@stacksjs/ts-cloud 0.16.50 → 0.16.52

package/dist/bin/{chunk-7jj0g6jk.js → chunk-0e9yddgc.js}

@@ -1,4 +1,4 @@
-import{aa,je,A,H,w,B,Oe,Qt}from"./chunk-k9f94hg4.js";import{ce,bn,re,Sn,h,Lr,oa}from"./chunk-kmpvqby6.js";import{Ue,S,ys,br,hi,yi,an,Tc,Mt,cn,ft,Qe,Fe,Ye,Ec,yt,Sr,Be,Ze,bi,Si,so,ao,et,ln,Tr,bt,m,ho,Ns,xs}from"./chunk-7cs9nnjy.js";import{qt,p}from"./chunk-z06jkvvr.js";import{v}from"./chunk-hhmqsrfc.js";import{g}from"./chunk-dv2he3vc.js";import{J,I,U,Dr,Oo,kr,gn}from"./chunk-hdqxyxs0.js";import{We,mr,eo,O,on,fc,hc,$t,pi,mi}from"./chunk-mdkd46c5.js";import{Ro}from"./chunk-9ehb4hc6.js";import{fe}from"./chunk-0wtshht7.js";import{Hs,qs}from"./chunk-e7pce8jb.js";import{Nr,wt,xr,_r,Or,$r,yn}from"./chunk-tcj1z34y.js";import{se,G,li}from"./chunk-f2t67d76.js";import{E}from"./chunk-da6dmacg.js";import{V}from"./chunk-yfa84s0c.js";import{P}from"./chunk-5ny7rggt.js";import{K,Ms,Us,ko,Vt,z,Fs}from"./chunk-j2wkxp7d.js";import{hs}from"./chunk-gr1ra9nj.js";import{sn}from"./chunk-ytzcsskk.js";import{_,N,na}from"./chunk-811k54jq.js";import{createCipheriv as $b,createDecipheriv as Lb,createHash as $p,randomBytes as Ui}from"node:crypto";import{createHmac as Nb,timingSafeEqual as Mb}from"node:crypto";var $d="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Ha(e){let t=0,r=0,n="";for(let i of e){r=r<<8|i,t+=8;while(t>=5)n+=$d[r>>>t-5&31],t-=5}if(t>0)n+=$d[r<<5-t&31];return n}function xp(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,n=0,i=[];for(let o of t){let s=$d.indexOf(o);if(s<0)throw Error("Invalid base32 secret");if(n=n<<5|s,r+=5,r>=8)i.push(n>>>r-8&255),r-=8}return Buffer.from(i)}function Dp(e,t,r=6){let n=Buffer.alloc(8);n.writeBigUInt64BE(BigInt(t));let i=Nb("sha1",xp(e)).update(n).digest(),o=i[i.length-1]&15,s=(i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255;return String(s%10**r).padStart(r,"0")}function Wa(e,t,r=Date.now(),n=1){let i=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(i))return;let o=Buffer.from(i),s=Math.floor(r/1000/30);for(let c=-n;c<=n;c++){if(s+c<0)continue;let u=Buffer.from(Dp(e,s+c));if(o.length===u.length&&Mb(o,u))return s+c}return}function Ld(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var Lp=1800000,So=43200000,Bp=3600000,Fp=300000,jp=600000;function hn(e){return typeof e==="string"?e:void 0}function Up(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function Bb(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function Bd(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function Fb(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function jb(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function Ub(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function zb(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function ui(e){return $p("sha256").update(e).digest("hex")}function pa(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:hn(e.email),emailVerifiedAt:hn(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:hn(e.disabled_at),lastLoginAt:hn(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Op(e,t){let r=hn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Up(e.metadata),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Fd(e,t){let r=hn(e.revoked_at),n=String(e.idle_expires_at),i=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:hn(e.user_agent),networkHint:hn(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:n,absoluteExpiresAt:i,recentAuthAt:String(e.recent_auth_at),mfaAt:hn(e.mfa_at),revokedAt:r,state:r?"revoked":n<=t||i<=t?"expired":"active"}}function _p(e){let t=hn(e.verified_at),r=hn(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function jd(e,t){let r=hn(e.consumed_at),n=String(e.expires_at),i=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:i,expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":i>=5?"locked":n<=t?"expired":"pending"}}function Np(e){let t=Up(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Ka(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Np(e.scopes),allowedDomains:Np(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Mp(e,t){let r=hn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Vb(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Le{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?$p("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=Ui(12),r=$b("aes-256-gcm",this.encryptionKey,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted authentication value is unavailable");let o=Lb("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=Bb(e.username),r=Bd(e.email),n=e.id??this.idFn(),i=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
+import{aa,je,A,H,w,B,Oe,Qt}from"./chunk-45thdtvf.js";import{ce,bn,re,Sn,h,Lr,oa}from"./chunk-wv8060cw.js";import{Ue,S,ys,br,hi,yi,an,Tc,Mt,cn,ft,Qe,Fe,Ye,Ec,yt,Sr,Be,Ze,bi,Si,so,ao,et,ln,Tr,bt,m,ho,Ns,xs}from"./chunk-5c4xh61a.js";import{qt,p}from"./chunk-z06jkvvr.js";import{v}from"./chunk-hhmqsrfc.js";import{g}from"./chunk-dv2he3vc.js";import{J,I,U,Dr,Oo,kr,gn}from"./chunk-cjagqdk3.js";import{We,mr,eo,O,on,fc,hc,$t,pi,mi}from"./chunk-nxvtya6v.js";import{Ro}from"./chunk-n5kdne4p.js";import{fe}from"./chunk-0wtshht7.js";import{Hs,qs}from"./chunk-f78wmcvb.js";import{Nr,wt,xr,_r,Or,$r,yn}from"./chunk-ngmewar1.js";import{se,G,li}from"./chunk-ddyd6f14.js";import{E}from"./chunk-da6dmacg.js";import{V}from"./chunk-yfa84s0c.js";import{P}from"./chunk-5ny7rggt.js";import{K,Ms,Us,ko,Vt,z,Fs}from"./chunk-a7hhzbvm.js";import{hs}from"./chunk-gr1ra9nj.js";import{sn}from"./chunk-ytzcsskk.js";import{_,N,na}from"./chunk-811k54jq.js";import{createCipheriv as $b,createDecipheriv as Lb,createHash as $p,randomBytes as Ui}from"node:crypto";import{createHmac as Nb,timingSafeEqual as Mb}from"node:crypto";var $d="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Ha(e){let t=0,r=0,n="";for(let i of e){r=r<<8|i,t+=8;while(t>=5)n+=$d[r>>>t-5&31],t-=5}if(t>0)n+=$d[r<<5-t&31];return n}function xp(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,n=0,i=[];for(let o of t){let s=$d.indexOf(o);if(s<0)throw Error("Invalid base32 secret");if(n=n<<5|s,r+=5,r>=8)i.push(n>>>r-8&255),r-=8}return Buffer.from(i)}function Dp(e,t,r=6){let n=Buffer.alloc(8);n.writeBigUInt64BE(BigInt(t));let i=Nb("sha1",xp(e)).update(n).digest(),o=i[i.length-1]&15,s=(i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255;return String(s%10**r).padStart(r,"0")}function Wa(e,t,r=Date.now(),n=1){let i=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(i))return;let o=Buffer.from(i),s=Math.floor(r/1000/30);for(let c=-n;c<=n;c++){if(s+c<0)continue;let u=Buffer.from(Dp(e,s+c));if(o.length===u.length&&Mb(o,u))return s+c}return}function Ld(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var Lp=1800000,So=43200000,Bp=3600000,Fp=300000,jp=600000;function hn(e){return typeof e==="string"?e:void 0}function Up(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function Bb(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function Bd(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function Fb(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function jb(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function Ub(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function zb(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function ui(e){return $p("sha256").update(e).digest("hex")}function pa(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:hn(e.email),emailVerifiedAt:hn(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:hn(e.disabled_at),lastLoginAt:hn(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Op(e,t){let r=hn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Up(e.metadata),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Fd(e,t){let r=hn(e.revoked_at),n=String(e.idle_expires_at),i=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:hn(e.user_agent),networkHint:hn(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:n,absoluteExpiresAt:i,recentAuthAt:String(e.recent_auth_at),mfaAt:hn(e.mfa_at),revokedAt:r,state:r?"revoked":n<=t||i<=t?"expired":"active"}}function _p(e){let t=hn(e.verified_at),r=hn(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function jd(e,t){let r=hn(e.consumed_at),n=String(e.expires_at),i=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:i,expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":i>=5?"locked":n<=t?"expired":"pending"}}function Np(e){let t=Up(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Ka(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Np(e.scopes),allowedDomains:Np(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Mp(e,t){let r=hn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Vb(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Le{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?$p("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=Ui(12),r=$b("aes-256-gcm",this.encryptionKey,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted authentication value is unavailable");let o=Lb("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=Bb(e.username),r=Bd(e.email),n=e.id??this.idFn(),i=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[n,e.actorId,t,r??null,e.emailVerified&&r?i:null,e.passwordHash,e.requiresPasswordUpgrade?1:0,i,i]),this.getIdentity(n)}getIdentity(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE id = ?").get(e);return t?pa(t):void 0}getIdentityByActor(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE actor_id = ?").get(e);return t?pa(t):void 0}getIdentityByUsername(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE username = ? COLLATE NOCASE").get(e.trim());return t?pa(t):void 0}getIdentityByEmail(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE email = ? COLLATE NOCASE").get(e.trim().toLowerCase());return t?pa(t):void 0}listIdentities(){return this.controlPlane.database.query("SELECT * FROM auth_identities ORDER BY username COLLATE NOCASE").all().map(pa)}updatePassword(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let i=this.now();return this.controlPlane.transaction(()=>{if(this.run(`UPDATE auth_identities SET password_hash = ?, credential_version = credential_version + 1,
         requires_password_upgrade = ?, updated_at = ? WHERE id = ?`,[t,r.requiresUpgrade?1:0,i,e]),r.revokeSessions!==!1)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[i,e])}),this.getIdentity(e)}rehashPassword(e,t){let r=this.now();this.run("UPDATE auth_identities SET password_hash = ?, requires_password_upgrade = 0, updated_at = ? WHERE id = ?",[t,r,e]);let n=this.getIdentity(e);if(!n)throw Error("Authentication identity was not found");return n}setVerifiedEmail(e,t){let r=Bd(t),n=this.now();this.run("UPDATE auth_identities SET email = ?, email_verified_at = ?, updated_at = ? WHERE id = ?",[r,n,n,e]);let i=this.getIdentity(e);if(!i)throw Error("Authentication identity was not found");return i}recordLogin(e){let t=this.now();this.run("UPDATE auth_identities SET last_login_at = ?, updated_at = ? WHERE id = ?",[t,t,e]);let r=this.getIdentity(e);if(!r)throw Error("Authentication identity was not found");return r}setDisabled(e,t){let r=this.now();this.controlPlane.transaction(()=>{if(this.run("UPDATE auth_identities SET disabled_at = ?, credential_version = credential_version + 1, updated_at = ? WHERE id = ?",[t?r:null,r,e]),t)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[r,e])});let n=this.getIdentity(e);if(!n)throw Error("Authentication identity was not found");return n}createActionToken(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let n=Ui(32).toString("base64url"),i=this.idFn(),o=this.now(),s=new Date(this.nowFn().getTime()+Math.min(86400000,Math.max(60000,r.ttlMs??Bp))).toISOString();return this.run("INSERT INTO auth_action_tokens (id, identity_id, type, token_hash, metadata, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[i,e,t,ui(n),JSON.stringify(r.metadata??{}),s,o]),{actionToken:this.getActionToken(i),token:n}}getActionToken(e){let t=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE id = ?").get(e);return t?Op(t,this.now()):void 0}consumeActionToken(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE token_hash = ? AND type = ?").get(ui(e),t);if(!r)throw Error("Action token is invalid");let n=Op(r,this.now());if(n.state!=="pending")throw Error(`Action token is ${n.state}`);if(this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),n.id,this.now()]).changes!==1)throw Error("Action token is no longer available");return this.getActionToken(n.id)})}revokeActionTokens(e,t){return this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE identity_id = ? AND type = ? AND consumed_at IS NULL",[this.now(),e,t]).changes}createSession(e){let t=this.getIdentity(e.identityId);if(!t||t.disabledAt)throw Error("Authentication identity is unavailable");let r=this.idFn(),n=Ui(32).toString("base64url"),i=`v2.${r}.${n}`,o=this.now(),s=Math.min(86400000,Math.max(60000,e.idleTtlMs??Lp)),c=Math.min(2592000000,Math.max(s,e.absoluteTtlMs??So));return this.run(`INSERT INTO auth_sessions (id, identity_id, token_hash, credential_version, auth_method, user_agent, network_hint,
       created_at, last_used_at, idle_expires_at, absolute_expires_at, recent_auth_at, mfa_at)
@@ -474,7 +474,7 @@ data: ${JSON.stringify({cursor:o,at:new Date().toISOString()})}
 ${c}
 ${u}`);return null}return n}catch(i){if(n)gs(n,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${i.message}`);return null}}function fA(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:$t(da(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,n])=>[r,{domain:n.domain,path:n.path,type:n.type,deploy:n.deploy,root:n.root,port:n.port,ssl:n.ssl}]))}}function wb(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function hA(e,t){return wb(t).find((r)=>r.id===e)}function gb(e){if(e.length<=db)return e;return`${e.slice(0,db)}
 
-[output truncated]`}async function mb(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:u}=await n.read();if(c)break;let a=i.decode(u,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function ap(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([mb(r.stdout,"stdout",t.onOutput),mb(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:gb(i),stderr:gb(o)}}finally{t.signal?.removeEventListener("abort",n)}}function yA(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var bA=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function SA(e){let t=Fa(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!bA.has(r)}var vA={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function fb(e,t){if(t.role==="admin")return!0;let r=Fa(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!SA(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=vA[n];return!!i&&!!t.capabilities?.includes(i)}function wA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=zT(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Et(e,i);if(uo(o)&&!Sb(o).isDirectory())return o;if(!Fa(o)&&uo(`${o}.html`))return`${o}.html`;if(!Fa(o)&&uo(Et(o,"index.html")))return Et(o,"index.html");return null}async function hb(e,t){let r=wA(e,t);if(!r){let o=Et(e,"404.html");if(uo(o))return new Response(await Li(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Rd("Not found",404)}if(Sb(r).isDirectory())return Rd("Not found",404);let n=await Li(r),i=YT[Fa(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var Ad=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],yb=new WeakMap;async function bb(e){let t=yb.get(e);if(t)return t;let r=await import("./chunk-f4mpkpbf.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return yb.set(e,i),i}async function dr(e={}){QT();let t=e.cwd??process.cwd(),r=e.host??HT,n=e.port??WT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await oA(t);let o=e.config??await Gi(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=w(o);if(s&&c&&!c.password)c.password=s;let u=o.infrastructure?.compute?.managedServices?.vitess;if(s&&u&&typeof u==="object"&&!u.password)u.password=s;let a=y(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let f=Object.keys(o.environments??{}),T=nA(o,e.environment),R=sA(t),D=await ps(o,T),W=new Map([[T,D]]),Y=new Map([[T,Date.now()]]),ee=new Map([[T,Date.now()]]),ne=new Map,he=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),te=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),Pe=H(o)!=="serverless",tt=(C)=>{let Te=W.get(C);if(Te&&!ub(Y.get(C),Date.now(),he))return Promise.resolve(Te);let De=ne.get(C);if(De)return De;let Ie=!Pe||ub(ee.get(C),Date.now(),te),Ve=ps(o,C,{includeSiteHealth:Ie}).then((gt)=>{let L=W.get(C),Pr=Ie?gt:pA(L,gt);if(W.set(C,Pr),Y.set(C,Date.now()),Ie)ee.set(C,Date.now());if(L?._serverReachable!==Pr._serverReachable||L?._metricsStatus!==Pr._metricsStatus||(L?.sitesDetail?.length??0)!==(Pr.sitesDetail?.length??0))di();return Pr}).finally(()=>ne.delete(C));return ne.set(C,Ve),Ve},$e=Ro(t),Gt=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Gt!=="0"&&(Gt==="1"||!o.cloud?.attachTo)){let C=!1,Te=Date.now()+300000,De=async()=>{if(C)return;C=!0;try{let Ve=Date.now(),gt=Ve>=Te;if(gt)Te=Ve+300000;let L=a.environments.get(T);await ci({controlPlane:a.store,projectId:a.project.id,environmentId:L?.id,config:o,environment:T,force:!0,lightweight:!0,includeSiteHealth:gt})}catch(Ve){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ve instanceof Error?Ve.message:String(Ve)}`)}finally{C=!1}};De(),setInterval(()=>void De(),60000).unref?.()}let ke=new Map,He=new Map,Tt=new Set,Ti=0;function lo(C,Te){if(C.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`))return C;let De=a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),Ie=De?a.store.getMembershipForActor(a.organization.id,De.id):void 0;if(!Ie||Ie.status!=="active")return{...C,role:"member",sites:{},capabilities:[]};let Ve=a.store.listGrants(Ie.id),gt=a.store.resolveAuthorizationTarget(a.organization.id,Ie.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),L=Sn({membership:Ie,grants:Ve,target:gt});if(Ie.roleTemplate==="owner"||Ie.roleTemplate==="admin")return{...C,role:"admin",sites:{},organizationRole:Ie.roleTemplate,organizationSource:Ie.source,capabilities:L};let Pr=a.environments.get(Te),Wt={};for(let Ke of a.store.listResources(a.project.id,Pr?.id).filter((nt)=>nt.kind==="application")){let nt=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:Ke.id});if(!nt||!re({membership:Ie,grants:Ve,capability:"project:read",target:nt}).allowed)continue;Wt[Ke.slug]=re({membership:Ie,grants:Ve,capability:"config:write",target:nt}).allowed?"owner":"collaborator"}return{...C,role:"member",sites:Wt,organizationRole:Ie.roleTemplate,organizationSource:Ie.source,capabilities:L}}function di(){Ti+=1,ke.clear();for(let C of Tt)gs(C,{recursive:!0,force:!0});Tt.clear()}let Ai=(C,Te)=>`${Te}:${C.role==="admin"?"admin":`member:${Object.entries(C.sites).sort(([De],[Ie])=>De.localeCompare(Ie)).map(([De,Ie])=>`${De}=${Ie}`).join(",")}`}:${[...C.capabilities??[]].sort().join(",")}`;async function ki(C,Te){let De=lo(C,Te),Ie=Ai(De,Te),Ve=ke.get(Ie);if(Ve)return Ve;let gt=He.get(Ie);if(gt)return gt;let L=Ti,Pr=(async()=>{let Wt=W.get(Te)??await ps(o,Te);W.set(Te,Wt);let Ke={...Yl(Wt,{user:De,slug:o.project.slug}),viewer:{role:De.role,organizationRole:De.organizationRole,organizationSource:De.organizationSource,capabilities:De.capabilities??[]}},nt=await mA(t,Ke);if(nt&&L!==Ti)return gs(nt,{recursive:!0,force:!0}),$e?.uiRoot;if(nt)Tt.add(nt);let vr=nt??$e?.uiRoot;if(vr)ke.set(Ie,vr);return vr})();He.set(Ie,Pr);try{return await Pr}finally{He.delete(Ie)}}let Ri=await ki({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!Ri)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ge=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ee=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ee&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Re=!Ee,Pt=fy(t),Jt=Re?Sy(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,we=new Le(a.store,{encryptionKey:x(t)}),ut=new qe(a.store),rt=new Ot(a.store),ze=new ir(a.store,{encryptionKey:x(t)}),Rr=new Zn(a.store),ms=new ti(a.store,{cwd:t}),Pi=new ei(a.store,{encryptionKey:x(t)}),At=new S(a.store,{workerId:`dashboard:${process.pid}`}),Dt=new rr(a.store),Bi=new nr(a.store,x(t)),po=new Nr(a.store),ja=new Hr(Dt,At,Bi),go=o.project?.region??"us-east-1",dp=x(t),dn=new $r(po,{encryptionKey:dp,backends:[new wt(a.store,dp),new xr(new K(go),go),new _r(new We(go),go),new Or]});await yn(dn,a,o);let Pd=new fe(go),Ib={aws_rds:new Hn(new Jn(Pd)),aws_aurora:new qn(new Xn(Pd)),aws_elasticache:new Gn(new Qn(new oe(go))),server:new Wn(new at),container:new Kn(new at)},up=(C)=>Ib[C.provider],Kt=new si(a.store),Bo=new Yr(Kt,At),lp=new ai(Bi),Cb={managed_database:new Rl(Dt,Pd),logical_database:new Ol(Dt,Bi),volume:new Nl,files:new Dl(t),control_plane:new $l(a.store,t),infrastructure:new Bl(new xa(go))},Eb=(C)=>Cb[C.resourceKind],Tb=(C)=>C.provider==="aws_backup"?void 0:lp,xd=new ft(a.store),Dd=[new Mt,new cn(A(t,"volumes"))],Fi=new an(xd,Dd,At),ua=new xe(a.store),xi=new On(ua,[new st("aws"),new st("hetzner"),new st("ssh")],At),mo=new $n(a.store),pp=new Ln(mo,ua),Fo=new Mn(a.store),gp=new Un(Fo,At),ji=new Bn(a.store),Od=new jn(ji,At),mp=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((C)=>new Vn(C,a.store,a.project.id,a.organization.id)),hr=new Qr(a.store),fp=new oi(hr,{queue:At}),Ht=new Ye(a.store),fo=new Qe(a.store),Cn=new ct(a.store),Je=new yt(a.store,{encryptionKey:x(t)}),Ab=()=>bb(a.store);for(let C of a.environments.values())Xr(hr,o,{organization:a.organization,project:a.project,environment:C,resources:a.store.listResources(a.project.id,C.id)});let En=new Sr(Je,{emailImpl:async(C)=>{let{email:Te}=await import("./chunk-626npmtj.js");return Te.send(C)}}),hp=async(C)=>{let Te=ln(Je,a.project.id,C),De=[];for(let Ie of Te.filter((Ve)=>Ve.notify&&Ve.alert))De.push(...await En.deliverAll(En.enqueue(a.organization.id,Ie.alert,Ie.transition)));return De.push(...await En.deliverAll(En.enqueueRemindersAndEscalations(a.organization.id,Je.listAlerts(a.project.id,{environmentId:C,states:["firing"]})))),De.push(...await En.retryDue()),{evaluations:Te,deliveries:De}},_d=!1,kb=async()=>{if(_d)return;_d=!0;try{for(let C of a.environments.values())for(let Te of Je.listHealthChecks(a.project.id,C.id).filter((De)=>De.enabled)){let De=Je.listHealthResults(Te.id,1)[0];if(De&&Date.now()-new Date(De.checkedAt).getTime()<Te.intervalSeconds*1000)continue;let Ie=await new Be(Je).runAndEvaluate(Te);for(let Ve of Ie.evaluations.filter((gt)=>gt.notify&&gt.alert))await En.deliverAll(En.enqueue(a.organization.id,Ve.alert,Ve.transition))}}finally{_d=!1}},yp=setInterval(()=>{for(let C of a.environments.values())hp(C.id).catch((Te)=>console.error("ts-cloud alert evaluation failed:",Te))},60000);yp.unref?.();let bp=setInterval(()=>{kb().catch((C)=>console.error("ts-cloud health check evaluation failed:",C))},30000);bp.unref?.();let Sp=setInterval(()=>{try{fp.tick()}catch(C){console.error("ts-cloud scheduled job evaluation failed:",C)}},30000);Sp.unref?.();let vp=setInterval(()=>{try{Bo.enqueueDue(),Bo.enqueueRetention()}catch(C){console.error("ts-cloud backup policy evaluation failed:",C)}},30000);vp.unref?.(),Ht.cleanup();let wp=setInterval(()=>{try{Ht.cleanup()}catch(C){console.error("ts-cloud preview cleanup failed:",C)}},3600000);wp.unref?.();let Rb=e.queueWorker??!0,Pb=yA(),xb=async(C,Te)=>{let Ie=(C.environmentId?a.store.listEnvironments(C.projectId).find((Ve)=>Ve.id===C.environmentId):void 0)?.slug??String(T);if(Te.kind==="dashboard_operation"&&Te.operationId){let Ve=W.get(Ie)??D,gt=ri(Te.operationId,o,Ve);if(!gt||gt.danger||!["scheduler","backup","worker"].includes(gt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let L=await Kr(o,Ie,gt);return{ok:L.ok,stdout:L.stdout,stderr:L.stderr??L.error,retryable:/temporar|unavailable|timeout|network/i.test(L.stderr??L.error??""),output:{command:L.command??null,operation:L.operation}}}if(Te.kind==="serverless_scheduler"){let Ve=await op(o,Ie,"run");return{ok:Ve.ok,stdout:Ve.stdout,stderr:Ve.error,retryable:/temporar|unavailable|timeout|network/i.test(Ve.error??""),output:{command:Ve.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Te.kind}.`}},Ua=Rb?new ys(At,{...Ec({store:a.store,execute:async(C,Te)=>{let De=Te.operation.input&&typeof Te.operation.input==="object"&&!Array.isArray(Te.operation.input)?Te.operation.input:{},Ie=De.source&&typeof De.source==="object"?De.source:void 0,Ve=t,gt,L,Pr;try{if(Ie?.bindingId&&Ie?.connectionId&&Ie?.commitSha){let Ke=ze.getBinding(String(Ie.bindingId)),nt=ze.getConnection(String(Ie.connectionId));if(!Ke||!nt||Ke.connectionId!==nt.id)throw Error("Queued source binding is no longer available");let gr=(Ke.repositoryId?ze.getRepository(Ke.repositoryId):ze.listRepositories(nt.id).find((Ss)=>Ss.fullName.toLowerCase()===Ke.repositoryFullName.toLowerCase()))?.cloneUrl;if(!gr&&nt.provider==="generic_ssh")gr=`git@${new URL(nt.host).hostname}:${Ke.repositoryFullName}.git`;if(!gr)gr=new URL(`/${Ke.repositoryFullName}.git`,nt.host.endsWith("/")?nt.host:`${nt.host}/`).href;let ye=Ke.deployKeyId?ze.getDeployKey(Ke.deployKeyId):void 0,Lt=ye&&Ke.deployKeyId?{...ye,privateKey:ze.getDeployPrivateKey(Ke.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(nt.provider)&&C.target.previewId){let Ss=Po(nt,ze.getCredential(nt.id)),ae=Ht.previews.getInstance(C.target.previewId);Pr=async(Tn,Ja)=>{try{await Ss.setCommitStatus(Ke.repositoryFullName,String(Ie.commitSha),{state:Tn,url:ae?.url,description:Ja})}catch(vs){Te.log(`Could not publish source status: ${vs instanceof Error?vs.message:String(vs)}`,{stream:"stderr"})}},await Pr("pending",`Preview deployment started for ${String(Ie.commitSha).slice(0,12)}`)}gt=cp(Et(kd(),"ts-cloud-queued-source-")),Te.log(`Checking out immutable source commit ${Ie.commitSha}.`,{stream:"system"}),Ve=(await nl({remote:gr,binding:Ke,destination:Et(gt,"checkout"),ref:String(Ie.branch??Ke.defaultBranch),commitSha:String(Ie.commitSha)},{credential:ze.getCredential(nt.id),deployKey:Lt})).directory}if(Te.operation.kind!=="preview.destroy"){let Ke=C.target.previewId?Ht.previews.getInstance(C.target.previewId):void 0,nt=Ke?Ht.previews.getDefinition(Ke.definitionId):void 0,vr=Te.operation.resourceId?a.store.getResource(Te.operation.resourceId):void 0;if(L=await dn.resolve({projectId:a.project.id,environmentId:Te.operation.environmentId,resourceId:Te.operation.resourceId,functionId:vr?.kind==="function"?vr.id:void 0,previewId:Ke?.id,trustedPreview:!!Ke&&!Ke.fork,allowedPreviewSecrets:nt?.inheritedSecrets}),L.warnings.some((gr)=>gr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${L.warnings.filter((gr)=>gr.code==="missing_required").map((gr)=>gr.key).join(", ")}`);if(Te.operation.resourceId)for(let gr of Object.values(L.entries))po.setDependency({entryId:gr.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:gr.required,requiresRedeploy:!0});Te.log(`Resolved configuration ${L.configurationHash.slice(0,18)} for ${Object.keys(L.values).length} keys.`,{stream:"system"})}let Wt=await ap(C,{cwd:Ve,cliEntry:i,signal:Te.signal,env:L?.values,onOutput:(Ke,nt)=>Te.log(nt,{stream:Ke,step:"execute",secrets:[...Pb,...Object.entries(L?.entries??{}).filter(([,vr])=>vr.kind==="secret").map(([vr])=>L.values[vr]).filter(Boolean)]})});if(Wt.ok&&Te.operation.resourceId&&L)for(let Ke of Object.values(L.entries))po.setDependency({entryId:Ke.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:Ke.required,requiresRedeploy:!1,lastDeployedVersion:Ke.version});return await Pr?.(Wt.ok?"success":"failure",Wt.ok?`Preview is ready at ${String(Ie?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Ie?.commitSha).slice(0,12)}`),Wt}catch(Wt){throw await Pr?.("error",`Preview deployment could not complete at ${String(Ie?.commitSha).slice(0,12)}`),Wt}finally{if(gt)gs(gt,{recursive:!0,force:!0})}}}),...Th({store:hr,executor:xb}),...uf({store:Dt,secrets:Bi,resolveAdapter:up}),...$m(ua,xi.drivers),...Vm(Fo,[new qu("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...rf({store:ji,cleanup:mp}),...Tc(xd,Dd),..._h({store:Kt,queue:At,resolveSource:Eb,resolveDestination:Tb,validateHealth:async(C,Te)=>{if(!C.healthCheckId)return{healthy:!0,mode:"adapter"};let De=Je.getHealthCheck(C.healthCheckId);if(!De||De.projectId!==C.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Ie=await new Be(Je).runAndEvaluate(De);return{healthy:Ie.result.status==="healthy",healthCheckId:De.id,healthResultId:Ie.result.id,target:Te}}}),...th({store:a.store,resolveDriver:e.releaseDriver??((C)=>({name:`${a.store.getResource(C.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:C.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(C,Te)=>{let De=Je.listHealthChecks(Te.projectId,Te.environmentId).find((Ve)=>Ve.enabled&&Ve.name===C&&(!Ve.resourceId||Ve.resourceId===Te.resourceId));if(!De)return{healthy:!1,message:`Named health gate ${C} was not found for this release.`};let Ie=await new Be(Je).runAndEvaluate(De);return{healthy:Ie.result.status==="healthy",evidence:{healthCheckId:De.id,healthResultId:Ie.result.id,status:Ie.result.status,timings:Ie.result.timings},message:Ie.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(C)=>console.error("ts-cloud deployment queue worker failed:",C)}):void 0;if(ni(a),rd(rt,ue(a,String(T)),D),Jt)Ya(a,Jt.users),Iy(we,a,Jt.users);let Ft=vy({cwd:t,enabled:Re,secret:Pt,authentication:we,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(T)}}),Yt=new Ul,Ip=setInterval(()=>Yt.sweep(),60000);Ip.unref?.();let za=new Ma,Nd=new Ma(3,900000,900000),Va=new Ma(8,900000,900000),Cp=setInterval(()=>za.prune(),300000),Ep=setInterval(()=>Nd.prune(),300000),Tp=setInterval(()=>Va.prune(),300000);if(Cp.unref?.(),Ep.unref?.(),Tp.unref?.(),Re){if(Jt?.generated)console.warn(`
+[output truncated]`}async function mb(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:u}=await n.read();if(c)break;let a=i.decode(u,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function ap(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([mb(r.stdout,"stdout",t.onOutput),mb(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:gb(i),stderr:gb(o)}}finally{t.signal?.removeEventListener("abort",n)}}function yA(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var bA=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function SA(e){let t=Fa(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!bA.has(r)}var vA={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function fb(e,t){if(t.role==="admin")return!0;let r=Fa(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!SA(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=vA[n];return!!i&&!!t.capabilities?.includes(i)}function wA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=zT(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Et(e,i);if(uo(o)&&!Sb(o).isDirectory())return o;if(!Fa(o)&&uo(`${o}.html`))return`${o}.html`;if(!Fa(o)&&uo(Et(o,"index.html")))return Et(o,"index.html");return null}async function hb(e,t){let r=wA(e,t);if(!r){let o=Et(e,"404.html");if(uo(o))return new Response(await Li(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return Rd("Not found",404)}if(Sb(r).isDirectory())return Rd("Not found",404);let n=await Li(r),i=YT[Fa(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var Ad=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],yb=new WeakMap;async function bb(e){let t=yb.get(e);if(t)return t;let r=await import("./chunk-vpt43nwa.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return yb.set(e,i),i}async function dr(e={}){QT();let t=e.cwd??process.cwd(),r=e.host??HT,n=e.port??WT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await oA(t);let o=e.config??await Gi(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=w(o);if(s&&c&&!c.password)c.password=s;let u=o.infrastructure?.compute?.managedServices?.vitess;if(s&&u&&typeof u==="object"&&!u.password)u.password=s;let a=y(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let f=Object.keys(o.environments??{}),T=nA(o,e.environment),R=sA(t),D=await ps(o,T),W=new Map([[T,D]]),Y=new Map([[T,Date.now()]]),ee=new Map([[T,Date.now()]]),ne=new Map,he=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),te=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),Pe=H(o)!=="serverless",tt=(C)=>{let Te=W.get(C);if(Te&&!ub(Y.get(C),Date.now(),he))return Promise.resolve(Te);let De=ne.get(C);if(De)return De;let Ie=!Pe||ub(ee.get(C),Date.now(),te),Ve=ps(o,C,{includeSiteHealth:Ie}).then((gt)=>{let L=W.get(C),Pr=Ie?gt:pA(L,gt);if(W.set(C,Pr),Y.set(C,Date.now()),Ie)ee.set(C,Date.now());if(L?._serverReachable!==Pr._serverReachable||L?._metricsStatus!==Pr._metricsStatus||(L?.sitesDetail?.length??0)!==(Pr.sitesDetail?.length??0))di();return Pr}).finally(()=>ne.delete(C));return ne.set(C,Ve),Ve},$e=Ro(t),Gt=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Gt!=="0"&&(Gt==="1"||!o.cloud?.attachTo)){let C=!1,Te=Date.now()+300000,De=async()=>{if(C)return;C=!0;try{let Ve=Date.now(),gt=Ve>=Te;if(gt)Te=Ve+300000;let L=a.environments.get(T);await ci({controlPlane:a.store,projectId:a.project.id,environmentId:L?.id,config:o,environment:T,force:!0,lightweight:!0,includeSiteHealth:gt})}catch(Ve){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ve instanceof Error?Ve.message:String(Ve)}`)}finally{C=!1}};De(),setInterval(()=>void De(),60000).unref?.()}let ke=new Map,He=new Map,Tt=new Set,Ti=0;function lo(C,Te){if(C.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`))return C;let De=a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),Ie=De?a.store.getMembershipForActor(a.organization.id,De.id):void 0;if(!Ie||Ie.status!=="active")return{...C,role:"member",sites:{},capabilities:[]};let Ve=a.store.listGrants(Ie.id),gt=a.store.resolveAuthorizationTarget(a.organization.id,Ie.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),L=Sn({membership:Ie,grants:Ve,target:gt});if(Ie.roleTemplate==="owner"||Ie.roleTemplate==="admin")return{...C,role:"admin",sites:{},organizationRole:Ie.roleTemplate,organizationSource:Ie.source,capabilities:L};let Pr=a.environments.get(Te),Wt={};for(let Ke of a.store.listResources(a.project.id,Pr?.id).filter((nt)=>nt.kind==="application")){let nt=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:Ke.id});if(!nt||!re({membership:Ie,grants:Ve,capability:"project:read",target:nt}).allowed)continue;Wt[Ke.slug]=re({membership:Ie,grants:Ve,capability:"config:write",target:nt}).allowed?"owner":"collaborator"}return{...C,role:"member",sites:Wt,organizationRole:Ie.roleTemplate,organizationSource:Ie.source,capabilities:L}}function di(){Ti+=1,ke.clear();for(let C of Tt)gs(C,{recursive:!0,force:!0});Tt.clear()}let Ai=(C,Te)=>`${Te}:${C.role==="admin"?"admin":`member:${Object.entries(C.sites).sort(([De],[Ie])=>De.localeCompare(Ie)).map(([De,Ie])=>`${De}=${Ie}`).join(",")}`}:${[...C.capabilities??[]].sort().join(",")}`;async function ki(C,Te){let De=lo(C,Te),Ie=Ai(De,Te),Ve=ke.get(Ie);if(Ve)return Ve;let gt=He.get(Ie);if(gt)return gt;let L=Ti,Pr=(async()=>{let Wt=W.get(Te)??await ps(o,Te);W.set(Te,Wt);let Ke={...Yl(Wt,{user:De,slug:o.project.slug}),viewer:{role:De.role,organizationRole:De.organizationRole,organizationSource:De.organizationSource,capabilities:De.capabilities??[]}},nt=await mA(t,Ke);if(nt&&L!==Ti)return gs(nt,{recursive:!0,force:!0}),$e?.uiRoot;if(nt)Tt.add(nt);let vr=nt??$e?.uiRoot;if(vr)ke.set(Ie,vr);return vr})();He.set(Ie,Pr);try{return await Pr}finally{He.delete(Ie)}}let Ri=await ki({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!Ri)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ge=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ee=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ee&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Re=!Ee,Pt=fy(t),Jt=Re?Sy(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,we=new Le(a.store,{encryptionKey:x(t)}),ut=new qe(a.store),rt=new Ot(a.store),ze=new ir(a.store,{encryptionKey:x(t)}),Rr=new Zn(a.store),ms=new ti(a.store,{cwd:t}),Pi=new ei(a.store,{encryptionKey:x(t)}),At=new S(a.store,{workerId:`dashboard:${process.pid}`}),Dt=new rr(a.store),Bi=new nr(a.store,x(t)),po=new Nr(a.store),ja=new Hr(Dt,At,Bi),go=o.project?.region??"us-east-1",dp=x(t),dn=new $r(po,{encryptionKey:dp,backends:[new wt(a.store,dp),new xr(new K(go),go),new _r(new We(go),go),new Or]});await yn(dn,a,o);let Pd=new fe(go),Ib={aws_rds:new Hn(new Jn(Pd)),aws_aurora:new qn(new Xn(Pd)),aws_elasticache:new Gn(new Qn(new oe(go))),server:new Wn(new at),container:new Kn(new at)},up=(C)=>Ib[C.provider],Kt=new si(a.store),Bo=new Yr(Kt,At),lp=new ai(Bi),Cb={managed_database:new Rl(Dt,Pd),logical_database:new Ol(Dt,Bi),volume:new Nl,files:new Dl(t),control_plane:new $l(a.store,t),infrastructure:new Bl(new xa(go))},Eb=(C)=>Cb[C.resourceKind],Tb=(C)=>C.provider==="aws_backup"?void 0:lp,xd=new ft(a.store),Dd=[new Mt,new cn(A(t,"volumes"))],Fi=new an(xd,Dd,At),ua=new xe(a.store),xi=new On(ua,[new st("aws"),new st("hetzner"),new st("ssh")],At),mo=new $n(a.store),pp=new Ln(mo,ua),Fo=new Mn(a.store),gp=new Un(Fo,At),ji=new Bn(a.store),Od=new jn(ji,At),mp=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((C)=>new Vn(C,a.store,a.project.id,a.organization.id)),hr=new Qr(a.store),fp=new oi(hr,{queue:At}),Ht=new Ye(a.store),fo=new Qe(a.store),Cn=new ct(a.store),Je=new yt(a.store,{encryptionKey:x(t)}),Ab=()=>bb(a.store);for(let C of a.environments.values())Xr(hr,o,{organization:a.organization,project:a.project,environment:C,resources:a.store.listResources(a.project.id,C.id)});let En=new Sr(Je,{emailImpl:async(C)=>{let{email:Te}=await import("./chunk-626npmtj.js");return Te.send(C)}}),hp=async(C)=>{let Te=ln(Je,a.project.id,C),De=[];for(let Ie of Te.filter((Ve)=>Ve.notify&&Ve.alert))De.push(...await En.deliverAll(En.enqueue(a.organization.id,Ie.alert,Ie.transition)));return De.push(...await En.deliverAll(En.enqueueRemindersAndEscalations(a.organization.id,Je.listAlerts(a.project.id,{environmentId:C,states:["firing"]})))),De.push(...await En.retryDue()),{evaluations:Te,deliveries:De}},_d=!1,kb=async()=>{if(_d)return;_d=!0;try{for(let C of a.environments.values())for(let Te of Je.listHealthChecks(a.project.id,C.id).filter((De)=>De.enabled)){let De=Je.listHealthResults(Te.id,1)[0];if(De&&Date.now()-new Date(De.checkedAt).getTime()<Te.intervalSeconds*1000)continue;let Ie=await new Be(Je).runAndEvaluate(Te);for(let Ve of Ie.evaluations.filter((gt)=>gt.notify&&gt.alert))await En.deliverAll(En.enqueue(a.organization.id,Ve.alert,Ve.transition))}}finally{_d=!1}},yp=setInterval(()=>{for(let C of a.environments.values())hp(C.id).catch((Te)=>console.error("ts-cloud alert evaluation failed:",Te))},60000);yp.unref?.();let bp=setInterval(()=>{kb().catch((C)=>console.error("ts-cloud health check evaluation failed:",C))},30000);bp.unref?.();let Sp=setInterval(()=>{try{fp.tick()}catch(C){console.error("ts-cloud scheduled job evaluation failed:",C)}},30000);Sp.unref?.();let vp=setInterval(()=>{try{Bo.enqueueDue(),Bo.enqueueRetention()}catch(C){console.error("ts-cloud backup policy evaluation failed:",C)}},30000);vp.unref?.(),Ht.cleanup();let wp=setInterval(()=>{try{Ht.cleanup()}catch(C){console.error("ts-cloud preview cleanup failed:",C)}},3600000);wp.unref?.();let Rb=e.queueWorker??!0,Pb=yA(),xb=async(C,Te)=>{let Ie=(C.environmentId?a.store.listEnvironments(C.projectId).find((Ve)=>Ve.id===C.environmentId):void 0)?.slug??String(T);if(Te.kind==="dashboard_operation"&&Te.operationId){let Ve=W.get(Ie)??D,gt=ri(Te.operationId,o,Ve);if(!gt||gt.danger||!["scheduler","backup","worker"].includes(gt.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let L=await Kr(o,Ie,gt);return{ok:L.ok,stdout:L.stdout,stderr:L.stderr??L.error,retryable:/temporar|unavailable|timeout|network/i.test(L.stderr??L.error??""),output:{command:L.command??null,operation:L.operation}}}if(Te.kind==="serverless_scheduler"){let Ve=await op(o,Ie,"run");return{ok:Ve.ok,stdout:Ve.stdout,stderr:Ve.error,retryable:/temporar|unavailable|timeout|network/i.test(Ve.error??""),output:{command:Ve.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Te.kind}.`}},Ua=Rb?new ys(At,{...Ec({store:a.store,execute:async(C,Te)=>{let De=Te.operation.input&&typeof Te.operation.input==="object"&&!Array.isArray(Te.operation.input)?Te.operation.input:{},Ie=De.source&&typeof De.source==="object"?De.source:void 0,Ve=t,gt,L,Pr;try{if(Ie?.bindingId&&Ie?.connectionId&&Ie?.commitSha){let Ke=ze.getBinding(String(Ie.bindingId)),nt=ze.getConnection(String(Ie.connectionId));if(!Ke||!nt||Ke.connectionId!==nt.id)throw Error("Queued source binding is no longer available");let gr=(Ke.repositoryId?ze.getRepository(Ke.repositoryId):ze.listRepositories(nt.id).find((Ss)=>Ss.fullName.toLowerCase()===Ke.repositoryFullName.toLowerCase()))?.cloneUrl;if(!gr&&nt.provider==="generic_ssh")gr=`git@${new URL(nt.host).hostname}:${Ke.repositoryFullName}.git`;if(!gr)gr=new URL(`/${Ke.repositoryFullName}.git`,nt.host.endsWith("/")?nt.host:`${nt.host}/`).href;let ye=Ke.deployKeyId?ze.getDeployKey(Ke.deployKeyId):void 0,Lt=ye&&Ke.deployKeyId?{...ye,privateKey:ze.getDeployPrivateKey(Ke.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(nt.provider)&&C.target.previewId){let Ss=Po(nt,ze.getCredential(nt.id)),ae=Ht.previews.getInstance(C.target.previewId);Pr=async(Tn,Ja)=>{try{await Ss.setCommitStatus(Ke.repositoryFullName,String(Ie.commitSha),{state:Tn,url:ae?.url,description:Ja})}catch(vs){Te.log(`Could not publish source status: ${vs instanceof Error?vs.message:String(vs)}`,{stream:"stderr"})}},await Pr("pending",`Preview deployment started for ${String(Ie.commitSha).slice(0,12)}`)}gt=cp(Et(kd(),"ts-cloud-queued-source-")),Te.log(`Checking out immutable source commit ${Ie.commitSha}.`,{stream:"system"}),Ve=(await nl({remote:gr,binding:Ke,destination:Et(gt,"checkout"),ref:String(Ie.branch??Ke.defaultBranch),commitSha:String(Ie.commitSha)},{credential:ze.getCredential(nt.id),deployKey:Lt})).directory}if(Te.operation.kind!=="preview.destroy"){let Ke=C.target.previewId?Ht.previews.getInstance(C.target.previewId):void 0,nt=Ke?Ht.previews.getDefinition(Ke.definitionId):void 0,vr=Te.operation.resourceId?a.store.getResource(Te.operation.resourceId):void 0;if(L=await dn.resolve({projectId:a.project.id,environmentId:Te.operation.environmentId,resourceId:Te.operation.resourceId,functionId:vr?.kind==="function"?vr.id:void 0,previewId:Ke?.id,trustedPreview:!!Ke&&!Ke.fork,allowedPreviewSecrets:nt?.inheritedSecrets}),L.warnings.some((gr)=>gr.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${L.warnings.filter((gr)=>gr.code==="missing_required").map((gr)=>gr.key).join(", ")}`);if(Te.operation.resourceId)for(let gr of Object.values(L.entries))po.setDependency({entryId:gr.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:gr.required,requiresRedeploy:!0});Te.log(`Resolved configuration ${L.configurationHash.slice(0,18)} for ${Object.keys(L.values).length} keys.`,{stream:"system"})}let Wt=await ap(C,{cwd:Ve,cliEntry:i,signal:Te.signal,env:L?.values,onOutput:(Ke,nt)=>Te.log(nt,{stream:Ke,step:"execute",secrets:[...Pb,...Object.entries(L?.entries??{}).filter(([,vr])=>vr.kind==="secret").map(([vr])=>L.values[vr]).filter(Boolean)]})});if(Wt.ok&&Te.operation.resourceId&&L)for(let Ke of Object.values(L.entries))po.setDependency({entryId:Ke.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:Ke.required,requiresRedeploy:!1,lastDeployedVersion:Ke.version});return await Pr?.(Wt.ok?"success":"failure",Wt.ok?`Preview is ready at ${String(Ie?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Ie?.commitSha).slice(0,12)}`),Wt}catch(Wt){throw await Pr?.("error",`Preview deployment could not complete at ${String(Ie?.commitSha).slice(0,12)}`),Wt}finally{if(gt)gs(gt,{recursive:!0,force:!0})}}}),...Th({store:hr,executor:xb}),...uf({store:Dt,secrets:Bi,resolveAdapter:up}),...$m(ua,xi.drivers),...Vm(Fo,[new qu("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...rf({store:ji,cleanup:mp}),...Tc(xd,Dd),..._h({store:Kt,queue:At,resolveSource:Eb,resolveDestination:Tb,validateHealth:async(C,Te)=>{if(!C.healthCheckId)return{healthy:!0,mode:"adapter"};let De=Je.getHealthCheck(C.healthCheckId);if(!De||De.projectId!==C.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Ie=await new Be(Je).runAndEvaluate(De);return{healthy:Ie.result.status==="healthy",healthCheckId:De.id,healthResultId:Ie.result.id,target:Te}}}),...th({store:a.store,resolveDriver:e.releaseDriver??((C)=>({name:`${a.store.getResource(C.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:C.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(C,Te)=>{let De=Je.listHealthChecks(Te.projectId,Te.environmentId).find((Ve)=>Ve.enabled&&Ve.name===C&&(!Ve.resourceId||Ve.resourceId===Te.resourceId));if(!De)return{healthy:!1,message:`Named health gate ${C} was not found for this release.`};let Ie=await new Be(Je).runAndEvaluate(De);return{healthy:Ie.result.status==="healthy",evidence:{healthCheckId:De.id,healthResultId:Ie.result.id,status:Ie.result.status,timings:Ie.result.timings},message:Ie.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(C)=>console.error("ts-cloud deployment queue worker failed:",C)}):void 0;if(ni(a),rd(rt,ue(a,String(T)),D),Jt)Ya(a,Jt.users),Iy(we,a,Jt.users);let Ft=vy({cwd:t,enabled:Re,secret:Pt,authentication:we,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(T)}}),Yt=new Ul,Ip=setInterval(()=>Yt.sweep(),60000);Ip.unref?.();let za=new Ma,Nd=new Ma(3,900000,900000),Va=new Ma(8,900000,900000),Cp=setInterval(()=>za.prune(),300000),Ep=setInterval(()=>Nd.prune(),300000),Tp=setInterval(()=>Va.prune(),300000);if(Cp.unref?.(),Ep.unref?.(),Tp.unref?.(),Re){if(Jt?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${Jt.generated.username}
     password: ${Jt.generated.password}
@@ -496,7 +496,7 @@ This link expires ${F.invitation.expiresAt} and can be used once.`});return b({i
 
 This replacement link expires ${k.invitation.expiresAt} and can be used once.`});return b({invitation:k.invitation,token:k.token,acceptUrl:M,delivered:F})}catch(k){return b({ok:!1,error:k instanceof Error?k.message:"Invitation could not be resent."},409)}}if(L.pathname==="/api/organization/memberships"&&C.method==="PATCH"){let d=await ie(C),l=a.store.getMembership(String(d.id??"")),k=Td(d.roleTemplate),M=Ba(d);if(!l||l.organizationId!==a.organization.id)return b({ok:!1,error:"Membership was not found."},404);if(!k||!M)return b({ok:!1,error:"Choose a valid role template and resource scope."},422);let F=_e(ae);if((l.roleTemplate==="owner"||k==="owner")&&(!Ei(String(d.password??""),ae.passwordHash)||F.membership?.roleTemplate!=="owner"))return b({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let j=a.store.resolveAuthorizationTarget(a.organization.id,M)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),Z=a.store.listGrants(l.id),me=Sn({membership:l,grants:Z,target:j}),le={...l,roleTemplate:k,scope:M},Ge=Sn({membership:le,grants:Z,target:j}),be={gained:Ge.filter((Ne)=>!me.includes(Ne)),lost:me.filter((Ne)=>!Ge.includes(Ne))};if(d.preview===!0)return b({membership:l,proposed:{roleTemplate:k,scope:M},accessDiff:be});if(String(d.confirm??"")!==l.id)return b({ok:!1,error:`Confirm this change with membership ID ${l.id}.`,accessDiff:be},409);try{return b({membership:a.store.updateMembership({id:l.id,roleTemplate:k,scope:M,actorId:F.actor?.id}),accessDiff:be})}catch(Ne){return b({ok:!1,error:Ne instanceof Error?Ne.message:"Membership could not be updated."},409)}}if(L.pathname==="/api/organization/memberships"&&C.method==="DELETE"){let d=await ie(C),l=a.store.getMembership(String(d.id??""));if(!l||l.organizationId!==a.organization.id)return b({ok:!1,error:"Membership was not found."},404);if(String(d.confirm??"")!==l.id)return b({ok:!1,error:`Confirm removal with membership ID ${l.id}.`},409);let k=_e(ae);if(l.roleTemplate==="owner"&&(k.membership?.roleTemplate!=="owner"||!Ei(String(d.password??""),ae.passwordHash)))return b({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return b({membership:a.store.revokeMembership(l.id,k.actor?.id)})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Membership could not be removed."},409)}}if(L.pathname==="/api/organization/grants"&&C.method==="POST"){let d=await ie(C),l=String(d.capability??""),k=d.effect==="deny"?"deny":d.effect==="allow"?"allow":void 0,M=Ba(d),F=_e(ae);if(!k||!M||!ce.includes(l))return b({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return b({grant:a.store.upsertGrant({organizationId:a.organization.id,membershipId:String(d.membershipId??""),effect:k,capability:l,scope:M,actorId:F.actor?.id})},201)}catch(X){return b({ok:!1,error:X instanceof Error?X.message:"Grant could not be created."},422)}}if(L.pathname==="/api/organization/grants"&&C.method==="DELETE"){let d=await ie(C),l=_e(ae),k=a.store.getGrant(String(d.id??""));if(!k||k.organizationId!==a.organization.id)return b({ok:!1,error:"Grant was not found."},404);return b({ok:a.store.removeGrant(k.id,l.actor?.id)})}if(L.pathname==="/api/tags"&&C.method==="GET")return b({tags:a.store.listTags(a.project.id),assignments:a.store.listResourceTags(a.project.id)});if(L.pathname==="/api/tags"&&C.method==="POST"){let d=await ie(C),l=a.store.upsertTag(a.project.id,String(d.name??""),String(d.color??"#5a8be0"));if(d.resourceId)a.store.assignTag(String(d.resourceId),l.id);return b({tag:l},201)}if(L.pathname==="/api/tags"&&C.method==="DELETE"){let d=await ie(C);return a.store.removeTag(String(d.resourceId??""),String(d.tagId??"")),b({ok:!0})}if(L.pathname==="/"&&!fb(L.pathname,Tn))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(ye)}`}});if(L.pathname==="/"&&Lt?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(ye)}`}});let Ja=ky(L.pathname);if(Ja)return new Response(null,{status:308,headers:{location:`${Ja}?env=${encodeURIComponent(ye)}`}});if(L.pathname==="/api/env"&&C.method==="POST"){let d=await ie(C),l=String(d.env??"");if(!f.includes(l))return b({ok:!1,error:`Unknown environment '${l}'.`,environments:f},404);return b({ok:!0,environment:l,environments:f,href:`?env=${encodeURIComponent(l)}`})}if(L.pathname==="/api/config"){let d={...fA(o),environment:ye,environments:f};return b(Py(d,Tn))}if(L.pathname==="/api/ssh-keys"&&C.method==="GET")return b({configPath:R,keys:$t(da(o))});if(L.pathname==="/api/ssh-keys"&&C.method==="POST"){if(!R)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=await Li(R,"utf8"),k=da(o),M=fc({configText:l,name:String(d.name??""),publicKey:String(d.publicKey??""),existingKeys:k});return await ls(R,M),lb(o,[...k,{name:String(d.name??"").trim(),publicKey:String(d.publicKey??"").trim().replace(/\s+/g," ")}]),b({ok:!0,configPath:R,keys:$t(da(o))})}if(L.pathname==="/api/ssh-keys"&&C.method==="DELETE"){if(!R)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=String(d.name??L.searchParams.get("name")??""),k=await Li(R,"utf8"),M=da(o),F=hc({configText:k,name:l,existingKeys:M});return await ls(R,F),lb(o,M.filter((X)=>X.name!==l.trim())),b({ok:!0,configPath:R,keys:$t(da(o))})}if(L.pathname==="/api/firewall"&&C.method==="GET")return b({configPath:R,alwaysOpen:[22,80,443],ports:sp(o)});if(L.pathname==="/api/firewall"&&C.method==="POST"){if(!R)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=Number(d.port);if(!$a(l))return b({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let k=sp(o),M=await Li(R,"utf8");try{await ls(R,$y(M,l,k))}catch(j){return b({ok:!1,error:j?.message??String(j)},422)}let F=us([...k,l]);pb(o,F);let X=d.apply===!1?null:await ar(o,ye,`ufw allow ${l}/tcp`).catch((j)=>({ok:!1,error:String(j?.message??j)}));return b({ok:!0,configPath:R,ports:F,apply:X})}if(L.pathname==="/api/firewall"&&C.method==="DELETE"){if(!R)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=Number(d.port??L.searchParams.get("port"));if(!$a(l))return b({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let k=sp(o),M=await Li(R,"utf8");await ls(R,Ly(M,l,k));let F=us(k.filter((j)=>j!==l));pb(o,F);let X=d.apply===!1?null:await ar(o,ye,`ufw delete allow ${l}/tcp`).catch((j)=>({ok:!1,error:String(j?.message??j)}));return b({ok:!0,configPath:R,ports:F,apply:X})}if(L.pathname==="/api/sites"&&C.method==="POST"){if(!R)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=String(d.name??"").trim(),k=String(d.root??"").trim();if(!l||!k)return b({ok:!1,error:"Site name and root are required."},422);let M={deploy:d.deploy==="bucket"?"bucket":"server",root:k,path:String(d.path??"").trim()||void 0,domain:String(d.domain??"").trim()||void 0,build:String(d.build??"").trim()||void 0,start:String(d.start??"").trim()||void 0,port:d.port?Number(d.port):void 0,type:String(d.type??"").trim()||void 0};if(M.port!==void 0&&(!Number.isInteger(M.port)||M.port<1||M.port>65535))return b({ok:!1,error:"Port must be a number between 1 and 65535."},422);let F=await Li(R,"utf8"),X=_n({configText:F,name:l,root:M.root,domain:M.domain,path:M.path,deploy:M.deploy,build:M.build,start:M.start,port:M.port,type:M.type});return await ls(R,X),aA(o,l,Object.fromEntries(Object.entries(M).filter(([,j])=>j!==void 0))),Lt=await ps(o,ye),W.set(ye,Lt),b({ok:!0,configPath:R,site:l,data:Lt})}if(L.pathname==="/api/sites"&&C.method==="DELETE"){if(!R)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=String(d.name??L.searchParams.get("name")??"").trim();if(!l||!o.sites?.[l])return b({ok:!1,error:`Site '${l}' was not found.`},404);let k=await Li(R,"utf8");return await ls(R,Sm({configText:k,name:l})),delete o.sites[l],Lt=await ps(o,ye),W.set(ye,Lt),b({ok:!0,configPath:R,site:l,data:Lt})}if(L.pathname==="/api/sites"&&C.method==="PATCH"){if(!R)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=String(d.name??"").trim(),k=o.sites?.[l];if(!l||!k)return b({ok:!1,error:`Site '${l}' was not found.`},404);if(Tn.role==="member"){let X=Oy(d);if(!X.ok)return b({ok:!1,error:X.error},403);let j=_y({siteName:l,body:d,sites:o.sites??{},ownSites:Object.keys(Tn.sites)});if(!j.ok)return b({ok:!1,error:j.error},409)}if(d.port!==void 0&&d.port!==null&&d.port!==""&&(!Number.isInteger(Number(d.port))||Number(d.port)<1||Number(d.port)>65535))return b({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof d.domain==="string"&&d.domain.trim()&&!_u(d.domain.trim()))return b({ok:!1,error:`Domain '${d.domain.trim()}' is not a valid hostname.`},422);let M=await Li(R,"utf8"),F=(X,j)=>{M=vm({configText:M,siteName:l,key:X,valueText:j})};if(d.ssl!==void 0)F("ssl",wm(d.ssl)),k.ssl=d.ssl;if(d.env!==void 0&&d.env&&typeof d.env==="object")F("env",Cm(d.env)),k.env=d.env;if(d.aliases!==void 0&&Array.isArray(d.aliases)){let X=d.aliases.map((j)=>String(j));F("aliases",Em(X)),k.aliases=X.map((j)=>j.trim().toLowerCase()).filter(Boolean)}if(d.redirects!==void 0&&d.redirects&&typeof d.redirects==="object")F("redirects",Tm(d.redirects)),k.redirects=d.redirects;for(let X of["domain","path","build","start","type","root","php"])if(typeof d[X]==="string"&&d[X].trim())F(X,Im(String(d[X]).trim())),k[X]=String(d[X]).trim();if(d.port!==void 0&&d.port!==null&&d.port!=="")F("port",String(Number(d.port))),k.port=Number(d.port);return await ls(R,M),Lt=await ps(o,ye),W.set(ye,Lt),b({ok:!0,configPath:R,site:l,data:Lt})}if(L.pathname==="/api/sites/deploy"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim();if(!l||!o.sites?.[l])return b({ok:!1,error:`Site '${l}' was not found.`},404);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to deploy this site.`},409);let k=ue(a,String(ye));await new rs(rt).run(new Ra,{...k,artifactRoot:t}),rd(rt,k,Lt??{});let M=lr(rt,{scope:k,desiredConfigHash:a.project.desiredConfigHash});if(M.decision.outcome==="block")return b({ok:!1,error:`Deployment blocked by security policy: ${M.decision.explanation}`,securityReview:M},409);let F={id:`deploy:${l}`,label:`Deploy ${l}`,description:`Deploy the ${l} site for ${ye}.`,command:["deploy","--env",ye,"--site",l,"--yes"],mutates:!0},X=await zi({controlPlane:a,environment:ye,actor:ae,kind:"dashboard.site.deploy",resourceSlug:l,input:{site:l},execute:()=>ap(F,{cwd:t,cliEntry:i})});return b({...X.result,controlPlaneOperation:X.operation,securityReview:M})}if(L.pathname==="/api/actions")return b(wb(ye));if(L.pathname==="/api/server/operations")return b(Wr(o,Lt));if(L.pathname==="/api/runtime/workloads"&&C.method==="GET"){let d=await Ci(o,ye);return b(d)}if(L.pathname==="/api/runtime/logs"&&C.method==="GET"){let d=String(L.searchParams.get("workload")??"");if(!d)return b({ok:!1,error:"A workload query parameter is required."},422);let l=Math.min(1000,Math.max(1,Number(L.searchParams.get("limit"))||200));try{return b(await new Ce(o,ye).logs(d,{limit:l}))}catch(k){return b({ok:!1,error:String(k?.message??k)},404)}}if(L.pathname==="/api/runtime/log-sessions"&&C.method==="POST"){let d=await ie(C),l=String(d.workloadId??"");if(!l)return b({ok:!1,error:"A workloadId is required."},422);let k=await Ci(o,ye),M=k.workloads.find((j)=>j.id===l);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!M.capabilities.logs.supported)return b({ok:!1,error:M.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let F=new Ce(o,ye,{inventory:async()=>k}),X=Yt.create("logs",l);return(async()=>{let j=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(d.sinceMs)||60000)));try{for(let Z=0;Z<200&&!Yt.signal(X.id)?.aborted;Z++){let me=await F.logs(l,{limit:Math.min(500,Math.max(1,Number(d.limit)||200)),since:j});for(let le of me.lines)if(Yt.append(X.id,`${le.timestamp?`${le.timestamp} `:""}${le.message}
 `),le.timestamp)j=new Date(Math.max(j.getTime(),new Date(le.timestamp).getTime()+1));await Bun.sleep(3000)}if(!Yt.signal(X.id)?.aborted)Yt.close(X.id,"complete")}catch(Z){Yt.append(X.id,Z instanceof Error?Z.message:String(Z),"stderr"),Yt.close(X.id,"failed",Z instanceof Error?Z.message:String(Z))}})(),b({ok:!0,session:X,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(X.id)}&workload=${encodeURIComponent(l)}`},201)}if((L.pathname==="/api/runtime/log-stream"||L.pathname==="/api/runtime/exec-stream")&&C.method==="GET"){let d=String(L.searchParams.get("id")??""),l=String(L.searchParams.get("workload")??""),k=Number(C.headers.get("last-event-id")??L.searchParams.get("after")??0)||0,M=Yt.read(d,l,k),F=L.pathname.includes("exec")?"exec":"logs";if(!M||M.kind!==F)return b({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return XT(Yt,M,k,C.signal)}if((L.pathname==="/api/runtime/log-sessions"||L.pathname==="/api/runtime/exec-sessions")&&C.method==="DELETE"){let d=await ie(C),l=Yt.cancel(String(d.id??""),String(d.workloadId??""));if(!l)return b({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return b({ok:!0,session:l})}if(L.pathname==="/api/runtime/exec-sessions"&&C.method==="POST"){let d=await ie(C),l=String(d.workloadId??""),k=await Ci(o,ye),M=k.workloads.find((Z)=>Z.id===l);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let F=Ft.resolveSession(C),X=new Ce(o,ye,{inventory:async()=>k}),j=Yt.create("exec",l);return zi({controlPlane:a,environment:ye,actor:ae,kind:"runtime.exec",resourceSlug:M.links.service,input:{workloadId:l,provider:M.provider,preset:d.preset?String(d.preset):null,freeForm:!!String(d.command??"").trim()},execute:()=>X.exec({workloadId:l,preset:["process","sockets","filesystem"].includes(String(d.preset))?String(d.preset):void 0,command:typeof d.command==="string"?d.command:void 0,confirm:String(d.confirm??""),recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F)})}).then(({result:Z,operation:me})=>{if(Yt.append(j.id,`operation ${me.id}
-`,"system"),Z.stdout)Yt.append(j.id,Z.stdout,"stdout");if(Z.stderr)Yt.append(j.id,Z.stderr,"stderr");Yt.close(j.id,Z.ok?"complete":"failed",Z.error)}).catch((Z)=>{let me=Z instanceof Error?Z.message:String(Z);Yt.append(j.id,me,"stderr"),Yt.close(j.id,"failed",me)}),b({ok:!0,session:j,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(j.id)}&workload=${encodeURIComponent(l)}`},202)}if(L.pathname==="/api/runtime/files/read"&&C.method==="POST"){let d=await ie(C),l=await Ci(o,ye),k=Ft.resolveSession(C),M=await new Ce(o,ye,{inventory:async()=>l}).readFile({workloadId:String(d.workloadId??""),path:String(d.path??""),confirm:String(d.confirm??""),recentAuth:!Re||!!k&&we.isRecentlyAuthenticated(k)});return b(M,M.ok?200:409)}if(L.pathname==="/api/runtime/files/write"&&C.method==="POST"){let d=await ie(C),l=await Ci(o,ye),k=String(d.workloadId??""),M=l.workloads.find((Z)=>Z.id===k);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let F=Ft.resolveSession(C),X=new Ce(o,ye,{inventory:async()=>l}),j=await zi({controlPlane:a,environment:ye,actor:ae,kind:"runtime.file.write",resourceSlug:M.links.service,input:{workloadId:k,provider:M.provider,path:String(d.path??""),bytes:Buffer.from(String(d.contentBase64??""),"base64").byteLength},execute:()=>X.writeFile({workloadId:k,path:String(d.path??""),contentBase64:String(d.contentBase64??""),confirm:String(d.confirm??""),recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F)})});return b({...j.result,controlPlaneOperation:j.operation},j.result.ok?200:409)}if(L.pathname==="/api/runtime/operations"&&C.method==="POST"){let d=await ie(C),l=String(d.workloadId??""),k=String(d.action??"");if(!l||!["start","stop","restart","redeploy","scale","inspect"].includes(k))return b({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let M=await Ci(o,ye),F=M.workloads.find((me)=>me.id===l);if(!F)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let X=Ft.resolveSession(C),j=new Ce(o,ye,{inventory:async()=>M}),Z=await zi({controlPlane:a,environment:ye,actor:ae,kind:`runtime.${k}`,resourceSlug:F.links.service,input:{workloadId:l,provider:F.provider,action:k,replicas:d.replicas==null?null:Number(d.replicas)},execute:()=>j.run({workloadId:l,action:k,replicas:d.replicas==null?void 0:Number(d.replicas),confirm:String(d.confirm??""),recentAuth:!Re||!!X&&we.isRecentlyAuthenticated(X)})});return b({...Z.result,controlPlaneOperation:Z.operation},Z.result.ok?200:409)}if(L.pathname.startsWith("/api/protection")){let d=ae.role==="admin"||Ga(ae,"security:read"),l=ae.role==="admin"||Ga(ae,"security:manage");if(!d)return b({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:k,describePosture:M}=await import("./chunk-cw3rhg1c.js"),F=new k(a.store),X=()=>{if(!l)throw Error("Changing protection controls requires security:manage.")};if(L.pathname==="/api/protection"&&C.method==="GET"){let j=F.current();return b({ok:!0,posture:M(j),controls:j,raw:F.raw()})}if(L.pathname==="/api/protection/attack-mode"&&C.method==="POST"){X();let j=await ie(C);if(j.enabled===!1)return b({ok:!0,disabled:F.disableAttackMode()});return b({ok:!0,control:F.enableAttackMode({hours:j.hours==null?void 0:Number(j.hours),reason:String(j.reason??"Enabled from the dashboard."),actorId:_e(ae).actor?.id})})}if(L.pathname==="/api/protection/pause"&&C.method==="POST"){X();let j=await ie(C);if(j.enabled===!1)return b({ok:!0,resumed:F.resumeMitigations()});return b({ok:!0,control:F.pauseMitigations({hours:j.hours==null?void 0:Number(j.hours),reason:String(j.reason??""),actorId:_e(ae).actor?.id})})}if(L.pathname==="/api/protection/ip-rules"&&C.method==="GET")return b({ok:!0,ipRules:F.current().ipRules});if(L.pathname==="/api/protection/ip-rules"&&(C.method==="POST"||C.method==="DELETE")){X();let j=await ie(C),Z=j.list==="allow"?"allow":"block",me=C.method==="POST"?F.addIpRule(Z,String(j.cidr??"")):F.removeIpRule(Z,String(j.cidr??""));return b({ok:!0,ipRules:me})}return b({ok:!1,error:"Protection endpoint was not found."},404)}if(L.pathname.startsWith("/api/spend/")||L.pathname==="/api/usage"){let d=await Ab(),{store:l,service:k,gate:M}=d,F=ae.role==="admin"||Ga(ae,"billing:read"),X=ae.role==="admin"||Ga(ae,"billing:manage");if(!F)return b({ok:!1,error:"Spend data requires the billing:read capability."},403);let j=a.environments.get(ye),Z={organizationId:a.organization.id,projectId:a.project.id,environmentId:j?.id},me=()=>{if(!X)throw Error("Changing a budget requires the billing:manage capability.")};if(L.pathname==="/api/usage"&&C.method==="GET")return b({ok:!0,...k.usageReport({organizationId:Z.organizationId,projectId:Z.projectId,period:L.searchParams.get("period")??"monthly",timezone:L.searchParams.get("timezone")??void 0})});if(L.pathname==="/api/spend/budgets"&&C.method==="GET")return b({ok:!0,budgets:l.listBudgets({organizationId:Z.organizationId,projectId:Z.projectId}).map((le)=>({...le,status:k.status(le)}))});if(L.pathname==="/api/spend/budgets"&&C.method==="POST"){me();let le=await ie(C),Ge=String(le.scope??"project"),be=l.createBudget({organizationId:Z.organizationId,projectId:Ge==="organization"?void 0:Z.projectId,environmentId:Ge==="environment"?Z.environmentId:void 0,name:String(le.name??"").trim(),period:le.period??"monthly",timezone:le.timezone?String(le.timezone):void 0,softLimitCents:le.softLimitCents==null?void 0:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?void 0:Math.round(Number(le.hardLimitCents)),graceSeconds:le.graceSeconds==null?void 0:Number(le.graceSeconds),dryRun:le.dryRun!==!1});return b({ok:!0,budget:be})}if(L.pathname==="/api/spend/budgets"&&C.method==="PATCH"){me();let le=await ie(C),Ge=String(le.id??""),be=l.getBudget(Ge);if(!be||be.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);return b({ok:!0,budget:l.updateBudget(Ge,{softLimitCents:le.softLimitCents==null?be.softLimitCents:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?be.hardLimitCents:Math.round(Number(le.hardLimitCents)),enabled:le.enabled==null?be.enabled:le.enabled===!0,dryRun:le.dryRun==null?be.dryRun:le.dryRun===!0},le.expectedVersion==null?void 0:Number(le.expectedVersion))})}if(L.pathname==="/api/spend/budgets"&&C.method==="DELETE"){me();let le=await ie(C),Ge=String(le.id??""),be=l.getBudget(Ge);if(!be||be.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);let Ne=M.closeBudget(Ge);return l.deleteBudget(Ge),b({ok:!0,deleted:!0,lifted:Ne})}if(L.pathname==="/api/spend/check"&&C.method==="POST"){me();let le=await ie(C),{SpendRunner:Ge}=await import("./chunk-f4mpkpbf.js"),be=new Ge({controlPlane:a.store,store:l,alerts:Je});if(le.apply!==!0){let Se=l.budgetsForScope(Z.organizationId,Z.projectId,Z.environmentId);return b({ok:!0,applied:!1,preview:Se.map((Ae)=>k.status(Ae))})}let Ne=await be.run({...Z,environmentKind:j?.kind});return b({ok:!0,applied:!0,result:Ne})}if(L.pathname==="/api/spend/enforcement"&&C.method==="GET")return b({ok:!0,enforcement:M.listUnder({organizationId:Z.organizationId})});if(L.pathname==="/api/spend/release"&&C.method==="POST"){me();let le=await ie(C),Ge=M.close(String(le.budgetId??""),le.action);return b({ok:Ge,released:Ge,note:Ge?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(L.pathname==="/api/spend/anomalies"&&C.method==="GET")return b({ok:!0,anomalies:l.listAnomalies({organizationId:Z.organizationId,projectId:Z.projectId,unacknowledgedOnly:L.searchParams.get("unacknowledged")==="true"})});if(L.pathname==="/api/spend/anomalies/acknowledge"&&C.method==="POST"){me();let le=await ie(C);return b({ok:!0,acknowledged:l.acknowledgeAnomaly(String(le.id??""))})}return b({ok:!1,error:"Spend endpoint was not found."},404)}if(L.pathname.startsWith("/api/health/")||L.pathname.startsWith("/api/alerts")||L.pathname.startsWith("/api/notifications/")){let d=a.environments.get(ye),l=a.store.listResources(a.project.id,d?.id),k=ae.role==="admin"||!!d&&la(ae,d.id,"runtime:read")?l:l.filter((j)=>yr(ae,j.id,"runtime:read")),M=(j)=>!j||k.some((Z)=>Z.id===j),F=(j)=>{if(!j)return;let Z=l.find((me)=>me.id===j||me.slug===j);if(!Z)throw Error("Alert resource was not found.");if(!M(Z.id))throw Error("Alert resource is outside your authorized scope.");return Z.id},X=_e(ae).actor;if(L.pathname==="/api/health/checks"&&C.method==="GET")return b({ok:!0,checks:Je.listHealthChecks(a.project.id,d?.id).filter((j)=>M(j.resourceId)).map((j)=>({...j,results:Je.listHealthResults(j.id,20)}))});if(L.pathname==="/api/health/checks"&&C.method==="POST"){let j=await ie(C),Z=String(j.kind??"http");if(Z==="command"&&ae.role!=="admin")return b({ok:!1,error:"Command health checks require an administrator."},403);let me={method:String(j.config?.method??"GET").toUpperCase().slice(0,10),path:j.config?.path?String(j.config.path).slice(0,500):void 0,port:j.config?.port==null?void 0:Number(j.config.port),command:Array.isArray(j.config?.command)?j.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(j.config?.expectedStatuses)?j.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:j.config?.expectedBody?String(j.config.expectedBody).slice(0,500):void 0};return b({ok:!0,check:Je.createHealthCheck({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),name:String(j.name??""),kind:Z,target:String(j.target??""),config:me,intervalSeconds:Number(j.intervalSeconds)||60,timeoutSeconds:Number(j.timeoutSeconds)||10,failureThreshold:Number(j.failureThreshold)||3,recoveryThreshold:Number(j.recoveryThreshold)||2,regions:Array.isArray(j.regions)?j.regions.map(String):["local"],enabled:j.enabled!==!1})},201)}if(L.pathname==="/api/health/checks"&&C.method==="PATCH"){let j=await ie(C),Z=Je.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,check:Je.setHealthCheckEnabled(Z.id,j.enabled!==!1)})}if(L.pathname==="/api/health/checks/test"&&C.method==="POST"){let j=await ie(C),Z=Je.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,productionIncidentCreated:!1,result:await new Be(Je).probe(Z)})}if(L.pathname==="/api/health/checks/run"&&C.method==="POST"){let j=await ie(C),Z=Je.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);let me=await new Be(Je).runAndEvaluate(Z),le=[];for(let Ge of me.evaluations.filter((be)=>be.notify&&be.alert)){let be=En.enqueue(a.organization.id,Ge.alert,Ge.transition);le.push(...await En.deliverAll(be))}return b({ok:!0,...me,deliveries:le})}if(L.pathname==="/api/alerts/rules"&&C.method==="GET")return b({ok:!0,rules:Je.listRules(a.project.id,d?.id).filter((j)=>M(j.resourceId))});if(L.pathname==="/api/alerts/rules"&&C.method==="POST"){let j=await ie(C),Z=j.healthCheckId?Je.getHealthCheck(String(j.healthCheckId)):void 0;if(j.healthCheckId&&(!Z||!M(Z.resourceId)))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,rule:Je.createRule({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource)??Z?.resourceId,healthCheckId:Z?.id,name:String(j.name??""),signal:String(j.signal??(Z?"health":"")),operator:String(j.operator??(Z?"unhealthy":"gt")),threshold:j.threshold==null?void 0:Number(j.threshold),recoveryThreshold:j.recoveryThreshold==null?void 0:Number(j.recoveryThreshold),windowMs:Number(j.windowMs)||300000,consecutive:Number(j.consecutive)||Z?.failureThreshold||3,recoveryConsecutive:Number(j.recoveryConsecutive)||Z?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(j.noDataPolicy))?j.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(j.severity))?j.severity:"warning",groupBy:Array.isArray(j.groupBy)?j.groupBy.map(String):[],labels:j.labels&&typeof j.labels==="object"?j.labels:{},enabled:j.enabled!==!1})},201)}if(L.pathname==="/api/alerts/rules"&&C.method==="PATCH"){let j=await ie(C),Z=Je.getRule(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert rule was not found."},404);return b({ok:!0,rule:Je.setRuleEnabled(Z.id,j.enabled!==!1)})}if(L.pathname==="/api/alerts/evaluate"&&C.method==="POST")return b({ok:!0,...await hp(d?.id)});if(L.pathname==="/api/alerts"&&C.method==="GET")return b({ok:!0,alerts:Je.listAlerts(a.project.id,{environmentId:d?.id,states:L.searchParams.getAll("state").length?L.searchParams.getAll("state"):void 0,limit:Number(L.searchParams.get("limit"))||200}).filter((j)=>M(j.resourceId)).map((j)=>({...j,deliveries:Je.listDeliveries({alertId:j.id,limit:50})}))});if(L.pathname==="/api/alerts/action"&&C.method==="POST"){let j=await ie(C),Z=Je.getAlert(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert was not found."},404);let me=String(j.action??"");if(me==="acknowledge")return b({ok:!0,alert:Je.acknowledge(Z.id,X?.id??"")});if(me==="assign")return b({ok:!0,alert:Je.assign(Z.id,j.ownerActorId==="me"?X?.id:j.ownerActorId?String(j.ownerActorId):void 0,X?.id)});if(me==="silence"){if(ae.role!=="admin")return b({ok:!1,error:"Silencing production alerts requires an administrator."},403);let le=Ft.resolveSession(C);if(Re&&(!le||!we.isRecentlyAuthenticated(le)))return b({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return b({ok:!0,alert:Je.silenceAlert(Z.id,String(j.until??""),X?.id)})}return b({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(L.pathname==="/api/alerts/silences"&&C.method==="POST"){let j=await ie(C);return b({ok:!0,id:Je.createSilence({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),matcher:j.matcher,reason:String(j.reason??""),startsAt:String(j.startsAt??new Date().toISOString()),endsAt:String(j.endsAt??""),timezone:String(j.timezone??"UTC"),actorId:X?.id})},201)}if(L.pathname==="/api/notifications/channels"&&C.method==="GET")return b({ok:!0,channels:Je.listChannels(a.organization.id)});if(L.pathname==="/api/notifications/channels"&&C.method==="POST"){let j=await ie(C),Z=String(j.kind??""),me=Z==="email"?{to:j.config?.to,from:j.config?.from}:Z==="telegram"?{chatId:String(j.config?.chatId??"")}:{};return b({ok:!0,channel:Je.createChannel({organizationId:a.organization.id,name:String(j.name??""),kind:Z,config:me,credential:j.credential?String(j.credential):void 0,actorId:X?.id})},201)}if(L.pathname==="/api/notifications/channels"&&C.method==="PATCH"){let j=await ie(C),Z=String(j.id??"");if(j.credential)return b({ok:!0,channel:Je.rotateChannel(Z,String(j.credential))});let me=String(j.status??"paused");if(!["active","paused","disabled"].includes(me))return b({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return b({ok:!0,channel:Je.setChannelStatus(Z,me)})}if(L.pathname==="/api/notifications/channels/test"&&C.method==="POST"){let j=await ie(C);return b({ok:!0,productionIncidentCreated:!1,result:await En.testChannel(String(j.id??""))})}if(L.pathname==="/api/notifications/routes"&&C.method==="GET")return b({ok:!0,routes:Je.listRoutes(a.organization.id)});if(L.pathname==="/api/notifications/routes"&&C.method==="POST"){let j=await ie(C),Z=Array.isArray(j.channelIds)?j.channelIds.map(String):[];if(Z.some((me)=>Je.getChannel(me)?.organizationId!==a.organization.id))return b({ok:!1,error:"Route contains an unavailable channel."},422);return b({ok:!0,route:Je.createRoute({organizationId:a.organization.id,name:String(j.name??""),priority:Number(j.priority)||0,matcher:j.matcher&&typeof j.matcher==="object"?j.matcher:{},channelIds:Z,quietHours:j.quietHours,groupWaitSeconds:Number(j.groupWaitSeconds)||30,reminderSeconds:j.reminderSeconds==null?void 0:Number(j.reminderSeconds),escalation:Array.isArray(j.escalation)?j.escalation:[],template:j.template?String(j.template):void 0,rateLimitPerMinute:Number(j.rateLimitPerMinute)||60,enabled:j.enabled!==!1})},201)}if(L.pathname==="/api/notifications/routes"&&C.method==="PATCH"){let j=await ie(C),Z=Je.getRoute(String(j.id??""));if(!Z||Z.organizationId!==a.organization.id)return b({ok:!1,error:"Notification route was not found."},404);return b({ok:!0,route:Je.setRouteEnabled(Z.id,j.enabled!==!1)})}if(L.pathname==="/api/notifications/routes/preview"&&C.method==="POST"){let j=await ie(C),me=(j.alertId?Je.getAlert(String(j.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),dedupKey:"preview",groupKey:String(j.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(j.severity))?j.severity:"warning",title:String(j.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return b({ok:!0,productionIncidentCreated:!1,matches:En.preview(a.organization.id,me,String(j.eventType??"firing")).map((le)=>({route:le.route,channels:le.channels,quiet:le.quiet}))})}if(L.pathname==="/api/notifications/deliveries"&&C.method==="GET")return b({ok:!0,deliveries:Je.listDeliveries({alertId:L.searchParams.get("alertId")??void 0,states:L.searchParams.getAll("state"),limit:Number(L.searchParams.get("limit"))||200})});if(L.pathname==="/api/notifications/deliveries/retry"&&C.method==="POST"){let j=await ie(C),Z=Je.getDelivery(String(j.id??""));if(!Z)return b({ok:!1,error:"Delivery was not found."},404);return Je.updateDelivery(Z.id,{state:"retrying",attempt:Math.max(0,Z.attempt-1),nextAttemptAt:new Date().toISOString()}),b({ok:!0,delivery:await En.deliver(Z.id)})}}if(L.pathname.startsWith("/api/jobs")||L.pathname.startsWith("/api/workers")){let d=a.environments.get(ye),l=a.store.listResources(a.project.id,d?.id),M=ae.role==="admin"||!!d&&la(ae,d.id,"automation:read")?l:l.filter((Se)=>yr(ae,Se.id,"automation:read")),F=(Se)=>!Se||M.some((Ae)=>Ae.id===Se),X=_e(ae).actor,j=W.get(ye)??D,Z=Wr(o,j),me=Z.filter((Se)=>!Se.danger&&["scheduler","backup","worker"].includes(Se.group)),le=H(o),Ge=()=>{let Se=Ft.resolveSession(C);return!Re||!!Se&&we.isRecentlyAuthenticated(Se)},be=(Se)=>{if(!Se||typeof Se!=="object"||Array.isArray(Se))return{};let Ae=Object.entries(Se).slice(0,50);if(Ae.some(([,Xe])=>typeof Xe!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(Xe)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(Ae)},Ne=(Se,Ae,Xe)=>a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,resourceId:Xe,actorId:X?.id,type:`job.${Se}`,payload:Ae});if(L.pathname==="/api/jobs/preview"&&C.method==="POST"){let Se=await ie(C);try{return b({ok:!0,productionExecutionCreated:!1,preview:dt(String(Se.expression??""),String(Se.timezone??"UTC"),new Date(Se.from?String(Se.from):Date.now()),Number(Se.count)||5)})}catch(Ae){return b({ok:!1,error:Ae instanceof Error?Ae.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(L.pathname==="/api/jobs"&&C.method==="GET")return b({ok:!0,jobs:hr.list(a.project.id,{environmentId:d?.id}).filter((Se)=>F(Se.resourceId)).map((Se)=>({...Se,preview:dt(Se.normalizedExpression,Se.timezone,new Date,5),capability:ii(Se),lastExecution:hr.listExecutions(Se.id,1)[0]}))});if(L.pathname==="/api/jobs"&&C.method==="POST"){let Se=await ie(C),Ae=String(Se.provider??(le==="serverless"?"eventbridge":"server")),Xe=le==="serverless"?"eventbridge":"server";if(Ae!==Xe)return b({ok:!1,error:`${le} environments accept ${Xe} schedules through this adapter.`},422);let ot=Se.operationId?String(Se.operationId):void 0;if(Ae==="server"&&(!ot||!me.some((Xt)=>Xt.id===ot)))return b({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let St=ii({provider:Ae,expression:String(Se.expression??""),flexibleMinutes:Number(Se.flexibleMinutes)||0,missedRunPolicy:Se.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Se.overlapPolicy))?Se.overlapPolicy:"forbid"});if(!St.supported)return b({ok:!1,error:St.notes.join(" ")},422);let fn=Se.resourceId?l.find((Xt)=>Xt.id===Se.resourceId||Xt.slug===Se.resourceId):void 0;if(Se.resourceId&&(!fn||!F(fn.id)))return b({ok:!1,error:"Job resource was not found."},404);try{let Xt=Ae==="server"?{kind:"dashboard_operation",operationId:ot}:{kind:"serverless_scheduler",action:"run"},bo=hr.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:fn?.id,name:String(Se.name??""),provider:Ae,expression:String(Se.expression??""),timezone:String(Se.timezone??"UTC"),startsAt:Se.startsAt?String(Se.startsAt):void 0,endsAt:Se.endsAt?String(Se.endsAt):void 0,flexibleMinutes:Number(Se.flexibleMinutes)||0,target:Xt,payloadRefs:be(Se.payloadRefs),missedRunPolicy:Se.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Se.overlapPolicy))?Se.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(Se.maxAttempts)||3,backoffSeconds:Number(Se.backoffSeconds)||30,deadLetterRef:Se.deadLetterRef?String(Se.deadLetterRef):void 0},timeoutSeconds:Number(Se.timeoutSeconds)||900,enabled:Se.enabled!==!1,origin:"managed",ownerActorId:X?.id,observedState:{},reconciliationStatus:"pending"});return Ne("created",{jobId:bo.id,provider:bo.provider,expression:bo.normalizedExpression},bo.resourceId),b({ok:!0,job:bo,capability:St},201)}catch(Xt){return b({ok:!1,error:Xt instanceof Error?Xt.message:"Scheduled job could not be created."},422)}}if(L.pathname==="/api/jobs"&&C.method==="PATCH"){let Se=await ie(C),Ae=hr.get(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);if(Ae.origin==="config")return b({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let Xe=Se.missedRunPolicy==null?void 0:String(Se.missedRunPolicy),ot=Se.overlapPolicy==null?void 0:String(Se.overlapPolicy);if(Xe&&!["skip","catch_up"].includes(Xe))return b({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ot&&!["allow","forbid","replace"].includes(ot))return b({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let St=hr.updateSchedule(Ae.id,{expression:Se.expression?String(Se.expression):void 0,timezone:Se.timezone?String(Se.timezone):void 0,missedRunPolicy:Xe,overlapPolicy:ot,timeoutSeconds:Se.timeoutSeconds==null?void 0:Number(Se.timeoutSeconds)});return Ne("updated",{jobId:St.id,expression:St.normalizedExpression,version:St.version},St.resourceId),b({ok:!0,job:St})}catch(St){return b({ok:!1,error:St instanceof Error?St.message:"Scheduled job could not be updated."},422)}}if(L.pathname==="/api/jobs/action"&&C.method==="POST"){let Se=await ie(C),Ae=hr.get(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);let Xe=String(Se.action??"");if(Xe==="run"){let ot=fp.enqueue(Ae,{trigger:"manual",actorId:X?.id});return Ne("run_queued",{jobId:Ae.id,executionId:ot.id},Ae.resourceId),b({ok:!0,execution:ot},202)}if(["disable","delete"].includes(Xe)&&d?.kind==="production"){if(String(Se.confirm??"")!==Xe)return b({ok:!1,error:`Type "${Xe}" to confirm this production change.`},409);if(!Ge())return b({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(Xe==="enable"||Xe==="disable"){let ot=hr.setEnabled(Ae.id,Xe==="enable");return Ne(Xe==="enable"?"enabled":"disabled",{jobId:Ae.id},Ae.resourceId),b({ok:!0,job:ot})}if(Xe==="delete")try{return hr.remove(Ae.id),Ne("deleted",{jobId:Ae.id,name:Ae.name},Ae.resourceId),b({ok:!0,deleted:Ae.id})}catch(ot){return b({ok:!1,error:ot instanceof Error?ot.message:"Scheduled job could not be deleted."},409)}return b({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(L.pathname==="/api/jobs/history"&&C.method==="GET"){let Se=hr.get(String(L.searchParams.get("jobId")??""));if(!Se||!F(Se.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);return b({ok:!0,executions:hr.listExecutions(Se.id,Number(L.searchParams.get("limit"))||100).map((Ae)=>({...Ae,logs:Ae.operationId?At.logs(Ae.operationId,{limit:500}):[]}))})}if(L.pathname==="/api/jobs/reconcile"&&C.method==="POST"){if(!d)return b({ok:!1,error:"Environment was not found."},404);let Se=Xr(hr,o,{organization:a.organization,project:a.project,environment:d,resources:l});return Ne("reconciled",Se),b({ok:!0,reconciliation:Se})}if(L.pathname==="/api/workers"&&C.method==="GET"){let Se=Array.isArray(j.workersDetail??j.workers)?j.workersDetail??j.workers:[];return b({ok:!0,workers:hr.listWorkers(a.project.id,d?.id).filter((Ae)=>F(Ae.resourceId)).map((Ae)=>{let Xe=Se.find((ot)=>ot.name===Ae.name||ot.site===Ae.target.site);return Xe?{...Ae,observedState:{...Ae.observedState,status:Xe.status??"configured",currentJob:Xe.currentJob??null,failures:Number(Xe.failed??Xe.failures)||0,processed:Number(Xe.processed)||0}}:Ae})})}if(L.pathname==="/api/workers/action"&&C.method==="POST"){let Se=await ie(C),Ae=hr.getWorker(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Worker was not found."},404);let Xe=String(Se.action??"");if(Xe==="restart"){if(String(Se.confirm??"")!==Ae.name)return b({ok:!1,error:`Type "${Ae.name}" to restart this worker.`},409);let ot=Z.find((Xt)=>Xt.id===Ae.target.operationId);if(!ot)return b({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let St=await Kr(o,ye,ot),fn=hr.reconcileWorker(Ae.id,St.ok?"in_sync":"unavailable",{...Ae.observedState,lastRestartAt:new Date().toISOString(),command:St.command??null,error:St.error??St.stderr??null});return Ne("worker_restarted",{workerId:Ae.id,ok:St.ok},Ae.resourceId),b({...St,worker:fn},St.ok?200:409)}if(Xe==="scale")return b({ok:!1,error:Ae.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return b({ok:!1,error:"Action must be restart or scale."},422)}}if(L.pathname.startsWith("/api/telemetry/")){let d=a.environments.get(ye),l=new et(a.store),k=a.store.listResources(a.project.id,d?.id),M=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(L.pathname)?"runtime:logs":"runtime:read",F=ae.role==="admin"||!!d&&la(ae,d.id,M),X=F?k:k.filter((be)=>yr(ae,be.id,M)),j=(be)=>Zy(X,F,be),Z=(be)=>{let Ne=new Date,Se={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},Ae=String(be.to??Ne.toISOString()),Xe=String(be.from??new Date(new Date(Ae).getTime()-(Se[String(be.range??"1h")]??Se["1h"])).toISOString()),ot=(fn)=>{let Xt=(Array.isArray(fn)?fn:String(fn??"").split(",")).map(String).filter(Boolean);return Xt.length?Xt:void 0},St=ot(be.kinds)?.filter((fn)=>["metric","log","trace","request","event"].includes(fn));return{projectId:a.project.id,environmentId:d?.id,resourceIds:j(be.resources),kinds:St,names:ot(be.names),sources:ot(be.sources),levels:ot(be.levels),from:Xe,to:Ae,text:String(be.text??"")||void 0,traceId:String(be.traceId??"")||void 0,requestId:String(be.requestId??"")||void 0,deploymentId:String(be.deploymentId??"")||void 0,releaseId:String(be.releaseId??"")||void 0,workloadId:String(be.workloadId??"")||void 0,cursor:String(be.cursor??"")||void 0,limit:Number(be.limit)||void 0}},me=Object.fromEntries(L.searchParams.entries()),le=(be=!1)=>ci({controlPlane:a.store,projectId:a.project.id,environmentId:d?.id,config:o,environment:ye,force:be,lightweight:!be}),Ge=()=>{let be=a.store.getSetting(`telemetry.collection:${a.project.id}:${d?.id??"all"}`)??{};return{generatedAt:String(be.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(be.statuses)?be.statuses:[],errors:Array.isArray(be.errors)?be.errors:[],policy:be.policy??Ze(a.store,a.project.id)}};if(L.pathname==="/api/telemetry/status"&&C.method==="GET"){le(!1);let be=Ge(),Ne=F?be.statuses:l.status(a.project.id,d?.id,be.policy.rawDays,be.policy.samplingRate,X.map((Ae)=>Ae.id)),Se=Ne.reduce((Ae,Xe)=>Ae+Xe.estimatedDailyBytes*30,0);return b({ok:!0,generatedAt:be.generatedAt,cached:be.cached,sources:Ne,errors:F?be.errors:[],policy:be.policy,retention:{rawDays:be.policy.rawDays,downsampleAfterDays:be.policy.downsampleAfterDays,downsampleBucketMs:be.policy.downsampleBucketMs,maxRecords:be.policy.maxRecords},estimatedMonthlyBytes:Se,estimatedMonthlyCostUsd:Si(Se,be.policy),costEstimateConfigured:be.policy.estimatedStorageUsdPerGbMonth>0})}if(L.pathname==="/api/telemetry/settings"&&C.method==="GET")return b({ok:!0,policy:Ze(a.store,a.project.id)});if(L.pathname==="/api/telemetry/settings"&&C.method==="PATCH"){let be=bi(a.store,a.project.id,await ie(C));return sb(a.project.id),b({ok:!0,policy:be})}if(L.pathname==="/api/telemetry/query"&&C.method==="GET"){le(!1);let be=Ge();return b({ok:!0,collection:{generatedAt:be.generatedAt,cached:be.cached},...l.query(Z(me))})}if(L.pathname==="/api/telemetry/tail"&&C.method==="GET"){le(!1);let be=new TextEncoder,Ne=new Date,Se=Z({...me,kinds:me.kinds||"log,request,event,trace",from:me.from||new Date(Ne.getTime()-120000).toISOString(),to:Ne.toISOString(),limit:Math.min(1000,Number(me.limit)||200),cursor:void 0}),Ae=C.headers.get("last-event-id")||String(me.cursor??"")||void 0,Xe,ot=!1,St=!1,fn=new ReadableStream({start(Xt){let bo=()=>{if(ot)return;if(ot=!0,Xe)clearInterval(Xe);C.signal.removeEventListener("abort",bo);try{Xt.close()}catch{}},Rp=async()=>{if(ot||St)return;St=!0;try{let Uo=l.tail({...Se,to:new Date(Date.now()+1000).toISOString()},Ae);for(let Pp of Uo.records)Ae=ao(Pp)??Ae,Xt.enqueue(be.encode(`id: ${Ae??""}
+`,"system"),Z.stdout)Yt.append(j.id,Z.stdout,"stdout");if(Z.stderr)Yt.append(j.id,Z.stderr,"stderr");Yt.close(j.id,Z.ok?"complete":"failed",Z.error)}).catch((Z)=>{let me=Z instanceof Error?Z.message:String(Z);Yt.append(j.id,me,"stderr"),Yt.close(j.id,"failed",me)}),b({ok:!0,session:j,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(j.id)}&workload=${encodeURIComponent(l)}`},202)}if(L.pathname==="/api/runtime/files/read"&&C.method==="POST"){let d=await ie(C),l=await Ci(o,ye),k=Ft.resolveSession(C),M=await new Ce(o,ye,{inventory:async()=>l}).readFile({workloadId:String(d.workloadId??""),path:String(d.path??""),confirm:String(d.confirm??""),recentAuth:!Re||!!k&&we.isRecentlyAuthenticated(k)});return b(M,M.ok?200:409)}if(L.pathname==="/api/runtime/files/write"&&C.method==="POST"){let d=await ie(C),l=await Ci(o,ye),k=String(d.workloadId??""),M=l.workloads.find((Z)=>Z.id===k);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let F=Ft.resolveSession(C),X=new Ce(o,ye,{inventory:async()=>l}),j=await zi({controlPlane:a,environment:ye,actor:ae,kind:"runtime.file.write",resourceSlug:M.links.service,input:{workloadId:k,provider:M.provider,path:String(d.path??""),bytes:Buffer.from(String(d.contentBase64??""),"base64").byteLength},execute:()=>X.writeFile({workloadId:k,path:String(d.path??""),contentBase64:String(d.contentBase64??""),confirm:String(d.confirm??""),recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F)})});return b({...j.result,controlPlaneOperation:j.operation},j.result.ok?200:409)}if(L.pathname==="/api/runtime/operations"&&C.method==="POST"){let d=await ie(C),l=String(d.workloadId??""),k=String(d.action??"");if(!l||!["start","stop","restart","redeploy","scale","inspect"].includes(k))return b({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let M=await Ci(o,ye),F=M.workloads.find((me)=>me.id===l);if(!F)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let X=Ft.resolveSession(C),j=new Ce(o,ye,{inventory:async()=>M}),Z=await zi({controlPlane:a,environment:ye,actor:ae,kind:`runtime.${k}`,resourceSlug:F.links.service,input:{workloadId:l,provider:F.provider,action:k,replicas:d.replicas==null?null:Number(d.replicas)},execute:()=>j.run({workloadId:l,action:k,replicas:d.replicas==null?void 0:Number(d.replicas),confirm:String(d.confirm??""),recentAuth:!Re||!!X&&we.isRecentlyAuthenticated(X)})});return b({...Z.result,controlPlaneOperation:Z.operation},Z.result.ok?200:409)}if(L.pathname.startsWith("/api/protection")){let d=ae.role==="admin"||Ga(ae,"security:read"),l=ae.role==="admin"||Ga(ae,"security:manage");if(!d)return b({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:k,describePosture:M}=await import("./chunk-20dp8658.js"),F=new k(a.store),X=()=>{if(!l)throw Error("Changing protection controls requires security:manage.")};if(L.pathname==="/api/protection"&&C.method==="GET"){let j=F.current();return b({ok:!0,posture:M(j),controls:j,raw:F.raw()})}if(L.pathname==="/api/protection/attack-mode"&&C.method==="POST"){X();let j=await ie(C);if(j.enabled===!1)return b({ok:!0,disabled:F.disableAttackMode()});return b({ok:!0,control:F.enableAttackMode({hours:j.hours==null?void 0:Number(j.hours),reason:String(j.reason??"Enabled from the dashboard."),actorId:_e(ae).actor?.id})})}if(L.pathname==="/api/protection/pause"&&C.method==="POST"){X();let j=await ie(C);if(j.enabled===!1)return b({ok:!0,resumed:F.resumeMitigations()});return b({ok:!0,control:F.pauseMitigations({hours:j.hours==null?void 0:Number(j.hours),reason:String(j.reason??""),actorId:_e(ae).actor?.id})})}if(L.pathname==="/api/protection/ip-rules"&&C.method==="GET")return b({ok:!0,ipRules:F.current().ipRules});if(L.pathname==="/api/protection/ip-rules"&&(C.method==="POST"||C.method==="DELETE")){X();let j=await ie(C),Z=j.list==="allow"?"allow":"block",me=C.method==="POST"?F.addIpRule(Z,String(j.cidr??"")):F.removeIpRule(Z,String(j.cidr??""));return b({ok:!0,ipRules:me})}return b({ok:!1,error:"Protection endpoint was not found."},404)}if(L.pathname.startsWith("/api/spend/")||L.pathname==="/api/usage"){let d=await Ab(),{store:l,service:k,gate:M}=d,F=ae.role==="admin"||Ga(ae,"billing:read"),X=ae.role==="admin"||Ga(ae,"billing:manage");if(!F)return b({ok:!1,error:"Spend data requires the billing:read capability."},403);let j=a.environments.get(ye),Z={organizationId:a.organization.id,projectId:a.project.id,environmentId:j?.id},me=()=>{if(!X)throw Error("Changing a budget requires the billing:manage capability.")};if(L.pathname==="/api/usage"&&C.method==="GET")return b({ok:!0,...k.usageReport({organizationId:Z.organizationId,projectId:Z.projectId,period:L.searchParams.get("period")??"monthly",timezone:L.searchParams.get("timezone")??void 0})});if(L.pathname==="/api/spend/budgets"&&C.method==="GET")return b({ok:!0,budgets:l.listBudgets({organizationId:Z.organizationId,projectId:Z.projectId}).map((le)=>({...le,status:k.status(le)}))});if(L.pathname==="/api/spend/budgets"&&C.method==="POST"){me();let le=await ie(C),Ge=String(le.scope??"project"),be=l.createBudget({organizationId:Z.organizationId,projectId:Ge==="organization"?void 0:Z.projectId,environmentId:Ge==="environment"?Z.environmentId:void 0,name:String(le.name??"").trim(),period:le.period??"monthly",timezone:le.timezone?String(le.timezone):void 0,softLimitCents:le.softLimitCents==null?void 0:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?void 0:Math.round(Number(le.hardLimitCents)),graceSeconds:le.graceSeconds==null?void 0:Number(le.graceSeconds),dryRun:le.dryRun!==!1});return b({ok:!0,budget:be})}if(L.pathname==="/api/spend/budgets"&&C.method==="PATCH"){me();let le=await ie(C),Ge=String(le.id??""),be=l.getBudget(Ge);if(!be||be.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);return b({ok:!0,budget:l.updateBudget(Ge,{softLimitCents:le.softLimitCents==null?be.softLimitCents:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?be.hardLimitCents:Math.round(Number(le.hardLimitCents)),enabled:le.enabled==null?be.enabled:le.enabled===!0,dryRun:le.dryRun==null?be.dryRun:le.dryRun===!0},le.expectedVersion==null?void 0:Number(le.expectedVersion))})}if(L.pathname==="/api/spend/budgets"&&C.method==="DELETE"){me();let le=await ie(C),Ge=String(le.id??""),be=l.getBudget(Ge);if(!be||be.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);let Ne=M.closeBudget(Ge);return l.deleteBudget(Ge),b({ok:!0,deleted:!0,lifted:Ne})}if(L.pathname==="/api/spend/check"&&C.method==="POST"){me();let le=await ie(C),{SpendRunner:Ge}=await import("./chunk-vpt43nwa.js"),be=new Ge({controlPlane:a.store,store:l,alerts:Je});if(le.apply!==!0){let Se=l.budgetsForScope(Z.organizationId,Z.projectId,Z.environmentId);return b({ok:!0,applied:!1,preview:Se.map((Ae)=>k.status(Ae))})}let Ne=await be.run({...Z,environmentKind:j?.kind});return b({ok:!0,applied:!0,result:Ne})}if(L.pathname==="/api/spend/enforcement"&&C.method==="GET")return b({ok:!0,enforcement:M.listUnder({organizationId:Z.organizationId})});if(L.pathname==="/api/spend/release"&&C.method==="POST"){me();let le=await ie(C),Ge=M.close(String(le.budgetId??""),le.action);return b({ok:Ge,released:Ge,note:Ge?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(L.pathname==="/api/spend/anomalies"&&C.method==="GET")return b({ok:!0,anomalies:l.listAnomalies({organizationId:Z.organizationId,projectId:Z.projectId,unacknowledgedOnly:L.searchParams.get("unacknowledged")==="true"})});if(L.pathname==="/api/spend/anomalies/acknowledge"&&C.method==="POST"){me();let le=await ie(C);return b({ok:!0,acknowledged:l.acknowledgeAnomaly(String(le.id??""))})}return b({ok:!1,error:"Spend endpoint was not found."},404)}if(L.pathname.startsWith("/api/health/")||L.pathname.startsWith("/api/alerts")||L.pathname.startsWith("/api/notifications/")){let d=a.environments.get(ye),l=a.store.listResources(a.project.id,d?.id),k=ae.role==="admin"||!!d&&la(ae,d.id,"runtime:read")?l:l.filter((j)=>yr(ae,j.id,"runtime:read")),M=(j)=>!j||k.some((Z)=>Z.id===j),F=(j)=>{if(!j)return;let Z=l.find((me)=>me.id===j||me.slug===j);if(!Z)throw Error("Alert resource was not found.");if(!M(Z.id))throw Error("Alert resource is outside your authorized scope.");return Z.id},X=_e(ae).actor;if(L.pathname==="/api/health/checks"&&C.method==="GET")return b({ok:!0,checks:Je.listHealthChecks(a.project.id,d?.id).filter((j)=>M(j.resourceId)).map((j)=>({...j,results:Je.listHealthResults(j.id,20)}))});if(L.pathname==="/api/health/checks"&&C.method==="POST"){let j=await ie(C),Z=String(j.kind??"http");if(Z==="command"&&ae.role!=="admin")return b({ok:!1,error:"Command health checks require an administrator."},403);let me={method:String(j.config?.method??"GET").toUpperCase().slice(0,10),path:j.config?.path?String(j.config.path).slice(0,500):void 0,port:j.config?.port==null?void 0:Number(j.config.port),command:Array.isArray(j.config?.command)?j.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(j.config?.expectedStatuses)?j.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:j.config?.expectedBody?String(j.config.expectedBody).slice(0,500):void 0};return b({ok:!0,check:Je.createHealthCheck({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),name:String(j.name??""),kind:Z,target:String(j.target??""),config:me,intervalSeconds:Number(j.intervalSeconds)||60,timeoutSeconds:Number(j.timeoutSeconds)||10,failureThreshold:Number(j.failureThreshold)||3,recoveryThreshold:Number(j.recoveryThreshold)||2,regions:Array.isArray(j.regions)?j.regions.map(String):["local"],enabled:j.enabled!==!1})},201)}if(L.pathname==="/api/health/checks"&&C.method==="PATCH"){let j=await ie(C),Z=Je.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,check:Je.setHealthCheckEnabled(Z.id,j.enabled!==!1)})}if(L.pathname==="/api/health/checks/test"&&C.method==="POST"){let j=await ie(C),Z=Je.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,productionIncidentCreated:!1,result:await new Be(Je).probe(Z)})}if(L.pathname==="/api/health/checks/run"&&C.method==="POST"){let j=await ie(C),Z=Je.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);let me=await new Be(Je).runAndEvaluate(Z),le=[];for(let Ge of me.evaluations.filter((be)=>be.notify&&be.alert)){let be=En.enqueue(a.organization.id,Ge.alert,Ge.transition);le.push(...await En.deliverAll(be))}return b({ok:!0,...me,deliveries:le})}if(L.pathname==="/api/alerts/rules"&&C.method==="GET")return b({ok:!0,rules:Je.listRules(a.project.id,d?.id).filter((j)=>M(j.resourceId))});if(L.pathname==="/api/alerts/rules"&&C.method==="POST"){let j=await ie(C),Z=j.healthCheckId?Je.getHealthCheck(String(j.healthCheckId)):void 0;if(j.healthCheckId&&(!Z||!M(Z.resourceId)))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,rule:Je.createRule({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource)??Z?.resourceId,healthCheckId:Z?.id,name:String(j.name??""),signal:String(j.signal??(Z?"health":"")),operator:String(j.operator??(Z?"unhealthy":"gt")),threshold:j.threshold==null?void 0:Number(j.threshold),recoveryThreshold:j.recoveryThreshold==null?void 0:Number(j.recoveryThreshold),windowMs:Number(j.windowMs)||300000,consecutive:Number(j.consecutive)||Z?.failureThreshold||3,recoveryConsecutive:Number(j.recoveryConsecutive)||Z?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(j.noDataPolicy))?j.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(j.severity))?j.severity:"warning",groupBy:Array.isArray(j.groupBy)?j.groupBy.map(String):[],labels:j.labels&&typeof j.labels==="object"?j.labels:{},enabled:j.enabled!==!1})},201)}if(L.pathname==="/api/alerts/rules"&&C.method==="PATCH"){let j=await ie(C),Z=Je.getRule(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert rule was not found."},404);return b({ok:!0,rule:Je.setRuleEnabled(Z.id,j.enabled!==!1)})}if(L.pathname==="/api/alerts/evaluate"&&C.method==="POST")return b({ok:!0,...await hp(d?.id)});if(L.pathname==="/api/alerts"&&C.method==="GET")return b({ok:!0,alerts:Je.listAlerts(a.project.id,{environmentId:d?.id,states:L.searchParams.getAll("state").length?L.searchParams.getAll("state"):void 0,limit:Number(L.searchParams.get("limit"))||200}).filter((j)=>M(j.resourceId)).map((j)=>({...j,deliveries:Je.listDeliveries({alertId:j.id,limit:50})}))});if(L.pathname==="/api/alerts/action"&&C.method==="POST"){let j=await ie(C),Z=Je.getAlert(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert was not found."},404);let me=String(j.action??"");if(me==="acknowledge")return b({ok:!0,alert:Je.acknowledge(Z.id,X?.id??"")});if(me==="assign")return b({ok:!0,alert:Je.assign(Z.id,j.ownerActorId==="me"?X?.id:j.ownerActorId?String(j.ownerActorId):void 0,X?.id)});if(me==="silence"){if(ae.role!=="admin")return b({ok:!1,error:"Silencing production alerts requires an administrator."},403);let le=Ft.resolveSession(C);if(Re&&(!le||!we.isRecentlyAuthenticated(le)))return b({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return b({ok:!0,alert:Je.silenceAlert(Z.id,String(j.until??""),X?.id)})}return b({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(L.pathname==="/api/alerts/silences"&&C.method==="POST"){let j=await ie(C);return b({ok:!0,id:Je.createSilence({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),matcher:j.matcher,reason:String(j.reason??""),startsAt:String(j.startsAt??new Date().toISOString()),endsAt:String(j.endsAt??""),timezone:String(j.timezone??"UTC"),actorId:X?.id})},201)}if(L.pathname==="/api/notifications/channels"&&C.method==="GET")return b({ok:!0,channels:Je.listChannels(a.organization.id)});if(L.pathname==="/api/notifications/channels"&&C.method==="POST"){let j=await ie(C),Z=String(j.kind??""),me=Z==="email"?{to:j.config?.to,from:j.config?.from}:Z==="telegram"?{chatId:String(j.config?.chatId??"")}:{};return b({ok:!0,channel:Je.createChannel({organizationId:a.organization.id,name:String(j.name??""),kind:Z,config:me,credential:j.credential?String(j.credential):void 0,actorId:X?.id})},201)}if(L.pathname==="/api/notifications/channels"&&C.method==="PATCH"){let j=await ie(C),Z=String(j.id??"");if(j.credential)return b({ok:!0,channel:Je.rotateChannel(Z,String(j.credential))});let me=String(j.status??"paused");if(!["active","paused","disabled"].includes(me))return b({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return b({ok:!0,channel:Je.setChannelStatus(Z,me)})}if(L.pathname==="/api/notifications/channels/test"&&C.method==="POST"){let j=await ie(C);return b({ok:!0,productionIncidentCreated:!1,result:await En.testChannel(String(j.id??""))})}if(L.pathname==="/api/notifications/routes"&&C.method==="GET")return b({ok:!0,routes:Je.listRoutes(a.organization.id)});if(L.pathname==="/api/notifications/routes"&&C.method==="POST"){let j=await ie(C),Z=Array.isArray(j.channelIds)?j.channelIds.map(String):[];if(Z.some((me)=>Je.getChannel(me)?.organizationId!==a.organization.id))return b({ok:!1,error:"Route contains an unavailable channel."},422);return b({ok:!0,route:Je.createRoute({organizationId:a.organization.id,name:String(j.name??""),priority:Number(j.priority)||0,matcher:j.matcher&&typeof j.matcher==="object"?j.matcher:{},channelIds:Z,quietHours:j.quietHours,groupWaitSeconds:Number(j.groupWaitSeconds)||30,reminderSeconds:j.reminderSeconds==null?void 0:Number(j.reminderSeconds),escalation:Array.isArray(j.escalation)?j.escalation:[],template:j.template?String(j.template):void 0,rateLimitPerMinute:Number(j.rateLimitPerMinute)||60,enabled:j.enabled!==!1})},201)}if(L.pathname==="/api/notifications/routes"&&C.method==="PATCH"){let j=await ie(C),Z=Je.getRoute(String(j.id??""));if(!Z||Z.organizationId!==a.organization.id)return b({ok:!1,error:"Notification route was not found."},404);return b({ok:!0,route:Je.setRouteEnabled(Z.id,j.enabled!==!1)})}if(L.pathname==="/api/notifications/routes/preview"&&C.method==="POST"){let j=await ie(C),me=(j.alertId?Je.getAlert(String(j.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),dedupKey:"preview",groupKey:String(j.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(j.severity))?j.severity:"warning",title:String(j.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return b({ok:!0,productionIncidentCreated:!1,matches:En.preview(a.organization.id,me,String(j.eventType??"firing")).map((le)=>({route:le.route,channels:le.channels,quiet:le.quiet}))})}if(L.pathname==="/api/notifications/deliveries"&&C.method==="GET")return b({ok:!0,deliveries:Je.listDeliveries({alertId:L.searchParams.get("alertId")??void 0,states:L.searchParams.getAll("state"),limit:Number(L.searchParams.get("limit"))||200})});if(L.pathname==="/api/notifications/deliveries/retry"&&C.method==="POST"){let j=await ie(C),Z=Je.getDelivery(String(j.id??""));if(!Z)return b({ok:!1,error:"Delivery was not found."},404);return Je.updateDelivery(Z.id,{state:"retrying",attempt:Math.max(0,Z.attempt-1),nextAttemptAt:new Date().toISOString()}),b({ok:!0,delivery:await En.deliver(Z.id)})}}if(L.pathname.startsWith("/api/jobs")||L.pathname.startsWith("/api/workers")){let d=a.environments.get(ye),l=a.store.listResources(a.project.id,d?.id),M=ae.role==="admin"||!!d&&la(ae,d.id,"automation:read")?l:l.filter((Se)=>yr(ae,Se.id,"automation:read")),F=(Se)=>!Se||M.some((Ae)=>Ae.id===Se),X=_e(ae).actor,j=W.get(ye)??D,Z=Wr(o,j),me=Z.filter((Se)=>!Se.danger&&["scheduler","backup","worker"].includes(Se.group)),le=H(o),Ge=()=>{let Se=Ft.resolveSession(C);return!Re||!!Se&&we.isRecentlyAuthenticated(Se)},be=(Se)=>{if(!Se||typeof Se!=="object"||Array.isArray(Se))return{};let Ae=Object.entries(Se).slice(0,50);if(Ae.some(([,Xe])=>typeof Xe!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(Xe)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(Ae)},Ne=(Se,Ae,Xe)=>a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,resourceId:Xe,actorId:X?.id,type:`job.${Se}`,payload:Ae});if(L.pathname==="/api/jobs/preview"&&C.method==="POST"){let Se=await ie(C);try{return b({ok:!0,productionExecutionCreated:!1,preview:dt(String(Se.expression??""),String(Se.timezone??"UTC"),new Date(Se.from?String(Se.from):Date.now()),Number(Se.count)||5)})}catch(Ae){return b({ok:!1,error:Ae instanceof Error?Ae.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(L.pathname==="/api/jobs"&&C.method==="GET")return b({ok:!0,jobs:hr.list(a.project.id,{environmentId:d?.id}).filter((Se)=>F(Se.resourceId)).map((Se)=>({...Se,preview:dt(Se.normalizedExpression,Se.timezone,new Date,5),capability:ii(Se),lastExecution:hr.listExecutions(Se.id,1)[0]}))});if(L.pathname==="/api/jobs"&&C.method==="POST"){let Se=await ie(C),Ae=String(Se.provider??(le==="serverless"?"eventbridge":"server")),Xe=le==="serverless"?"eventbridge":"server";if(Ae!==Xe)return b({ok:!1,error:`${le} environments accept ${Xe} schedules through this adapter.`},422);let ot=Se.operationId?String(Se.operationId):void 0;if(Ae==="server"&&(!ot||!me.some((Xt)=>Xt.id===ot)))return b({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let St=ii({provider:Ae,expression:String(Se.expression??""),flexibleMinutes:Number(Se.flexibleMinutes)||0,missedRunPolicy:Se.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Se.overlapPolicy))?Se.overlapPolicy:"forbid"});if(!St.supported)return b({ok:!1,error:St.notes.join(" ")},422);let fn=Se.resourceId?l.find((Xt)=>Xt.id===Se.resourceId||Xt.slug===Se.resourceId):void 0;if(Se.resourceId&&(!fn||!F(fn.id)))return b({ok:!1,error:"Job resource was not found."},404);try{let Xt=Ae==="server"?{kind:"dashboard_operation",operationId:ot}:{kind:"serverless_scheduler",action:"run"},bo=hr.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:fn?.id,name:String(Se.name??""),provider:Ae,expression:String(Se.expression??""),timezone:String(Se.timezone??"UTC"),startsAt:Se.startsAt?String(Se.startsAt):void 0,endsAt:Se.endsAt?String(Se.endsAt):void 0,flexibleMinutes:Number(Se.flexibleMinutes)||0,target:Xt,payloadRefs:be(Se.payloadRefs),missedRunPolicy:Se.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Se.overlapPolicy))?Se.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(Se.maxAttempts)||3,backoffSeconds:Number(Se.backoffSeconds)||30,deadLetterRef:Se.deadLetterRef?String(Se.deadLetterRef):void 0},timeoutSeconds:Number(Se.timeoutSeconds)||900,enabled:Se.enabled!==!1,origin:"managed",ownerActorId:X?.id,observedState:{},reconciliationStatus:"pending"});return Ne("created",{jobId:bo.id,provider:bo.provider,expression:bo.normalizedExpression},bo.resourceId),b({ok:!0,job:bo,capability:St},201)}catch(Xt){return b({ok:!1,error:Xt instanceof Error?Xt.message:"Scheduled job could not be created."},422)}}if(L.pathname==="/api/jobs"&&C.method==="PATCH"){let Se=await ie(C),Ae=hr.get(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);if(Ae.origin==="config")return b({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let Xe=Se.missedRunPolicy==null?void 0:String(Se.missedRunPolicy),ot=Se.overlapPolicy==null?void 0:String(Se.overlapPolicy);if(Xe&&!["skip","catch_up"].includes(Xe))return b({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ot&&!["allow","forbid","replace"].includes(ot))return b({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let St=hr.updateSchedule(Ae.id,{expression:Se.expression?String(Se.expression):void 0,timezone:Se.timezone?String(Se.timezone):void 0,missedRunPolicy:Xe,overlapPolicy:ot,timeoutSeconds:Se.timeoutSeconds==null?void 0:Number(Se.timeoutSeconds)});return Ne("updated",{jobId:St.id,expression:St.normalizedExpression,version:St.version},St.resourceId),b({ok:!0,job:St})}catch(St){return b({ok:!1,error:St instanceof Error?St.message:"Scheduled job could not be updated."},422)}}if(L.pathname==="/api/jobs/action"&&C.method==="POST"){let Se=await ie(C),Ae=hr.get(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);let Xe=String(Se.action??"");if(Xe==="run"){let ot=fp.enqueue(Ae,{trigger:"manual",actorId:X?.id});return Ne("run_queued",{jobId:Ae.id,executionId:ot.id},Ae.resourceId),b({ok:!0,execution:ot},202)}if(["disable","delete"].includes(Xe)&&d?.kind==="production"){if(String(Se.confirm??"")!==Xe)return b({ok:!1,error:`Type "${Xe}" to confirm this production change.`},409);if(!Ge())return b({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(Xe==="enable"||Xe==="disable"){let ot=hr.setEnabled(Ae.id,Xe==="enable");return Ne(Xe==="enable"?"enabled":"disabled",{jobId:Ae.id},Ae.resourceId),b({ok:!0,job:ot})}if(Xe==="delete")try{return hr.remove(Ae.id),Ne("deleted",{jobId:Ae.id,name:Ae.name},Ae.resourceId),b({ok:!0,deleted:Ae.id})}catch(ot){return b({ok:!1,error:ot instanceof Error?ot.message:"Scheduled job could not be deleted."},409)}return b({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(L.pathname==="/api/jobs/history"&&C.method==="GET"){let Se=hr.get(String(L.searchParams.get("jobId")??""));if(!Se||!F(Se.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);return b({ok:!0,executions:hr.listExecutions(Se.id,Number(L.searchParams.get("limit"))||100).map((Ae)=>({...Ae,logs:Ae.operationId?At.logs(Ae.operationId,{limit:500}):[]}))})}if(L.pathname==="/api/jobs/reconcile"&&C.method==="POST"){if(!d)return b({ok:!1,error:"Environment was not found."},404);let Se=Xr(hr,o,{organization:a.organization,project:a.project,environment:d,resources:l});return Ne("reconciled",Se),b({ok:!0,reconciliation:Se})}if(L.pathname==="/api/workers"&&C.method==="GET"){let Se=Array.isArray(j.workersDetail??j.workers)?j.workersDetail??j.workers:[];return b({ok:!0,workers:hr.listWorkers(a.project.id,d?.id).filter((Ae)=>F(Ae.resourceId)).map((Ae)=>{let Xe=Se.find((ot)=>ot.name===Ae.name||ot.site===Ae.target.site);return Xe?{...Ae,observedState:{...Ae.observedState,status:Xe.status??"configured",currentJob:Xe.currentJob??null,failures:Number(Xe.failed??Xe.failures)||0,processed:Number(Xe.processed)||0}}:Ae})})}if(L.pathname==="/api/workers/action"&&C.method==="POST"){let Se=await ie(C),Ae=hr.getWorker(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Worker was not found."},404);let Xe=String(Se.action??"");if(Xe==="restart"){if(String(Se.confirm??"")!==Ae.name)return b({ok:!1,error:`Type "${Ae.name}" to restart this worker.`},409);let ot=Z.find((Xt)=>Xt.id===Ae.target.operationId);if(!ot)return b({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let St=await Kr(o,ye,ot),fn=hr.reconcileWorker(Ae.id,St.ok?"in_sync":"unavailable",{...Ae.observedState,lastRestartAt:new Date().toISOString(),command:St.command??null,error:St.error??St.stderr??null});return Ne("worker_restarted",{workerId:Ae.id,ok:St.ok},Ae.resourceId),b({...St,worker:fn},St.ok?200:409)}if(Xe==="scale")return b({ok:!1,error:Ae.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return b({ok:!1,error:"Action must be restart or scale."},422)}}if(L.pathname.startsWith("/api/telemetry/")){let d=a.environments.get(ye),l=new et(a.store),k=a.store.listResources(a.project.id,d?.id),M=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(L.pathname)?"runtime:logs":"runtime:read",F=ae.role==="admin"||!!d&&la(ae,d.id,M),X=F?k:k.filter((be)=>yr(ae,be.id,M)),j=(be)=>Zy(X,F,be),Z=(be)=>{let Ne=new Date,Se={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},Ae=String(be.to??Ne.toISOString()),Xe=String(be.from??new Date(new Date(Ae).getTime()-(Se[String(be.range??"1h")]??Se["1h"])).toISOString()),ot=(fn)=>{let Xt=(Array.isArray(fn)?fn:String(fn??"").split(",")).map(String).filter(Boolean);return Xt.length?Xt:void 0},St=ot(be.kinds)?.filter((fn)=>["metric","log","trace","request","event"].includes(fn));return{projectId:a.project.id,environmentId:d?.id,resourceIds:j(be.resources),kinds:St,names:ot(be.names),sources:ot(be.sources),levels:ot(be.levels),from:Xe,to:Ae,text:String(be.text??"")||void 0,traceId:String(be.traceId??"")||void 0,requestId:String(be.requestId??"")||void 0,deploymentId:String(be.deploymentId??"")||void 0,releaseId:String(be.releaseId??"")||void 0,workloadId:String(be.workloadId??"")||void 0,cursor:String(be.cursor??"")||void 0,limit:Number(be.limit)||void 0}},me=Object.fromEntries(L.searchParams.entries()),le=(be=!1)=>ci({controlPlane:a.store,projectId:a.project.id,environmentId:d?.id,config:o,environment:ye,force:be,lightweight:!be}),Ge=()=>{let be=a.store.getSetting(`telemetry.collection:${a.project.id}:${d?.id??"all"}`)??{};return{generatedAt:String(be.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(be.statuses)?be.statuses:[],errors:Array.isArray(be.errors)?be.errors:[],policy:be.policy??Ze(a.store,a.project.id)}};if(L.pathname==="/api/telemetry/status"&&C.method==="GET"){le(!1);let be=Ge(),Ne=F?be.statuses:l.status(a.project.id,d?.id,be.policy.rawDays,be.policy.samplingRate,X.map((Ae)=>Ae.id)),Se=Ne.reduce((Ae,Xe)=>Ae+Xe.estimatedDailyBytes*30,0);return b({ok:!0,generatedAt:be.generatedAt,cached:be.cached,sources:Ne,errors:F?be.errors:[],policy:be.policy,retention:{rawDays:be.policy.rawDays,downsampleAfterDays:be.policy.downsampleAfterDays,downsampleBucketMs:be.policy.downsampleBucketMs,maxRecords:be.policy.maxRecords},estimatedMonthlyBytes:Se,estimatedMonthlyCostUsd:Si(Se,be.policy),costEstimateConfigured:be.policy.estimatedStorageUsdPerGbMonth>0})}if(L.pathname==="/api/telemetry/settings"&&C.method==="GET")return b({ok:!0,policy:Ze(a.store,a.project.id)});if(L.pathname==="/api/telemetry/settings"&&C.method==="PATCH"){let be=bi(a.store,a.project.id,await ie(C));return sb(a.project.id),b({ok:!0,policy:be})}if(L.pathname==="/api/telemetry/query"&&C.method==="GET"){le(!1);let be=Ge();return b({ok:!0,collection:{generatedAt:be.generatedAt,cached:be.cached},...l.query(Z(me))})}if(L.pathname==="/api/telemetry/tail"&&C.method==="GET"){le(!1);let be=new TextEncoder,Ne=new Date,Se=Z({...me,kinds:me.kinds||"log,request,event,trace",from:me.from||new Date(Ne.getTime()-120000).toISOString(),to:Ne.toISOString(),limit:Math.min(1000,Number(me.limit)||200),cursor:void 0}),Ae=C.headers.get("last-event-id")||String(me.cursor??"")||void 0,Xe,ot=!1,St=!1,fn=new ReadableStream({start(Xt){let bo=()=>{if(ot)return;if(ot=!0,Xe)clearInterval(Xe);C.signal.removeEventListener("abort",bo);try{Xt.close()}catch{}},Rp=async()=>{if(ot||St)return;St=!0;try{let Uo=l.tail({...Se,to:new Date(Date.now()+1000).toISOString()},Ae);for(let Pp of Uo.records)Ae=ao(Pp)??Ae,Xt.enqueue(be.encode(`id: ${Ae??""}
 event: record
 data: ${JSON.stringify(Pp)}
 
@@ -507,5 +507,5 @@ data: ${JSON.stringify({message:Uo instanceof Error?Uo.message:String(Uo)})}
 data: ${JSON.stringify({cursor:Ae,at:new Date().toISOString()})}
 
 `))},5000),Xe.unref?.(),C.signal.addEventListener("abort",bo,{once:!0})},cancel(){if(ot=!0,Xe)clearInterval(Xe)}});return new Response(fn,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(L.pathname==="/api/telemetry/series"&&C.method==="GET"){le(!1);let be=Ge(),Ne=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(me.aggregation))?me.aggregation:"avg",Se=Z({...me,kinds:"metric",limit:5000}),Ae=l.series({...Se,bucketMs:Number(me.bucketMs)||60000,aggregation:Ne,timezone:String(me.timezone??"UTC"),compareFrom:me.compareFrom,compareTo:me.compareTo});return b({ok:!0,collection:{generatedAt:be.generatedAt,cached:be.cached},query:{aggregation:Ne,bucketMs:Number(me.bucketMs)||60000,timezone:String(me.timezone??"UTC")},series:Ae})}if(L.pathname==="/api/telemetry/refresh"&&C.method==="POST")return b({ok:!0,...await le(!0)});if(L.pathname==="/api/telemetry/export"&&C.method==="POST"){let be=await ie(C);await le(!1);let Ne=l.query({...Z(be),limit:Math.min(5000,Number(be.limit)||5000),cursor:void 0});if((be.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:Z(be),...Ne},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let Ae=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],Xe=[Ae.join(","),...Ne.records.map((ot)=>Ae.map((St)=>`"${String(ot[St]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(Xe,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="GET"){let be=_e(ae);return b({ok:!0,queries:l.listSavedQueries(a.project.id,be.actor?.id)})}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="POST"){let be=await ie(C),Ne=_e(ae);return b({ok:!0,query:l.saveQuery(a.project.id,Ne.actor?.id,String(be.name??""),Z(be.query??be))},201)}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="DELETE"){let be=await ie(C),Ne=_e(ae),Se=l.deleteSavedQuery(a.project.id,Ne.actor?.id,String(be.id??""));return b({ok:Se},Se?200:404)}}if(L.pathname.startsWith("/api/configuration")){let d=a.environments.get(ye),l=ae.role==="admin"||!!Tn.capabilities?.includes("secrets:read"),k=ae.role==="admin"||!!Tn.capabilities?.includes("secrets:write"),M={projectId:a.project.id,environmentId:d?.id},F={"cache-control":"no-store"};if(L.pathname==="/api/configuration"&&C.method==="GET"){let X=Object.fromEntries(L.searchParams),j=X.scopeType||X.scopeId?sa(X,M):void 0,Z=["variable","secret"].includes(String(X.kind))?X.kind:void 0,me=j?.type==="preview"?Ht.previews.getInstance(j.id):void 0,le=me?Ht.previews.getDefinition(me.definitionId):void 0,Ge=j?await dn.resolve({projectId:a.project.id,environmentId:j.environmentId,resourceId:j.resourceId,functionId:j.type==="function"?j.id:void 0,previewId:j.previewId,trustedPreview:!!me&&!me.fork,allowedPreviewSecrets:le?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:l}):void 0,be=a.store.listResources(a.project.id);return b({ok:!0,entries:dn.list({projectId:a.project.id,scope:j,kind:Z,search:X.search,canReadSecretMetadata:l}),effectiveEntries:Ge?Object.values(Ge.entries).filter((Ne)=>!Z||Ne.kind===Z).filter((Ne)=>!X.search||Ne.key.toLowerCase().includes(String(X.search).toLowerCase())):[],configurationHash:Ge?.configurationHash,warnings:Ge?.warnings??[],scopes:{project:a.project,environments:a.store.listEnvironments(a.project.id),resources:be.filter((Ne)=>Ne.kind!=="function"),functions:be.filter((Ne)=>Ne.kind==="function"),previews:Ht.previews.listInstances({projectId:a.project.id}).filter((Ne)=>Ne.status!=="destroyed").map((Ne)=>({id:Ne.id,name:Ne.name,environmentId:Ne.baseEnvironmentId,resourceId:Ne.resourceId,fork:Ne.fork,status:Ne.status}))}},200,F)}if(L.pathname==="/api/configuration/export"&&C.method==="GET"){let X=sa(Object.fromEntries(L.searchParams),M);return new Response(dn.exportVariables({projectId:a.project.id,scope:X}),{headers:{...F,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(L.pathname==="/api/configuration/plan"&&C.method==="POST"){let X=await ie(C),j=sa(X,M),Z=X.values&&typeof X.values==="object"&&!Array.isArray(X.values)?Object.fromEntries(Object.entries(X.values).map(([me,le])=>[me,String(le)])):{};return b({ok:!0,plan:dn.plan({projectId:a.project.id,scope:j,values:Z,removeMissing:X.removeMissing===!0})},200,F)}if(L.pathname==="/api/configuration"&&C.method==="POST"){let X=await ie(C),j=sa(X,M),Z=X.kind==="secret"?"secret":"variable",me=String(X.key??"");if(Z==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let le=await dn.set({organizationId:a.organization.id,projectId:a.project.id,scope:j,key:me,kind:Z,value:X.value==null?void 0:String(X.value),reference:X.reference==null?void 0:String(X.reference),backend:X.backend,required:X.required===!0,expectedVersion:X.expectedVersion==null?void 0:Number(X.expectedVersion),confirmed:String(X.confirm??"")===me,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:_e(ae).actor?.id});return b({ok:!0,entry:dn.list({projectId:a.project.id,scope:j,canReadSecretMetadata:l}).find((Ge)=>Ge.id===le.entry.id),mutation:le.mutation,warnings:le.warnings},le.mutation.added.length?201:200,F)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le)},409,F)}}if(L.pathname==="/api/configuration/import"&&C.method==="POST"){let X=await ie(C),j=sa(X,M),Z=Array.isArray(X.secretKeys)?X.secretKeys.map(String):[];if(Z.length&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let me=await dn.importDotenv({organizationId:a.organization.id,projectId:a.project.id,scope:j,source:String(X.source??""),secretKeys:Z,backend:X.backend,confirmed:X.confirm==="import",idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:_e(ae).actor?.id});return b({ok:me.document.valid,diagnostics:me.document.diagnostics,mutation:me.mutation,warnings:me.warnings},me.document.valid?200:422,F)}catch(me){return b({ok:!1,error:me instanceof Error?me.message:String(me)},409,F)}}if(L.pathname==="/api/configuration/dependencies"&&C.method==="POST"){let X=await ie(C),j=po.get(String(X.entryId??"")),Z=a.store.getResource(String(X.resourceId??""));if(!j||j.projectId!==a.project.id||!Z||Z.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry or dependent resource was not found."},404,F);return b({ok:!0,dependency:po.setDependency({entryId:j.id,resourceId:Z.id,injectionTarget:["native_reference","file"].includes(String(X.injectionTarget))?X.injectionTarget:"environment",required:X.required!==!1,requiresRedeploy:X.requiresRedeploy!==!1,lastDeployedVersion:X.lastDeployedVersion==null?void 0:Number(X.lastDeployedVersion)})},200,F)}if(L.pathname==="/api/configuration/transfer"&&C.method==="POST"){let X=await ie(C),j=po.get(String(X.id??"")),Z=sa({...X,scopeType:X.targetScopeType,scopeId:X.targetScopeId},M);if(!j||j.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,F);if(j.kind==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let me=await dn.transfer({entryId:j.id,targetScope:Z,mode:X.mode==="move"?"move":"copy",confirmed:X.confirm===j.key,actorId:_e(ae).actor?.id,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey});return b({ok:!0,entry:dn.list({projectId:a.project.id,scope:Z,canReadSecretMetadata:l}).find((le)=>le.id===me.entry.id),mutation:me.mutation},200,F)}catch(me){return b({ok:!1,error:me instanceof Error?me.message:String(me)},409,F)}}if(L.pathname==="/api/configuration/bulk"&&C.method==="POST"){let X=await ie(C),j=Array.isArray(X.ids)?X.ids.map(String).slice(0,500):[],Z=j.map((le)=>po.get(le)).filter((le)=>!!le&&le.projectId===a.project.id);if(Z.length!==j.length)return b({ok:!1,error:"One or more configuration entries were not found."},404,F);if(Z.some((le)=>le.kind==="secret")&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);if(X.action!=="delete"||X.confirm!=="bulk")return b({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,F);let me=[];try{for(let le of Z)me.push(await dn.remove({entryId:le.id,expectedVersion:le.version,confirmed:!0,actorId:_e(ae).actor?.id}));return b({ok:!0,removed:me.flatMap((le)=>le.removed),affectedResourceIds:[...new Set(me.flatMap((le)=>le.affectedResourceIds))].sort()},200,F)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le),partial:me.flatMap((Ge)=>Ge.removed)},409,F)}}if(L.pathname==="/api/configuration/reveal"&&C.method==="POST"){let X=await ie(C),j=Ft.resolveSession(C);try{return b({ok:!0,value:await dn.reveal({entryId:String(X.id??""),canRevealSecrets:l,recentlyAuthenticated:!Re||!!j&&we.isRecentlyAuthenticated(j),actorId:_e(ae).actor?.id})},200,F)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},403,F)}}if(L.pathname==="/api/configuration"&&C.method==="DELETE"){let X=await ie(C),j=po.get(String(X.id??""));if(j?.kind==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);if(!j||j.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,F);try{return b({ok:!0,mutation:await dn.remove({entryId:j.id,expectedVersion:Number(X.expectedVersion),confirmed:String(X.confirm??"")===j.key,actorId:_e(ae).actor?.id})},200,F)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},409,F)}}}if(L.pathname.startsWith("/api/fleet")){let d=_e(ae).actor?.id,l=(k,M=409)=>b({ok:!1,error:k instanceof Error?k.message:String(k)},M,{"cache-control":"no-store"});if(L.pathname==="/api/fleet"&&C.method==="GET")return b({ok:!0,servers:ua.list(a.project.id),resources:a.store.listResources(a.project.id),operations:At.list({projectId:a.project.id,limit:200}).filter((k)=>k.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(L.pathname==="/api/fleet"&&C.method==="POST"){let k=await ie(C);try{return b({ok:!0,server:xi.enroll({organizationId:a.organization.id,projectId:a.project.id,name:String(k.name??""),provider:["aws","hetzner"].includes(String(k.provider))?k.provider:"ssh",providerId:k.providerId?String(k.providerId):void 0,region:k.region?String(k.region):void 0,zone:k.zone?String(k.zone):void 0,endpoint:String(k.endpoint??""),sshUser:String(k.sshUser??"deploy"),sshPort:k.sshPort?Number(k.sshPort):22,credentialRef:String(k.credentialRef??""),roles:Array.isArray(k.roles)?k.roles:[],labels:k.labels&&typeof k.labels==="object"?k.labels:{}})},201)}catch(M){return l(M,422)}}if(L.pathname==="/api/fleet/action"&&C.method==="POST"){let k=await ie(C),M=String(k.id??""),F=String(k.action??"");try{if(F==="test")return b({ok:!0,server:await xi.test(M)});if(F==="validate")return b({ok:!0,server:await xi.validate(M)});if(F==="review_host_key")return b({ok:!0,server:xi.reviewHostKey(M,String(k.fingerprint??""))});if(F==="bootstrap")return b({ok:!0,...xi.bootstrap(M,k.confirmed===!0)},k.confirmed===!0?202:200);if(F==="heartbeat")return b({ok:!0,server:xi.heartbeat(M,{usage:k.usage&&typeof k.usage==="object"?k.usage:{}})});if(F==="drain")return b({ok:!0,server:xi.drain(M,k.completed===!0)});if(F==="uncordon")return b({ok:!0,server:xi.uncordon(M)});if(F==="archive")return b({ok:!0,server:xi.archive(M,String(k.confirmation??""))});return l("Unsupported fleet action.",422)}catch(X){return l(X)}}}if(L.pathname.startsWith("/api/capacity")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(L.pathname==="/api/capacity"&&C.method==="GET")return b({ok:!0,pools:mo.listPools(a.project.id),placements:mo.listPlacements(a.project.id),servers:ua.list(a.project.id)},200,{"cache-control":"no-store"});if(L.pathname==="/api/capacity"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,pool:mo.createPool({organizationId:a.organization.id,projectId:a.project.id,name:String(l.name??""),purpose:String(l.purpose??"application"),backend:String(l.backend??"server"),region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{},requiredServerLabels:l.requiredServerLabels&&typeof l.requiredServerLabels==="object"?l.requiredServerLabels:{},toleratedTaints:Array.isArray(l.toleratedTaints)?l.toleratedTaints.map(String):[],capacity:l.capacity&&typeof l.capacity==="object"?l.capacity:{},maxWorkloads:Number(l.maxWorkloads??10),costWeight:Number(l.costWeight??1),spreadKey:l.spreadKey?String(l.spreadKey):void 0,concurrency:Number(l.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(k){return d(k,422)}}if(L.pathname==="/api/capacity/member"&&C.method==="POST"){let l=await ie(C);try{return mo.addMember(String(l.poolId??""),String(l.serverId??"")),b({ok:!0,pool:mo.getPool(String(l.poolId??""))})}catch(k){return d(k,422)}}if(L.pathname==="/api/capacity/explain"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,decisions:pp.explain(a.project.id,{purpose:String(l.purpose??"application"),resources:l.resources&&typeof l.resources==="object"?l.resources:{},region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{}})})}catch(k){return d(k,422)}}if(L.pathname==="/api/capacity/action"&&C.method==="POST"){let l=await ie(C);try{if(l.action==="drain")return b({ok:!0,...pp.drainPool(String(l.poolId??""))});if(l.action==="enable")return b({ok:!0,pool:mo.updatePool(String(l.poolId??""),{status:"active"})});if(l.action==="disable")return b({ok:!0,pool:mo.updatePool(String(l.poolId??""),{status:"disabled"})});return d("Unsupported capacity action.",422)}catch(k){return d(k,422)}}}if(L.pathname.startsWith("/api/regions")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(L.pathname==="/api/regions"&&C.method==="GET")return b({ok:!0,topologies:Fo.list(a.project.id).map((l)=>({topology:l,targets:Fo.targets(l.id),channels:Fo.channels(l.id),route:Fo.route(l.id),executions:Fo.executions(l.id)}))},200,{"cache-control":"no-store"});if(L.pathname==="/api/regions"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,topology:gp.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:a.environments.get(ye)?.id,name:String(l.name??""),hostname:String(l.hostname??""),regions:Array.isArray(l.regions)?l.regions:[],trafficPolicy:l.trafficPolicy==="weighted"||l.trafficPolicy==="latency"?l.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(l.replicate)?l.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(l.maxLagSeconds??30),retainOnDestroy:l.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:l.cdnEnabled===!0,wafEnabled:l.wafEnabled===!0})},201)}catch(k){return d(k,422)}}if(L.pathname==="/api/regions/action"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...gp.enqueue({topologyId:String(l.topologyId??""),kind:String(l.action??""),targetRegion:l.targetRegion?String(l.targetRegion):void 0,revision:l.revision?String(l.revision):void 0,manifest:l.manifest&&typeof l.manifest==="object"?l.manifest:{},confirmation:l.confirmation?String(l.confirmation):void 0,deleteData:l.deleteData===!0})},202)}catch(k){return d(k,422)}}}if(L.pathname.startsWith("/api/maintenance")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(L.pathname==="/api/maintenance"&&C.method==="GET")return b({ok:!0,manifests:ji.manifests(a.organization.id),windows:ji.windows(a.project.id),campaigns:ji.campaigns(a.project.id).map((l)=>({campaign:l,targets:ji.targets(l.id)})),cleanups:ji.cleanups(a.project.id),drills:ji.drills(a.project.id)},200,{"cache-control":"no-store"});if(L.pathname==="/api/maintenance/cleanup-preview"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,plan:await Od.previewCleanup({projectId:a.project.id,kind:String(l.kind??"operations"),criteria:{olderThanDays:Number(l.olderThanDays??30)}},mp)},201)}catch(k){return d(k,422)}}if(L.pathname==="/api/maintenance/cleanup-apply"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...Od.enqueueCleanup(String(l.planId??""),String(l.confirmation??""))},202)}catch(k){return d(k,422)}}if(L.pathname==="/api/maintenance/drill"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,drill:ji.createDrill({projectId:a.project.id,scenario:String(l.scenario??"control_plane"),isolatedTarget:String(l.isolatedTarget??""),expectedRpoMinutes:Number(l.expectedRpoMinutes??60),expectedRtoMinutes:Number(l.expectedRtoMinutes??30),recoveryPointId:l.recoveryPointId?String(l.recoveryPointId):void 0,topologyId:l.topologyId?String(l.topologyId):void 0})},201)}catch(k){return d(k,422)}}if(L.pathname==="/api/maintenance/drill-run"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...Od.enqueueDrill(String(l.drillId??""))},202)}catch(k){return d(k,422)}}}if(L.pathname.startsWith("/api/volumes")){let d=a.environments.get(ye),l=_e(ae).actor?.id,k=(M,F=409)=>b({ok:!1,error:M instanceof Error?M.message:String(M)},F,{"cache-control":"no-store"});if(L.pathname==="/api/volumes"&&C.method==="GET"){let M=xd.inventory(a.project.id,d?.id),F=a.store.listResources(a.project.id,d?.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind,provider:X.provider,providerId:X.providerId}));return b({ok:!0,volumes:M,resources:F,operations:At.list({projectId:a.project.id,limit:100}).filter((X)=>X.operation.kind.startsWith("volume.")),recoveryPoints:Kt.listRecoveryPoints(a.project.id).filter((X)=>X.kind==="volume"),providers:Dd.map((X)=>({provider:X.provider,type:X.type,capabilities:X.capabilities()}))},200,{"cache-control":"no-store"})}if(L.pathname==="/api/volumes"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:M.resourceId?String(M.resourceId):void 0,name:String(M.name??""),provider:String(M.provider??"docker"),type:M.type==="docker"?"docker":M.type,capacityBytes:M.capacityBytes==null?void 0:Number(M.capacityBytes),filesystem:M.filesystem?String(M.filesystem):void 0,encrypted:M.encrypted===!0,desiredState:M.desiredState&&typeof M.desiredState==="object"?M.desiredState:{},actorId:l})},202,{"cache-control":"no-store"})}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/attach"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.attach(String(M.volumeId??""),{resourceId:String(M.resourceId??""),targetPath:String(M.targetPath??""),readOnly:M.readOnly===!0,uid:M.uid==null?void 0:Number(M.uid),gid:M.gid==null?void 0:Number(M.gid),mode:M.mode?String(M.mode):void 0,propagation:M.propagation,driverOptions:M.driverOptions&&typeof M.driverOptions==="object"?M.driverOptions:{},actorId:l})},202)}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/detach"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.detach(String(M.volumeId??""),String(M.attachmentId??""),{force:M.force===!0,drained:M.drained===!0,unmounted:M.unmounted===!0,confirmation:M.confirmation?String(M.confirmation):void 0,actorId:l})},202)}catch(F){return k(F)}}if(L.pathname==="/api/volumes/resize"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.resize(String(M.volumeId??""),Number(M.capacityBytes),{drained:M.drained===!0,actorId:l})},202)}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/snapshot"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.snapshot(String(M.volumeId??""),{name:M.name?String(M.name):void 0,actorId:l})},202)}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/restore"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.restore(String(M.snapshotId??""),{name:String(M.name??""),actorId:l})},202)}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/discover"&&C.method==="POST")try{return b({ok:!0,volumes:await Fi.discover({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,actorId:l})})}catch(M){return k(M,502)}if(L.pathname==="/api/volumes/adopt"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,volume:Fi.adopt(String(M.volumeId??""),{name:String(M.name??""),actorId:l})})}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes"&&C.method==="DELETE"){let M=await ie(C),F=Ft.resolveSession(C);try{return b({ok:!0,...Fi.delete(String(M.volumeId??""),{recentAuthAt:!Re||F&&we.isRecentlyAuthenticated(F)?new Date().toISOString():void 0,confirmation:M.confirmation?String(M.confirmation):void 0,backupOverride:M.backupOverride===!0,backupOverrideConfirmation:M.backupOverrideConfirmation?String(M.backupOverrideConfirmation):void 0,actorId:l})},202)}catch(X){return k(X)}}}if(L.pathname==="/api/backups"&&C.method==="GET"){let d=a.environments.get(ye),l=Kt.listPolicies(a.project.id,d?.id),k=new Set(l.map((Z)=>Z.id)),M=Kt.listRecoveryPoints(a.project.id).filter((Z)=>!Z.policyId||k.has(Z.policyId)),F=Kt.listJobs(a.project.id).filter((Z)=>!Z.policyId||k.has(Z.policyId)),X=(Z)=>({...Z,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Z.credentialRef,clientEncryptionConfigured:!!Z.encryptionKeyRef}),j=await Promise.all(Kt.listDestinations(a.project.id).map(async(Z)=>({...X(Z),credentialStatus:await Oh(Z,Bi)})));return b({ok:!0,destinations:j,policies:l,recoveryPoints:M,jobs:F,coverage:Kt.coverage(a.project.id).filter((Z)=>k.has(Z.policy.id)),resources:d?a.store.listResources(a.project.id,d.id).map((Z)=>({id:Z.id,name:Z.name,slug:Z.slug,kind:Z.kind})):[]})}if(L.pathname==="/api/backups/destinations"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim(),k=String(d.provider??""),M=String(d.encryption??"provider"),F=`secret://data-services/backups/${a.project.id}/${l}`,X=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(k))return b({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(M))return b({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let j,Z;if(d.credentials&&typeof d.credentials==="object"&&!Array.isArray(d.credentials))j=`${F}/credentials`,await Bi.put(j,JSON.stringify(d.credentials)),X.push(j);if(M!=="provider"){let le=String(d.encryptionKey??"");if(le.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");Z=`${F}/encryption-key`,await Bi.put(Z,le),X.push(Z)}let me=Kt.createDestination({organizationId:a.organization.id,projectId:a.project.id,name:l,provider:k,endpoint:d.endpoint?String(d.endpoint):void 0,endpointPolicy:d.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:d.bucket?String(d.bucket):void 0,prefix:String(d.prefix??""),region:d.region?String(d.region):go,forcePathStyle:d.forcePathStyle===!0,credentialRef:j,encryption:M,encryptionKeyRef:Z,immutability:d.immutability&&typeof d.immutability==="object"&&!Array.isArray(d.immutability)?d.immutability:{},status:"untested"});return b({ok:!0,destination:{...me,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!j,clientEncryptionConfigured:!!Z}},201)}catch(j){for(let Z of X)await Bi.remove(Z).catch(()=>{});return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}if(L.pathname==="/api/backups/destinations/test"&&C.method==="POST"){let d=await ie(C),l=Kt.getDestination(String(d.id??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(l.provider==="aws_backup")return b({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await lp.test(l),b({ok:!0,destination:Kt.recordDestinationTest(l.id,{ok:!0})})}catch(k){let M=k instanceof Error?k.message:String(k);return Kt.recordDestinationTest(l.id,{ok:!1,error:M}),b({ok:!1,error:M},502)}}if(L.pathname==="/api/backups/policies"&&C.method==="POST"){let d=await ie(C),l=a.environments.get(ye),k=Kt.getDestination(String(d.destinationId??"")),M=String(d.resourceKind??""),F=d.dataServiceId?String(d.dataServiceId):void 0,X=F?Dt.get(F):void 0,j=d.resourceId?String(d.resourceId):void 0,Z=j?a.store.getResource(j):void 0;if(!l)return b({ok:!1,error:"Environment was not found."},404);if(!k||k.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(M))return b({ok:!1,error:"A supported backup resource kind is required."},422);if(F&&(!X||X.projectId!==a.project.id||X.environmentId!==l.id))return b({ok:!1,error:"Data service was not found in this environment."},404);if(j&&(!Z||Z.projectId!==a.project.id||Z.environmentId!==l.id))return b({ok:!1,error:"Resource was not found in this environment."},404);if(M==="managed_database"&&!X)return b({ok:!1,error:"Managed database policies require a data service."},422);if(M==="logical_database"&&(!X||!["container","server"].includes(X.provider)))return b({ok:!1,error:"Logical database policies require an on-box data service."},422);if(M==="volume"&&(!Z||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(d.volumeName??""))))return b({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let me=Array.isArray(d.includePatterns)?d.includePatterns.map(String).filter(Boolean):[];if(M==="files"&&(!Z||!me.length))return b({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(M==="control_plane"&&k.encryption==="provider")return b({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(M==="infrastructure"&&(k.provider!=="aws_backup"||!me.some((le)=>le.startsWith("resource:arn:"))||!me.some((le)=>le.startsWith("role:arn:"))))return b({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let le=Kt.createPolicy({organizationId:a.organization.id,projectId:a.project.id,environmentId:l.id,resourceId:j,dataServiceId:F,destinationId:k.id,name:String(d.name??"").trim(),resourceKind:M,schedule:String(d.schedule??"daily"),timezone:String(d.timezone??"UTC"),retention:d.retention&&typeof d.retention==="object"&&!Array.isArray(d.retention)?d.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(d.compression))?d.compression:"gzip",encryption:["destination","client_side","both"].includes(String(d.encryption))?d.encryption:"destination",includePatterns:M==="volume"?[String(d.volumeName),...me]:me,excludePatterns:Array.isArray(d.excludePatterns)?d.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(d.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(d.expectedRtoMinutes)||120),healthCheckId:d.healthCheckId?String(d.healthCheckId):void 0,enabled:d.enabled!==!1});return b({ok:!0,policy:le},201)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le)},422)}}if(L.pathname==="/api/backups/run"&&C.method==="POST"){let d=await ie(C),l=Kt.getPolicy(String(d.policyId??"")),k=a.environments.get(ye);if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Backup policy was not found in this environment."},404);try{let M=Bo.enqueueBackup(l,new Date().toISOString(),_e(ae).actor?.id);return b({ok:!0,job:M},202)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:String(M)},409)}}if(L.pathname==="/api/backups/verify"&&C.method==="POST"){let d=await ie(C),l=Kt.getRecoveryPoint(String(d.recoveryPointId??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);return b({ok:!0,job:Bo.enqueueVerification(l)},202)}if(L.pathname==="/api/backups/restore"&&C.method==="POST"){let d=await ie(C),l=Kt.getRecoveryPoint(String(d.recoveryPointId??"")),k=d.mode==="in_place"?"in_place":"isolated",M=d.target&&typeof d.target==="object"&&!Array.isArray(d.target)?{...d.target,inPlace:k==="in_place"}:{inPlace:k==="in_place"},F=Ft.resolveSession(C),X={mode:k,target:M,targetName:String(d.targetName??""),confirm:d.confirm?String(d.confirm):void 0,recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F),downtimeAcknowledged:d.downtimeAcknowledged===!0,safetyBackupId:d.safetyBackupId?String(d.safetyBackupId):void 0};if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.drill===!0&&k!=="isolated")return b({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let j=Bo.planRestore(l,X);if(d.execute!==!0)return b({ok:!0,plan:j,executionCreated:!1});let Z=Bo.enqueueRestore(l,{...X,drill:d.drill===!0,actorId:_e(ae).actor?.id});return b({ok:!0,plan:j,job:Z},202)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},409)}}if(L.pathname==="/api/backups/recovery-points"&&C.method==="POST"){let d=await ie(C),l=Kt.getRecoveryPoint(String(d.id??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.held==null&&d.pinned==null)return b({ok:!1,error:"held or pinned must be provided."},422);return b({ok:!0,recoveryPoint:Kt.updateRecoveryPoint(l.id,{held:d.held==null?l.held:d.held===!0,pinned:d.pinned==null?l.pinned:d.pinned===!0})})}if(L.pathname==="/api/backups/retention"&&C.method==="POST")return b({ok:!0,jobs:Bo.enqueueRetention()},202);if(L.pathname==="/api/data-services/capabilities"&&C.method==="GET"){let d=String(L.searchParams.get("engine")??""),l=String(L.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(d)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(l))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,engine:d,provider:l,capabilities:tr(d,l)})}if(L.pathname==="/api/data-services"&&C.method==="GET"){let d=a.environments.get(ye),l=Dt.list(a.project.id,d?.id).map((k)=>{let M=Dt.credential(k.id);return{...k,credentialRef:void 0,credential:M?{configured:!0,username:M.username,version:M.version,rotatedAt:M.rotatedAt}:void 0,dependencies:Dt.dependencies(k.id).map((F)=>({resourceId:F.resourceId,requiresRedeploy:F.requiresRedeploy}))}});return b({ok:!0,services:l})}if(L.pathname==="/api/data-services/preview"&&C.method==="POST"){let d=await ie(C);if(d.id){let M=Dt.get(String(d.id)),F=a.environments.get(ye),X=String(d.action??"");if(!M||M.projectId!==a.project.id||M.environmentId!==F?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Ad.includes(X))return b({ok:!1,error:`Action must be one of: ${Ad.join(", ")}.`},422);try{return b({ok:!0,plan:ja.plan(M,X,d.changes??{})})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}let l=String(d.engine??""),k=String(d.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(k))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,capabilities:tr(l,k),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(L.pathname==="/api/data-services"&&C.method==="POST"){let d=await ie(C),l=String(d.engine??""),k=String(d.provider??""),M=a.environments.get(ye),F=_e(ae);if(!M)return b({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(k))return b({ok:!1,error:"A supported engine and provider are required."},422);let X={organizationId:a.organization.id,projectId:a.project.id,environmentId:M.id,resourceId:d.resourceId?String(d.resourceId):void 0,name:String(d.name??"").trim(),engine:l,provider:k,placement:String(d.placement??d.name??"").trim(),engineVersion:d.engineVersion?String(d.engineVersion):void 0,plan:String(d.plan??(k==="aws_elasticache"?"cache.t4g.micro":k==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:d.storageGb==null?void 0:Number(d.storageGb),highAvailability:d.highAvailability===!0,publicExposure:d.publicExposure===!0,allowedCidrs:Array.isArray(d.allowedCidrs)?d.allowedCidrs.map(String):[],desiredState:d.desiredState&&typeof d.desiredState==="object"&&!Array.isArray(d.desiredState)?d.desiredState:{},observedState:{},origin:d.adopt===!0?"adopted":"managed",managementEnabled:d.adopt!==!0,ownerActorId:F.actor?.id,username:d.username?String(d.username):void 0};try{if(d.adopt===!0){let Z=Dt.create({...X,status:"adopted",credentialRef:void 0});return b({ok:!0,service:Z,readOnly:!0},201)}if(!up({provider:k,engine:l}))return b({ok:!1,error:`No ${k}/${l} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let j=await ja.create(X);return b({ok:!0,service:j.service,operationId:j.operationId,oneTimeCredential:j.credential},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}if(L.pathname==="/api/data-services/connections"&&C.method==="GET"){let d=Dt.get(String(L.searchParams.get("id")??"")),l=a.environments.get(ye);if(!d||d.projectId!==a.project.id||d.environmentId!==l?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);let k=typeof d.observedState.endpoint==="string"?d.observedState.endpoint:void 0,M=typeof d.observedState.readerEndpoint==="string"?d.observedState.readerEndpoint:void 0,F=Number(d.observedState.port)||(d.engine==="postgres"?5432:d.engine==="redis"?6379:d.engine==="mongodb"?27017:d.engine==="libsql"?8080:3306),X=typeof d.observedState.database==="string"?d.observedState.database:void 0,j=typeof d.observedState.tls==="boolean"?d.observedState.tls:d.provider.startsWith("aws_"),Z=[...k?[{type:d.publicExposure?"external":"internal",host:k,port:F,database:X,tls:j}]:[],...M?[{type:"internal",host:M,port:F,database:X,tls:j}]:[],{type:"tunnel",host:k??d.placement,port:F,database:X,tls:j}];return b({ok:!0,serviceId:d.id,guidance:zn(d,Z)})}if(L.pathname==="/api/data-services/action"&&C.method==="POST"){let d=await ie(C),l=Dt.get(String(d.id??"")),k=a.environments.get(ye),M=String(d.action??"");if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Ad.includes(M))return b({ok:!1,error:`Action must be one of: ${Ad.join(", ")}.`},422);let F=d.changes&&typeof d.changes==="object"&&!Array.isArray(d.changes)?d.changes:{};try{let X=ja.plan(l,M,F);if(d.execute!==!0)return b({ok:!0,plan:X,productionExecutionCreated:!1});let j=ja.enqueue(l,M,F,_e(ae).actor?.id);return b({ok:!0,plan:X,operationId:j},202)}catch(X){return b({ok:!1,error:X instanceof Error?X.message:String(X)},409)}}if(L.pathname==="/api/data-services/dependencies"&&C.method==="POST"){let d=await ie(C),l=Dt.get(String(d.id??"")),k=a.environments.get(ye),M=a.store.getResource(String(d.resourceId??""));if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M||M.projectId!==a.project.id||M.environmentId!==k?.id)return b({ok:!1,error:"Dependent resource was not found in this environment."},404);if(d.remove===!0)return b({ok:Dt.removeDependency(l.id,M.id)});return Dt.addDependency({serviceId:l.id,resourceId:M.id,secretRef:l.credentialRef??`secret://data-services/${l.projectId}/${l.name}`,requiresRedeploy:d.requiresRedeploy!==!1}),b({ok:!0,dependencies:Dt.dependencies(l.id).map((F)=>({resourceId:F.resourceId,requiresRedeploy:F.requiresRedeploy}))})}if(L.pathname==="/api/data-services/management"&&C.method==="POST"){let d=await ie(C),l=Dt.get(String(d.id??"")),k=a.environments.get(ye);if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(l.origin!=="adopted"||d.reviewed!==!0||d.confirm!==l.name)return b({ok:!1,error:`Enabling management requires reviewed=true and typing ${l.name}.`},409);return b({ok:!0,service:Dt.update(l.id,l.version,{managementEnabled:!0})})}if(L.pathname==="/api/data-services/reveal"&&C.method==="POST"){let d=await ie(C),l=Dt.get(String(d.id??"")),k=a.environments.get(ye),M=l?Dt.credential(l.id):void 0;if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M)return b({ok:!1,error:"No managed credential is configured."},404);return b({ok:!0,credential:{username:M.username,password:await Bi.resolve(M.secretRef),version:M.version}},200,{"cache-control":"no-store"})}if(L.pathname==="/api/databases"&&C.method==="GET")return b(await Rm(o,ye));if(L.pathname==="/api/databases"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim();if(!Xi(l))return b({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return b({...await Pm(o,ye,l),name:l})}if(L.pathname==="/api/databases/vitess"&&C.method==="GET"){let d=await _m(o,ye);return b({...d,unhealthy:Nm(d.tablets),missingPrimary:Mm(d)})}if(L.pathname==="/api/databases/vitess/provision"&&C.method==="POST"){let d=await ie(C);try{return b(await my(o,ye,{keyspace:String(d.keyspace??""),username:String(d.username??""),password:String(d.password??""),sharded:d.sharded===!0,confirm:String(d.confirm??"")}))}catch(l){return b({ok:!1,error:l instanceof Error?l.message:String(l)},422)}}if(L.pathname==="/api/databases/vitess/migrations"&&C.method==="GET"){let d=L.searchParams.get("keyspace")??void 0;return b(await py(o,ye,d))}if(L.pathname==="/api/databases/vitess/migrations/action"&&C.method==="POST"){let d=await ie(C),l=String(d.uuid??"").trim(),k=String(d.action??"");if(!["retry","cancel","cleanup","complete"].includes(k))return b({ok:!1,error:"Unknown migration action."},422);return b(await gy(o,ye,l,k))}if(L.pathname==="/api/databases/vitess/keyspaces"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim(),k=d.sharded===!0;return b(await dy(o,ye,l,{sharded:k}))}if(L.pathname==="/api/databases/vitess/vschema"&&C.method==="POST"){let d=await ie(C),l=String(d.keyspace??"").trim(),k=typeof d.vschema==="string"?d.vschema:JSON.stringify(d.vschema??null);return b(await uy(o,ye,l,k))}if(L.pathname==="/api/databases/vitess/schema"&&C.method==="POST"){let d=await ie(C),l=String(d.sql??"");return b(await ly(o,ye,l))}if(L.pathname==="/api/databases/vitess/install-client"&&C.method==="POST")return b(await cy(o,ye));if(L.pathname==="/api/databases/backups"&&C.method==="GET")return b(await Om(o,ye));if(L.pathname==="/api/databases/backup"&&C.method==="POST"){let d=await ie(C),l=String(d.database??"").trim();if(!Xi(l))return b({ok:!1,error:"Database name must be a valid identifier."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to back up this database.`},409);return b(await Dm(o,ye,l))}if(L.pathname==="/api/databases/users"&&C.method==="POST"){let d=await ie(C),l=String(d.username??"").trim(),k=String(d.password??""),M=String(d.database??"").trim()||void 0,F=d.access==="readonly"?"readonly":"all";if(!Xi(l))return b({ok:!1,error:"Username must be a valid identifier."},422);if(!k)return b({ok:!1,error:"Password is required."},422);if(M&&!Xi(M))return b({ok:!1,error:"Database must be a valid identifier."},422);return b({...await xm(o,ye,{username:l,password:k,database:M,access:F}),username:l})}if(L.pathname==="/api/dashboard-data")return Lt=W.get(ye)??await tt(ye),tt(ye),b(Yl(Lt,{user:Tn,slug:o.project.slug}));if(L.pathname==="/api/users"&&C.method==="GET")return b({ok:!0,users:nn(t).map(ia)});if(L.pathname==="/api/users"&&C.method==="POST"){let d=await ie(C),l=String(d.username??"").trim();if(!vd(l))return b({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let k=d.sites&&typeof d.sites==="object"?d.sites:{},M=new Set(Object.keys(o.sites??{})),F={};for(let[Z,me]of Object.entries(k)){if(!M.has(Z))return b({ok:!1,error:`Site '${Z}' was not found.`},404);if(me!=="owner"&&me!=="collaborator")return b({ok:!1,error:`Unknown site role '${me}'. Use 'owner' or 'collaborator'.`},422);F[Z]=me}let X=typeof d.password==="string"&&d.password.trim()?d.password.trim():void 0;if(X&&X.length<12)return b({ok:!1,error:"Password must be at least 12 characters."},422);let j=Na(t,{username:l,password:X,name:typeof d.name==="string"?d.name:void 0,sites:F});return Ya(a,nn(t)),di(),b({ok:!0,user:ia(j.user),password:j.password})}if(L.pathname==="/api/users"&&C.method==="DELETE"){let d=await ie(C),l=String(d.username??"").trim();if(l.toLowerCase()===ae.username.toLowerCase())return b({ok:!1,error:"You cannot remove your own account."},409);let k=Fn(nn(t),l),M=k?a.store.getActorByExternalId("user",`dashboard:${k.username.toLowerCase()}`):void 0,F=M?a.store.getMembershipForActor(a.organization.id,M.id):void 0;if(F&&F.source!=="legacy")return b({ok:!1,error:"Organization members must be removed from Organization access."},409);let X=Ql(t,l);if(!X.ok)return b(X,409);return Ya(a,nn(t)),ke.clear(),b({ok:!0,username:l})}if(L.pathname==="/api/actions/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.action?hA(d.action,ye):void 0;if(!l)return b({ok:!1,error:"Unknown dashboard action."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this action.`},409);let k=await zi({controlPlane:a,environment:ye,actor:ae,kind:`dashboard.action.${l.id}`,input:{action:l.id},execute:()=>ap(l,{cwd:t,cliEntry:i})});return b({...k.result,controlPlaneOperation:k.operation})}if(L.pathname==="/api/server/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.operation?ri(d.operation,o,Lt):void 0;if(!l)return b({ok:!1,error:"Unknown or unavailable server operation."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let k=ue(a,String(ye));await new rs(rt).run(new Ra,{...k,artifactRoot:t});let M=lr(rt,{scope:k,desiredConfigHash:a.project.desiredConfigHash});if(M.decision.outcome==="block")return b({ok:!1,error:`Operation blocked by security policy: ${M.decision.explanation}`,securityReview:M},409);let F=await zi({controlPlane:a,environment:ye,actor:ae,kind:`dashboard.server.${l.id}`,resourceSlug:l.target,input:{operation:l.id,target:l.target,to:d.to??null},execute:()=>Kr(o,ye,l,{to:d.to})});return b({...F.result,controlPlaneOperation:F.operation,securityReview:M})}if(L.pathname==="/api/server/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command on the server.'},409);let l=await zi({controlPlane:a,environment:ye,actor:ae,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>ar(o,ye,String(d.command??""))});return b({...l.result,controlPlaneOperation:l.operation})}if(L.pathname==="/api/serverless/operations")return b(rp(o,ye,Lt));if(L.pathname==="/api/serverless/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.operation?jy(d.operation,o,ye,Lt):void 0;if(!l)return b({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let k=await zi({controlPlane:a,environment:ye,actor:ae,kind:`dashboard.serverless.${l.id}`,input:{operation:l.id,min:d.min??null,max:d.max??null},execute:()=>Uy(o,ye,l,{min:d.min,max:d.max})});return Lt=await ps(o,ye),W.set(ye,Lt),b({...k.result,controlPlaneOperation:k.operation})}if(L.pathname==="/api/serverless/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command.'},409);return b(await zy(o,ye,String(d.command??"")))}if(L.pathname==="/api/serverless/dlq"&&C.method==="GET"){let d=Number(L.searchParams.get("max"))||10;return b(await Vy(o,ye,d))}if(L.pathname==="/api/serverless/dlq/redrive"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="redrive")return b({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return b(await qy(o,ye,{max:d.max,targetQueue:d.targetQueue}))}if(L.pathname==="/api/serverless/dlq/purge"&&C.method==="POST"){if((await C.json().catch(()=>({}))).confirm!=="purge")return b({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return b(await Gy(o,ye))}if(L.pathname==="/api/serverless/secrets"&&C.method==="GET")return b({secrets:Jy(o,ye)});if(L.pathname==="/api/serverless/secrets"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return b({ok:!1,error:"A secret id is required."},422);if(typeof d.value!=="string"||d.value==="")return b({ok:!1,error:"A non-empty value is required."},422);return b(await Hy(o,ye,l,d.value))}if(L.pathname==="/api/serverless/secrets"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return b({ok:!1,error:"A secret id is required."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to delete this secret.`},409);return b(await Wy(o,ye,l))}if(L.pathname==="/api/serverless/functions/config"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.mode??"").trim();if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to update this function.`},409);return b(await Ky(o,ye,l,{memory:d.memory,timeout:d.timeout}))}if(L.pathname==="/api/serverless/alarms"&&C.method==="GET")return b(await Qy(o,ye));if(L.pathname==="/api/serverless/alarms"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.preset??"").trim(),k=Number(d.threshold);if(!l)return b({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(k))return b({ok:!1,error:"A numeric threshold is required."},422);return b(await Yy(o,ye,l,k))}if(L.pathname==="/api/serverless/alarms"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),l=String(d.name??"").trim();if(!l)return b({ok:!1,error:"An alarm name is required."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to delete this alarm.`},409);return b(await Xy(o,ye,l))}if(L.pathname==="/api/serverless/traces"&&C.method==="GET"){let d=Number(L.searchParams.get("minutes"))||30;return b(await Ed(o,ye,d))}if(L.pathname==="/api/serverless/scheduler"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.action??"").trim();if(l!=="enable"&&l!=="disable"&&l!=="run")return b({ok:!1,error:"Unknown scheduler action."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to ${l} the scheduler.`},409);return b(await op(o,ye,l))}if(!fb(L.pathname,Tn))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(ye)}`}});let vs=await ki(ae,ye);if(!vs)return Rd("ts-cloud dashboard UI is unavailable.",503);return hb(vs,L.pathname)}catch(jo){if(e.verbose)console.error(jo);return b({ok:!1,error:jo?.message??String(jo)},500)}})();if(!Wt)return Wt;if(gt&&(L.pathname.startsWith("/api/")||L.pathname.startsWith("/auth/"))){let Ke;if((Ie.headers.get("content-type")||"").includes("application/json"))Ke=await Ie.json().catch(()=>{return});let vr=Ft.resolveUser(C),gr=vr?_e(vr).actor:void 0;a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,actorId:gr?.id,correlationId:Ve,type:Wt.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:Wt.status<400?"info":"warning",payload:eA(C.method,L.pathname,Ke,Wt.status,Date.now()-De)})}return Wt.headers.set("x-request-id",Ve),Wt}});Ua?.start();let Ob=e.spendLoop??!0,kp;if(Ob)(async()=>{let{SpendRunner:C,SpendLoopLease:Te,startSpendLoop:De}=await import("./chunk-f4mpkpbf.js"),{store:Ie}=await bb(a.store),Ve=new C({controlPlane:a.store,store:Ie,alerts:Je});kp=De(Ve,{lease:new Te(a.store,{owner:`dashboard:${process.pid}`}),onError:(gt)=>console.error(`[ts-cloud] spend cycle failed: ${gt instanceof Error?gt.message:String(gt)}`)})})();let _b=bs.stop.bind(bs);return bs.stop=(C)=>{clearInterval(Cp),clearInterval(Ep),clearInterval(Tp),clearInterval(Ip),clearInterval(wp),clearInterval(yp),clearInterval(bp),clearInterval(Sp),clearInterval(vp),di(),Yt.clear(),Ua?.stop(),kp?.();let Te=_b(C);if(Ua)Ua.settled().finally(()=>a.store.close());else a.store.close();return Te},{server:bs,url:`http://${r}:${bs.port}/`}}
+`);return new Response(Xe,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="GET"){let be=_e(ae);return b({ok:!0,queries:l.listSavedQueries(a.project.id,be.actor?.id)})}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="POST"){let be=await ie(C),Ne=_e(ae);return b({ok:!0,query:l.saveQuery(a.project.id,Ne.actor?.id,String(be.name??""),Z(be.query??be))},201)}if(L.pathname==="/api/telemetry/saved-queries"&&C.method==="DELETE"){let be=await ie(C),Ne=_e(ae),Se=l.deleteSavedQuery(a.project.id,Ne.actor?.id,String(be.id??""));return b({ok:Se},Se?200:404)}}if(L.pathname.startsWith("/api/configuration")){let d=a.environments.get(ye),l=ae.role==="admin"||!!Tn.capabilities?.includes("secrets:read"),k=ae.role==="admin"||!!Tn.capabilities?.includes("secrets:write"),M={projectId:a.project.id,environmentId:d?.id},F={"cache-control":"no-store"};if(L.pathname==="/api/configuration"&&C.method==="GET"){let X=Object.fromEntries(L.searchParams),j=X.scopeType||X.scopeId?sa(X,M):void 0,Z=["variable","secret"].includes(String(X.kind))?X.kind:void 0,me=j?.type==="preview"?Ht.previews.getInstance(j.id):void 0,le=me?Ht.previews.getDefinition(me.definitionId):void 0,Ge=j?await dn.resolve({projectId:a.project.id,environmentId:j.environmentId,resourceId:j.resourceId,functionId:j.type==="function"?j.id:void 0,previewId:j.previewId,trustedPreview:!!me&&!me.fork,allowedPreviewSecrets:le?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:l}):void 0,be=a.store.listResources(a.project.id);return b({ok:!0,entries:dn.list({projectId:a.project.id,scope:j,kind:Z,search:X.search,canReadSecretMetadata:l}),effectiveEntries:Ge?Object.values(Ge.entries).filter((Ne)=>!Z||Ne.kind===Z).filter((Ne)=>!X.search||Ne.key.toLowerCase().includes(String(X.search).toLowerCase())):[],configurationHash:Ge?.configurationHash,warnings:Ge?.warnings??[],scopes:{project:a.project,environments:a.store.listEnvironments(a.project.id),resources:be.filter((Ne)=>Ne.kind!=="function"),functions:be.filter((Ne)=>Ne.kind==="function"),previews:Ht.previews.listInstances({projectId:a.project.id}).filter((Ne)=>Ne.status!=="destroyed").map((Ne)=>({id:Ne.id,name:Ne.name,environmentId:Ne.baseEnvironmentId,resourceId:Ne.resourceId,fork:Ne.fork,status:Ne.status}))}},200,F)}if(L.pathname==="/api/configuration/export"&&C.method==="GET"){let X=sa(Object.fromEntries(L.searchParams),M);return new Response(dn.exportVariables({projectId:a.project.id,scope:X}),{headers:{...F,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(L.pathname==="/api/configuration/plan"&&C.method==="POST"){let X=await ie(C),j=sa(X,M),Z=X.values&&typeof X.values==="object"&&!Array.isArray(X.values)?Object.fromEntries(Object.entries(X.values).map(([me,le])=>[me,String(le)])):{};return b({ok:!0,plan:dn.plan({projectId:a.project.id,scope:j,values:Z,removeMissing:X.removeMissing===!0})},200,F)}if(L.pathname==="/api/configuration"&&C.method==="POST"){let X=await ie(C),j=sa(X,M),Z=X.kind==="secret"?"secret":"variable",me=String(X.key??"");if(Z==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let le=await dn.set({organizationId:a.organization.id,projectId:a.project.id,scope:j,key:me,kind:Z,value:X.value==null?void 0:String(X.value),reference:X.reference==null?void 0:String(X.reference),backend:X.backend,required:X.required===!0,expectedVersion:X.expectedVersion==null?void 0:Number(X.expectedVersion),confirmed:String(X.confirm??"")===me,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:_e(ae).actor?.id});return b({ok:!0,entry:dn.list({projectId:a.project.id,scope:j,canReadSecretMetadata:l}).find((Ge)=>Ge.id===le.entry.id),mutation:le.mutation,warnings:le.warnings},le.mutation.added.length?201:200,F)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le)},409,F)}}if(L.pathname==="/api/configuration/import"&&C.method==="POST"){let X=await ie(C),j=sa(X,M),Z=Array.isArray(X.secretKeys)?X.secretKeys.map(String):[];if(Z.length&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let me=await dn.importDotenv({organizationId:a.organization.id,projectId:a.project.id,scope:j,source:String(X.source??""),secretKeys:Z,backend:X.backend,confirmed:X.confirm==="import",idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:_e(ae).actor?.id});return b({ok:me.document.valid,diagnostics:me.document.diagnostics,mutation:me.mutation,warnings:me.warnings},me.document.valid?200:422,F)}catch(me){return b({ok:!1,error:me instanceof Error?me.message:String(me)},409,F)}}if(L.pathname==="/api/configuration/dependencies"&&C.method==="POST"){let X=await ie(C),j=po.get(String(X.entryId??"")),Z=a.store.getResource(String(X.resourceId??""));if(!j||j.projectId!==a.project.id||!Z||Z.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry or dependent resource was not found."},404,F);return b({ok:!0,dependency:po.setDependency({entryId:j.id,resourceId:Z.id,injectionTarget:["native_reference","file"].includes(String(X.injectionTarget))?X.injectionTarget:"environment",required:X.required!==!1,requiresRedeploy:X.requiresRedeploy!==!1,lastDeployedVersion:X.lastDeployedVersion==null?void 0:Number(X.lastDeployedVersion)})},200,F)}if(L.pathname==="/api/configuration/transfer"&&C.method==="POST"){let X=await ie(C),j=po.get(String(X.id??"")),Z=sa({...X,scopeType:X.targetScopeType,scopeId:X.targetScopeId},M);if(!j||j.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,F);if(j.kind==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let me=await dn.transfer({entryId:j.id,targetScope:Z,mode:X.mode==="move"?"move":"copy",confirmed:X.confirm===j.key,actorId:_e(ae).actor?.id,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey});return b({ok:!0,entry:dn.list({projectId:a.project.id,scope:Z,canReadSecretMetadata:l}).find((le)=>le.id===me.entry.id),mutation:me.mutation},200,F)}catch(me){return b({ok:!1,error:me instanceof Error?me.message:String(me)},409,F)}}if(L.pathname==="/api/configuration/bulk"&&C.method==="POST"){let X=await ie(C),j=Array.isArray(X.ids)?X.ids.map(String).slice(0,500):[],Z=j.map((le)=>po.get(le)).filter((le)=>!!le&&le.projectId===a.project.id);if(Z.length!==j.length)return b({ok:!1,error:"One or more configuration entries were not found."},404,F);if(Z.some((le)=>le.kind==="secret")&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);if(X.action!=="delete"||X.confirm!=="bulk")return b({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,F);let me=[];try{for(let le of Z)me.push(await dn.remove({entryId:le.id,expectedVersion:le.version,confirmed:!0,actorId:_e(ae).actor?.id}));return b({ok:!0,removed:me.flatMap((le)=>le.removed),affectedResourceIds:[...new Set(me.flatMap((le)=>le.affectedResourceIds))].sort()},200,F)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le),partial:me.flatMap((Ge)=>Ge.removed)},409,F)}}if(L.pathname==="/api/configuration/reveal"&&C.method==="POST"){let X=await ie(C),j=Ft.resolveSession(C);try{return b({ok:!0,value:await dn.reveal({entryId:String(X.id??""),canRevealSecrets:l,recentlyAuthenticated:!Re||!!j&&we.isRecentlyAuthenticated(j),actorId:_e(ae).actor?.id})},200,F)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},403,F)}}if(L.pathname==="/api/configuration"&&C.method==="DELETE"){let X=await ie(C),j=po.get(String(X.id??""));if(j?.kind==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);if(!j||j.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,F);try{return b({ok:!0,mutation:await dn.remove({entryId:j.id,expectedVersion:Number(X.expectedVersion),confirmed:String(X.confirm??"")===j.key,actorId:_e(ae).actor?.id})},200,F)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},409,F)}}}if(L.pathname.startsWith("/api/fleet")){let d=_e(ae).actor?.id,l=(k,M=409)=>b({ok:!1,error:k instanceof Error?k.message:String(k)},M,{"cache-control":"no-store"});if(L.pathname==="/api/fleet"&&C.method==="GET")return b({ok:!0,servers:ua.list(a.project.id),resources:a.store.listResources(a.project.id),operations:At.list({projectId:a.project.id,limit:200}).filter((k)=>k.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(L.pathname==="/api/fleet"&&C.method==="POST"){let k=await ie(C);try{return b({ok:!0,server:xi.enroll({organizationId:a.organization.id,projectId:a.project.id,name:String(k.name??""),provider:["aws","hetzner"].includes(String(k.provider))?k.provider:"ssh",providerId:k.providerId?String(k.providerId):void 0,region:k.region?String(k.region):void 0,zone:k.zone?String(k.zone):void 0,endpoint:String(k.endpoint??""),sshUser:String(k.sshUser??"deploy"),sshPort:k.sshPort?Number(k.sshPort):22,credentialRef:String(k.credentialRef??""),roles:Array.isArray(k.roles)?k.roles:[],labels:k.labels&&typeof k.labels==="object"?k.labels:{}})},201)}catch(M){return l(M,422)}}if(L.pathname==="/api/fleet/action"&&C.method==="POST"){let k=await ie(C),M=String(k.id??""),F=String(k.action??"");try{if(F==="test")return b({ok:!0,server:await xi.test(M)});if(F==="validate")return b({ok:!0,server:await xi.validate(M)});if(F==="review_host_key")return b({ok:!0,server:xi.reviewHostKey(M,String(k.fingerprint??""))});if(F==="bootstrap")return b({ok:!0,...xi.bootstrap(M,k.confirmed===!0)},k.confirmed===!0?202:200);if(F==="heartbeat")return b({ok:!0,server:xi.heartbeat(M,{usage:k.usage&&typeof k.usage==="object"?k.usage:{}})});if(F==="drain")return b({ok:!0,server:xi.drain(M,k.completed===!0)});if(F==="uncordon")return b({ok:!0,server:xi.uncordon(M)});if(F==="archive")return b({ok:!0,server:xi.archive(M,String(k.confirmation??""))});return l("Unsupported fleet action.",422)}catch(X){return l(X)}}}if(L.pathname.startsWith("/api/capacity")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(L.pathname==="/api/capacity"&&C.method==="GET")return b({ok:!0,pools:mo.listPools(a.project.id),placements:mo.listPlacements(a.project.id),servers:ua.list(a.project.id)},200,{"cache-control":"no-store"});if(L.pathname==="/api/capacity"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,pool:mo.createPool({organizationId:a.organization.id,projectId:a.project.id,name:String(l.name??""),purpose:String(l.purpose??"application"),backend:String(l.backend??"server"),region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{},requiredServerLabels:l.requiredServerLabels&&typeof l.requiredServerLabels==="object"?l.requiredServerLabels:{},toleratedTaints:Array.isArray(l.toleratedTaints)?l.toleratedTaints.map(String):[],capacity:l.capacity&&typeof l.capacity==="object"?l.capacity:{},maxWorkloads:Number(l.maxWorkloads??10),costWeight:Number(l.costWeight??1),spreadKey:l.spreadKey?String(l.spreadKey):void 0,concurrency:Number(l.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(k){return d(k,422)}}if(L.pathname==="/api/capacity/member"&&C.method==="POST"){let l=await ie(C);try{return mo.addMember(String(l.poolId??""),String(l.serverId??"")),b({ok:!0,pool:mo.getPool(String(l.poolId??""))})}catch(k){return d(k,422)}}if(L.pathname==="/api/capacity/explain"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,decisions:pp.explain(a.project.id,{purpose:String(l.purpose??"application"),resources:l.resources&&typeof l.resources==="object"?l.resources:{},region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{}})})}catch(k){return d(k,422)}}if(L.pathname==="/api/capacity/action"&&C.method==="POST"){let l=await ie(C);try{if(l.action==="drain")return b({ok:!0,...pp.drainPool(String(l.poolId??""))});if(l.action==="enable")return b({ok:!0,pool:mo.updatePool(String(l.poolId??""),{status:"active"})});if(l.action==="disable")return b({ok:!0,pool:mo.updatePool(String(l.poolId??""),{status:"disabled"})});return d("Unsupported capacity action.",422)}catch(k){return d(k,422)}}}if(L.pathname.startsWith("/api/regions")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(L.pathname==="/api/regions"&&C.method==="GET")return b({ok:!0,topologies:Fo.list(a.project.id).map((l)=>({topology:l,targets:Fo.targets(l.id),channels:Fo.channels(l.id),route:Fo.route(l.id),executions:Fo.executions(l.id)}))},200,{"cache-control":"no-store"});if(L.pathname==="/api/regions"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,topology:gp.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:a.environments.get(ye)?.id,name:String(l.name??""),hostname:String(l.hostname??""),regions:Array.isArray(l.regions)?l.regions:[],trafficPolicy:l.trafficPolicy==="weighted"||l.trafficPolicy==="latency"?l.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(l.replicate)?l.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(l.maxLagSeconds??30),retainOnDestroy:l.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:l.cdnEnabled===!0,wafEnabled:l.wafEnabled===!0})},201)}catch(k){return d(k,422)}}if(L.pathname==="/api/regions/action"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...gp.enqueue({topologyId:String(l.topologyId??""),kind:String(l.action??""),targetRegion:l.targetRegion?String(l.targetRegion):void 0,revision:l.revision?String(l.revision):void 0,manifest:l.manifest&&typeof l.manifest==="object"?l.manifest:{},confirmation:l.confirmation?String(l.confirmation):void 0,deleteData:l.deleteData===!0})},202)}catch(k){return d(k,422)}}}if(L.pathname.startsWith("/api/maintenance")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(L.pathname==="/api/maintenance"&&C.method==="GET")return b({ok:!0,manifests:ji.manifests(a.organization.id),windows:ji.windows(a.project.id),campaigns:ji.campaigns(a.project.id).map((l)=>({campaign:l,targets:ji.targets(l.id)})),cleanups:ji.cleanups(a.project.id),drills:ji.drills(a.project.id)},200,{"cache-control":"no-store"});if(L.pathname==="/api/maintenance/cleanup-preview"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,plan:await Od.previewCleanup({projectId:a.project.id,kind:String(l.kind??"operations"),criteria:{olderThanDays:Number(l.olderThanDays??30)}},mp)},201)}catch(k){return d(k,422)}}if(L.pathname==="/api/maintenance/cleanup-apply"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...Od.enqueueCleanup(String(l.planId??""),String(l.confirmation??""))},202)}catch(k){return d(k,422)}}if(L.pathname==="/api/maintenance/drill"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,drill:ji.createDrill({projectId:a.project.id,scenario:String(l.scenario??"control_plane"),isolatedTarget:String(l.isolatedTarget??""),expectedRpoMinutes:Number(l.expectedRpoMinutes??60),expectedRtoMinutes:Number(l.expectedRtoMinutes??30),recoveryPointId:l.recoveryPointId?String(l.recoveryPointId):void 0,topologyId:l.topologyId?String(l.topologyId):void 0})},201)}catch(k){return d(k,422)}}if(L.pathname==="/api/maintenance/drill-run"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...Od.enqueueDrill(String(l.drillId??""))},202)}catch(k){return d(k,422)}}}if(L.pathname.startsWith("/api/volumes")){let d=a.environments.get(ye),l=_e(ae).actor?.id,k=(M,F=409)=>b({ok:!1,error:M instanceof Error?M.message:String(M)},F,{"cache-control":"no-store"});if(L.pathname==="/api/volumes"&&C.method==="GET"){let M=xd.inventory(a.project.id,d?.id),F=a.store.listResources(a.project.id,d?.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind,provider:X.provider,providerId:X.providerId}));return b({ok:!0,volumes:M,resources:F,operations:At.list({projectId:a.project.id,limit:100}).filter((X)=>X.operation.kind.startsWith("volume.")),recoveryPoints:Kt.listRecoveryPoints(a.project.id).filter((X)=>X.kind==="volume"),providers:Dd.map((X)=>({provider:X.provider,type:X.type,capabilities:X.capabilities()}))},200,{"cache-control":"no-store"})}if(L.pathname==="/api/volumes"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:M.resourceId?String(M.resourceId):void 0,name:String(M.name??""),provider:String(M.provider??"docker"),type:M.type==="docker"?"docker":M.type,capacityBytes:M.capacityBytes==null?void 0:Number(M.capacityBytes),filesystem:M.filesystem?String(M.filesystem):void 0,encrypted:M.encrypted===!0,desiredState:M.desiredState&&typeof M.desiredState==="object"?M.desiredState:{},actorId:l})},202,{"cache-control":"no-store"})}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/attach"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.attach(String(M.volumeId??""),{resourceId:String(M.resourceId??""),targetPath:String(M.targetPath??""),readOnly:M.readOnly===!0,uid:M.uid==null?void 0:Number(M.uid),gid:M.gid==null?void 0:Number(M.gid),mode:M.mode?String(M.mode):void 0,propagation:M.propagation,driverOptions:M.driverOptions&&typeof M.driverOptions==="object"?M.driverOptions:{},actorId:l})},202)}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/detach"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.detach(String(M.volumeId??""),String(M.attachmentId??""),{force:M.force===!0,drained:M.drained===!0,unmounted:M.unmounted===!0,confirmation:M.confirmation?String(M.confirmation):void 0,actorId:l})},202)}catch(F){return k(F)}}if(L.pathname==="/api/volumes/resize"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.resize(String(M.volumeId??""),Number(M.capacityBytes),{drained:M.drained===!0,actorId:l})},202)}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/snapshot"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.snapshot(String(M.volumeId??""),{name:M.name?String(M.name):void 0,actorId:l})},202)}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/restore"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...Fi.restore(String(M.snapshotId??""),{name:String(M.name??""),actorId:l})},202)}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes/discover"&&C.method==="POST")try{return b({ok:!0,volumes:await Fi.discover({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,actorId:l})})}catch(M){return k(M,502)}if(L.pathname==="/api/volumes/adopt"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,volume:Fi.adopt(String(M.volumeId??""),{name:String(M.name??""),actorId:l})})}catch(F){return k(F,422)}}if(L.pathname==="/api/volumes"&&C.method==="DELETE"){let M=await ie(C),F=Ft.resolveSession(C);try{return b({ok:!0,...Fi.delete(String(M.volumeId??""),{recentAuthAt:!Re||F&&we.isRecentlyAuthenticated(F)?new Date().toISOString():void 0,confirmation:M.confirmation?String(M.confirmation):void 0,backupOverride:M.backupOverride===!0,backupOverrideConfirmation:M.backupOverrideConfirmation?String(M.backupOverrideConfirmation):void 0,actorId:l})},202)}catch(X){return k(X)}}}if(L.pathname==="/api/backups"&&C.method==="GET"){let d=a.environments.get(ye),l=Kt.listPolicies(a.project.id,d?.id),k=new Set(l.map((Z)=>Z.id)),M=Kt.listRecoveryPoints(a.project.id).filter((Z)=>!Z.policyId||k.has(Z.policyId)),F=Kt.listJobs(a.project.id).filter((Z)=>!Z.policyId||k.has(Z.policyId)),X=(Z)=>({...Z,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Z.credentialRef,clientEncryptionConfigured:!!Z.encryptionKeyRef}),j=await Promise.all(Kt.listDestinations(a.project.id).map(async(Z)=>({...X(Z),credentialStatus:await Oh(Z,Bi)})));return b({ok:!0,destinations:j,policies:l,recoveryPoints:M,jobs:F,coverage:Kt.coverage(a.project.id).filter((Z)=>k.has(Z.policy.id)),resources:d?a.store.listResources(a.project.id,d.id).map((Z)=>({id:Z.id,name:Z.name,slug:Z.slug,kind:Z.kind})):[]})}if(L.pathname==="/api/backups/destinations"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim(),k=String(d.provider??""),M=String(d.encryption??"provider"),F=`secret://data-services/backups/${a.project.id}/${l}`,X=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(k))return b({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(M))return b({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let j,Z;if(d.credentials&&typeof d.credentials==="object"&&!Array.isArray(d.credentials))j=`${F}/credentials`,await Bi.put(j,JSON.stringify(d.credentials)),X.push(j);if(M!=="provider"){let le=String(d.encryptionKey??"");if(le.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");Z=`${F}/encryption-key`,await Bi.put(Z,le),X.push(Z)}let me=Kt.createDestination({organizationId:a.organization.id,projectId:a.project.id,name:l,provider:k,endpoint:d.endpoint?String(d.endpoint):void 0,endpointPolicy:d.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:d.bucket?String(d.bucket):void 0,prefix:String(d.prefix??""),region:d.region?String(d.region):go,forcePathStyle:d.forcePathStyle===!0,credentialRef:j,encryption:M,encryptionKeyRef:Z,immutability:d.immutability&&typeof d.immutability==="object"&&!Array.isArray(d.immutability)?d.immutability:{},status:"untested"});return b({ok:!0,destination:{...me,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!j,clientEncryptionConfigured:!!Z}},201)}catch(j){for(let Z of X)await Bi.remove(Z).catch(()=>{});return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}if(L.pathname==="/api/backups/destinations/test"&&C.method==="POST"){let d=await ie(C),l=Kt.getDestination(String(d.id??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(l.provider==="aws_backup")return b({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await lp.test(l),b({ok:!0,destination:Kt.recordDestinationTest(l.id,{ok:!0})})}catch(k){let M=k instanceof Error?k.message:String(k);return Kt.recordDestinationTest(l.id,{ok:!1,error:M}),b({ok:!1,error:M},502)}}if(L.pathname==="/api/backups/policies"&&C.method==="POST"){let d=await ie(C),l=a.environments.get(ye),k=Kt.getDestination(String(d.destinationId??"")),M=String(d.resourceKind??""),F=d.dataServiceId?String(d.dataServiceId):void 0,X=F?Dt.get(F):void 0,j=d.resourceId?String(d.resourceId):void 0,Z=j?a.store.getResource(j):void 0;if(!l)return b({ok:!1,error:"Environment was not found."},404);if(!k||k.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(M))return b({ok:!1,error:"A supported backup resource kind is required."},422);if(F&&(!X||X.projectId!==a.project.id||X.environmentId!==l.id))return b({ok:!1,error:"Data service was not found in this environment."},404);if(j&&(!Z||Z.projectId!==a.project.id||Z.environmentId!==l.id))return b({ok:!1,error:"Resource was not found in this environment."},404);if(M==="managed_database"&&!X)return b({ok:!1,error:"Managed database policies require a data service."},422);if(M==="logical_database"&&(!X||!["container","server"].includes(X.provider)))return b({ok:!1,error:"Logical database policies require an on-box data service."},422);if(M==="volume"&&(!Z||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(d.volumeName??""))))return b({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let me=Array.isArray(d.includePatterns)?d.includePatterns.map(String).filter(Boolean):[];if(M==="files"&&(!Z||!me.length))return b({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(M==="control_plane"&&k.encryption==="provider")return b({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(M==="infrastructure"&&(k.provider!=="aws_backup"||!me.some((le)=>le.startsWith("resource:arn:"))||!me.some((le)=>le.startsWith("role:arn:"))))return b({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let le=Kt.createPolicy({organizationId:a.organization.id,projectId:a.project.id,environmentId:l.id,resourceId:j,dataServiceId:F,destinationId:k.id,name:String(d.name??"").trim(),resourceKind:M,schedule:String(d.schedule??"daily"),timezone:String(d.timezone??"UTC"),retention:d.retention&&typeof d.retention==="object"&&!Array.isArray(d.retention)?d.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(d.compression))?d.compression:"gzip",encryption:["destination","client_side","both"].includes(String(d.encryption))?d.encryption:"destination",includePatterns:M==="volume"?[String(d.volumeName),...me]:me,excludePatterns:Array.isArray(d.excludePatterns)?d.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(d.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(d.expectedRtoMinutes)||120),healthCheckId:d.healthCheckId?String(d.healthCheckId):void 0,enabled:d.enabled!==!1});return b({ok:!0,policy:le},201)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le)},422)}}if(L.pathname==="/api/backups/run"&&C.method==="POST"){let d=await ie(C),l=Kt.getPolicy(String(d.policyId??"")),k=a.environments.get(ye);if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Backup policy was not found in this environment."},404);try{let M=Bo.enqueueBackup(l,new Date().toISOString(),_e(ae).actor?.id);return b({ok:!0,job:M},202)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:String(M)},409)}}if(L.pathname==="/api/backups/verify"&&C.method==="POST"){let d=await ie(C),l=Kt.getRecoveryPoint(String(d.recoveryPointId??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);return b({ok:!0,job:Bo.enqueueVerification(l)},202)}if(L.pathname==="/api/backups/restore"&&C.method==="POST"){let d=await ie(C),l=Kt.getRecoveryPoint(String(d.recoveryPointId??"")),k=d.mode==="in_place"?"in_place":"isolated",M=d.target&&typeof d.target==="object"&&!Array.isArray(d.target)?{...d.target,inPlace:k==="in_place"}:{inPlace:k==="in_place"},F=Ft.resolveSession(C),X={mode:k,target:M,targetName:String(d.targetName??""),confirm:d.confirm?String(d.confirm):void 0,recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F),downtimeAcknowledged:d.downtimeAcknowledged===!0,safetyBackupId:d.safetyBackupId?String(d.safetyBackupId):void 0};if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.drill===!0&&k!=="isolated")return b({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let j=Bo.planRestore(l,X);if(d.execute!==!0)return b({ok:!0,plan:j,executionCreated:!1});let Z=Bo.enqueueRestore(l,{...X,drill:d.drill===!0,actorId:_e(ae).actor?.id});return b({ok:!0,plan:j,job:Z},202)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},409)}}if(L.pathname==="/api/backups/recovery-points"&&C.method==="POST"){let d=await ie(C),l=Kt.getRecoveryPoint(String(d.id??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.held==null&&d.pinned==null)return b({ok:!1,error:"held or pinned must be provided."},422);return b({ok:!0,recoveryPoint:Kt.updateRecoveryPoint(l.id,{held:d.held==null?l.held:d.held===!0,pinned:d.pinned==null?l.pinned:d.pinned===!0})})}if(L.pathname==="/api/backups/retention"&&C.method==="POST")return b({ok:!0,jobs:Bo.enqueueRetention()},202);if(L.pathname==="/api/data-services/capabilities"&&C.method==="GET"){let d=String(L.searchParams.get("engine")??""),l=String(L.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(d)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(l))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,engine:d,provider:l,capabilities:tr(d,l)})}if(L.pathname==="/api/data-services"&&C.method==="GET"){let d=a.environments.get(ye),l=Dt.list(a.project.id,d?.id).map((k)=>{let M=Dt.credential(k.id);return{...k,credentialRef:void 0,credential:M?{configured:!0,username:M.username,version:M.version,rotatedAt:M.rotatedAt}:void 0,dependencies:Dt.dependencies(k.id).map((F)=>({resourceId:F.resourceId,requiresRedeploy:F.requiresRedeploy}))}});return b({ok:!0,services:l})}if(L.pathname==="/api/data-services/preview"&&C.method==="POST"){let d=await ie(C);if(d.id){let M=Dt.get(String(d.id)),F=a.environments.get(ye),X=String(d.action??"");if(!M||M.projectId!==a.project.id||M.environmentId!==F?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Ad.includes(X))return b({ok:!1,error:`Action must be one of: ${Ad.join(", ")}.`},422);try{return b({ok:!0,plan:ja.plan(M,X,d.changes??{})})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}let l=String(d.engine??""),k=String(d.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(k))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,capabilities:tr(l,k),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(L.pathname==="/api/data-services"&&C.method==="POST"){let d=await ie(C),l=String(d.engine??""),k=String(d.provider??""),M=a.environments.get(ye),F=_e(ae);if(!M)return b({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(k))return b({ok:!1,error:"A supported engine and provider are required."},422);let X={organizationId:a.organization.id,projectId:a.project.id,environmentId:M.id,resourceId:d.resourceId?String(d.resourceId):void 0,name:String(d.name??"").trim(),engine:l,provider:k,placement:String(d.placement??d.name??"").trim(),engineVersion:d.engineVersion?String(d.engineVersion):void 0,plan:String(d.plan??(k==="aws_elasticache"?"cache.t4g.micro":k==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:d.storageGb==null?void 0:Number(d.storageGb),highAvailability:d.highAvailability===!0,publicExposure:d.publicExposure===!0,allowedCidrs:Array.isArray(d.allowedCidrs)?d.allowedCidrs.map(String):[],desiredState:d.desiredState&&typeof d.desiredState==="object"&&!Array.isArray(d.desiredState)?d.desiredState:{},observedState:{},origin:d.adopt===!0?"adopted":"managed",managementEnabled:d.adopt!==!0,ownerActorId:F.actor?.id,username:d.username?String(d.username):void 0};try{if(d.adopt===!0){let Z=Dt.create({...X,status:"adopted",credentialRef:void 0});return b({ok:!0,service:Z,readOnly:!0},201)}if(!up({provider:k,engine:l}))return b({ok:!1,error:`No ${k}/${l} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let j=await ja.create(X);return b({ok:!0,service:j.service,operationId:j.operationId,oneTimeCredential:j.credential},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}if(L.pathname==="/api/data-services/connections"&&C.method==="GET"){let d=Dt.get(String(L.searchParams.get("id")??"")),l=a.environments.get(ye);if(!d||d.projectId!==a.project.id||d.environmentId!==l?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);let k=typeof d.observedState.endpoint==="string"?d.observedState.endpoint:void 0,M=typeof d.observedState.readerEndpoint==="string"?d.observedState.readerEndpoint:void 0,F=Number(d.observedState.port)||(d.engine==="postgres"?5432:d.engine==="redis"?6379:d.engine==="mongodb"?27017:d.engine==="libsql"?8080:3306),X=typeof d.observedState.database==="string"?d.observedState.database:void 0,j=typeof d.observedState.tls==="boolean"?d.observedState.tls:d.provider.startsWith("aws_"),Z=[...k?[{type:d.publicExposure?"external":"internal",host:k,port:F,database:X,tls:j}]:[],...M?[{type:"internal",host:M,port:F,database:X,tls:j}]:[],{type:"tunnel",host:k??d.placement,port:F,database:X,tls:j}];return b({ok:!0,serviceId:d.id,guidance:zn(d,Z)})}if(L.pathname==="/api/data-services/action"&&C.method==="POST"){let d=await ie(C),l=Dt.get(String(d.id??"")),k=a.environments.get(ye),M=String(d.action??"");if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Ad.includes(M))return b({ok:!1,error:`Action must be one of: ${Ad.join(", ")}.`},422);let F=d.changes&&typeof d.changes==="object"&&!Array.isArray(d.changes)?d.changes:{};try{let X=ja.plan(l,M,F);if(d.execute!==!0)return b({ok:!0,plan:X,productionExecutionCreated:!1});let j=ja.enqueue(l,M,F,_e(ae).actor?.id);return b({ok:!0,plan:X,operationId:j},202)}catch(X){return b({ok:!1,error:X instanceof Error?X.message:String(X)},409)}}if(L.pathname==="/api/data-services/dependencies"&&C.method==="POST"){let d=await ie(C),l=Dt.get(String(d.id??"")),k=a.environments.get(ye),M=a.store.getResource(String(d.resourceId??""));if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M||M.projectId!==a.project.id||M.environmentId!==k?.id)return b({ok:!1,error:"Dependent resource was not found in this environment."},404);if(d.remove===!0)return b({ok:Dt.removeDependency(l.id,M.id)});return Dt.addDependency({serviceId:l.id,resourceId:M.id,secretRef:l.credentialRef??`secret://data-services/${l.projectId}/${l.name}`,requiresRedeploy:d.requiresRedeploy!==!1}),b({ok:!0,dependencies:Dt.dependencies(l.id).map((F)=>({resourceId:F.resourceId,requiresRedeploy:F.requiresRedeploy}))})}if(L.pathname==="/api/data-services/management"&&C.method==="POST"){let d=await ie(C),l=Dt.get(String(d.id??"")),k=a.environments.get(ye);if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(l.origin!=="adopted"||d.reviewed!==!0||d.confirm!==l.name)return b({ok:!1,error:`Enabling management requires reviewed=true and typing ${l.name}.`},409);return b({ok:!0,service:Dt.update(l.id,l.version,{managementEnabled:!0})})}if(L.pathname==="/api/data-services/reveal"&&C.method==="POST"){let d=await ie(C),l=Dt.get(String(d.id??"")),k=a.environments.get(ye),M=l?Dt.credential(l.id):void 0;if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M)return b({ok:!1,error:"No managed credential is configured."},404);return b({ok:!0,credential:{username:M.username,password:await Bi.resolve(M.secretRef),version:M.version}},200,{"cache-control":"no-store"})}if(L.pathname==="/api/databases"&&C.method==="GET")return b(await Rm(o,ye));if(L.pathname==="/api/databases"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim();if(!Xi(l))return b({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return b({...await Pm(o,ye,l),name:l})}if(L.pathname==="/api/databases/vitess"&&C.method==="GET"){let d=await _m(o,ye);return b({...d,unhealthy:Nm(d.tablets),missingPrimary:Mm(d)})}if(L.pathname==="/api/databases/vitess/provision"&&C.method==="POST"){let d=await ie(C);try{return b(await my(o,ye,{keyspace:String(d.keyspace??""),username:String(d.username??""),password:String(d.password??""),sharded:d.sharded===!0,confirm:String(d.confirm??"")}))}catch(l){return b({ok:!1,error:l instanceof Error?l.message:String(l)},422)}}if(L.pathname==="/api/databases/vitess/migrations"&&C.method==="GET"){let d=L.searchParams.get("keyspace")??void 0;return b(await py(o,ye,d))}if(L.pathname==="/api/databases/vitess/migrations/action"&&C.method==="POST"){let d=await ie(C),l=String(d.uuid??"").trim(),k=String(d.action??"");if(!["retry","cancel","cleanup","complete"].includes(k))return b({ok:!1,error:"Unknown migration action."},422);return b(await gy(o,ye,l,k))}if(L.pathname==="/api/databases/vitess/keyspaces"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim(),k=d.sharded===!0;return b(await dy(o,ye,l,{sharded:k}))}if(L.pathname==="/api/databases/vitess/vschema"&&C.method==="POST"){let d=await ie(C),l=String(d.keyspace??"").trim(),k=typeof d.vschema==="string"?d.vschema:JSON.stringify(d.vschema??null);return b(await uy(o,ye,l,k))}if(L.pathname==="/api/databases/vitess/schema"&&C.method==="POST"){let d=await ie(C),l=String(d.sql??"");return b(await ly(o,ye,l))}if(L.pathname==="/api/databases/vitess/install-client"&&C.method==="POST")return b(await cy(o,ye));if(L.pathname==="/api/databases/backups"&&C.method==="GET")return b(await Om(o,ye));if(L.pathname==="/api/databases/backup"&&C.method==="POST"){let d=await ie(C),l=String(d.database??"").trim();if(!Xi(l))return b({ok:!1,error:"Database name must be a valid identifier."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to back up this database.`},409);return b(await Dm(o,ye,l))}if(L.pathname==="/api/databases/users"&&C.method==="POST"){let d=await ie(C),l=String(d.username??"").trim(),k=String(d.password??""),M=String(d.database??"").trim()||void 0,F=d.access==="readonly"?"readonly":"all";if(!Xi(l))return b({ok:!1,error:"Username must be a valid identifier."},422);if(!k)return b({ok:!1,error:"Password is required."},422);if(M&&!Xi(M))return b({ok:!1,error:"Database must be a valid identifier."},422);return b({...await xm(o,ye,{username:l,password:k,database:M,access:F}),username:l})}if(L.pathname==="/api/dashboard-data")return Lt=W.get(ye)??await tt(ye),tt(ye),b(Yl(Lt,{user:Tn,slug:o.project.slug}));if(L.pathname==="/api/users"&&C.method==="GET")return b({ok:!0,users:nn(t).map(ia)});if(L.pathname==="/api/users"&&C.method==="POST"){let d=await ie(C),l=String(d.username??"").trim();if(!vd(l))return b({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let k=d.sites&&typeof d.sites==="object"?d.sites:{},M=new Set(Object.keys(o.sites??{})),F={};for(let[Z,me]of Object.entries(k)){if(!M.has(Z))return b({ok:!1,error:`Site '${Z}' was not found.`},404);if(me!=="owner"&&me!=="collaborator")return b({ok:!1,error:`Unknown site role '${me}'. Use 'owner' or 'collaborator'.`},422);F[Z]=me}let X=typeof d.password==="string"&&d.password.trim()?d.password.trim():void 0;if(X&&X.length<12)return b({ok:!1,error:"Password must be at least 12 characters."},422);let j=Na(t,{username:l,password:X,name:typeof d.name==="string"?d.name:void 0,sites:F});return Ya(a,nn(t)),di(),b({ok:!0,user:ia(j.user),password:j.password})}if(L.pathname==="/api/users"&&C.method==="DELETE"){let d=await ie(C),l=String(d.username??"").trim();if(l.toLowerCase()===ae.username.toLowerCase())return b({ok:!1,error:"You cannot remove your own account."},409);let k=Fn(nn(t),l),M=k?a.store.getActorByExternalId("user",`dashboard:${k.username.toLowerCase()}`):void 0,F=M?a.store.getMembershipForActor(a.organization.id,M.id):void 0;if(F&&F.source!=="legacy")return b({ok:!1,error:"Organization members must be removed from Organization access."},409);let X=Ql(t,l);if(!X.ok)return b(X,409);return Ya(a,nn(t)),ke.clear(),b({ok:!0,username:l})}if(L.pathname==="/api/actions/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.action?hA(d.action,ye):void 0;if(!l)return b({ok:!1,error:"Unknown dashboard action."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this action.`},409);let k=await zi({controlPlane:a,environment:ye,actor:ae,kind:`dashboard.action.${l.id}`,input:{action:l.id},execute:()=>ap(l,{cwd:t,cliEntry:i})});return b({...k.result,controlPlaneOperation:k.operation})}if(L.pathname==="/api/server/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.operation?ri(d.operation,o,Lt):void 0;if(!l)return b({ok:!1,error:"Unknown or unavailable server operation."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let k=ue(a,String(ye));await new rs(rt).run(new Ra,{...k,artifactRoot:t});let M=lr(rt,{scope:k,desiredConfigHash:a.project.desiredConfigHash});if(M.decision.outcome==="block")return b({ok:!1,error:`Operation blocked by security policy: ${M.decision.explanation}`,securityReview:M},409);let F=await zi({controlPlane:a,environment:ye,actor:ae,kind:`dashboard.server.${l.id}`,resourceSlug:l.target,input:{operation:l.id,target:l.target,to:d.to??null},execute:()=>Kr(o,ye,l,{to:d.to})});return b({...F.result,controlPlaneOperation:F.operation,securityReview:M})}if(L.pathname==="/api/server/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command on the server.'},409);let l=await zi({controlPlane:a,environment:ye,actor:ae,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>ar(o,ye,String(d.command??""))});return b({...l.result,controlPlaneOperation:l.operation})}if(L.pathname==="/api/serverless/operations")return b(rp(o,ye,Lt));if(L.pathname==="/api/serverless/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.operation?jy(d.operation,o,ye,Lt):void 0;if(!l)return b({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let k=await zi({controlPlane:a,environment:ye,actor:ae,kind:`dashboard.serverless.${l.id}`,input:{operation:l.id,min:d.min??null,max:d.max??null},execute:()=>Uy(o,ye,l,{min:d.min,max:d.max})});return Lt=await ps(o,ye),W.set(ye,Lt),b({...k.result,controlPlaneOperation:k.operation})}if(L.pathname==="/api/serverless/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command.'},409);return b(await zy(o,ye,String(d.command??"")))}if(L.pathname==="/api/serverless/dlq"&&C.method==="GET"){let d=Number(L.searchParams.get("max"))||10;return b(await Vy(o,ye,d))}if(L.pathname==="/api/serverless/dlq/redrive"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="redrive")return b({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return b(await qy(o,ye,{max:d.max,targetQueue:d.targetQueue}))}if(L.pathname==="/api/serverless/dlq/purge"&&C.method==="POST"){if((await C.json().catch(()=>({}))).confirm!=="purge")return b({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return b(await Gy(o,ye))}if(L.pathname==="/api/serverless/secrets"&&C.method==="GET")return b({secrets:Jy(o,ye)});if(L.pathname==="/api/serverless/secrets"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return b({ok:!1,error:"A secret id is required."},422);if(typeof d.value!=="string"||d.value==="")return b({ok:!1,error:"A non-empty value is required."},422);return b(await Hy(o,ye,l,d.value))}if(L.pathname==="/api/serverless/secrets"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return b({ok:!1,error:"A secret id is required."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to delete this secret.`},409);return b(await Wy(o,ye,l))}if(L.pathname==="/api/serverless/functions/config"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.mode??"").trim();if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to update this function.`},409);return b(await Ky(o,ye,l,{memory:d.memory,timeout:d.timeout}))}if(L.pathname==="/api/serverless/alarms"&&C.method==="GET")return b(await Qy(o,ye));if(L.pathname==="/api/serverless/alarms"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.preset??"").trim(),k=Number(d.threshold);if(!l)return b({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(k))return b({ok:!1,error:"A numeric threshold is required."},422);return b(await Yy(o,ye,l,k))}if(L.pathname==="/api/serverless/alarms"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),l=String(d.name??"").trim();if(!l)return b({ok:!1,error:"An alarm name is required."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to delete this alarm.`},409);return b(await Xy(o,ye,l))}if(L.pathname==="/api/serverless/traces"&&C.method==="GET"){let d=Number(L.searchParams.get("minutes"))||30;return b(await Ed(o,ye,d))}if(L.pathname==="/api/serverless/scheduler"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.action??"").trim();if(l!=="enable"&&l!=="disable"&&l!=="run")return b({ok:!1,error:"Unknown scheduler action."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to ${l} the scheduler.`},409);return b(await op(o,ye,l))}if(!fb(L.pathname,Tn))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(ye)}`}});let vs=await ki(ae,ye);if(!vs)return Rd("ts-cloud dashboard UI is unavailable.",503);return hb(vs,L.pathname)}catch(jo){if(e.verbose)console.error(jo);return b({ok:!1,error:jo?.message??String(jo)},500)}})();if(!Wt)return Wt;if(gt&&(L.pathname.startsWith("/api/")||L.pathname.startsWith("/auth/"))){let Ke;if((Ie.headers.get("content-type")||"").includes("application/json"))Ke=await Ie.json().catch(()=>{return});let vr=Ft.resolveUser(C),gr=vr?_e(vr).actor:void 0;a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,actorId:gr?.id,correlationId:Ve,type:Wt.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:Wt.status<400?"info":"warning",payload:eA(C.method,L.pathname,Ke,Wt.status,Date.now()-De)})}return Wt.headers.set("x-request-id",Ve),Wt}});Ua?.start();let Ob=e.spendLoop??!0,kp;if(Ob)(async()=>{let{SpendRunner:C,SpendLoopLease:Te,startSpendLoop:De}=await import("./chunk-vpt43nwa.js"),{store:Ie}=await bb(a.store),Ve=new C({controlPlane:a.store,store:Ie,alerts:Je});kp=De(Ve,{lease:new Te(a.store,{owner:`dashboard:${process.pid}`}),onError:(gt)=>console.error(`[ts-cloud] spend cycle failed: ${gt instanceof Error?gt.message:String(gt)}`)})})();let _b=bs.stop.bind(bs);return bs.stop=(C)=>{clearInterval(Cp),clearInterval(Ep),clearInterval(Tp),clearInterval(Ip),clearInterval(wp),clearInterval(yp),clearInterval(bp),clearInterval(Sp),clearInterval(vp),di(),Yt.clear(),Ua?.stop(),kp?.();let Te=_b(C);if(Ua)Ua.settled().finally(()=>a.store.close());else a.store.close();return Te},{server:bs,url:`http://${r}:${bs.port}/`}}
 export{Le,x,Nn,y,xn,Gi,_n,ns,zr,st,xe,On,$n,Ln,Mn,Un,Bn,jn,Vn,oe,tr,rr,zn,Hr,Hn,qn,Gn,Wn,Kn,Jn,Xn,Qn,at,nr,ir,Nt,qr,or,sr,Wi,xt,Yn,de,Zn,ei,ti,Gr,Wr,ri,Kr,ar,cr,ct,_t,Ot,Jr,ue,ni,lc,dc,lr,uc,q,Ki,qe,lt,dt,ii,Xr,oi,Qr,si,ai,Yr,is,pe,ve,Me,Ce,ci,dr};