-",url:e.Http?.HttpURL??"-",httpStatus:e.Http?.HttpStatus??0}}async function Cd(e,t,r=30){try{let n=await z(e,t),i=new Ql(n.region),o=new Date,s=new Date(o.getTime()-Math.min(360,Math.max(1,r))*60000),c=`${n.slug}-${t}-http`,u=await i.getTraceSummaries({startTime:s,endTime:o,filterExpression:`service("${c}")`});if(!u.summaries.length)u=await i.getTraceSummaries({startTime:s,endTime:o});return{ok:!0,traces:u.summaries.slice(0,100).map(kT)}}catch(n){return{ok:!1,traces:[],error:Ur(n?.message??String(n))}}}async function rp(e,t,r){try{let n=await z(e,t),i=`${n.slug}-${t}-scheduler`;if(r==="run"){let s=await Bt(e,t,"schedule:run");return{operation:"scheduler:run",command:"schedule:run",ok:!0,stdout:Ur(s||"Scheduler run triggered.")}}let o=new be(n.region);if(r==="enable")await o.enableRule({Name:i});else await o.disableRule({Name:i});return{operation:`scheduler:${r}`,command:`${r} ${i}`,ok:!0,stdout:`Scheduler rule ${i} ${r}d.`}}catch(n){return{operation:`scheduler:${r}`,ok:!1,error:Ur(n?.message??String(n))}}}function kn(e){let t=Ed(e.name),r=ip(e.configText);if(xT(e.configText,r.start,r.end,t))throw Error(`Site '${t}' already exists in cloud.config.ts`);let n=PT({...e,name:t}),i=e.configText.slice(0,r.end).trimEnd(),o=e.configText.slice(r.end),s=i.endsWith("{")?`
 `:i.endsWith(",")?`
 
 `:`,