@stacksjs/ts-cloud 0.16.82 → 0.16.83

package/dist/bin/{chunk-zn2efqcr.js → chunk-sge03gvm.js}

@@ -1,4 +1,4 @@
-import{pa,ze,I,H,w,U,$e,rr}from"./chunk-sacx9p6f.js";import{ce,Tn,ne,En,h,Br,da}from"./chunk-ssnvdxh4.js";import{Be,S,ms,hr,gi,fi,rn,vc,Ft,nn,gt,Ke,Fe,Je,Cc,ht,yr,je,Xe,hi,yi,ro,no,Qe,on,vr,yt,m,po,Is,Ps}from"./chunk-462swbg5.js";import{Jt,Xt,p}from"./chunk-btrxye8p.js";import{v}from"./chunk-yf2drw7r.js";import{g}from"./chunk-1wgyq50e.js";import{W,A,R,Tt,ko,Et,fn}from"./chunk-w9jfrf3v.js";import{Ze,Er,bo,O,mn,Hc,Gc,zt,Ii,Pi}from"./chunk-33xqndrp.js";import{zo}from"./chunk-20rfyk4x.js";import{fe}from"./chunk-zfn3a9sx.js";import{Ds,ks}from"./chunk-gy29teqh.js";import{Or,Pt,$r,Lr,Mr,Ur,Cn}from"./chunk-d0m01m6d.js";import{ae,q,Ti}from"./chunk-3wvpgb8m.js";import{E}from"./chunk-jqs2ywj2.js";import{V}from"./chunk-89v3ec9n.js";import{D}from"./chunk-19mhwmfp.js";import{J,ta,ra,Wo,Wt,z,na}from"./chunk-nzg624aj.js";import{Xs}from"./chunk-zn9wmqd1.js";import{bn}from"./chunk-gn7rdyz7.js";import{L,x,ca}from"./chunk-bkx2kapc.js";import{createCipheriv as Fb,createDecipheriv as jb,createHash as Bp,randomBytes as zi}from"node:crypto";import{createHmac as Lb,timingSafeEqual as Bb}from"node:crypto";var Bd="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Wa(e){let t=0,r=0,n="";for(let i of e){r=r<<8|i,t+=8;while(t>=5)n+=Bd[r>>>t-5&31],t-=5}if(t>0)n+=Bd[r<<5-t&31];return n}function Op(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,n=0,i=[];for(let o of t){let s=Bd.indexOf(o);if(s<0)throw Error("Invalid base32 secret");if(n=n<<5|s,r+=5,r>=8)i.push(n>>>r-8&255),r-=8}return Buffer.from(i)}function _p(e,t,r=6){let n=Buffer.alloc(8);n.writeBigUInt64BE(BigInt(t));let i=Lb("sha1",Op(e)).update(n).digest(),o=i[i.length-1]&15,s=(i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255;return String(s%10**r).padStart(r,"0")}function Ka(e,t,r=Date.now(),n=1){let i=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(i))return;let o=Buffer.from(i),s=Math.floor(r/1000/30);for(let c=-n;c<=n;c++){if(s+c<0)continue;let u=Buffer.from(_p(e,s+c));if(o.length===u.length&&Bb(o,u))return s+c}return}function Fd(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var Fp=1800000,vo=43200000,jp=3600000,Up=300000,zp=600000;function yn(e){return typeof e==="string"?e:void 0}function Vp(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function Ub(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function jd(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function zb(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function Vb(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function qb(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function Gb(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function Nn(e){return Bp("sha256").update(e).digest("hex")}function ga(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:yn(e.email),emailVerifiedAt:yn(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:yn(e.disabled_at),lastLoginAt:yn(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Np(e,t){let r=yn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Vp(e.metadata),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Ud(e,t){let r=yn(e.revoked_at),n=String(e.idle_expires_at),i=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:yn(e.user_agent),networkHint:yn(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:n,absoluteExpiresAt:i,recentAuthAt:String(e.recent_auth_at),mfaAt:yn(e.mfa_at),revokedAt:r,state:r?"revoked":n<=t||i<=t?"expired":"active"}}function $p(e){let t=yn(e.verified_at),r=yn(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function zd(e,t){let r=yn(e.consumed_at),n=String(e.expires_at),i=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:i,expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":i>=5?"locked":n<=t?"expired":"pending"}}function Mp(e){let t=Vp(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Qa(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Mp(e.scopes),allowedDomains:Mp(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Lp(e,t){let r=yn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Jb(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Me{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?Bp("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=zi(12),r=Fb("aes-256-gcm",this.encryptionKey,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted authentication value is unavailable");let o=jb("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=Ub(e.username),r=jd(e.email),n=e.id??this.idFn(),i=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
+import{pa,ze,I,H,w,U,$e,rr}from"./chunk-5xvvxh1f.js";import{ce,Tn,ne,En,h,Br,da}from"./chunk-eqw1dk00.js";import{Be,S,ms,hr,gi,fi,rn,vc,Ft,nn,gt,Ke,Fe,Je,Cc,ht,yr,je,Xe,hi,yi,ro,no,Qe,on,vr,yt,m,po,Is,Ps}from"./chunk-f1jkvaxm.js";import{Jt,Xt,p}from"./chunk-btrxye8p.js";import{v}from"./chunk-yf2drw7r.js";import{g}from"./chunk-1wgyq50e.js";import{W,A,R,Tt,ko,Et,fn}from"./chunk-859pmy2r.js";import{Ze,Er,bo,O,mn,Hc,Gc,zt,Ii,Pi}from"./chunk-3x9rma7g.js";import{zo}from"./chunk-c4krzg7x.js";import{fe}from"./chunk-zfn3a9sx.js";import{Ds,ks}from"./chunk-msvg10yf.js";import{Or,Pt,$r,Lr,Mr,Ur,Cn}from"./chunk-yd2vnd4y.js";import{ae,q,Ti}from"./chunk-8erhr0vh.js";import{E}from"./chunk-jqs2ywj2.js";import{V}from"./chunk-89v3ec9n.js";import{D}from"./chunk-19mhwmfp.js";import{J,ta,ra,Wo,Wt,z,na}from"./chunk-hkgbbph1.js";import{Xs}from"./chunk-zn9wmqd1.js";import{bn}from"./chunk-gn7rdyz7.js";import{L,x,ca}from"./chunk-bkx2kapc.js";import{createCipheriv as Fb,createDecipheriv as jb,createHash as Bp,randomBytes as zi}from"node:crypto";import{createHmac as Lb,timingSafeEqual as Bb}from"node:crypto";var Bd="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";function Wa(e){let t=0,r=0,n="";for(let i of e){r=r<<8|i,t+=8;while(t>=5)n+=Bd[r>>>t-5&31],t-=5}if(t>0)n+=Bd[r<<5-t&31];return n}function Op(e){let t=e.toUpperCase().replace(/[^A-Z2-7]/g,""),r=0,n=0,i=[];for(let o of t){let s=Bd.indexOf(o);if(s<0)throw Error("Invalid base32 secret");if(n=n<<5|s,r+=5,r>=8)i.push(n>>>r-8&255),r-=8}return Buffer.from(i)}function _p(e,t,r=6){let n=Buffer.alloc(8);n.writeBigUInt64BE(BigInt(t));let i=Lb("sha1",Op(e)).update(n).digest(),o=i[i.length-1]&15,s=(i[o]&127)<<24|(i[o+1]&255)<<16|(i[o+2]&255)<<8|i[o+3]&255;return String(s%10**r).padStart(r,"0")}function Ka(e,t,r=Date.now(),n=1){let i=t.replace(/[\s-]/g,"");if(!/^\d{6}$/.test(i))return;let o=Buffer.from(i),s=Math.floor(r/1000/30);for(let c=-n;c<=n;c++){if(s+c<0)continue;let u=Buffer.from(_p(e,s+c));if(o.length===u.length&&Bb(o,u))return s+c}return}function Fd(e){let t=e.issuer?.trim()||"ts-cloud",r=`${t}:${e.account}`;return`otpauth://totp/${encodeURIComponent(r)}?secret=${encodeURIComponent(e.secret)}&issuer=${encodeURIComponent(t)}&algorithm=SHA1&digits=6&period=30`}var Fp=1800000,vo=43200000,jp=3600000,Up=300000,zp=600000;function yn(e){return typeof e==="string"?e:void 0}function Vp(e){if(typeof e!=="string")return{};try{return JSON.parse(e)}catch{return{}}}function Ub(e){let t=e.trim();if(!/^[a-z0-9][a-z0-9._-]{1,31}$/i.test(t))throw Error("Username must be 2-32 characters: letters, numbers, dot, dash or underscore");return t}function jd(e){if(e===void 0||!e.trim())return;let t=e.trim().toLowerCase();if(!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)||t.length>254)throw Error("A valid email address is required");return t}function zb(e){let t=e.trim().toLowerCase();if(!/^[a-z0-9][a-z0-9-]{1,47}$/.test(t))throw Error("OIDC provider slug must be 2-48 lowercase letters, numbers or dashes");return t}function Vb(e){let t=new URL(e.trim());if(t.search||t.hash||t.username||t.password)throw Error("OIDC issuer cannot contain credentials, a query, or a fragment");if(t.protocol!=="https:"&&!(t.protocol==="http:"&&["127.0.0.1","::1","localhost"].includes(t.hostname)))throw Error("OIDC issuer must use HTTPS");return t.href.replace(/\/$/,"")}function qb(e){let t=[...new Set(e.map((r)=>r.trim().toLowerCase()).filter(Boolean))];if(t.length===0)throw Error("At least one explicit OIDC email domain is required");if(t.some((r)=>!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(r)||!r.includes(".")||r.includes("..")))throw Error("OIDC email domains must be explicit DNS names without wildcards");return t}function Gb(e){let t=[...new Set(["openid",...e??["email","profile"]].map((r)=>r.trim()).filter(Boolean))];if(t.some((r)=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(r)))throw Error("OIDC scopes contain unsupported characters");return t}function Nn(e){return Bp("sha256").update(e).digest("hex")}function ga(e){return{id:String(e.id),actorId:String(e.actor_id),username:String(e.username),email:yn(e.email),emailVerifiedAt:yn(e.email_verified_at),passwordHash:String(e.password_hash),credentialVersion:Number(e.credential_version),requiresPasswordUpgrade:Number(e.requires_password_upgrade)===1,disabledAt:yn(e.disabled_at),lastLoginAt:yn(e.last_login_at),createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Np(e,t){let r=yn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),identityId:String(e.identity_id),type:String(e.type),metadata:Vp(e.metadata),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Ud(e,t){let r=yn(e.revoked_at),n=String(e.idle_expires_at),i=String(e.absolute_expires_at);return{id:String(e.id),identityId:String(e.identity_id),credentialVersion:Number(e.credential_version),authMethod:String(e.auth_method),userAgent:yn(e.user_agent),networkHint:yn(e.network_hint),createdAt:String(e.created_at),lastUsedAt:String(e.last_used_at),idleExpiresAt:n,absoluteExpiresAt:i,recentAuthAt:String(e.recent_auth_at),mfaAt:yn(e.mfa_at),revokedAt:r,state:r?"revoked":n<=t||i<=t?"expired":"active"}}function $p(e){let t=yn(e.verified_at),r=yn(e.disabled_at);return{id:String(e.id),identityId:String(e.identity_id),type:"totp",label:String(e.label),createdAt:String(e.created_at),verifiedAt:t,disabledAt:r,state:r?"disabled":t?"active":"pending"}}function zd(e,t){let r=yn(e.consumed_at),n=String(e.expires_at),i=Number(e.attempts);return{id:String(e.id),identityId:String(e.identity_id),purpose:String(e.purpose),attempts:i,expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":i>=5?"locked":n<=t?"expired":"pending"}}function Mp(e){let t=Vp(e);return Array.isArray(t)?t.filter((r)=>typeof r==="string"):[]}function Qa(e){return{id:String(e.id),organizationId:String(e.organization_id),slug:String(e.slug),name:String(e.name),issuer:String(e.issuer),clientId:String(e.client_id),hasClientSecret:typeof e.client_secret_ciphertext==="string"&&e.client_secret_ciphertext.length>0,scopes:Mp(e.scopes),allowedDomains:Mp(e.allowed_domains),defaultRole:String(e.default_role),enabled:Number(e.enabled)===1,enforceSso:Number(e.enforce_sso)===1,createdAt:String(e.created_at),updatedAt:String(e.updated_at)}}function Lp(e,t){let r=yn(e.consumed_at),n=String(e.expires_at);return{id:String(e.id),providerId:String(e.provider_id),redirectUri:String(e.redirect_uri),returnPath:String(e.return_path),expiresAt:n,consumedAt:r,createdAt:String(e.created_at),state:r?"consumed":n<=t?"expired":"pending"}}function Jb(e){return{id:String(e.id),providerId:String(e.provider_id),identityId:String(e.identity_id),subject:String(e.subject),email:String(e.email),linkedAt:String(e.linked_at),lastLoginAt:String(e.last_login_at)}}class Me{controlPlane;nowFn;idFn;encryptionKey;constructor(e,t={}){this.controlPlane=e;this.nowFn=t.now??(()=>new Date),this.idFn=t.id??(()=>crypto.randomUUID()),this.encryptionKey=t.encryptionKey?Bp("sha256").update(t.encryptionKey).digest():void 0}now(){return this.nowFn().toISOString()}run(e,t){this.controlPlane.database.run(e,t)}encrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let t=zi(12),r=Fb("aes-256-gcm",this.encryptionKey,t),n=Buffer.concat([r.update(e,"utf8"),r.final()]);return`v1.${t.toString("base64url")}.${r.getAuthTag().toString("base64url")}.${n.toString("base64url")}`}decrypt(e){if(!this.encryptionKey)throw Error("Authentication encryption key is not configured");let[t,r,n,i]=e.split(".");if(t!=="v1"||!r||!n||!i)throw Error("Encrypted authentication value is unavailable");let o=jb("aes-256-gcm",this.encryptionKey,Buffer.from(r,"base64url"));return o.setAuthTag(Buffer.from(n,"base64url")),Buffer.concat([o.update(Buffer.from(i,"base64url")),o.final()]).toString("utf8")}createIdentity(e){if(!this.controlPlane.getActor(e.actorId))throw Error("Authentication actor was not found");let t=Ub(e.username),r=jd(e.email),n=e.id??this.idFn(),i=this.now();return this.run(`INSERT INTO auth_identities (id, actor_id, username, email, email_verified_at, password_hash, requires_password_upgrade, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,[n,e.actorId,t,r??null,e.emailVerified&&r?i:null,e.passwordHash,e.requiresPasswordUpgrade?1:0,i,i]),this.getIdentity(n)}getIdentity(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE id = ?").get(e);return t?ga(t):void 0}getIdentityByActor(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE actor_id = ?").get(e);return t?ga(t):void 0}getIdentityByUsername(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE username = ? COLLATE NOCASE").get(e.trim());return t?ga(t):void 0}getIdentityByEmail(e){let t=this.controlPlane.database.query("SELECT * FROM auth_identities WHERE email = ? COLLATE NOCASE").get(e.trim().toLowerCase());return t?ga(t):void 0}listIdentities(){return this.controlPlane.database.query("SELECT * FROM auth_identities ORDER BY username COLLATE NOCASE").all().map(ga)}updatePassword(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let i=this.now();return this.controlPlane.transaction(()=>{if(this.run(`UPDATE auth_identities SET password_hash = ?, credential_version = credential_version + 1,
         requires_password_upgrade = ?, updated_at = ? WHERE id = ?`,[t,r.requiresUpgrade?1:0,i,e]),r.revokeSessions!==!1)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[i,e])}),this.getIdentity(e)}rehashPassword(e,t){let r=this.now();this.run("UPDATE auth_identities SET password_hash = ?, requires_password_upgrade = 0, updated_at = ? WHERE id = ?",[t,r,e]);let n=this.getIdentity(e);if(!n)throw Error("Authentication identity was not found");return n}setVerifiedEmail(e,t){let r=jd(t),n=this.now();this.run("UPDATE auth_identities SET email = ?, email_verified_at = ?, updated_at = ? WHERE id = ?",[r,n,n,e]);let i=this.getIdentity(e);if(!i)throw Error("Authentication identity was not found");return i}recordLogin(e){let t=this.now();this.run("UPDATE auth_identities SET last_login_at = ?, updated_at = ? WHERE id = ?",[t,t,e]);let r=this.getIdentity(e);if(!r)throw Error("Authentication identity was not found");return r}setDisabled(e,t){let r=this.now();this.controlPlane.transaction(()=>{if(this.run("UPDATE auth_identities SET disabled_at = ?, credential_version = credential_version + 1, updated_at = ? WHERE id = ?",[t?r:null,r,e]),t)this.run("UPDATE auth_sessions SET revoked_at = ? WHERE identity_id = ? AND revoked_at IS NULL",[r,e])});let n=this.getIdentity(e);if(!n)throw Error("Authentication identity was not found");return n}createActionToken(e,t,r={}){if(!this.getIdentity(e))throw Error("Authentication identity was not found");let n=zi(32).toString("base64url"),i=this.idFn(),o=this.now(),s=new Date(this.nowFn().getTime()+Math.min(86400000,Math.max(60000,r.ttlMs??jp))).toISOString();return this.run("INSERT INTO auth_action_tokens (id, identity_id, type, token_hash, metadata, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)",[i,e,t,Nn(n),JSON.stringify(r.metadata??{}),s,o]),{actionToken:this.getActionToken(i),token:n}}getActionToken(e){let t=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE id = ?").get(e);return t?Np(t,this.now()):void 0}consumeActionToken(e,t){return this.controlPlane.transaction(()=>{let r=this.controlPlane.database.query("SELECT * FROM auth_action_tokens WHERE token_hash = ? AND type = ?").get(Nn(e),t);if(!r)throw Error("Action token is invalid");let n=Np(r,this.now());if(n.state!=="pending")throw Error(`Action token is ${n.state}`);if(this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL AND expires_at > ?",[this.now(),n.id,this.now()]).changes!==1)throw Error("Action token is no longer available");return this.getActionToken(n.id)})}revokeActionTokens(e,t){return this.controlPlane.database.run("UPDATE auth_action_tokens SET consumed_at = ? WHERE identity_id = ? AND type = ? AND consumed_at IS NULL",[this.now(),e,t]).changes}createSession(e){let t=this.getIdentity(e.identityId);if(!t||t.disabledAt)throw Error("Authentication identity is unavailable");let r=this.idFn(),n=zi(32).toString("base64url"),i=`v2.${r}.${n}`,o=this.now(),s=Math.min(86400000,Math.max(60000,e.idleTtlMs??Fp)),c=Math.min(2592000000,Math.max(s,e.absoluteTtlMs??vo));return this.run(`INSERT INTO auth_sessions (id, identity_id, token_hash, credential_version, auth_method, user_agent, network_hint,
       created_at, last_used_at, idle_expires_at, absolute_expires_at, recent_auth_at, mfa_at)
@@ -474,7 +474,7 @@ data: ${JSON.stringify({cursor:o,at:new Date().toISOString()})}
 ${c}
 ${u}`);return null}return n}catch(i){if(n)fs(n,{recursive:!0,force:!0});if(process.env.TSCLOUD_DASHBOARD_VERBOSE)console.warn(`ts-cloud dashboard: live UI build errored; serving the pre-built UI. ${i.message}`);return null}}function SA(e){let t=e.infrastructure?.compute?.managedServices?JSON.parse(JSON.stringify(e.infrastructure.compute.managedServices)):void 0;if(t?.vitess?.password)t.vitess.password="";return{project:{name:e.project?.name,slug:e.project?.slug,region:e.project?.region},provider:e.provider,environments:Object.keys(e.environments??{}),compute:e.infrastructure?.compute?{provider:e.infrastructure.compute.provider,runtime:e.infrastructure.compute.runtime,webServer:e.infrastructure.compute.webServer,proxy:e.infrastructure.compute.proxy?{engine:e.infrastructure.compute.proxy.engine,onDemandTls:e.infrastructure.compute.proxy.onDemandTls,cdn:!!e.infrastructure.compute.proxy.cdn}:void 0,managedServices:t,sshKeys:zt(aa(e)).map((r)=>({name:r.name,type:r.type,fingerprint:r.fingerprint,added:r.added}))}:void 0,sites:Object.fromEntries(Object.entries(e.sites??{}).map(([r,n])=>[r,{domain:n.domain,path:n.path,type:n.type,deploy:n.deploy,root:n.root,port:n.port,ssl:n.ssl}]))}}function Eb(e){return[{id:"status",label:"Refresh Cloud Status",description:"Runs the local ts-cloud status checks against configured providers.",command:["status","--env",e],mutates:!1},{id:"doctor",label:"Run Doctor",description:"Checks local tooling, credentials, and provider access.",command:["doctor"],mutates:!1},{id:"security-scan",label:"Security Scan",description:"Runs the pre-deploy scanner from this checkout.",command:["deploy:security-scan","--source",".","--fail-on","critical"],mutates:!1},{id:"deploy",label:"Deploy Environment",description:"Deploys the selected environment from the local checkout.",command:["deploy","--env",e,"--yes"],mutates:!0,confirm:"deploy"}]}function vA(e,t){return Eb(t).find((r)=>r.id===e)}function hb(e){if(e.length<=pb)return e;return`${e.slice(0,pb)}
 
-[output truncated]`}async function yb(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:u}=await n.read();if(c)break;let a=i.decode(u,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function dp(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([yb(r.stdout,"stdout",t.onOutput),yb(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:hb(i),stderr:hb(o)}}finally{t.signal?.removeEventListener("abort",n)}}function wA(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var IA=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function CA(e){let t=ja(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!IA.has(r)}var EA={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function bb(e,t){if(t.role==="admin")return!0;let r=ja(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!CA(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=EA[n];return!!i&&!!t.capabilities?.includes(i)}function TA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=JT(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Ct(e,i);if(uo(o)&&!Ib(o).isDirectory())return o;if(!ja(o)&&uo(`${o}.html`))return`${o}.html`;if(!ja(o)&&uo(Ct(o,"index.html")))return Ct(o,"index.html");return null}async function Sb(e,t){let r=TA(e,t);if(!r){let o=Ct(e,"404.html");if(uo(o))return new Response(await Bi(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return xd("Not found",404)}if(Ib(r).isDirectory())return xd("Not found",404);let n=await Bi(r),i=tA[ja(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var Rd=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],vb=new WeakMap;async function wb(e){let t=vb.get(e);if(t)return t;let r=await import("./chunk-y9qdpwa6.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return vb.set(e,i),i}async function fr(e={}){eA();let t=e.cwd??process.cwd(),r=e.host??YT,n=e.port??XT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await dA(t);let o=e.config??await Zi(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=w(o);if(s&&c&&!c.password)c.password=s;let u=o.infrastructure?.compute?.managedServices?.vitess;if(s&&u&&typeof u==="object"&&!u.password)u.password=s;let a=y(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let f=Object.keys(o.environments??{}),T=aA(o,e.environment),P=uA(t),N=await gs(o,T),K=new Map([[T,N]]),Y=new Map([[T,Date.now()]]),ee=new Map([[T,Date.now()]]),re=new Map,he=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),te=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),Pe=H(o)!=="serverless",tt=(C)=>{let Te=K.get(C);if(Te&&!gb(Y.get(C),Date.now(),he))return Promise.resolve(Te);let De=re.get(C);if(De)return De;let Ie=!Pe||gb(ee.get(C),Date.now(),te),Ve=gs(o,C,{includeSiteHealth:Ie}).then((ct)=>{let B=K.get(C),_r=Ie?ct:hA(B,ct);if(K.set(C,_r),Y.set(C,Date.now()),Ie)ee.set(C,Date.now());if(B?._serverReachable!==_r._serverReachable||B?._metricsStatus!==_r._metricsStatus||(B?.sitesDetail?.length??0)!==(_r.sitesDetail?.length??0))_n();return _r}).finally(()=>re.delete(C));return re.set(C,Ve),Ve},Ne=zo(t),Gt=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Gt!=="0"&&(Gt==="1"||!o.cloud?.attachTo)){let C=!1,Te=Date.now()+300000,De=async()=>{if(C)return;C=!0;try{let Ve=Date.now(),ct=Ve>=Te;if(ct)Te=Ve+300000;let B=a.environments.get(T);await pi({controlPlane:a.store,projectId:a.project.id,environmentId:B?.id,config:o,environment:T,force:!0,lightweight:!0,includeSiteHealth:ct})}catch(Ve){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ve instanceof Error?Ve.message:String(Ve)}`)}finally{C=!1}};De(),setInterval(()=>void De(),60000).unref?.()}let ke=new Map,He=new Map,At=new Set,Ei=0;function lo(C,Te){if(C.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`))return C;let De=a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),Ie=De?a.store.getMembershipForActor(a.organization.id,De.id):void 0;if(!Ie||Ie.status!=="active")return{...C,role:"member",sites:{},capabilities:[]};let Ve=a.store.listGrants(Ie.id),ct=a.store.resolveAuthorizationTarget(a.organization.id,Ie.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),B=En({membership:Ie,grants:Ve,target:ct});if(Ie.roleTemplate==="owner"||Ie.roleTemplate==="admin")return{...C,role:"admin",sites:{},organizationRole:Ie.roleTemplate,organizationSource:Ie.source,capabilities:B};let _r=a.environments.get(Te),Qt={};for(let Ye of a.store.listResources(a.project.id,_r?.id).filter((nt)=>nt.kind==="application")){let nt=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:Ye.id});if(!nt||!ne({membership:Ie,grants:Ve,capability:"project:read",target:nt}).allowed)continue;Qt[Ye.slug]=ne({membership:Ie,grants:Ve,capability:"config:write",target:nt}).allowed?"owner":"collaborator"}return{...C,role:"member",sites:Qt,organizationRole:Ie.roleTemplate,organizationSource:Ie.source,capabilities:B}}function _n(){Ei+=1,ke.clear();for(let C of At)fs(C,{recursive:!0,force:!0});At.clear()}let Ai=(C,Te)=>`${Te}:${C.role==="admin"?"admin":`member:${Object.entries(C.sites).sort(([De],[Ie])=>De.localeCompare(Ie)).map(([De,Ie])=>`${De}=${Ie}`).join(",")}`}:${[...C.capabilities??[]].sort().join(",")}`;async function ki(C,Te){let De=lo(C,Te),Ie=Ai(De,Te),Ve=ke.get(Ie);if(Ve)return Ve;let ct=He.get(Ie);if(ct)return ct;let B=Ei,_r=(async()=>{let Qt=K.get(Te)??await gs(o,Te);K.set(Te,Qt);let Ye={...Zl(Qt,{user:De,slug:o.project.slug}),viewer:{role:De.role,organizationRole:De.organizationRole,organizationSource:De.organizationSource,capabilities:De.capabilities??[]}},nt=await bA(t,Ye);if(nt&&B!==Ei)return fs(nt,{recursive:!0,force:!0}),Ne?.uiRoot;if(nt)At.add(nt);let Cr=nt??Ne?.uiRoot;if(Cr)ke.set(Ie,Cr);return Cr})();He.set(Ie,_r);try{return await _r}finally{He.delete(Ie)}}let Ri=await ki({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!Ri)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ge=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ee=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ee&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Re=!Ee,Dt=by(t),Ht=Re?Iy(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,we=new Me(a.store,{encryptionKey:_(t)}),st=new We(a.store),rt=new Ut(a.store),Le=new lr(a.store,{encryptionKey:_(t)}),Dr=new ni(a.store),hs=new oi(a.store,{cwd:t}),xi=new ii(a.store,{encryptionKey:_(t)}),kt=new S(a.store,{workerId:`dashboard:${process.pid}`}),Ot=new ar(a.store),Fi=new cr(a.store,_(t)),go=new Or(a.store),Ua=new Wr(Ot,kt,Fi),mo=o.project?.region??"us-east-1",lp=_(t),un=new Ur(go,{encryptionKey:lp,backends:[new Pt(a.store,lp),new $r(new J(mo),mo),new Lr(new Ze(mo),mo),new Mr]});await Cn(un,a,o);let Dd=new fe(mo),Tb={aws_rds:new Kn(new Zn(Dd)),aws_aurora:new Jn(new ei(Dd)),aws_elasticache:new Xn(new ti(new oe(mo))),server:new Qn(new dt),container:new Yn(new dt)},pp=(C)=>Tb[C.provider],Yt=new di(a.store),Lo=new tn(Yt,kt),gp=new ui(Fi),Ab={managed_database:new xl(Ot,Dd),logical_database:new Nl(Ot,Fi),volume:new Ml,files:new _l(t),control_plane:new Bl(a.store,t),infrastructure:new jl(new Da(mo))},kb=(C)=>Ab[C.resourceKind],Rb=(C)=>C.provider==="aws_backup"?void 0:gp,Od=new gt(a.store),_d=[new Ft,new nn(I(t,"volumes"))],ji=new rn(Od,_d,kt),ua=new xe(a.store),Di=new Un(ua,[new lt("aws"),new lt("hetzner"),new lt("ssh")],kt),fo=new Bn(a.store),mp=new jn(fo,ua),Bo=new Vn(a.store),fp=new zn(Bo,kt),Ui=new Hn(a.store),Nd=new Gn(Ui,kt),hp=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((C)=>new qn(C,a.store,a.project.id,a.organization.id)),wr=new en(a.store),yp=new li(wr,{queue:kt}),Kt=new Je(a.store),ho=new Ke(a.store),wn=new ut(a.store),Ge=new ht(a.store,{encryptionKey:_(t)}),Pb=()=>wb(a.store);for(let C of a.environments.values())Zr(wr,o,{organization:a.organization,project:a.project,environment:C,resources:a.store.listResources(a.project.id,C.id)});let In=new yr(Ge,{emailImpl:async(C)=>{let{email:Te}=await import("./chunk-7yhy2a7h.js");return Te.send(C)}}),bp=async(C)=>{let Te=on(Ge,a.project.id,C),De=[];for(let Ie of Te.filter((Ve)=>Ve.notify&&Ve.alert))De.push(...await In.deliverAll(In.enqueue(a.organization.id,Ie.alert,Ie.transition)));return De.push(...await In.deliverAll(In.enqueueRemindersAndEscalations(a.organization.id,Ge.listAlerts(a.project.id,{environmentId:C,states:["firing"]})))),De.push(...await In.retryDue()),{evaluations:Te,deliveries:De}},$d=!1,xb=async()=>{if($d)return;$d=!0;try{for(let C of a.environments.values())for(let Te of Ge.listHealthChecks(a.project.id,C.id).filter((De)=>De.enabled)){let De=Ge.listHealthResults(Te.id,1)[0];if(De&&Date.now()-new Date(De.checkedAt).getTime()<Te.intervalSeconds*1000)continue;let Ie=await new je(Ge).runAndEvaluate(Te);for(let Ve of Ie.evaluations.filter((ct)=>ct.notify&&ct.alert))await In.deliverAll(In.enqueue(a.organization.id,Ve.alert,Ve.transition))}}finally{$d=!1}},Sp=setInterval(()=>{for(let C of a.environments.values())bp(C.id).catch((Te)=>console.error("ts-cloud alert evaluation failed:",Te))},60000);Sp.unref?.();let vp=setInterval(()=>{xb().catch((C)=>console.error("ts-cloud health check evaluation failed:",C))},30000);vp.unref?.();let wp=setInterval(()=>{try{yp.tick()}catch(C){console.error("ts-cloud scheduled job evaluation failed:",C)}},30000);wp.unref?.();let Ip=setInterval(()=>{try{Lo.enqueueDue(),Lo.enqueueRetention()}catch(C){console.error("ts-cloud backup policy evaluation failed:",C)}},30000);Ip.unref?.(),Kt.cleanup();let Cp=setInterval(()=>{try{Kt.cleanup()}catch(C){console.error("ts-cloud preview cleanup failed:",C)}},3600000);Cp.unref?.();let Db=e.queueWorker??!0,Ob=wA(),_b=async(C,Te)=>{let Ie=(C.environmentId?a.store.listEnvironments(C.projectId).find((Ve)=>Ve.id===C.environmentId):void 0)?.slug??String(T);if(Te.kind==="dashboard_operation"&&Te.operationId){let Ve=K.get(Ie)??N,ct=si(Te.operationId,o,Ve);if(!ct||ct.danger||!["scheduler","backup","worker"].includes(ct.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let B=await Qr(o,Ie,ct);return{ok:B.ok,stdout:B.stdout,stderr:B.stderr??B.error,retryable:/temporar|unavailable|timeout|network/i.test(B.stderr??B.error??""),output:{command:B.command??null,operation:B.operation}}}if(Te.kind==="serverless_scheduler"){let Ve=await ap(o,Ie,"run");return{ok:Ve.ok,stdout:Ve.stdout,stderr:Ve.error,retryable:/temporar|unavailable|timeout|network/i.test(Ve.error??""),output:{command:Ve.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Te.kind}.`}},za=Db?new ms(kt,{...Cc({store:a.store,execute:async(C,Te)=>{let De=Te.operation.input&&typeof Te.operation.input==="object"&&!Array.isArray(Te.operation.input)?Te.operation.input:{},Ie=De.source&&typeof De.source==="object"?De.source:void 0,Ve=t,ct,B,_r;try{if(Ie?.bindingId&&Ie?.connectionId&&Ie?.commitSha){let Ye=Le.getBinding(String(Ie.bindingId)),nt=Le.getConnection(String(Ie.connectionId));if(!Ye||!nt||Ye.connectionId!==nt.id)throw Error("Queued source binding is no longer available");let br=(Ye.repositoryId?Le.getRepository(Ye.repositoryId):Le.listRepositories(nt.id).find((Ss)=>Ss.fullName.toLowerCase()===Ye.repositoryFullName.toLowerCase()))?.cloneUrl;if(!br&&nt.provider==="generic_ssh")br=`git@${new URL(nt.host).hostname}:${Ye.repositoryFullName}.git`;if(!br)br=new URL(`/${Ye.repositoryFullName}.git`,nt.host.endsWith("/")?nt.host:`${nt.host}/`).href;let ye=Ye.deployKeyId?Le.getDeployKey(Ye.deployKeyId):void 0,_t=ye&&Ye.deployKeyId?{...ye,privateKey:Le.getDeployPrivateKey(Ye.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(nt.provider)&&C.target.previewId){let Ss=Po(nt,Le.getCredential(nt.id)),se=Kt.previews.getInstance(C.target.previewId);_r=async(An,Ha)=>{try{await Ss.setCommitStatus(Ye.repositoryFullName,String(Ie.commitSha),{state:An,url:se?.url,description:Ha})}catch(vs){Te.log(`Could not publish source status: ${vs instanceof Error?vs.message:String(vs)}`,{stream:"stderr"})}},await _r("pending",`Preview deployment started for ${String(Ie.commitSha).slice(0,12)}`)}ct=up(Ct(Pd(),"ts-cloud-queued-source-")),Te.log(`Checking out immutable source commit ${Ie.commitSha}.`,{stream:"system"}),Ve=(await ol({remote:br,binding:Ye,destination:Ct(ct,"checkout"),ref:String(Ie.branch??Ye.defaultBranch),commitSha:String(Ie.commitSha)},{credential:Le.getCredential(nt.id),deployKey:_t})).directory}if(Te.operation.kind!=="preview.destroy"){let Ye=C.target.previewId?Kt.previews.getInstance(C.target.previewId):void 0,nt=Ye?Kt.previews.getDefinition(Ye.definitionId):void 0,Cr=Te.operation.resourceId?a.store.getResource(Te.operation.resourceId):void 0;if(B=await un.resolve({projectId:a.project.id,environmentId:Te.operation.environmentId,resourceId:Te.operation.resourceId,functionId:Cr?.kind==="function"?Cr.id:void 0,previewId:Ye?.id,trustedPreview:!!Ye&&!Ye.fork,allowedPreviewSecrets:nt?.inheritedSecrets}),B.warnings.some((br)=>br.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${B.warnings.filter((br)=>br.code==="missing_required").map((br)=>br.key).join(", ")}`);if(Te.operation.resourceId)for(let br of Object.values(B.entries))go.setDependency({entryId:br.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:br.required,requiresRedeploy:!0});Te.log(`Resolved configuration ${B.configurationHash.slice(0,18)} for ${Object.keys(B.values).length} keys.`,{stream:"system"})}let Qt=await dp(C,{cwd:Ve,cliEntry:i,signal:Te.signal,env:B?.values,onOutput:(Ye,nt)=>Te.log(nt,{stream:Ye,step:"execute",secrets:[...Ob,...Object.entries(B?.entries??{}).filter(([,Cr])=>Cr.kind==="secret").map(([Cr])=>B.values[Cr]).filter(Boolean)]})});if(Qt.ok&&Te.operation.resourceId&&B)for(let Ye of Object.values(B.entries))go.setDependency({entryId:Ye.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:Ye.required,requiresRedeploy:!1,lastDeployedVersion:Ye.version});return await _r?.(Qt.ok?"success":"failure",Qt.ok?`Preview is ready at ${String(Ie?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Ie?.commitSha).slice(0,12)}`),Qt}catch(Qt){throw await _r?.("error",`Preview deployment could not complete at ${String(Ie?.commitSha).slice(0,12)}`),Qt}finally{if(ct)fs(ct,{recursive:!0,force:!0})}}}),...kh({store:wr,executor:_b}),...pf({store:Ot,secrets:Fi,resolveAdapter:pp}),...Bm(ua,Di.drivers),...Gm(Bo,[new Ju("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...of({store:Ui,cleanup:hp}),...vc(Od,_d),...$h({store:Yt,queue:kt,resolveSource:kb,resolveDestination:Rb,validateHealth:async(C,Te)=>{if(!C.healthCheckId)return{healthy:!0,mode:"adapter"};let De=Ge.getHealthCheck(C.healthCheckId);if(!De||De.projectId!==C.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Ie=await new je(Ge).runAndEvaluate(De);return{healthy:Ie.result.status==="healthy",healthCheckId:De.id,healthResultId:Ie.result.id,target:Te}}}),...nh({store:a.store,resolveDriver:e.releaseDriver??((C)=>({name:`${a.store.getResource(C.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:C.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(C,Te)=>{let De=Ge.listHealthChecks(Te.projectId,Te.environmentId).find((Ve)=>Ve.enabled&&Ve.name===C&&(!Ve.resourceId||Ve.resourceId===Te.resourceId));if(!De)return{healthy:!1,message:`Named health gate ${C} was not found for this release.`};let Ie=await new je(Ge).runAndEvaluate(De);return{healthy:Ie.result.status==="healthy",evidence:{healthCheckId:De.id,healthResultId:Ie.result.id,status:Ie.result.status,timings:Ie.result.timings},message:Ie.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(C)=>console.error("ts-cloud deployment queue worker failed:",C)}):void 0;if(ai(a),id(rt,ue(a,String(T)),N),Ht)Xa(a,Ht.users),Ty(we,a,Ht.users);let Bt=Cy({cwd:t,enabled:Re,secret:Dt,authentication:we,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(T)}}),Zt=new Vl,Ep=setInterval(()=>Zt.sweep(),60000);Ep.unref?.();let Va=new Ma,Md=new Ma(3,900000,900000),qa=new Ma(8,900000,900000),Tp=setInterval(()=>Va.prune(),300000),Ap=setInterval(()=>Md.prune(),300000),kp=setInterval(()=>qa.prune(),300000);if(Tp.unref?.(),Ap.unref?.(),kp.unref?.(),Re){if(Ht?.generated)console.warn(`
+[output truncated]`}async function yb(e,t,r){let n=e.getReader(),i=new TextDecoder,o="";while(!0){let{done:c,value:u}=await n.read();if(c)break;let a=i.decode(u,{stream:!0});if(o+=a,a)r?.(t,a)}let s=i.decode();if(s)o+=s,r?.(t,s);return o}async function dp(e,t){let r=Bun.spawn([process.execPath,t.cliEntry,...e.command],{cwd:t.cwd,stdout:"pipe",stderr:"pipe",env:{...process.env,...t.env}}),n=()=>{try{r.kill()}catch{}};if(t.signal?.aborted)n();else t.signal?.addEventListener("abort",n,{once:!0});try{let[i,o,s]=await Promise.all([yb(r.stdout,"stdout",t.onOutput),yb(r.stderr,"stderr",t.onOutput),r.exited]);return{action:e.id,command:["cloud",...e.command].join(" "),exitCode:s,ok:s===0,stdout:hb(i),stderr:hb(o)}}finally{t.signal?.removeEventListener("abort",n)}}function wA(){return Object.entries(process.env).filter(([e,t])=>!!t&&t.length>=8&&/(?:secret|token|password|passwd|private|credential|api.?key|access.?key)/i.test(e)).map(([,e])=>e)}var IA=new Set(["/server/sites","/server/deployments","/server/logs","/integrations","/applications/new","/applications/compose","/operations/queue","/operations/previews","/operations/releases","/operations/workloads","/operations/observability","/operations/alerts","/operations/jobs","/data/backups","/account/security","/security","/access-denied"]);function CA(e){let t=ja(e);if(t&&t!==".html")return!1;let r=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(r==="/")return!1;return!IA.has(r)}var EA={"/":"runtime:read","/server/activity":"audit:read","/server/sites":"project:read","/server/deployments":"deployments:read","/server/logs":"runtime:logs","/server/metrics":"runtime:read","/server/services":"runtime:read","/data/backups":"backups:read","/data/volumes":"data:read","/server/fleet":"fleet:read","/server/capacity":"fleet:read","/server/actions":"runtime:restart","/server/database":"data:read","/server/firewall":"fleet:read","/infrastructure/topology":"fleet:read","/server/security":"security:read","/security":"security:read","/integrations":"sources:read","/applications/new":"applications:read","/applications/compose":"applications:read","/operations/queue":"deployments:read","/operations/previews":"deployments:read","/operations/releases":"deployments:read","/operations/regions":"deployments:read","/operations/maintenance":"deployments:read","/operations/workloads":"runtime:read","/operations/observability":"runtime:logs","/operations/alerts":"runtime:read","/operations/jobs":"automation:read","/operations/configuration":"config:read","/server/ssh-keys":"fleet:read","/server/terminal":"runtime:terminal","/server/team":"users:read","/account/security":"project:read","/account/automation":"users:read","/serverless":"project:read","/serverless/deployments":"deployments:read","/serverless/logs":"runtime:logs","/serverless/metrics":"runtime:read","/serverless/traces":"runtime:read","/serverless/functions":"config:read","/serverless/queues":"data:read","/serverless/data":"data:read","/serverless/assets":"project:read","/serverless/secrets":"secrets:read","/serverless/firewall":"fleet:read","/serverless/alarms":"runtime:read","/serverless/cost":"project:read"};function bb(e,t){if(t.role==="admin")return!0;let r=ja(e);if(r&&r!==".html")return!0;if(t.organizationSource==="legacy")return!CA(e);let n=e.replace(/\.html$/,"").replace(/\/+$/,"")||"/";if(n==="/access-denied")return!0;let i=EA[n];return!!i&&!!t.capabilities?.includes(i)}function TA(e,t){let r=decodeURIComponent(t).replace(/^\/+/,""),i=JT(r===""?"index.html":r);if(i.startsWith("..")||i.includes("/../"))return null;let o=Ct(e,i);if(uo(o)&&!Ib(o).isDirectory())return o;if(!ja(o)&&uo(`${o}.html`))return`${o}.html`;if(!ja(o)&&uo(Ct(o,"index.html")))return Ct(o,"index.html");return null}async function Sb(e,t){let r=TA(e,t);if(!r){let o=Ct(e,"404.html");if(uo(o))return new Response(await Bi(o),{status:404,headers:{"content-type":"text/html; charset=utf-8"}});return xd("Not found",404)}if(Ib(r).isDirectory())return xd("Not found",404);let n=await Bi(r),i=tA[ja(r)]??"application/octet-stream";return new Response(n,{headers:{"content-type":i}})}var Rd=["observe","backup","restore","restart","resize","version","rotate","expose","delete","logs","slow_queries","users","databases"],vb=new WeakMap;async function wb(e){let t=vb.get(e);if(t)return t;let r=await import("./chunk-rpsnnr53.js"),n=new r.SpendStore(e),i={store:n,service:new r.SpendService(n),gate:new r.SpendGate(e)};return vb.set(e,i),i}async function fr(e={}){eA();let t=e.cwd??process.cwd(),r=e.host??YT,n=e.port??XT,i=e.cliEntry??process.argv[1];if(e.box)process.env.TS_CLOUD_DASHBOARD_BOX="1";await dA(t);let o=e.config??await Zi(),s=process.env.TS_CLOUD_DASHBOARD_DB_PASSWORD,c=w(o);if(s&&c&&!c.password)c.password=s;let u=o.infrastructure?.compute?.managedServices?.vitess;if(s&&u&&typeof u==="object"&&!u.password)u.password=s;let a=y(t,o);if(a.reconciliation.failed>0)console.warn(`  ts-cloud dashboard: marked ${a.reconciliation.failed} orphaned operation(s) as failed after restart.`);let f=Object.keys(o.environments??{}),T=aA(o,e.environment),P=uA(t),N=await gs(o,T),K=new Map([[T,N]]),Y=new Map([[T,Date.now()]]),ee=new Map([[T,Date.now()]]),re=new Map,he=Math.min(300000,Math.max(5000,Number(process.env.TS_CLOUD_DASHBOARD_REFRESH_MS)||30000)),te=Math.min(1800000,Math.max(60000,Number(process.env.TS_CLOUD_DASHBOARD_SITE_REFRESH_MS)||300000)),Pe=H(o)!=="serverless",tt=(C)=>{let Te=K.get(C);if(Te&&!gb(Y.get(C),Date.now(),he))return Promise.resolve(Te);let De=re.get(C);if(De)return De;let Ie=!Pe||gb(ee.get(C),Date.now(),te),Ve=gs(o,C,{includeSiteHealth:Ie}).then((ct)=>{let B=K.get(C),_r=Ie?ct:hA(B,ct);if(K.set(C,_r),Y.set(C,Date.now()),Ie)ee.set(C,Date.now());if(B?._serverReachable!==_r._serverReachable||B?._metricsStatus!==_r._metricsStatus||(B?.sitesDetail?.length??0)!==(_r.sitesDetail?.length??0))_n();return _r}).finally(()=>re.delete(C));return re.set(C,Ve),Ve},Ne=zo(t),Gt=process.env.TS_CLOUD_DASHBOARD_TELEMETRY?.trim();if(e.box&&Gt!=="0"&&(Gt==="1"||!o.cloud?.attachTo)){let C=!1,Te=Date.now()+300000,De=async()=>{if(C)return;C=!0;try{let Ve=Date.now(),ct=Ve>=Te;if(ct)Te=Ve+300000;let B=a.environments.get(T);await pi({controlPlane:a.store,projectId:a.project.id,environmentId:B?.id,config:o,environment:T,force:!0,lightweight:!0,includeSiteHealth:ct})}catch(Ve){if(e.verbose)console.warn(`  ts-cloud dashboard: background telemetry collection failed: ${Ve instanceof Error?Ve.message:String(Ve)}`)}finally{C=!1}};De(),setInterval(()=>void De(),60000).unref?.()}let ke=new Map,He=new Map,At=new Set,Ei=0;function lo(C,Te){if(C.role==="admin"&&!a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`))return C;let De=a.store.getActorByExternalId("user",`dashboard:${C.username.toLowerCase()}`),Ie=De?a.store.getMembershipForActor(a.organization.id,De.id):void 0;if(!Ie||Ie.status!=="active")return{...C,role:"member",sites:{},capabilities:[]};let Ve=a.store.listGrants(Ie.id),ct=a.store.resolveAuthorizationTarget(a.organization.id,Ie.scope)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),B=En({membership:Ie,grants:Ve,target:ct});if(Ie.roleTemplate==="owner"||Ie.roleTemplate==="admin")return{...C,role:"admin",sites:{},organizationRole:Ie.roleTemplate,organizationSource:Ie.source,capabilities:B};let _r=a.environments.get(Te),Qt={};for(let Ye of a.store.listResources(a.project.id,_r?.id).filter((nt)=>nt.kind==="application")){let nt=a.store.resolveAuthorizationTarget(a.organization.id,{type:"resource",id:Ye.id});if(!nt||!ne({membership:Ie,grants:Ve,capability:"project:read",target:nt}).allowed)continue;Qt[Ye.slug]=ne({membership:Ie,grants:Ve,capability:"config:write",target:nt}).allowed?"owner":"collaborator"}return{...C,role:"member",sites:Qt,organizationRole:Ie.roleTemplate,organizationSource:Ie.source,capabilities:B}}function _n(){Ei+=1,ke.clear();for(let C of At)fs(C,{recursive:!0,force:!0});At.clear()}let Ai=(C,Te)=>`${Te}:${C.role==="admin"?"admin":`member:${Object.entries(C.sites).sort(([De],[Ie])=>De.localeCompare(Ie)).map(([De,Ie])=>`${De}=${Ie}`).join(",")}`}:${[...C.capabilities??[]].sort().join(",")}`;async function ki(C,Te){let De=lo(C,Te),Ie=Ai(De,Te),Ve=ke.get(Ie);if(Ve)return Ve;let ct=He.get(Ie);if(ct)return ct;let B=Ei,_r=(async()=>{let Qt=K.get(Te)??await gs(o,Te);K.set(Te,Qt);let Ye={...Zl(Qt,{user:De,slug:o.project.slug}),viewer:{role:De.role,organizationRole:De.organizationRole,organizationSource:De.organizationSource,capabilities:De.capabilities??[]}},nt=await bA(t,Ye);if(nt&&B!==Ei)return fs(nt,{recursive:!0,force:!0}),Ne?.uiRoot;if(nt)At.add(nt);let Cr=nt??Ne?.uiRoot;if(Cr)ke.set(Ie,Cr);return Cr})();He.set(Ie,_r);try{return await _r}finally{He.delete(Ie)}}let Ri=await ki({username:"",passwordHash:"",role:"admin",sites:{}},T);if(!Ri)throw Error("ts-cloud dashboard UI not found. Run `bun run build` in ts-cloud or reinstall the package.");let Q=new WeakMap,ge=process.env.TS_CLOUD_DASHBOARD_TERMINAL!=="0",Ee=process.env.TS_CLOUD_DASHBOARD_AUTH==="0";if(Ee&&e.box)throw Error("TS_CLOUD_DASHBOARD_AUTH=0 is refused in box mode: the dashboard is internet-facing there, and disabling auth would expose a root shell.");let Re=!Ee,Dt=by(t),Ht=Re?Iy(t,process.env.TS_CLOUD_UI_USERNAME?.trim()||"admin"):void 0,we=new Me(a.store,{encryptionKey:_(t)}),st=new We(a.store),rt=new Ut(a.store),Le=new lr(a.store,{encryptionKey:_(t)}),Dr=new ni(a.store),hs=new oi(a.store,{cwd:t}),xi=new ii(a.store,{encryptionKey:_(t)}),kt=new S(a.store,{workerId:`dashboard:${process.pid}`}),Ot=new ar(a.store),Fi=new cr(a.store,_(t)),go=new Or(a.store),Ua=new Wr(Ot,kt,Fi),mo=o.project?.region??"us-east-1",lp=_(t),un=new Ur(go,{encryptionKey:lp,backends:[new Pt(a.store,lp),new $r(new J(mo),mo),new Lr(new Ze(mo),mo),new Mr]});await Cn(un,a,o);let Dd=new fe(mo),Tb={aws_rds:new Kn(new Zn(Dd)),aws_aurora:new Jn(new ei(Dd)),aws_elasticache:new Xn(new ti(new oe(mo))),server:new Qn(new dt),container:new Yn(new dt)},pp=(C)=>Tb[C.provider],Yt=new di(a.store),Lo=new tn(Yt,kt),gp=new ui(Fi),Ab={managed_database:new xl(Ot,Dd),logical_database:new Nl(Ot,Fi),volume:new Ml,files:new _l(t),control_plane:new Bl(a.store,t),infrastructure:new jl(new Da(mo))},kb=(C)=>Ab[C.resourceKind],Rb=(C)=>C.provider==="aws_backup"?void 0:gp,Od=new gt(a.store),_d=[new Ft,new nn(I(t,"volumes"))],ji=new rn(Od,_d,kt),ua=new xe(a.store),Di=new Un(ua,[new lt("aws"),new lt("hetzner"),new lt("ssh")],kt),fo=new Bn(a.store),mp=new jn(fo,ua),Bo=new Vn(a.store),fp=new zn(Bo,kt),Ui=new Hn(a.store),Nd=new Gn(Ui,kt),hp=["releases","artifacts","operations","logs","previews","snapshots","orphaned_resources"].map((C)=>new qn(C,a.store,a.project.id,a.organization.id)),wr=new en(a.store),yp=new li(wr,{queue:kt}),Kt=new Je(a.store),ho=new Ke(a.store),wn=new ut(a.store),Ge=new ht(a.store,{encryptionKey:_(t)}),Pb=()=>wb(a.store);for(let C of a.environments.values())Zr(wr,o,{organization:a.organization,project:a.project,environment:C,resources:a.store.listResources(a.project.id,C.id)});let In=new yr(Ge,{emailImpl:async(C)=>{let{email:Te}=await import("./chunk-7yhy2a7h.js");return Te.send(C)}}),bp=async(C)=>{let Te=on(Ge,a.project.id,C),De=[];for(let Ie of Te.filter((Ve)=>Ve.notify&&Ve.alert))De.push(...await In.deliverAll(In.enqueue(a.organization.id,Ie.alert,Ie.transition)));return De.push(...await In.deliverAll(In.enqueueRemindersAndEscalations(a.organization.id,Ge.listAlerts(a.project.id,{environmentId:C,states:["firing"]})))),De.push(...await In.retryDue()),{evaluations:Te,deliveries:De}},$d=!1,xb=async()=>{if($d)return;$d=!0;try{for(let C of a.environments.values())for(let Te of Ge.listHealthChecks(a.project.id,C.id).filter((De)=>De.enabled)){let De=Ge.listHealthResults(Te.id,1)[0];if(De&&Date.now()-new Date(De.checkedAt).getTime()<Te.intervalSeconds*1000)continue;let Ie=await new je(Ge).runAndEvaluate(Te);for(let Ve of Ie.evaluations.filter((ct)=>ct.notify&&ct.alert))await In.deliverAll(In.enqueue(a.organization.id,Ve.alert,Ve.transition))}}finally{$d=!1}},Sp=setInterval(()=>{for(let C of a.environments.values())bp(C.id).catch((Te)=>console.error("ts-cloud alert evaluation failed:",Te))},60000);Sp.unref?.();let vp=setInterval(()=>{xb().catch((C)=>console.error("ts-cloud health check evaluation failed:",C))},30000);vp.unref?.();let wp=setInterval(()=>{try{yp.tick()}catch(C){console.error("ts-cloud scheduled job evaluation failed:",C)}},30000);wp.unref?.();let Ip=setInterval(()=>{try{Lo.enqueueDue(),Lo.enqueueRetention()}catch(C){console.error("ts-cloud backup policy evaluation failed:",C)}},30000);Ip.unref?.(),Kt.cleanup();let Cp=setInterval(()=>{try{Kt.cleanup()}catch(C){console.error("ts-cloud preview cleanup failed:",C)}},3600000);Cp.unref?.();let Db=e.queueWorker??!0,Ob=wA(),_b=async(C,Te)=>{let Ie=(C.environmentId?a.store.listEnvironments(C.projectId).find((Ve)=>Ve.id===C.environmentId):void 0)?.slug??String(T);if(Te.kind==="dashboard_operation"&&Te.operationId){let Ve=K.get(Ie)??N,ct=si(Te.operationId,o,Ve);if(!ct||ct.danger||!["scheduler","backup","worker"].includes(ct.group))return{ok:!1,stderr:"The allowlisted dashboard operation is no longer available."};let B=await Qr(o,Ie,ct);return{ok:B.ok,stdout:B.stdout,stderr:B.stderr??B.error,retryable:/temporar|unavailable|timeout|network/i.test(B.stderr??B.error??""),output:{command:B.command??null,operation:B.operation}}}if(Te.kind==="serverless_scheduler"){let Ve=await ap(o,Ie,"run");return{ok:Ve.ok,stdout:Ve.stdout,stderr:Ve.error,retryable:/temporar|unavailable|timeout|network/i.test(Ve.error??""),output:{command:Ve.command??null,operation:"serverless_scheduler"}}}return{ok:!1,stderr:`No safe executor is configured for ${Te.kind}.`}},za=Db?new ms(kt,{...Cc({store:a.store,execute:async(C,Te)=>{let De=Te.operation.input&&typeof Te.operation.input==="object"&&!Array.isArray(Te.operation.input)?Te.operation.input:{},Ie=De.source&&typeof De.source==="object"?De.source:void 0,Ve=t,ct,B,_r;try{if(Ie?.bindingId&&Ie?.connectionId&&Ie?.commitSha){let Ye=Le.getBinding(String(Ie.bindingId)),nt=Le.getConnection(String(Ie.connectionId));if(!Ye||!nt||Ye.connectionId!==nt.id)throw Error("Queued source binding is no longer available");let br=(Ye.repositoryId?Le.getRepository(Ye.repositoryId):Le.listRepositories(nt.id).find((Ss)=>Ss.fullName.toLowerCase()===Ye.repositoryFullName.toLowerCase()))?.cloneUrl;if(!br&&nt.provider==="generic_ssh")br=`git@${new URL(nt.host).hostname}:${Ye.repositoryFullName}.git`;if(!br)br=new URL(`/${Ye.repositoryFullName}.git`,nt.host.endsWith("/")?nt.host:`${nt.host}/`).href;let ye=Ye.deployKeyId?Le.getDeployKey(Ye.deployKeyId):void 0,_t=ye&&Ye.deployKeyId?{...ye,privateKey:Le.getDeployPrivateKey(Ye.deployKeyId)}:void 0;if(["github","gitlab","bitbucket","gitea"].includes(nt.provider)&&C.target.previewId){let Ss=Po(nt,Le.getCredential(nt.id)),se=Kt.previews.getInstance(C.target.previewId);_r=async(An,Ha)=>{try{await Ss.setCommitStatus(Ye.repositoryFullName,String(Ie.commitSha),{state:An,url:se?.url,description:Ha})}catch(vs){Te.log(`Could not publish source status: ${vs instanceof Error?vs.message:String(vs)}`,{stream:"stderr"})}},await _r("pending",`Preview deployment started for ${String(Ie.commitSha).slice(0,12)}`)}ct=up(Ct(Pd(),"ts-cloud-queued-source-")),Te.log(`Checking out immutable source commit ${Ie.commitSha}.`,{stream:"system"}),Ve=(await ol({remote:br,binding:Ye,destination:Ct(ct,"checkout"),ref:String(Ie.branch??Ye.defaultBranch),commitSha:String(Ie.commitSha)},{credential:Le.getCredential(nt.id),deployKey:_t})).directory}if(Te.operation.kind!=="preview.destroy"){let Ye=C.target.previewId?Kt.previews.getInstance(C.target.previewId):void 0,nt=Ye?Kt.previews.getDefinition(Ye.definitionId):void 0,Cr=Te.operation.resourceId?a.store.getResource(Te.operation.resourceId):void 0;if(B=await un.resolve({projectId:a.project.id,environmentId:Te.operation.environmentId,resourceId:Te.operation.resourceId,functionId:Cr?.kind==="function"?Cr.id:void 0,previewId:Ye?.id,trustedPreview:!!Ye&&!Ye.fork,allowedPreviewSecrets:nt?.inheritedSecrets}),B.warnings.some((br)=>br.code==="missing_required"))throw Error(`Required deployment configuration is unavailable: ${B.warnings.filter((br)=>br.code==="missing_required").map((br)=>br.key).join(", ")}`);if(Te.operation.resourceId)for(let br of Object.values(B.entries))go.setDependency({entryId:br.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:br.required,requiresRedeploy:!0});Te.log(`Resolved configuration ${B.configurationHash.slice(0,18)} for ${Object.keys(B.values).length} keys.`,{stream:"system"})}let Qt=await dp(C,{cwd:Ve,cliEntry:i,signal:Te.signal,env:B?.values,onOutput:(Ye,nt)=>Te.log(nt,{stream:Ye,step:"execute",secrets:[...Ob,...Object.entries(B?.entries??{}).filter(([,Cr])=>Cr.kind==="secret").map(([Cr])=>B.values[Cr]).filter(Boolean)]})});if(Qt.ok&&Te.operation.resourceId&&B)for(let Ye of Object.values(B.entries))go.setDependency({entryId:Ye.id,resourceId:Te.operation.resourceId,injectionTarget:"environment",required:Ye.required,requiresRedeploy:!1,lastDeployedVersion:Ye.version});return await _r?.(Qt.ok?"success":"failure",Qt.ok?`Preview is ready at ${String(Ie?.commitSha).slice(0,12)}`:`Preview deployment failed at ${String(Ie?.commitSha).slice(0,12)}`),Qt}catch(Qt){throw await _r?.("error",`Preview deployment could not complete at ${String(Ie?.commitSha).slice(0,12)}`),Qt}finally{if(ct)fs(ct,{recursive:!0,force:!0})}}}),...kh({store:wr,executor:_b}),...pf({store:Ot,secrets:Fi,resolveAdapter:pp}),...Bm(ua,Di.drivers),...Gm(Bo,[new Ju("aws","AWS regional execution requires an injected AwsRegionalTransport; topology and plans were preserved without provider mutation.")]),...of({store:Ui,cleanup:hp}),...vc(Od,_d),...$h({store:Yt,queue:kt,resolveSource:kb,resolveDestination:Rb,validateHealth:async(C,Te)=>{if(!C.healthCheckId)return{healthy:!0,mode:"adapter"};let De=Ge.getHealthCheck(C.healthCheckId);if(!De||De.projectId!==C.projectId)return{healthy:!1,error:"Configured restore health check was not found."};let Ie=await new je(Ge).runAndEvaluate(De);return{healthy:Ie.result.status==="healthy",healthCheckId:De.id,healthResultId:Ie.result.id,target:Te}}}),...nh({store:a.store,resolveDriver:e.releaseDriver??((C)=>({name:`${a.store.getResource(C.resourceId)?.provider??"provider"} release driver`,capability:()=>({strategy:C.strategy,supported:!1,explanation:"This dashboard process has no immutable activation driver configured for the target provider.",capacityMultiplier:1,costImpact:"none",rollback:"The previous release remains preserved; configure a release driver before retrying."}),activate:async()=>{throw Error("Immutable activation driver is not configured")},rollback:async()=>{throw Error("Immutable rollback driver is not configured")}})),resolveHealthGate:async(C,Te)=>{let De=Ge.listHealthChecks(Te.projectId,Te.environmentId).find((Ve)=>Ve.enabled&&Ve.name===C&&(!Ve.resourceId||Ve.resourceId===Te.resourceId));if(!De)return{healthy:!1,message:`Named health gate ${C} was not found for this release.`};let Ie=await new je(Ge).runAndEvaluate(De);return{healthy:Ie.result.status==="healthy",evidence:{healthCheckId:De.id,healthResultId:Ie.result.id,status:Ie.result.status,timings:Ie.result.timings},message:Ie.result.message}}})},{parallelism:e.queueParallelism??(Number(process.env.TS_CLOUD_QUEUE_PARALLELISM)||8),onError:(C)=>console.error("ts-cloud deployment queue worker failed:",C)}):void 0;if(ai(a),id(rt,ue(a,String(T)),N),Ht)Xa(a,Ht.users),Ty(we,a,Ht.users);let Bt=Cy({cwd:t,enabled:Re,secret:Dt,authentication:we,authorization:{store:a.store,organizationId:a.organization.id,projectId:a.project.id,defaultEnvironment:String(T)}}),Zt=new Vl,Ep=setInterval(()=>Zt.sweep(),60000);Ep.unref?.();let Va=new Ma,Md=new Ma(3,900000,900000),qa=new Ma(8,900000,900000),Tp=setInterval(()=>Va.prune(),300000),Ap=setInterval(()=>Md.prune(),300000),kp=setInterval(()=>qa.prune(),300000);if(Tp.unref?.(),Ap.unref?.(),kp.unref?.(),Re){if(Ht?.generated)console.warn(`
   ts-cloud dashboard: created the first admin.
     username: ${Ht.generated.username}
     password: ${Ht.generated.password}
@@ -496,7 +496,7 @@ This link expires ${F.invitation.expiresAt} and can be used once.`});return b({i
 
 This replacement link expires ${k.invitation.expiresAt} and can be used once.`});return b({invitation:k.invitation,token:k.token,acceptUrl:M,delivered:F})}catch(k){return b({ok:!1,error:k instanceof Error?k.message:"Invitation could not be resent."},409)}}if(B.pathname==="/api/organization/memberships"&&C.method==="PATCH"){let d=await ie(C),l=a.store.getMembership(String(d.id??"")),k=kd(d.roleTemplate),M=Fa(d);if(!l||l.organizationId!==a.organization.id)return b({ok:!1,error:"Membership was not found."},404);if(!k||!M)return b({ok:!1,error:"Choose a valid role template and resource scope."},422);let F=Oe(se);if((l.roleTemplate==="owner"||k==="owner")&&(!Ci(String(d.password??""),se.passwordHash)||F.membership?.roleTemplate!=="owner"))return b({ok:!1,error:"Ownership changes require an owner to re-enter their password."},401);let j=a.store.resolveAuthorizationTarget(a.organization.id,M)??a.store.resolveAuthorizationTarget(a.organization.id,{type:"project",id:a.project.id}),Z=a.store.listGrants(l.id),me=En({membership:l,grants:Z,target:j}),le={...l,roleTemplate:k,scope:M},qe=En({membership:le,grants:Z,target:j}),be={gained:qe.filter((_e)=>!me.includes(_e)),lost:me.filter((_e)=>!qe.includes(_e))};if(d.preview===!0)return b({membership:l,proposed:{roleTemplate:k,scope:M},accessDiff:be});if(String(d.confirm??"")!==l.id)return b({ok:!1,error:`Confirm this change with membership ID ${l.id}.`,accessDiff:be},409);try{return b({membership:a.store.updateMembership({id:l.id,roleTemplate:k,scope:M,actorId:F.actor?.id}),accessDiff:be})}catch(_e){return b({ok:!1,error:_e instanceof Error?_e.message:"Membership could not be updated."},409)}}if(B.pathname==="/api/organization/memberships"&&C.method==="DELETE"){let d=await ie(C),l=a.store.getMembership(String(d.id??""));if(!l||l.organizationId!==a.organization.id)return b({ok:!1,error:"Membership was not found."},404);if(String(d.confirm??"")!==l.id)return b({ok:!1,error:`Confirm removal with membership ID ${l.id}.`},409);let k=Oe(se);if(l.roleTemplate==="owner"&&(k.membership?.roleTemplate!=="owner"||!Ci(String(d.password??""),se.passwordHash)))return b({ok:!1,error:"Removing an owner requires an owner to re-enter their current password."},401);try{return b({membership:a.store.revokeMembership(l.id,k.actor?.id)})}catch(M){return b({ok:!1,error:M instanceof Error?M.message:"Membership could not be removed."},409)}}if(B.pathname==="/api/organization/grants"&&C.method==="POST"){let d=await ie(C),l=String(d.capability??""),k=d.effect==="deny"?"deny":d.effect==="allow"?"allow":void 0,M=Fa(d),F=Oe(se);if(!k||!M||!ce.includes(l))return b({ok:!1,error:"Choose a valid capability, effect, and resource scope."},422);try{return b({grant:a.store.upsertGrant({organizationId:a.organization.id,membershipId:String(d.membershipId??""),effect:k,capability:l,scope:M,actorId:F.actor?.id})},201)}catch(X){return b({ok:!1,error:X instanceof Error?X.message:"Grant could not be created."},422)}}if(B.pathname==="/api/organization/grants"&&C.method==="DELETE"){let d=await ie(C),l=Oe(se),k=a.store.getGrant(String(d.id??""));if(!k||k.organizationId!==a.organization.id)return b({ok:!1,error:"Grant was not found."},404);return b({ok:a.store.removeGrant(k.id,l.actor?.id)})}if(B.pathname==="/api/tags"&&C.method==="GET")return b({tags:a.store.listTags(a.project.id),assignments:a.store.listResourceTags(a.project.id)});if(B.pathname==="/api/tags"&&C.method==="POST"){let d=await ie(C),l=a.store.upsertTag(a.project.id,String(d.name??""),String(d.color??"#5a8be0"));if(d.resourceId)a.store.assignTag(String(d.resourceId),l.id);return b({tag:l},201)}if(B.pathname==="/api/tags"&&C.method==="DELETE"){let d=await ie(C);return a.store.removeTag(String(d.resourceId??""),String(d.tagId??"")),b({ok:!0})}if(B.pathname==="/"&&!bb(B.pathname,An))return new Response(null,{status:302,headers:{location:`/server/sites?env=${encodeURIComponent(ye)}`}});if(B.pathname==="/"&&_t?.mode==="serverless")return new Response(null,{status:302,headers:{location:`/serverless?env=${encodeURIComponent(ye)}`}});let Ha=xy(B.pathname);if(Ha)return new Response(null,{status:308,headers:{location:`${Ha}?env=${encodeURIComponent(ye)}`}});if(B.pathname==="/api/env"&&C.method==="POST"){let d=await ie(C),l=String(d.env??"");if(!f.includes(l))return b({ok:!1,error:`Unknown environment '${l}'.`,environments:f},404);return b({ok:!0,environment:l,environments:f,href:`?env=${encodeURIComponent(l)}`})}if(B.pathname==="/api/config"){let d={...SA(o),environment:ye,environments:f};return b(Oy(d,An))}if(B.pathname==="/api/ssh-keys"&&C.method==="GET")return b({configPath:P,keys:zt(aa(o))});if(B.pathname==="/api/ssh-keys"&&C.method==="POST"){if(!P)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=await Bi(P,"utf8"),k=aa(o),M=Hc({configText:l,name:String(d.name??""),publicKey:String(d.publicKey??""),existingKeys:k});return await ls(P,M),mb(o,[...k,{name:String(d.name??"").trim(),publicKey:String(d.publicKey??"").trim().replace(/\s+/g," ")}]),b({ok:!0,configPath:P,keys:zt(aa(o))})}if(B.pathname==="/api/ssh-keys"&&C.method==="DELETE"){if(!P)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=String(d.name??B.searchParams.get("name")??""),k=await Bi(P,"utf8"),M=aa(o),F=Gc({configText:k,name:l,existingKeys:M});return await ls(P,F),mb(o,M.filter((X)=>X.name!==l.trim())),b({ok:!0,configPath:P,keys:zt(aa(o))})}if(B.pathname==="/api/firewall"&&C.method==="GET")return b({configPath:P,alwaysOpen:[22,80,443],ports:cp(o)});if(B.pathname==="/api/firewall"&&C.method==="POST"){if(!P)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=Number(d.port);if(!La(l))return b({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let k=cp(o),M=await Bi(P,"utf8");try{await ls(P,Fy(M,l,k))}catch(j){return b({ok:!1,error:j?.message??String(j)},422)}let F=ds([...k,l]);fb(o,F);let X=d.apply===!1?null:await pr(o,ye,`ufw allow ${l}/tcp`).catch((j)=>({ok:!1,error:String(j?.message??j)}));return b({ok:!0,configPath:P,ports:F,apply:X})}if(B.pathname==="/api/firewall"&&C.method==="DELETE"){if(!P)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=Number(d.port??B.searchParams.get("port"));if(!La(l))return b({ok:!1,error:"Port must be an integer between 1 and 65535."},422);let k=cp(o),M=await Bi(P,"utf8");await ls(P,jy(M,l,k));let F=ds(k.filter((j)=>j!==l));fb(o,F);let X=d.apply===!1?null:await pr(o,ye,`ufw delete allow ${l}/tcp`).catch((j)=>({ok:!1,error:String(j?.message??j)}));return b({ok:!0,configPath:P,ports:F,apply:X})}if(B.pathname==="/api/sites"&&C.method==="POST"){if(!P)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=String(d.name??"").trim(),k=String(d.root??"").trim();if(!l||!k)return b({ok:!1,error:"Site name and root are required."},422);let M={deploy:d.deploy==="bucket"?"bucket":"server",root:k,path:String(d.path??"").trim()||void 0,domain:String(d.domain??"").trim()||void 0,build:String(d.build??"").trim()||void 0,start:String(d.start??"").trim()||void 0,port:d.port?Number(d.port):void 0,type:String(d.type??"").trim()||void 0};if(M.port!==void 0&&(!Number.isInteger(M.port)||M.port<1||M.port>65535))return b({ok:!1,error:"Port must be a number between 1 and 65535."},422);let F=await Bi(P,"utf8"),X=Mn({configText:F,name:l,root:M.root,domain:M.domain,path:M.path,deploy:M.deploy,build:M.build,start:M.start,port:M.port,type:M.type});return await ls(P,X),lA(o,l,Object.fromEntries(Object.entries(M).filter(([,j])=>j!==void 0))),_t=await gs(o,ye),K.set(ye,_t),b({ok:!0,configPath:P,site:l,data:_t})}if(B.pathname==="/api/sites"&&C.method==="DELETE"){if(!P)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=String(d.name??B.searchParams.get("name")??"").trim();if(!l||!o.sites?.[l])return b({ok:!1,error:`Site '${l}' was not found.`},404);let k=await Bi(P,"utf8");return await ls(P,wm({configText:k,name:l})),delete o.sites[l],_t=await gs(o,ye),K.set(ye,_t),b({ok:!0,configPath:P,site:l,data:_t})}if(B.pathname==="/api/sites"&&C.method==="PATCH"){if(!P)return b({ok:!1,error:"No cloud config file was found in this checkout."},404);let d=await ie(C),l=String(d.name??"").trim(),k=o.sites?.[l];if(!l||!k)return b({ok:!1,error:`Site '${l}' was not found.`},404);if(An.role==="member"){let X=$y(d);if(!X.ok)return b({ok:!1,error:X.error},403);let j=My({siteName:l,body:d,sites:o.sites??{},ownSites:Object.keys(An.sites)});if(!j.ok)return b({ok:!1,error:j.error},409)}if(d.port!==void 0&&d.port!==null&&d.port!==""&&(!Number.isInteger(Number(d.port))||Number(d.port)<1||Number(d.port)>65535))return b({ok:!1,error:"Port must be a number between 1 and 65535."},422);if(typeof d.domain==="string"&&d.domain.trim()&&!$u(d.domain.trim()))return b({ok:!1,error:`Domain '${d.domain.trim()}' is not a valid hostname.`},422);let M=await Bi(P,"utf8"),F=(X,j)=>{M=Im({configText:M,siteName:l,key:X,valueText:j})};if(d.ssl!==void 0)F("ssl",Cm(d.ssl)),k.ssl=d.ssl;if(d.env!==void 0&&d.env&&typeof d.env==="object")F("env",Tm(d.env)),k.env=d.env;if(d.aliases!==void 0&&Array.isArray(d.aliases)){let X=d.aliases.map((j)=>String(j));F("aliases",Am(X)),k.aliases=X.map((j)=>j.trim().toLowerCase()).filter(Boolean)}if(d.redirects!==void 0&&d.redirects&&typeof d.redirects==="object")F("redirects",km(d.redirects)),k.redirects=d.redirects;for(let X of["domain","path","build","start","type","root","php"])if(typeof d[X]==="string"&&d[X].trim())F(X,Em(String(d[X]).trim())),k[X]=String(d[X]).trim();if(d.port!==void 0&&d.port!==null&&d.port!=="")F("port",String(Number(d.port))),k.port=Number(d.port);return await ls(P,M),_t=await gs(o,ye),K.set(ye,_t),b({ok:!0,configPath:P,site:l,data:_t})}if(B.pathname==="/api/sites/deploy"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim();if(!l||!o.sites?.[l])return b({ok:!1,error:`Site '${l}' was not found.`},404);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to deploy this site.`},409);let k=ue(a,String(ye));await new ns(rt).run(new Pa,{...k,artifactRoot:t}),id(rt,k,_t??{});let M=gr(rt,{scope:k,desiredConfigHash:a.project.desiredConfigHash});if(M.decision.outcome==="block")return b({ok:!1,error:`Deployment blocked by security policy: ${M.decision.explanation}`,securityReview:M},409);let F={id:`deploy:${l}`,label:`Deploy ${l}`,description:`Deploy the ${l} site for ${ye}.`,command:["deploy","--env",ye,"--site",l,"--yes"],mutates:!0},X=await Vi({controlPlane:a,environment:ye,actor:se,kind:"dashboard.site.deploy",resourceSlug:l,input:{site:l},execute:()=>dp(F,{cwd:t,cliEntry:i})});return b({...X.result,controlPlaneOperation:X.operation,securityReview:M})}if(B.pathname==="/api/actions")return b(Eb(ye));if(B.pathname==="/api/server/operations")return b(Xr(o,_t));if(B.pathname==="/api/runtime/workloads"&&C.method==="GET"){let d=await wi(o,ye);return b(d)}if(B.pathname==="/api/runtime/logs"&&C.method==="GET"){let d=String(B.searchParams.get("workload")??"");if(!d)return b({ok:!1,error:"A workload query parameter is required."},422);let l=Math.min(1000,Math.max(1,Number(B.searchParams.get("limit"))||200));try{return b(await new Ce(o,ye).logs(d,{limit:l}))}catch(k){return b({ok:!1,error:String(k?.message??k)},404)}}if(B.pathname==="/api/runtime/log-sessions"&&C.method==="POST"){let d=await ie(C),l=String(d.workloadId??"");if(!l)return b({ok:!1,error:"A workloadId is required."},422);let k=await wi(o,ye),M=k.workloads.find((j)=>j.id===l);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);if(!M.capabilities.logs.supported)return b({ok:!1,error:M.capabilities.logs.reason??"Logs are unsupported for this workload."},409);let F=new Ce(o,ye,{inventory:async()=>k}),X=Zt.create("logs",l);return(async()=>{let j=new Date(Date.now()-Math.min(3600000,Math.max(1000,Number(d.sinceMs)||60000)));try{for(let Z=0;Z<200&&!Zt.signal(X.id)?.aborted;Z++){let me=await F.logs(l,{limit:Math.min(500,Math.max(1,Number(d.limit)||200)),since:j});for(let le of me.lines)if(Zt.append(X.id,`${le.timestamp?`${le.timestamp} `:""}${le.message}
 `),le.timestamp)j=new Date(Math.max(j.getTime(),new Date(le.timestamp).getTime()+1));await Bun.sleep(3000)}if(!Zt.signal(X.id)?.aborted)Zt.close(X.id,"complete")}catch(Z){Zt.append(X.id,Z instanceof Error?Z.message:String(Z),"stderr"),Zt.close(X.id,"failed",Z instanceof Error?Z.message:String(Z))}})(),b({ok:!0,session:X,streamUrl:`/api/runtime/log-stream?id=${encodeURIComponent(X.id)}&workload=${encodeURIComponent(l)}`},201)}if((B.pathname==="/api/runtime/log-stream"||B.pathname==="/api/runtime/exec-stream")&&C.method==="GET"){let d=String(B.searchParams.get("id")??""),l=String(B.searchParams.get("workload")??""),k=Number(C.headers.get("last-event-id")??B.searchParams.get("after")??0)||0,M=Zt.read(d,l,k),F=B.pathname.includes("exec")?"exec":"logs";if(!M||M.kind!==F)return b({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return rA(Zt,M,k,C.signal)}if((B.pathname==="/api/runtime/log-sessions"||B.pathname==="/api/runtime/exec-sessions")&&C.method==="DELETE"){let d=await ie(C),l=Zt.cancel(String(d.id??""),String(d.workloadId??""));if(!l)return b({ok:!1,error:"Runtime stream was not found in this workload scope."},404);return b({ok:!0,session:l})}if(B.pathname==="/api/runtime/exec-sessions"&&C.method==="POST"){let d=await ie(C),l=String(d.workloadId??""),k=await wi(o,ye),M=k.workloads.find((Z)=>Z.id===l);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let F=Bt.resolveSession(C),X=new Ce(o,ye,{inventory:async()=>k}),j=Zt.create("exec",l);return Vi({controlPlane:a,environment:ye,actor:se,kind:"runtime.exec",resourceSlug:M.links.service,input:{workloadId:l,provider:M.provider,preset:d.preset?String(d.preset):null,freeForm:!!String(d.command??"").trim()},execute:()=>X.exec({workloadId:l,preset:["process","sockets","filesystem"].includes(String(d.preset))?String(d.preset):void 0,command:typeof d.command==="string"?d.command:void 0,confirm:String(d.confirm??""),recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F)})}).then(({result:Z,operation:me})=>{if(Zt.append(j.id,`operation ${me.id}
-`,"system"),Z.stdout)Zt.append(j.id,Z.stdout,"stdout");if(Z.stderr)Zt.append(j.id,Z.stderr,"stderr");Zt.close(j.id,Z.ok?"complete":"failed",Z.error)}).catch((Z)=>{let me=Z instanceof Error?Z.message:String(Z);Zt.append(j.id,me,"stderr"),Zt.close(j.id,"failed",me)}),b({ok:!0,session:j,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(j.id)}&workload=${encodeURIComponent(l)}`},202)}if(B.pathname==="/api/runtime/files/read"&&C.method==="POST"){let d=await ie(C),l=await wi(o,ye),k=Bt.resolveSession(C),M=await new Ce(o,ye,{inventory:async()=>l}).readFile({workloadId:String(d.workloadId??""),path:String(d.path??""),confirm:String(d.confirm??""),recentAuth:!Re||!!k&&we.isRecentlyAuthenticated(k)});return b(M,M.ok?200:409)}if(B.pathname==="/api/runtime/files/write"&&C.method==="POST"){let d=await ie(C),l=await wi(o,ye),k=String(d.workloadId??""),M=l.workloads.find((Z)=>Z.id===k);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let F=Bt.resolveSession(C),X=new Ce(o,ye,{inventory:async()=>l}),j=await Vi({controlPlane:a,environment:ye,actor:se,kind:"runtime.file.write",resourceSlug:M.links.service,input:{workloadId:k,provider:M.provider,path:String(d.path??""),bytes:Buffer.from(String(d.contentBase64??""),"base64").byteLength},execute:()=>X.writeFile({workloadId:k,path:String(d.path??""),contentBase64:String(d.contentBase64??""),confirm:String(d.confirm??""),recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F)})});return b({...j.result,controlPlaneOperation:j.operation},j.result.ok?200:409)}if(B.pathname==="/api/runtime/operations"&&C.method==="POST"){let d=await ie(C),l=String(d.workloadId??""),k=String(d.action??"");if(!l||!["start","stop","restart","redeploy","scale","inspect"].includes(k))return b({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let M=await wi(o,ye),F=M.workloads.find((me)=>me.id===l);if(!F)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let X=Bt.resolveSession(C),j=new Ce(o,ye,{inventory:async()=>M}),Z=await Vi({controlPlane:a,environment:ye,actor:se,kind:`runtime.${k}`,resourceSlug:F.links.service,input:{workloadId:l,provider:F.provider,action:k,replicas:d.replicas==null?null:Number(d.replicas)},execute:()=>j.run({workloadId:l,action:k,replicas:d.replicas==null?void 0:Number(d.replicas),confirm:String(d.confirm??""),recentAuth:!Re||!!X&&we.isRecentlyAuthenticated(X)})});return b({...Z.result,controlPlaneOperation:Z.operation},Z.result.ok?200:409)}if(B.pathname.startsWith("/api/protection")){let d=se.role==="admin"||Ja(se,"security:read"),l=se.role==="admin"||Ja(se,"security:manage");if(!d)return b({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:k,describePosture:M}=await import("./chunk-k9s81q0g.js"),F=new k(a.store),X=()=>{if(!l)throw Error("Changing protection controls requires security:manage.")};if(B.pathname==="/api/protection"&&C.method==="GET"){let j=F.current();return b({ok:!0,posture:M(j),controls:j,raw:F.raw()})}if(B.pathname==="/api/protection/attack-mode"&&C.method==="POST"){X();let j=await ie(C);if(j.enabled===!1)return b({ok:!0,disabled:F.disableAttackMode()});return b({ok:!0,control:F.enableAttackMode({hours:j.hours==null?void 0:Number(j.hours),reason:String(j.reason??"Enabled from the dashboard."),actorId:Oe(se).actor?.id})})}if(B.pathname==="/api/protection/pause"&&C.method==="POST"){X();let j=await ie(C);if(j.enabled===!1)return b({ok:!0,resumed:F.resumeMitigations()});return b({ok:!0,control:F.pauseMitigations({hours:j.hours==null?void 0:Number(j.hours),reason:String(j.reason??""),actorId:Oe(se).actor?.id})})}if(B.pathname==="/api/protection/ip-rules"&&C.method==="GET")return b({ok:!0,ipRules:F.current().ipRules});if(B.pathname==="/api/protection/ip-rules"&&(C.method==="POST"||C.method==="DELETE")){X();let j=await ie(C),Z=j.list==="allow"?"allow":"block",me=C.method==="POST"?F.addIpRule(Z,String(j.cidr??"")):F.removeIpRule(Z,String(j.cidr??""));return b({ok:!0,ipRules:me})}return b({ok:!1,error:"Protection endpoint was not found."},404)}if(B.pathname.startsWith("/api/spend/")||B.pathname==="/api/usage"){let d=await Pb(),{store:l,service:k,gate:M}=d,F=se.role==="admin"||Ja(se,"billing:read"),X=se.role==="admin"||Ja(se,"billing:manage");if(!F)return b({ok:!1,error:"Spend data requires the billing:read capability."},403);let j=a.environments.get(ye),Z={organizationId:a.organization.id,projectId:a.project.id,environmentId:j?.id},me=()=>{if(!X)throw Error("Changing a budget requires the billing:manage capability.")};if(B.pathname==="/api/usage"&&C.method==="GET")return b({ok:!0,...k.usageReport({organizationId:Z.organizationId,projectId:Z.projectId,period:B.searchParams.get("period")??"monthly",timezone:B.searchParams.get("timezone")??void 0})});if(B.pathname==="/api/spend/budgets"&&C.method==="GET")return b({ok:!0,budgets:l.listBudgets({organizationId:Z.organizationId,projectId:Z.projectId}).map((le)=>({...le,status:k.status(le)}))});if(B.pathname==="/api/spend/budgets"&&C.method==="POST"){me();let le=await ie(C),qe=String(le.scope??"project"),be=l.createBudget({organizationId:Z.organizationId,projectId:qe==="organization"?void 0:Z.projectId,environmentId:qe==="environment"?Z.environmentId:void 0,name:String(le.name??"").trim(),period:le.period??"monthly",timezone:le.timezone?String(le.timezone):void 0,softLimitCents:le.softLimitCents==null?void 0:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?void 0:Math.round(Number(le.hardLimitCents)),graceSeconds:le.graceSeconds==null?void 0:Number(le.graceSeconds),dryRun:le.dryRun!==!1});return b({ok:!0,budget:be})}if(B.pathname==="/api/spend/budgets"&&C.method==="PATCH"){me();let le=await ie(C),qe=String(le.id??""),be=l.getBudget(qe);if(!be||be.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);return b({ok:!0,budget:l.updateBudget(qe,{softLimitCents:le.softLimitCents==null?be.softLimitCents:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?be.hardLimitCents:Math.round(Number(le.hardLimitCents)),enabled:le.enabled==null?be.enabled:le.enabled===!0,dryRun:le.dryRun==null?be.dryRun:le.dryRun===!0},le.expectedVersion==null?void 0:Number(le.expectedVersion))})}if(B.pathname==="/api/spend/budgets"&&C.method==="DELETE"){me();let le=await ie(C),qe=String(le.id??""),be=l.getBudget(qe);if(!be||be.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);let _e=M.closeBudget(qe);return l.deleteBudget(qe),b({ok:!0,deleted:!0,lifted:_e})}if(B.pathname==="/api/spend/check"&&C.method==="POST"){me();let le=await ie(C),{SpendRunner:qe}=await import("./chunk-y9qdpwa6.js"),be=new qe({controlPlane:a.store,store:l,alerts:Ge});if(le.apply!==!0){let Se=l.budgetsForScope(Z.organizationId,Z.projectId,Z.environmentId);return b({ok:!0,applied:!1,preview:Se.map((Ae)=>k.status(Ae))})}let _e=await be.run({...Z,environmentKind:j?.kind});return b({ok:!0,applied:!0,result:_e})}if(B.pathname==="/api/spend/enforcement"&&C.method==="GET")return b({ok:!0,enforcement:M.listUnder({organizationId:Z.organizationId})});if(B.pathname==="/api/spend/release"&&C.method==="POST"){me();let le=await ie(C),qe=M.close(String(le.budgetId??""),le.action);return b({ok:qe,released:qe,note:qe?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(B.pathname==="/api/spend/anomalies"&&C.method==="GET")return b({ok:!0,anomalies:l.listAnomalies({organizationId:Z.organizationId,projectId:Z.projectId,unacknowledgedOnly:B.searchParams.get("unacknowledged")==="true"})});if(B.pathname==="/api/spend/anomalies/acknowledge"&&C.method==="POST"){me();let le=await ie(C);return b({ok:!0,acknowledged:l.acknowledgeAnomaly(String(le.id??""))})}return b({ok:!1,error:"Spend endpoint was not found."},404)}if(B.pathname.startsWith("/api/health/")||B.pathname.startsWith("/api/alerts")||B.pathname.startsWith("/api/notifications/")){let d=a.environments.get(ye),l=a.store.listResources(a.project.id,d?.id),k=se.role==="admin"||!!d&&la(se,d.id,"runtime:read")?l:l.filter((j)=>Ir(se,j.id,"runtime:read")),M=(j)=>!j||k.some((Z)=>Z.id===j),F=(j)=>{if(!j)return;let Z=l.find((me)=>me.id===j||me.slug===j);if(!Z)throw Error("Alert resource was not found.");if(!M(Z.id))throw Error("Alert resource is outside your authorized scope.");return Z.id},X=Oe(se).actor;if(B.pathname==="/api/health/checks"&&C.method==="GET")return b({ok:!0,checks:Ge.listHealthChecks(a.project.id,d?.id).filter((j)=>M(j.resourceId)).map((j)=>({...j,results:Ge.listHealthResults(j.id,20)}))});if(B.pathname==="/api/health/checks"&&C.method==="POST"){let j=await ie(C),Z=String(j.kind??"http");if(Z==="command"&&se.role!=="admin")return b({ok:!1,error:"Command health checks require an administrator."},403);let me={method:String(j.config?.method??"GET").toUpperCase().slice(0,10),path:j.config?.path?String(j.config.path).slice(0,500):void 0,port:j.config?.port==null?void 0:Number(j.config.port),command:Array.isArray(j.config?.command)?j.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(j.config?.expectedStatuses)?j.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:j.config?.expectedBody?String(j.config.expectedBody).slice(0,500):void 0};return b({ok:!0,check:Ge.createHealthCheck({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),name:String(j.name??""),kind:Z,target:String(j.target??""),config:me,intervalSeconds:Number(j.intervalSeconds)||60,timeoutSeconds:Number(j.timeoutSeconds)||10,failureThreshold:Number(j.failureThreshold)||3,recoveryThreshold:Number(j.recoveryThreshold)||2,regions:Array.isArray(j.regions)?j.regions.map(String):["local"],enabled:j.enabled!==!1})},201)}if(B.pathname==="/api/health/checks"&&C.method==="PATCH"){let j=await ie(C),Z=Ge.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,check:Ge.setHealthCheckEnabled(Z.id,j.enabled!==!1)})}if(B.pathname==="/api/health/checks/test"&&C.method==="POST"){let j=await ie(C),Z=Ge.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,productionIncidentCreated:!1,result:await new je(Ge).probe(Z)})}if(B.pathname==="/api/health/checks/run"&&C.method==="POST"){let j=await ie(C),Z=Ge.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);let me=await new je(Ge).runAndEvaluate(Z),le=[];for(let qe of me.evaluations.filter((be)=>be.notify&&be.alert)){let be=In.enqueue(a.organization.id,qe.alert,qe.transition);le.push(...await In.deliverAll(be))}return b({ok:!0,...me,deliveries:le})}if(B.pathname==="/api/alerts/rules"&&C.method==="GET")return b({ok:!0,rules:Ge.listRules(a.project.id,d?.id).filter((j)=>M(j.resourceId))});if(B.pathname==="/api/alerts/rules"&&C.method==="POST"){let j=await ie(C),Z=j.healthCheckId?Ge.getHealthCheck(String(j.healthCheckId)):void 0;if(j.healthCheckId&&(!Z||!M(Z.resourceId)))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,rule:Ge.createRule({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource)??Z?.resourceId,healthCheckId:Z?.id,name:String(j.name??""),signal:String(j.signal??(Z?"health":"")),operator:String(j.operator??(Z?"unhealthy":"gt")),threshold:j.threshold==null?void 0:Number(j.threshold),recoveryThreshold:j.recoveryThreshold==null?void 0:Number(j.recoveryThreshold),windowMs:Number(j.windowMs)||300000,consecutive:Number(j.consecutive)||Z?.failureThreshold||3,recoveryConsecutive:Number(j.recoveryConsecutive)||Z?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(j.noDataPolicy))?j.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(j.severity))?j.severity:"warning",groupBy:Array.isArray(j.groupBy)?j.groupBy.map(String):[],labels:j.labels&&typeof j.labels==="object"?j.labels:{},enabled:j.enabled!==!1})},201)}if(B.pathname==="/api/alerts/rules"&&C.method==="PATCH"){let j=await ie(C),Z=Ge.getRule(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert rule was not found."},404);return b({ok:!0,rule:Ge.setRuleEnabled(Z.id,j.enabled!==!1)})}if(B.pathname==="/api/alerts/evaluate"&&C.method==="POST")return b({ok:!0,...await bp(d?.id)});if(B.pathname==="/api/alerts"&&C.method==="GET")return b({ok:!0,alerts:Ge.listAlerts(a.project.id,{environmentId:d?.id,states:B.searchParams.getAll("state").length?B.searchParams.getAll("state"):void 0,limit:Number(B.searchParams.get("limit"))||200}).filter((j)=>M(j.resourceId)).map((j)=>({...j,deliveries:Ge.listDeliveries({alertId:j.id,limit:50})}))});if(B.pathname==="/api/alerts/action"&&C.method==="POST"){let j=await ie(C),Z=Ge.getAlert(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert was not found."},404);let me=String(j.action??"");if(me==="acknowledge")return b({ok:!0,alert:Ge.acknowledge(Z.id,X?.id??"")});if(me==="assign")return b({ok:!0,alert:Ge.assign(Z.id,j.ownerActorId==="me"?X?.id:j.ownerActorId?String(j.ownerActorId):void 0,X?.id)});if(me==="silence"){if(se.role!=="admin")return b({ok:!1,error:"Silencing production alerts requires an administrator."},403);let le=Bt.resolveSession(C);if(Re&&(!le||!we.isRecentlyAuthenticated(le)))return b({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return b({ok:!0,alert:Ge.silenceAlert(Z.id,String(j.until??""),X?.id)})}return b({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(B.pathname==="/api/alerts/silences"&&C.method==="POST"){let j=await ie(C);return b({ok:!0,id:Ge.createSilence({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),matcher:j.matcher,reason:String(j.reason??""),startsAt:String(j.startsAt??new Date().toISOString()),endsAt:String(j.endsAt??""),timezone:String(j.timezone??"UTC"),actorId:X?.id})},201)}if(B.pathname==="/api/notifications/channels"&&C.method==="GET")return b({ok:!0,channels:Ge.listChannels(a.organization.id)});if(B.pathname==="/api/notifications/channels"&&C.method==="POST"){let j=await ie(C),Z=String(j.kind??""),me=Z==="email"?{to:j.config?.to,from:j.config?.from}:Z==="telegram"?{chatId:String(j.config?.chatId??"")}:{};return b({ok:!0,channel:Ge.createChannel({organizationId:a.organization.id,name:String(j.name??""),kind:Z,config:me,credential:j.credential?String(j.credential):void 0,actorId:X?.id})},201)}if(B.pathname==="/api/notifications/channels"&&C.method==="PATCH"){let j=await ie(C),Z=String(j.id??"");if(j.credential)return b({ok:!0,channel:Ge.rotateChannel(Z,String(j.credential))});let me=String(j.status??"paused");if(!["active","paused","disabled"].includes(me))return b({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return b({ok:!0,channel:Ge.setChannelStatus(Z,me)})}if(B.pathname==="/api/notifications/channels/test"&&C.method==="POST"){let j=await ie(C);return b({ok:!0,productionIncidentCreated:!1,result:await In.testChannel(String(j.id??""))})}if(B.pathname==="/api/notifications/routes"&&C.method==="GET")return b({ok:!0,routes:Ge.listRoutes(a.organization.id)});if(B.pathname==="/api/notifications/routes"&&C.method==="POST"){let j=await ie(C),Z=Array.isArray(j.channelIds)?j.channelIds.map(String):[];if(Z.some((me)=>Ge.getChannel(me)?.organizationId!==a.organization.id))return b({ok:!1,error:"Route contains an unavailable channel."},422);return b({ok:!0,route:Ge.createRoute({organizationId:a.organization.id,name:String(j.name??""),priority:Number(j.priority)||0,matcher:j.matcher&&typeof j.matcher==="object"?j.matcher:{},channelIds:Z,quietHours:j.quietHours,groupWaitSeconds:Number(j.groupWaitSeconds)||30,reminderSeconds:j.reminderSeconds==null?void 0:Number(j.reminderSeconds),escalation:Array.isArray(j.escalation)?j.escalation:[],template:j.template?String(j.template):void 0,rateLimitPerMinute:Number(j.rateLimitPerMinute)||60,enabled:j.enabled!==!1})},201)}if(B.pathname==="/api/notifications/routes"&&C.method==="PATCH"){let j=await ie(C),Z=Ge.getRoute(String(j.id??""));if(!Z||Z.organizationId!==a.organization.id)return b({ok:!1,error:"Notification route was not found."},404);return b({ok:!0,route:Ge.setRouteEnabled(Z.id,j.enabled!==!1)})}if(B.pathname==="/api/notifications/routes/preview"&&C.method==="POST"){let j=await ie(C),me=(j.alertId?Ge.getAlert(String(j.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),dedupKey:"preview",groupKey:String(j.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(j.severity))?j.severity:"warning",title:String(j.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return b({ok:!0,productionIncidentCreated:!1,matches:In.preview(a.organization.id,me,String(j.eventType??"firing")).map((le)=>({route:le.route,channels:le.channels,quiet:le.quiet}))})}if(B.pathname==="/api/notifications/deliveries"&&C.method==="GET")return b({ok:!0,deliveries:Ge.listDeliveries({alertId:B.searchParams.get("alertId")??void 0,states:B.searchParams.getAll("state"),limit:Number(B.searchParams.get("limit"))||200})});if(B.pathname==="/api/notifications/deliveries/retry"&&C.method==="POST"){let j=await ie(C),Z=Ge.getDelivery(String(j.id??""));if(!Z)return b({ok:!1,error:"Delivery was not found."},404);return Ge.updateDelivery(Z.id,{state:"retrying",attempt:Math.max(0,Z.attempt-1),nextAttemptAt:new Date().toISOString()}),b({ok:!0,delivery:await In.deliver(Z.id)})}}if(B.pathname.startsWith("/api/jobs")||B.pathname.startsWith("/api/workers")){let d=a.environments.get(ye),l=a.store.listResources(a.project.id,d?.id),M=se.role==="admin"||!!d&&la(se,d.id,"automation:read")?l:l.filter((Se)=>Ir(se,Se.id,"automation:read")),F=(Se)=>!Se||M.some((Ae)=>Ae.id===Se),X=Oe(se).actor,j=K.get(ye)??N,Z=Xr(o,j),me=Z.filter((Se)=>!Se.danger&&["scheduler","backup","worker"].includes(Se.group)),le=H(o),qe=()=>{let Se=Bt.resolveSession(C);return!Re||!!Se&&we.isRecentlyAuthenticated(Se)},be=(Se)=>{if(!Se||typeof Se!=="object"||Array.isArray(Se))return{};let Ae=Object.entries(Se).slice(0,50);if(Ae.some(([,et])=>typeof et!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(et)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(Ae)},_e=(Se,Ae,et)=>a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,resourceId:et,actorId:X?.id,type:`job.${Se}`,payload:Ae});if(B.pathname==="/api/jobs/preview"&&C.method==="POST"){let Se=await ie(C);try{return b({ok:!0,productionExecutionCreated:!1,preview:mt(String(Se.expression??""),String(Se.timezone??"UTC"),new Date(Se.from?String(Se.from):Date.now()),Number(Se.count)||5)})}catch(Ae){return b({ok:!1,error:Ae instanceof Error?Ae.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(B.pathname==="/api/jobs"&&C.method==="GET")return b({ok:!0,jobs:wr.list(a.project.id,{environmentId:d?.id}).filter((Se)=>F(Se.resourceId)).map((Se)=>({...Se,preview:mt(Se.normalizedExpression,Se.timezone,new Date,5),capability:ci(Se),lastExecution:wr.listExecutions(Se.id,1)[0]}))});if(B.pathname==="/api/jobs"&&C.method==="POST"){let Se=await ie(C),Ae=String(Se.provider??(le==="serverless"?"eventbridge":"server")),et=le==="serverless"?"eventbridge":"server";if(Ae!==et)return b({ok:!1,error:`${le} environments accept ${et} schedules through this adapter.`},422);let ot=Se.operationId?String(Se.operationId):void 0;if(Ae==="server"&&(!ot||!me.some((er)=>er.id===ot)))return b({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let St=ci({provider:Ae,expression:String(Se.expression??""),flexibleMinutes:Number(Se.flexibleMinutes)||0,missedRunPolicy:Se.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Se.overlapPolicy))?Se.overlapPolicy:"forbid"});if(!St.supported)return b({ok:!1,error:St.notes.join(" ")},422);let hn=Se.resourceId?l.find((er)=>er.id===Se.resourceId||er.slug===Se.resourceId):void 0;if(Se.resourceId&&(!hn||!F(hn.id)))return b({ok:!1,error:"Job resource was not found."},404);try{let er=Ae==="server"?{kind:"dashboard_operation",operationId:ot}:{kind:"serverless_scheduler",action:"run"},So=wr.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:hn?.id,name:String(Se.name??""),provider:Ae,expression:String(Se.expression??""),timezone:String(Se.timezone??"UTC"),startsAt:Se.startsAt?String(Se.startsAt):void 0,endsAt:Se.endsAt?String(Se.endsAt):void 0,flexibleMinutes:Number(Se.flexibleMinutes)||0,target:er,payloadRefs:be(Se.payloadRefs),missedRunPolicy:Se.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Se.overlapPolicy))?Se.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(Se.maxAttempts)||3,backoffSeconds:Number(Se.backoffSeconds)||30,deadLetterRef:Se.deadLetterRef?String(Se.deadLetterRef):void 0},timeoutSeconds:Number(Se.timeoutSeconds)||900,enabled:Se.enabled!==!1,origin:"managed",ownerActorId:X?.id,observedState:{},reconciliationStatus:"pending"});return _e("created",{jobId:So.id,provider:So.provider,expression:So.normalizedExpression},So.resourceId),b({ok:!0,job:So,capability:St},201)}catch(er){return b({ok:!1,error:er instanceof Error?er.message:"Scheduled job could not be created."},422)}}if(B.pathname==="/api/jobs"&&C.method==="PATCH"){let Se=await ie(C),Ae=wr.get(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);if(Ae.origin==="config")return b({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let et=Se.missedRunPolicy==null?void 0:String(Se.missedRunPolicy),ot=Se.overlapPolicy==null?void 0:String(Se.overlapPolicy);if(et&&!["skip","catch_up"].includes(et))return b({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ot&&!["allow","forbid","replace"].includes(ot))return b({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let St=wr.updateSchedule(Ae.id,{expression:Se.expression?String(Se.expression):void 0,timezone:Se.timezone?String(Se.timezone):void 0,missedRunPolicy:et,overlapPolicy:ot,timeoutSeconds:Se.timeoutSeconds==null?void 0:Number(Se.timeoutSeconds)});return _e("updated",{jobId:St.id,expression:St.normalizedExpression,version:St.version},St.resourceId),b({ok:!0,job:St})}catch(St){return b({ok:!1,error:St instanceof Error?St.message:"Scheduled job could not be updated."},422)}}if(B.pathname==="/api/jobs/action"&&C.method==="POST"){let Se=await ie(C),Ae=wr.get(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);let et=String(Se.action??"");if(et==="run"){let ot=yp.enqueue(Ae,{trigger:"manual",actorId:X?.id});return _e("run_queued",{jobId:Ae.id,executionId:ot.id},Ae.resourceId),b({ok:!0,execution:ot},202)}if(["disable","delete"].includes(et)&&d?.kind==="production"){if(String(Se.confirm??"")!==et)return b({ok:!1,error:`Type "${et}" to confirm this production change.`},409);if(!qe())return b({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(et==="enable"||et==="disable"){let ot=wr.setEnabled(Ae.id,et==="enable");return _e(et==="enable"?"enabled":"disabled",{jobId:Ae.id},Ae.resourceId),b({ok:!0,job:ot})}if(et==="delete")try{return wr.remove(Ae.id),_e("deleted",{jobId:Ae.id,name:Ae.name},Ae.resourceId),b({ok:!0,deleted:Ae.id})}catch(ot){return b({ok:!1,error:ot instanceof Error?ot.message:"Scheduled job could not be deleted."},409)}return b({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(B.pathname==="/api/jobs/history"&&C.method==="GET"){let Se=wr.get(String(B.searchParams.get("jobId")??""));if(!Se||!F(Se.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);return b({ok:!0,executions:wr.listExecutions(Se.id,Number(B.searchParams.get("limit"))||100).map((Ae)=>({...Ae,logs:Ae.operationId?kt.logs(Ae.operationId,{limit:500}):[]}))})}if(B.pathname==="/api/jobs/reconcile"&&C.method==="POST"){if(!d)return b({ok:!1,error:"Environment was not found."},404);let Se=Zr(wr,o,{organization:a.organization,project:a.project,environment:d,resources:l});return _e("reconciled",Se),b({ok:!0,reconciliation:Se})}if(B.pathname==="/api/workers"&&C.method==="GET"){let Se=Array.isArray(j.workersDetail??j.workers)?j.workersDetail??j.workers:[];return b({ok:!0,workers:wr.listWorkers(a.project.id,d?.id).filter((Ae)=>F(Ae.resourceId)).map((Ae)=>{let et=Se.find((ot)=>ot.name===Ae.name||ot.site===Ae.target.site);return et?{...Ae,observedState:{...Ae.observedState,status:et.status??"configured",currentJob:et.currentJob??null,failures:Number(et.failed??et.failures)||0,processed:Number(et.processed)||0}}:Ae})})}if(B.pathname==="/api/workers/action"&&C.method==="POST"){let Se=await ie(C),Ae=wr.getWorker(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Worker was not found."},404);let et=String(Se.action??"");if(et==="restart"){if(String(Se.confirm??"")!==Ae.name)return b({ok:!1,error:`Type "${Ae.name}" to restart this worker.`},409);let ot=Z.find((er)=>er.id===Ae.target.operationId);if(!ot)return b({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let St=await Qr(o,ye,ot),hn=wr.reconcileWorker(Ae.id,St.ok?"in_sync":"unavailable",{...Ae.observedState,lastRestartAt:new Date().toISOString(),command:St.command??null,error:St.error??St.stderr??null});return _e("worker_restarted",{workerId:Ae.id,ok:St.ok},Ae.resourceId),b({...St,worker:hn},St.ok?200:409)}if(et==="scale")return b({ok:!1,error:Ae.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return b({ok:!1,error:"Action must be restart or scale."},422)}}if(B.pathname.startsWith("/api/telemetry/")){let d=a.environments.get(ye),l=new Qe(a.store),k=a.store.listResources(a.project.id,d?.id),M=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(B.pathname)?"runtime:logs":"runtime:read",F=se.role==="admin"||!!d&&la(se,d.id,M),X=F?k:k.filter((be)=>Ir(se,be.id,M)),j=(be)=>rb(X,F,be),Z=(be)=>{let _e=new Date,Se={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},Ae=String(be.to??_e.toISOString()),et=String(be.from??new Date(new Date(Ae).getTime()-(Se[String(be.range??"1h")]??Se["1h"])).toISOString()),ot=(hn)=>{let er=(Array.isArray(hn)?hn:String(hn??"").split(",")).map(String).filter(Boolean);return er.length?er:void 0},St=ot(be.kinds)?.filter((hn)=>["metric","log","trace","request","event"].includes(hn));return{projectId:a.project.id,environmentId:d?.id,resourceIds:j(be.resources),kinds:St,names:ot(be.names),sources:ot(be.sources),levels:ot(be.levels),from:et,to:Ae,text:String(be.text??"")||void 0,traceId:String(be.traceId??"")||void 0,requestId:String(be.requestId??"")||void 0,deploymentId:String(be.deploymentId??"")||void 0,releaseId:String(be.releaseId??"")||void 0,workloadId:String(be.workloadId??"")||void 0,cursor:String(be.cursor??"")||void 0,limit:Number(be.limit)||void 0}},me=Object.fromEntries(B.searchParams.entries()),le=(be=!1)=>pi({controlPlane:a.store,projectId:a.project.id,environmentId:d?.id,config:o,environment:ye,force:be,lightweight:!be}),qe=()=>{let be=a.store.getSetting(`telemetry.collection:${a.project.id}:${d?.id??"all"}`)??{};return{generatedAt:String(be.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(be.statuses)?be.statuses:[],errors:Array.isArray(be.errors)?be.errors:[],policy:be.policy??Xe(a.store,a.project.id)}};if(B.pathname==="/api/telemetry/status"&&C.method==="GET"){le(!1);let be=qe(),_e=F?be.statuses:l.status(a.project.id,d?.id,be.policy.rawDays,be.policy.samplingRate,X.map((Ae)=>Ae.id)),Se=_e.reduce((Ae,et)=>Ae+et.estimatedDailyBytes*30,0);return b({ok:!0,generatedAt:be.generatedAt,cached:be.cached,sources:_e,errors:F?be.errors:[],policy:be.policy,retention:{rawDays:be.policy.rawDays,downsampleAfterDays:be.policy.downsampleAfterDays,downsampleBucketMs:be.policy.downsampleBucketMs,maxRecords:be.policy.maxRecords},estimatedMonthlyBytes:Se,estimatedMonthlyCostUsd:yi(Se,be.policy),costEstimateConfigured:be.policy.estimatedStorageUsdPerGbMonth>0})}if(B.pathname==="/api/telemetry/settings"&&C.method==="GET")return b({ok:!0,policy:Xe(a.store,a.project.id)});if(B.pathname==="/api/telemetry/settings"&&C.method==="PATCH"){let be=hi(a.store,a.project.id,await ie(C));return db(a.project.id),b({ok:!0,policy:be})}if(B.pathname==="/api/telemetry/query"&&C.method==="GET"){le(!1);let be=qe();return b({ok:!0,collection:{generatedAt:be.generatedAt,cached:be.cached},...l.query(Z(me))})}if(B.pathname==="/api/telemetry/tail"&&C.method==="GET"){le(!1);let be=new TextEncoder,_e=new Date,Se=Z({...me,kinds:me.kinds||"log,request,event,trace",from:me.from||new Date(_e.getTime()-120000).toISOString(),to:_e.toISOString(),limit:Math.min(1000,Number(me.limit)||200),cursor:void 0}),Ae=C.headers.get("last-event-id")||String(me.cursor??"")||void 0,et,ot=!1,St=!1,hn=new ReadableStream({start(er){let So=()=>{if(ot)return;if(ot=!0,et)clearInterval(et);C.signal.removeEventListener("abort",So);try{er.close()}catch{}},xp=async()=>{if(ot||St)return;St=!0;try{let jo=l.tail({...Se,to:new Date(Date.now()+1000).toISOString()},Ae);for(let Dp of jo.records)Ae=no(Dp)??Ae,er.enqueue(be.encode(`id: ${Ae??""}
+`,"system"),Z.stdout)Zt.append(j.id,Z.stdout,"stdout");if(Z.stderr)Zt.append(j.id,Z.stderr,"stderr");Zt.close(j.id,Z.ok?"complete":"failed",Z.error)}).catch((Z)=>{let me=Z instanceof Error?Z.message:String(Z);Zt.append(j.id,me,"stderr"),Zt.close(j.id,"failed",me)}),b({ok:!0,session:j,streamUrl:`/api/runtime/exec-stream?id=${encodeURIComponent(j.id)}&workload=${encodeURIComponent(l)}`},202)}if(B.pathname==="/api/runtime/files/read"&&C.method==="POST"){let d=await ie(C),l=await wi(o,ye),k=Bt.resolveSession(C),M=await new Ce(o,ye,{inventory:async()=>l}).readFile({workloadId:String(d.workloadId??""),path:String(d.path??""),confirm:String(d.confirm??""),recentAuth:!Re||!!k&&we.isRecentlyAuthenticated(k)});return b(M,M.ok?200:409)}if(B.pathname==="/api/runtime/files/write"&&C.method==="POST"){let d=await ie(C),l=await wi(o,ye),k=String(d.workloadId??""),M=l.workloads.find((Z)=>Z.id===k);if(!M)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let F=Bt.resolveSession(C),X=new Ce(o,ye,{inventory:async()=>l}),j=await Vi({controlPlane:a,environment:ye,actor:se,kind:"runtime.file.write",resourceSlug:M.links.service,input:{workloadId:k,provider:M.provider,path:String(d.path??""),bytes:Buffer.from(String(d.contentBase64??""),"base64").byteLength},execute:()=>X.writeFile({workloadId:k,path:String(d.path??""),contentBase64:String(d.contentBase64??""),confirm:String(d.confirm??""),recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F)})});return b({...j.result,controlPlaneOperation:j.operation},j.result.ok?200:409)}if(B.pathname==="/api/runtime/operations"&&C.method==="POST"){let d=await ie(C),l=String(d.workloadId??""),k=String(d.action??"");if(!l||!["start","stop","restart","redeploy","scale","inspect"].includes(k))return b({ok:!1,error:"A valid workloadId and lifecycle action are required."},422);let M=await wi(o,ye),F=M.workloads.find((me)=>me.id===l);if(!F)return b({ok:!1,error:"Workload was not found in the current project and environment."},404);let X=Bt.resolveSession(C),j=new Ce(o,ye,{inventory:async()=>M}),Z=await Vi({controlPlane:a,environment:ye,actor:se,kind:`runtime.${k}`,resourceSlug:F.links.service,input:{workloadId:l,provider:F.provider,action:k,replicas:d.replicas==null?null:Number(d.replicas)},execute:()=>j.run({workloadId:l,action:k,replicas:d.replicas==null?void 0:Number(d.replicas),confirm:String(d.confirm??""),recentAuth:!Re||!!X&&we.isRecentlyAuthenticated(X)})});return b({...Z.result,controlPlaneOperation:Z.operation},Z.result.ok?200:409)}if(B.pathname.startsWith("/api/protection")){let d=se.role==="admin"||Ja(se,"security:read"),l=se.role==="admin"||Ja(se,"security:manage");if(!d)return b({ok:!1,error:"Protection controls require security:read."},403);let{ProtectionControlStore:k,describePosture:M}=await import("./chunk-ydbvafmk.js"),F=new k(a.store),X=()=>{if(!l)throw Error("Changing protection controls requires security:manage.")};if(B.pathname==="/api/protection"&&C.method==="GET"){let j=F.current();return b({ok:!0,posture:M(j),controls:j,raw:F.raw()})}if(B.pathname==="/api/protection/attack-mode"&&C.method==="POST"){X();let j=await ie(C);if(j.enabled===!1)return b({ok:!0,disabled:F.disableAttackMode()});return b({ok:!0,control:F.enableAttackMode({hours:j.hours==null?void 0:Number(j.hours),reason:String(j.reason??"Enabled from the dashboard."),actorId:Oe(se).actor?.id})})}if(B.pathname==="/api/protection/pause"&&C.method==="POST"){X();let j=await ie(C);if(j.enabled===!1)return b({ok:!0,resumed:F.resumeMitigations()});return b({ok:!0,control:F.pauseMitigations({hours:j.hours==null?void 0:Number(j.hours),reason:String(j.reason??""),actorId:Oe(se).actor?.id})})}if(B.pathname==="/api/protection/ip-rules"&&C.method==="GET")return b({ok:!0,ipRules:F.current().ipRules});if(B.pathname==="/api/protection/ip-rules"&&(C.method==="POST"||C.method==="DELETE")){X();let j=await ie(C),Z=j.list==="allow"?"allow":"block",me=C.method==="POST"?F.addIpRule(Z,String(j.cidr??"")):F.removeIpRule(Z,String(j.cidr??""));return b({ok:!0,ipRules:me})}return b({ok:!1,error:"Protection endpoint was not found."},404)}if(B.pathname.startsWith("/api/spend/")||B.pathname==="/api/usage"){let d=await Pb(),{store:l,service:k,gate:M}=d,F=se.role==="admin"||Ja(se,"billing:read"),X=se.role==="admin"||Ja(se,"billing:manage");if(!F)return b({ok:!1,error:"Spend data requires the billing:read capability."},403);let j=a.environments.get(ye),Z={organizationId:a.organization.id,projectId:a.project.id,environmentId:j?.id},me=()=>{if(!X)throw Error("Changing a budget requires the billing:manage capability.")};if(B.pathname==="/api/usage"&&C.method==="GET")return b({ok:!0,...k.usageReport({organizationId:Z.organizationId,projectId:Z.projectId,period:B.searchParams.get("period")??"monthly",timezone:B.searchParams.get("timezone")??void 0})});if(B.pathname==="/api/spend/budgets"&&C.method==="GET")return b({ok:!0,budgets:l.listBudgets({organizationId:Z.organizationId,projectId:Z.projectId}).map((le)=>({...le,status:k.status(le)}))});if(B.pathname==="/api/spend/budgets"&&C.method==="POST"){me();let le=await ie(C),qe=String(le.scope??"project"),be=l.createBudget({organizationId:Z.organizationId,projectId:qe==="organization"?void 0:Z.projectId,environmentId:qe==="environment"?Z.environmentId:void 0,name:String(le.name??"").trim(),period:le.period??"monthly",timezone:le.timezone?String(le.timezone):void 0,softLimitCents:le.softLimitCents==null?void 0:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?void 0:Math.round(Number(le.hardLimitCents)),graceSeconds:le.graceSeconds==null?void 0:Number(le.graceSeconds),dryRun:le.dryRun!==!1});return b({ok:!0,budget:be})}if(B.pathname==="/api/spend/budgets"&&C.method==="PATCH"){me();let le=await ie(C),qe=String(le.id??""),be=l.getBudget(qe);if(!be||be.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);return b({ok:!0,budget:l.updateBudget(qe,{softLimitCents:le.softLimitCents==null?be.softLimitCents:Math.round(Number(le.softLimitCents)),hardLimitCents:le.hardLimitCents==null?be.hardLimitCents:Math.round(Number(le.hardLimitCents)),enabled:le.enabled==null?be.enabled:le.enabled===!0,dryRun:le.dryRun==null?be.dryRun:le.dryRun===!0},le.expectedVersion==null?void 0:Number(le.expectedVersion))})}if(B.pathname==="/api/spend/budgets"&&C.method==="DELETE"){me();let le=await ie(C),qe=String(le.id??""),be=l.getBudget(qe);if(!be||be.organizationId!==Z.organizationId)return b({ok:!1,error:"Budget was not found."},404);let _e=M.closeBudget(qe);return l.deleteBudget(qe),b({ok:!0,deleted:!0,lifted:_e})}if(B.pathname==="/api/spend/check"&&C.method==="POST"){me();let le=await ie(C),{SpendRunner:qe}=await import("./chunk-rpsnnr53.js"),be=new qe({controlPlane:a.store,store:l,alerts:Ge});if(le.apply!==!0){let Se=l.budgetsForScope(Z.organizationId,Z.projectId,Z.environmentId);return b({ok:!0,applied:!1,preview:Se.map((Ae)=>k.status(Ae))})}let _e=await be.run({...Z,environmentKind:j?.kind});return b({ok:!0,applied:!0,result:_e})}if(B.pathname==="/api/spend/enforcement"&&C.method==="GET")return b({ok:!0,enforcement:M.listUnder({organizationId:Z.organizationId})});if(B.pathname==="/api/spend/release"&&C.method==="POST"){me();let le=await ie(C),qe=M.close(String(le.budgetId??""),le.action);return b({ok:qe,released:qe,note:qe?"The next spend cycle re-applies this if spend is still over the threshold.":"That action was not in force."})}if(B.pathname==="/api/spend/anomalies"&&C.method==="GET")return b({ok:!0,anomalies:l.listAnomalies({organizationId:Z.organizationId,projectId:Z.projectId,unacknowledgedOnly:B.searchParams.get("unacknowledged")==="true"})});if(B.pathname==="/api/spend/anomalies/acknowledge"&&C.method==="POST"){me();let le=await ie(C);return b({ok:!0,acknowledged:l.acknowledgeAnomaly(String(le.id??""))})}return b({ok:!1,error:"Spend endpoint was not found."},404)}if(B.pathname.startsWith("/api/health/")||B.pathname.startsWith("/api/alerts")||B.pathname.startsWith("/api/notifications/")){let d=a.environments.get(ye),l=a.store.listResources(a.project.id,d?.id),k=se.role==="admin"||!!d&&la(se,d.id,"runtime:read")?l:l.filter((j)=>Ir(se,j.id,"runtime:read")),M=(j)=>!j||k.some((Z)=>Z.id===j),F=(j)=>{if(!j)return;let Z=l.find((me)=>me.id===j||me.slug===j);if(!Z)throw Error("Alert resource was not found.");if(!M(Z.id))throw Error("Alert resource is outside your authorized scope.");return Z.id},X=Oe(se).actor;if(B.pathname==="/api/health/checks"&&C.method==="GET")return b({ok:!0,checks:Ge.listHealthChecks(a.project.id,d?.id).filter((j)=>M(j.resourceId)).map((j)=>({...j,results:Ge.listHealthResults(j.id,20)}))});if(B.pathname==="/api/health/checks"&&C.method==="POST"){let j=await ie(C),Z=String(j.kind??"http");if(Z==="command"&&se.role!=="admin")return b({ok:!1,error:"Command health checks require an administrator."},403);let me={method:String(j.config?.method??"GET").toUpperCase().slice(0,10),path:j.config?.path?String(j.config.path).slice(0,500):void 0,port:j.config?.port==null?void 0:Number(j.config.port),command:Array.isArray(j.config?.command)?j.config.command.map(String).slice(0,20):void 0,expectedStatuses:Array.isArray(j.config?.expectedStatuses)?j.config.expectedStatuses.map(Number).filter(Number.isInteger).slice(0,20):void 0,expectedBody:j.config?.expectedBody?String(j.config.expectedBody).slice(0,500):void 0};return b({ok:!0,check:Ge.createHealthCheck({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),name:String(j.name??""),kind:Z,target:String(j.target??""),config:me,intervalSeconds:Number(j.intervalSeconds)||60,timeoutSeconds:Number(j.timeoutSeconds)||10,failureThreshold:Number(j.failureThreshold)||3,recoveryThreshold:Number(j.recoveryThreshold)||2,regions:Array.isArray(j.regions)?j.regions.map(String):["local"],enabled:j.enabled!==!1})},201)}if(B.pathname==="/api/health/checks"&&C.method==="PATCH"){let j=await ie(C),Z=Ge.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,check:Ge.setHealthCheckEnabled(Z.id,j.enabled!==!1)})}if(B.pathname==="/api/health/checks/test"&&C.method==="POST"){let j=await ie(C),Z=Ge.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,productionIncidentCreated:!1,result:await new je(Ge).probe(Z)})}if(B.pathname==="/api/health/checks/run"&&C.method==="POST"){let j=await ie(C),Z=Ge.getHealthCheck(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Health check was not found."},404);let me=await new je(Ge).runAndEvaluate(Z),le=[];for(let qe of me.evaluations.filter((be)=>be.notify&&be.alert)){let be=In.enqueue(a.organization.id,qe.alert,qe.transition);le.push(...await In.deliverAll(be))}return b({ok:!0,...me,deliveries:le})}if(B.pathname==="/api/alerts/rules"&&C.method==="GET")return b({ok:!0,rules:Ge.listRules(a.project.id,d?.id).filter((j)=>M(j.resourceId))});if(B.pathname==="/api/alerts/rules"&&C.method==="POST"){let j=await ie(C),Z=j.healthCheckId?Ge.getHealthCheck(String(j.healthCheckId)):void 0;if(j.healthCheckId&&(!Z||!M(Z.resourceId)))return b({ok:!1,error:"Health check was not found."},404);return b({ok:!0,rule:Ge.createRule({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource)??Z?.resourceId,healthCheckId:Z?.id,name:String(j.name??""),signal:String(j.signal??(Z?"health":"")),operator:String(j.operator??(Z?"unhealthy":"gt")),threshold:j.threshold==null?void 0:Number(j.threshold),recoveryThreshold:j.recoveryThreshold==null?void 0:Number(j.recoveryThreshold),windowMs:Number(j.windowMs)||300000,consecutive:Number(j.consecutive)||Z?.failureThreshold||3,recoveryConsecutive:Number(j.recoveryConsecutive)||Z?.recoveryThreshold||2,noDataPolicy:["ignore","pending","firing"].includes(String(j.noDataPolicy))?j.noDataPolicy:"pending",severity:["info","warning","critical"].includes(String(j.severity))?j.severity:"warning",groupBy:Array.isArray(j.groupBy)?j.groupBy.map(String):[],labels:j.labels&&typeof j.labels==="object"?j.labels:{},enabled:j.enabled!==!1})},201)}if(B.pathname==="/api/alerts/rules"&&C.method==="PATCH"){let j=await ie(C),Z=Ge.getRule(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert rule was not found."},404);return b({ok:!0,rule:Ge.setRuleEnabled(Z.id,j.enabled!==!1)})}if(B.pathname==="/api/alerts/evaluate"&&C.method==="POST")return b({ok:!0,...await bp(d?.id)});if(B.pathname==="/api/alerts"&&C.method==="GET")return b({ok:!0,alerts:Ge.listAlerts(a.project.id,{environmentId:d?.id,states:B.searchParams.getAll("state").length?B.searchParams.getAll("state"):void 0,limit:Number(B.searchParams.get("limit"))||200}).filter((j)=>M(j.resourceId)).map((j)=>({...j,deliveries:Ge.listDeliveries({alertId:j.id,limit:50})}))});if(B.pathname==="/api/alerts/action"&&C.method==="POST"){let j=await ie(C),Z=Ge.getAlert(String(j.id??""));if(!Z||!M(Z.resourceId))return b({ok:!1,error:"Alert was not found."},404);let me=String(j.action??"");if(me==="acknowledge")return b({ok:!0,alert:Ge.acknowledge(Z.id,X?.id??"")});if(me==="assign")return b({ok:!0,alert:Ge.assign(Z.id,j.ownerActorId==="me"?X?.id:j.ownerActorId?String(j.ownerActorId):void 0,X?.id)});if(me==="silence"){if(se.role!=="admin")return b({ok:!1,error:"Silencing production alerts requires an administrator."},403);let le=Bt.resolveSession(C);if(Re&&(!le||!we.isRecentlyAuthenticated(le)))return b({ok:!1,error:"Recent authentication is required to silence alerts.",stepUpRequired:!0},401);return b({ok:!0,alert:Ge.silenceAlert(Z.id,String(j.until??""),X?.id)})}return b({ok:!1,error:"Action must be acknowledge, assign, or silence."},422)}if(B.pathname==="/api/alerts/silences"&&C.method==="POST"){let j=await ie(C);return b({ok:!0,id:Ge.createSilence({projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),matcher:j.matcher,reason:String(j.reason??""),startsAt:String(j.startsAt??new Date().toISOString()),endsAt:String(j.endsAt??""),timezone:String(j.timezone??"UTC"),actorId:X?.id})},201)}if(B.pathname==="/api/notifications/channels"&&C.method==="GET")return b({ok:!0,channels:Ge.listChannels(a.organization.id)});if(B.pathname==="/api/notifications/channels"&&C.method==="POST"){let j=await ie(C),Z=String(j.kind??""),me=Z==="email"?{to:j.config?.to,from:j.config?.from}:Z==="telegram"?{chatId:String(j.config?.chatId??"")}:{};return b({ok:!0,channel:Ge.createChannel({organizationId:a.organization.id,name:String(j.name??""),kind:Z,config:me,credential:j.credential?String(j.credential):void 0,actorId:X?.id})},201)}if(B.pathname==="/api/notifications/channels"&&C.method==="PATCH"){let j=await ie(C),Z=String(j.id??"");if(j.credential)return b({ok:!0,channel:Ge.rotateChannel(Z,String(j.credential))});let me=String(j.status??"paused");if(!["active","paused","disabled"].includes(me))return b({ok:!1,error:"Channel status must be active, paused, or disabled."},422);return b({ok:!0,channel:Ge.setChannelStatus(Z,me)})}if(B.pathname==="/api/notifications/channels/test"&&C.method==="POST"){let j=await ie(C);return b({ok:!0,productionIncidentCreated:!1,result:await In.testChannel(String(j.id??""))})}if(B.pathname==="/api/notifications/routes"&&C.method==="GET")return b({ok:!0,routes:Ge.listRoutes(a.organization.id)});if(B.pathname==="/api/notifications/routes"&&C.method==="POST"){let j=await ie(C),Z=Array.isArray(j.channelIds)?j.channelIds.map(String):[];if(Z.some((me)=>Ge.getChannel(me)?.organizationId!==a.organization.id))return b({ok:!1,error:"Route contains an unavailable channel."},422);return b({ok:!0,route:Ge.createRoute({organizationId:a.organization.id,name:String(j.name??""),priority:Number(j.priority)||0,matcher:j.matcher&&typeof j.matcher==="object"?j.matcher:{},channelIds:Z,quietHours:j.quietHours,groupWaitSeconds:Number(j.groupWaitSeconds)||30,reminderSeconds:j.reminderSeconds==null?void 0:Number(j.reminderSeconds),escalation:Array.isArray(j.escalation)?j.escalation:[],template:j.template?String(j.template):void 0,rateLimitPerMinute:Number(j.rateLimitPerMinute)||60,enabled:j.enabled!==!1})},201)}if(B.pathname==="/api/notifications/routes"&&C.method==="PATCH"){let j=await ie(C),Z=Ge.getRoute(String(j.id??""));if(!Z||Z.organizationId!==a.organization.id)return b({ok:!1,error:"Notification route was not found."},404);return b({ok:!0,route:Ge.setRouteEnabled(Z.id,j.enabled!==!1)})}if(B.pathname==="/api/notifications/routes/preview"&&C.method==="POST"){let j=await ie(C),me=(j.alertId?Ge.getAlert(String(j.alertId)):void 0)??{id:"preview",ruleId:"preview",projectId:a.project.id,environmentId:d?.id,resourceId:F(j.resourceId??j.resource),dedupKey:"preview",groupKey:String(j.groupKey??"default"),state:"firing",severity:["info","warning","critical"].includes(String(j.severity))?j.severity:"warning",title:String(j.title??"Rule preview"),evidence:{},failureCount:1,recoveryCount:0,occurrenceCount:1,firstSeenAt:new Date().toISOString(),lastSeenAt:new Date().toISOString(),firingAt:new Date().toISOString(),updatedAt:new Date().toISOString()};return b({ok:!0,productionIncidentCreated:!1,matches:In.preview(a.organization.id,me,String(j.eventType??"firing")).map((le)=>({route:le.route,channels:le.channels,quiet:le.quiet}))})}if(B.pathname==="/api/notifications/deliveries"&&C.method==="GET")return b({ok:!0,deliveries:Ge.listDeliveries({alertId:B.searchParams.get("alertId")??void 0,states:B.searchParams.getAll("state"),limit:Number(B.searchParams.get("limit"))||200})});if(B.pathname==="/api/notifications/deliveries/retry"&&C.method==="POST"){let j=await ie(C),Z=Ge.getDelivery(String(j.id??""));if(!Z)return b({ok:!1,error:"Delivery was not found."},404);return Ge.updateDelivery(Z.id,{state:"retrying",attempt:Math.max(0,Z.attempt-1),nextAttemptAt:new Date().toISOString()}),b({ok:!0,delivery:await In.deliver(Z.id)})}}if(B.pathname.startsWith("/api/jobs")||B.pathname.startsWith("/api/workers")){let d=a.environments.get(ye),l=a.store.listResources(a.project.id,d?.id),M=se.role==="admin"||!!d&&la(se,d.id,"automation:read")?l:l.filter((Se)=>Ir(se,Se.id,"automation:read")),F=(Se)=>!Se||M.some((Ae)=>Ae.id===Se),X=Oe(se).actor,j=K.get(ye)??N,Z=Xr(o,j),me=Z.filter((Se)=>!Se.danger&&["scheduler","backup","worker"].includes(Se.group)),le=H(o),qe=()=>{let Se=Bt.resolveSession(C);return!Re||!!Se&&we.isRecentlyAuthenticated(Se)},be=(Se)=>{if(!Se||typeof Se!=="object"||Array.isArray(Se))return{};let Ae=Object.entries(Se).slice(0,50);if(Ae.some(([,et])=>typeof et!=="string"||!/^(?:secret|ssm|arn|env):\/\//.test(et)))throw Error("Job payload values must be secret or environment references, never inline values.");return Object.fromEntries(Ae)},_e=(Se,Ae,et)=>a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,resourceId:et,actorId:X?.id,type:`job.${Se}`,payload:Ae});if(B.pathname==="/api/jobs/preview"&&C.method==="POST"){let Se=await ie(C);try{return b({ok:!0,productionExecutionCreated:!1,preview:mt(String(Se.expression??""),String(Se.timezone??"UTC"),new Date(Se.from?String(Se.from):Date.now()),Number(Se.count)||5)})}catch(Ae){return b({ok:!1,error:Ae instanceof Error?Ae.message:"Schedule preview could not be generated.",productionExecutionCreated:!1},422)}}if(B.pathname==="/api/jobs"&&C.method==="GET")return b({ok:!0,jobs:wr.list(a.project.id,{environmentId:d?.id}).filter((Se)=>F(Se.resourceId)).map((Se)=>({...Se,preview:mt(Se.normalizedExpression,Se.timezone,new Date,5),capability:ci(Se),lastExecution:wr.listExecutions(Se.id,1)[0]}))});if(B.pathname==="/api/jobs"&&C.method==="POST"){let Se=await ie(C),Ae=String(Se.provider??(le==="serverless"?"eventbridge":"server")),et=le==="serverless"?"eventbridge":"server";if(Ae!==et)return b({ok:!1,error:`${le} environments accept ${et} schedules through this adapter.`},422);let ot=Se.operationId?String(Se.operationId):void 0;if(Ae==="server"&&(!ot||!me.some((er)=>er.id===ot)))return b({ok:!1,error:"Server jobs require an allowlisted operation target."},422);let St=ci({provider:Ae,expression:String(Se.expression??""),flexibleMinutes:Number(Se.flexibleMinutes)||0,missedRunPolicy:Se.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Se.overlapPolicy))?Se.overlapPolicy:"forbid"});if(!St.supported)return b({ok:!1,error:St.notes.join(" ")},422);let hn=Se.resourceId?l.find((er)=>er.id===Se.resourceId||er.slug===Se.resourceId):void 0;if(Se.resourceId&&(!hn||!F(hn.id)))return b({ok:!1,error:"Job resource was not found."},404);try{let er=Ae==="server"?{kind:"dashboard_operation",operationId:ot}:{kind:"serverless_scheduler",action:"run"},So=wr.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:hn?.id,name:String(Se.name??""),provider:Ae,expression:String(Se.expression??""),timezone:String(Se.timezone??"UTC"),startsAt:Se.startsAt?String(Se.startsAt):void 0,endsAt:Se.endsAt?String(Se.endsAt):void 0,flexibleMinutes:Number(Se.flexibleMinutes)||0,target:er,payloadRefs:be(Se.payloadRefs),missedRunPolicy:Se.missedRunPolicy==="catch_up"?"catch_up":"skip",overlapPolicy:["allow","forbid","replace"].includes(String(Se.overlapPolicy))?Se.overlapPolicy:"forbid",retryPolicy:{maxAttempts:Number(Se.maxAttempts)||3,backoffSeconds:Number(Se.backoffSeconds)||30,deadLetterRef:Se.deadLetterRef?String(Se.deadLetterRef):void 0},timeoutSeconds:Number(Se.timeoutSeconds)||900,enabled:Se.enabled!==!1,origin:"managed",ownerActorId:X?.id,observedState:{},reconciliationStatus:"pending"});return _e("created",{jobId:So.id,provider:So.provider,expression:So.normalizedExpression},So.resourceId),b({ok:!0,job:So,capability:St},201)}catch(er){return b({ok:!1,error:er instanceof Error?er.message:"Scheduled job could not be created."},422)}}if(B.pathname==="/api/jobs"&&C.method==="PATCH"){let Se=await ie(C),Ae=wr.get(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);if(Ae.origin==="config")return b({ok:!1,error:"Config-defined schedules must be edited in cloud.config.ts and reconciled."},409);let et=Se.missedRunPolicy==null?void 0:String(Se.missedRunPolicy),ot=Se.overlapPolicy==null?void 0:String(Se.overlapPolicy);if(et&&!["skip","catch_up"].includes(et))return b({ok:!1,error:"Missed-run policy must be skip or catch_up."},422);if(ot&&!["allow","forbid","replace"].includes(ot))return b({ok:!1,error:"Overlap policy must be allow, forbid, or replace."},422);try{let St=wr.updateSchedule(Ae.id,{expression:Se.expression?String(Se.expression):void 0,timezone:Se.timezone?String(Se.timezone):void 0,missedRunPolicy:et,overlapPolicy:ot,timeoutSeconds:Se.timeoutSeconds==null?void 0:Number(Se.timeoutSeconds)});return _e("updated",{jobId:St.id,expression:St.normalizedExpression,version:St.version},St.resourceId),b({ok:!0,job:St})}catch(St){return b({ok:!1,error:St instanceof Error?St.message:"Scheduled job could not be updated."},422)}}if(B.pathname==="/api/jobs/action"&&C.method==="POST"){let Se=await ie(C),Ae=wr.get(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);let et=String(Se.action??"");if(et==="run"){let ot=yp.enqueue(Ae,{trigger:"manual",actorId:X?.id});return _e("run_queued",{jobId:Ae.id,executionId:ot.id},Ae.resourceId),b({ok:!0,execution:ot},202)}if(["disable","delete"].includes(et)&&d?.kind==="production"){if(String(Se.confirm??"")!==et)return b({ok:!1,error:`Type "${et}" to confirm this production change.`},409);if(!qe())return b({ok:!1,error:"Recent authentication is required for this production change.",stepUpRequired:!0},401)}if(et==="enable"||et==="disable"){let ot=wr.setEnabled(Ae.id,et==="enable");return _e(et==="enable"?"enabled":"disabled",{jobId:Ae.id},Ae.resourceId),b({ok:!0,job:ot})}if(et==="delete")try{return wr.remove(Ae.id),_e("deleted",{jobId:Ae.id,name:Ae.name},Ae.resourceId),b({ok:!0,deleted:Ae.id})}catch(ot){return b({ok:!1,error:ot instanceof Error?ot.message:"Scheduled job could not be deleted."},409)}return b({ok:!1,error:"Action must be run, enable, disable, or delete."},422)}if(B.pathname==="/api/jobs/history"&&C.method==="GET"){let Se=wr.get(String(B.searchParams.get("jobId")??""));if(!Se||!F(Se.resourceId))return b({ok:!1,error:"Scheduled job was not found."},404);return b({ok:!0,executions:wr.listExecutions(Se.id,Number(B.searchParams.get("limit"))||100).map((Ae)=>({...Ae,logs:Ae.operationId?kt.logs(Ae.operationId,{limit:500}):[]}))})}if(B.pathname==="/api/jobs/reconcile"&&C.method==="POST"){if(!d)return b({ok:!1,error:"Environment was not found."},404);let Se=Zr(wr,o,{organization:a.organization,project:a.project,environment:d,resources:l});return _e("reconciled",Se),b({ok:!0,reconciliation:Se})}if(B.pathname==="/api/workers"&&C.method==="GET"){let Se=Array.isArray(j.workersDetail??j.workers)?j.workersDetail??j.workers:[];return b({ok:!0,workers:wr.listWorkers(a.project.id,d?.id).filter((Ae)=>F(Ae.resourceId)).map((Ae)=>{let et=Se.find((ot)=>ot.name===Ae.name||ot.site===Ae.target.site);return et?{...Ae,observedState:{...Ae.observedState,status:et.status??"configured",currentJob:et.currentJob??null,failures:Number(et.failed??et.failures)||0,processed:Number(et.processed)||0}}:Ae})})}if(B.pathname==="/api/workers/action"&&C.method==="POST"){let Se=await ie(C),Ae=wr.getWorker(String(Se.id??""));if(!Ae||!F(Ae.resourceId))return b({ok:!1,error:"Worker was not found."},404);let et=String(Se.action??"");if(et==="restart"){if(String(Se.confirm??"")!==Ae.name)return b({ok:!1,error:`Type "${Ae.name}" to restart this worker.`},409);let ot=Z.find((er)=>er.id===Ae.target.operationId);if(!ot)return b({ok:!1,error:"The allowlisted worker restart operation is unavailable."},409);let St=await Qr(o,ye,ot),hn=wr.reconcileWorker(Ae.id,St.ok?"in_sync":"unavailable",{...Ae.observedState,lastRestartAt:new Date().toISOString(),command:St.command??null,error:St.error??St.stderr??null});return _e("worker_restarted",{workerId:Ae.id,ok:St.ok},Ae.resourceId),b({...St,worker:hn},St.ok?200:409)}if(et==="scale")return b({ok:!1,error:Ae.provider==="systemd"?"Systemd worker scale is config-managed; edit the worker definition and reconcile.":"This provider does not expose safe worker scaling through the current adapter."},422);return b({ok:!1,error:"Action must be restart or scale."},422)}}if(B.pathname.startsWith("/api/telemetry/")){let d=a.environments.get(ye),l=new Qe(a.store),k=a.store.listResources(a.project.id,d?.id),M=["/api/telemetry/query","/api/telemetry/tail","/api/telemetry/export","/api/telemetry/saved-queries","/api/telemetry/refresh"].includes(B.pathname)?"runtime:logs":"runtime:read",F=se.role==="admin"||!!d&&la(se,d.id,M),X=F?k:k.filter((be)=>Ir(se,be.id,M)),j=(be)=>rb(X,F,be),Z=(be)=>{let _e=new Date,Se={"1h":3600000,"6h":21600000,"24h":86400000,"7d":604800000,"30d":2592000000},Ae=String(be.to??_e.toISOString()),et=String(be.from??new Date(new Date(Ae).getTime()-(Se[String(be.range??"1h")]??Se["1h"])).toISOString()),ot=(hn)=>{let er=(Array.isArray(hn)?hn:String(hn??"").split(",")).map(String).filter(Boolean);return er.length?er:void 0},St=ot(be.kinds)?.filter((hn)=>["metric","log","trace","request","event"].includes(hn));return{projectId:a.project.id,environmentId:d?.id,resourceIds:j(be.resources),kinds:St,names:ot(be.names),sources:ot(be.sources),levels:ot(be.levels),from:et,to:Ae,text:String(be.text??"")||void 0,traceId:String(be.traceId??"")||void 0,requestId:String(be.requestId??"")||void 0,deploymentId:String(be.deploymentId??"")||void 0,releaseId:String(be.releaseId??"")||void 0,workloadId:String(be.workloadId??"")||void 0,cursor:String(be.cursor??"")||void 0,limit:Number(be.limit)||void 0}},me=Object.fromEntries(B.searchParams.entries()),le=(be=!1)=>pi({controlPlane:a.store,projectId:a.project.id,environmentId:d?.id,config:o,environment:ye,force:be,lightweight:!be}),qe=()=>{let be=a.store.getSetting(`telemetry.collection:${a.project.id}:${d?.id??"all"}`)??{};return{generatedAt:String(be.generatedAt??new Date().toISOString()),cached:!0,statuses:Array.isArray(be.statuses)?be.statuses:[],errors:Array.isArray(be.errors)?be.errors:[],policy:be.policy??Xe(a.store,a.project.id)}};if(B.pathname==="/api/telemetry/status"&&C.method==="GET"){le(!1);let be=qe(),_e=F?be.statuses:l.status(a.project.id,d?.id,be.policy.rawDays,be.policy.samplingRate,X.map((Ae)=>Ae.id)),Se=_e.reduce((Ae,et)=>Ae+et.estimatedDailyBytes*30,0);return b({ok:!0,generatedAt:be.generatedAt,cached:be.cached,sources:_e,errors:F?be.errors:[],policy:be.policy,retention:{rawDays:be.policy.rawDays,downsampleAfterDays:be.policy.downsampleAfterDays,downsampleBucketMs:be.policy.downsampleBucketMs,maxRecords:be.policy.maxRecords},estimatedMonthlyBytes:Se,estimatedMonthlyCostUsd:yi(Se,be.policy),costEstimateConfigured:be.policy.estimatedStorageUsdPerGbMonth>0})}if(B.pathname==="/api/telemetry/settings"&&C.method==="GET")return b({ok:!0,policy:Xe(a.store,a.project.id)});if(B.pathname==="/api/telemetry/settings"&&C.method==="PATCH"){let be=hi(a.store,a.project.id,await ie(C));return db(a.project.id),b({ok:!0,policy:be})}if(B.pathname==="/api/telemetry/query"&&C.method==="GET"){le(!1);let be=qe();return b({ok:!0,collection:{generatedAt:be.generatedAt,cached:be.cached},...l.query(Z(me))})}if(B.pathname==="/api/telemetry/tail"&&C.method==="GET"){le(!1);let be=new TextEncoder,_e=new Date,Se=Z({...me,kinds:me.kinds||"log,request,event,trace",from:me.from||new Date(_e.getTime()-120000).toISOString(),to:_e.toISOString(),limit:Math.min(1000,Number(me.limit)||200),cursor:void 0}),Ae=C.headers.get("last-event-id")||String(me.cursor??"")||void 0,et,ot=!1,St=!1,hn=new ReadableStream({start(er){let So=()=>{if(ot)return;if(ot=!0,et)clearInterval(et);C.signal.removeEventListener("abort",So);try{er.close()}catch{}},xp=async()=>{if(ot||St)return;St=!0;try{let jo=l.tail({...Se,to:new Date(Date.now()+1000).toISOString()},Ae);for(let Dp of jo.records)Ae=no(Dp)??Ae,er.enqueue(be.encode(`id: ${Ae??""}
 event: record
 data: ${JSON.stringify(Dp)}
 
@@ -507,5 +507,5 @@ data: ${JSON.stringify({message:jo instanceof Error?jo.message:String(jo)})}
 data: ${JSON.stringify({cursor:Ae,at:new Date().toISOString()})}
 
 `))},5000),et.unref?.(),C.signal.addEventListener("abort",So,{once:!0})},cancel(){if(ot=!0,et)clearInterval(et)}});return new Response(hn,{headers:{"cache-control":"no-cache, no-transform",connection:"keep-alive","content-type":"text/event-stream; charset=utf-8","x-accel-buffering":"no"}})}if(B.pathname==="/api/telemetry/series"&&C.method==="GET"){le(!1);let be=qe(),_e=["sum","avg","min","max","count","p50","p90","p95","p99"].includes(String(me.aggregation))?me.aggregation:"avg",Se=Z({...me,kinds:"metric",limit:5000}),Ae=l.series({...Se,bucketMs:Number(me.bucketMs)||60000,aggregation:_e,timezone:String(me.timezone??"UTC"),compareFrom:me.compareFrom,compareTo:me.compareTo});return b({ok:!0,collection:{generatedAt:be.generatedAt,cached:be.cached},query:{aggregation:_e,bucketMs:Number(me.bucketMs)||60000,timezone:String(me.timezone??"UTC")},series:Ae})}if(B.pathname==="/api/telemetry/refresh"&&C.method==="POST")return b({ok:!0,...await le(!0)});if(B.pathname==="/api/telemetry/export"&&C.method==="POST"){let be=await ie(C);await le(!1);let _e=l.query({...Z(be),limit:Math.min(5000,Number(be.limit)||5000),cursor:void 0});if((be.format==="csv"?"csv":"json")==="json")return new Response(JSON.stringify({exportedAt:new Date().toISOString(),query:Z(be),..._e},null,2),{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.json"',"content-type":"application/json; charset=utf-8"}});let Ae=["timestamp","kind","source","name","level","value","unit","message","traceId","requestId","deploymentId","releaseId","workloadId"],et=[Ae.join(","),..._e.records.map((ot)=>Ae.map((St)=>`"${String(ot[St]??"").replaceAll('"','""')}"`).join(","))].join(`
-`);return new Response(et,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(B.pathname==="/api/telemetry/saved-queries"&&C.method==="GET"){let be=Oe(se);return b({ok:!0,queries:l.listSavedQueries(a.project.id,be.actor?.id)})}if(B.pathname==="/api/telemetry/saved-queries"&&C.method==="POST"){let be=await ie(C),_e=Oe(se);return b({ok:!0,query:l.saveQuery(a.project.id,_e.actor?.id,String(be.name??""),Z(be.query??be))},201)}if(B.pathname==="/api/telemetry/saved-queries"&&C.method==="DELETE"){let be=await ie(C),_e=Oe(se),Se=l.deleteSavedQuery(a.project.id,_e.actor?.id,String(be.id??""));return b({ok:Se},Se?200:404)}}if(B.pathname.startsWith("/api/configuration")){let d=a.environments.get(ye),l=se.role==="admin"||!!An.capabilities?.includes("secrets:read"),k=se.role==="admin"||!!An.capabilities?.includes("secrets:write"),M={projectId:a.project.id,environmentId:d?.id},F={"cache-control":"no-store"};if(B.pathname==="/api/configuration"&&C.method==="GET"){let X=Object.fromEntries(B.searchParams),j=X.scopeType||X.scopeId?oa(X,M):void 0,Z=["variable","secret"].includes(String(X.kind))?X.kind:void 0,me=j?.type==="preview"?Kt.previews.getInstance(j.id):void 0,le=me?Kt.previews.getDefinition(me.definitionId):void 0,qe=j?await un.resolve({projectId:a.project.id,environmentId:j.environmentId,resourceId:j.resourceId,functionId:j.type==="function"?j.id:void 0,previewId:j.previewId,trustedPreview:!!me&&!me.fork,allowedPreviewSecrets:le?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:l}):void 0,be=a.store.listResources(a.project.id);return b({ok:!0,entries:un.list({projectId:a.project.id,scope:j,kind:Z,search:X.search,canReadSecretMetadata:l}),effectiveEntries:qe?Object.values(qe.entries).filter((_e)=>!Z||_e.kind===Z).filter((_e)=>!X.search||_e.key.toLowerCase().includes(String(X.search).toLowerCase())):[],configurationHash:qe?.configurationHash,warnings:qe?.warnings??[],scopes:{project:a.project,environments:a.store.listEnvironments(a.project.id),resources:be.filter((_e)=>_e.kind!=="function"),functions:be.filter((_e)=>_e.kind==="function"),previews:Kt.previews.listInstances({projectId:a.project.id}).filter((_e)=>_e.status!=="destroyed").map((_e)=>({id:_e.id,name:_e.name,environmentId:_e.baseEnvironmentId,resourceId:_e.resourceId,fork:_e.fork,status:_e.status}))}},200,F)}if(B.pathname==="/api/configuration/export"&&C.method==="GET"){let X=oa(Object.fromEntries(B.searchParams),M);return new Response(un.exportVariables({projectId:a.project.id,scope:X}),{headers:{...F,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(B.pathname==="/api/configuration/plan"&&C.method==="POST"){let X=await ie(C),j=oa(X,M),Z=X.values&&typeof X.values==="object"&&!Array.isArray(X.values)?Object.fromEntries(Object.entries(X.values).map(([me,le])=>[me,String(le)])):{};return b({ok:!0,plan:un.plan({projectId:a.project.id,scope:j,values:Z,removeMissing:X.removeMissing===!0})},200,F)}if(B.pathname==="/api/configuration"&&C.method==="POST"){let X=await ie(C),j=oa(X,M),Z=X.kind==="secret"?"secret":"variable",me=String(X.key??"");if(Z==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let le=await un.set({organizationId:a.organization.id,projectId:a.project.id,scope:j,key:me,kind:Z,value:X.value==null?void 0:String(X.value),reference:X.reference==null?void 0:String(X.reference),backend:X.backend,required:X.required===!0,expectedVersion:X.expectedVersion==null?void 0:Number(X.expectedVersion),confirmed:String(X.confirm??"")===me,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:Oe(se).actor?.id});return b({ok:!0,entry:un.list({projectId:a.project.id,scope:j,canReadSecretMetadata:l}).find((qe)=>qe.id===le.entry.id),mutation:le.mutation,warnings:le.warnings},le.mutation.added.length?201:200,F)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le)},409,F)}}if(B.pathname==="/api/configuration/import"&&C.method==="POST"){let X=await ie(C),j=oa(X,M),Z=Array.isArray(X.secretKeys)?X.secretKeys.map(String):[];if(Z.length&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let me=await un.importDotenv({organizationId:a.organization.id,projectId:a.project.id,scope:j,source:String(X.source??""),secretKeys:Z,backend:X.backend,confirmed:X.confirm==="import",idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:Oe(se).actor?.id});return b({ok:me.document.valid,diagnostics:me.document.diagnostics,mutation:me.mutation,warnings:me.warnings},me.document.valid?200:422,F)}catch(me){return b({ok:!1,error:me instanceof Error?me.message:String(me)},409,F)}}if(B.pathname==="/api/configuration/dependencies"&&C.method==="POST"){let X=await ie(C),j=go.get(String(X.entryId??"")),Z=a.store.getResource(String(X.resourceId??""));if(!j||j.projectId!==a.project.id||!Z||Z.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry or dependent resource was not found."},404,F);return b({ok:!0,dependency:go.setDependency({entryId:j.id,resourceId:Z.id,injectionTarget:["native_reference","file"].includes(String(X.injectionTarget))?X.injectionTarget:"environment",required:X.required!==!1,requiresRedeploy:X.requiresRedeploy!==!1,lastDeployedVersion:X.lastDeployedVersion==null?void 0:Number(X.lastDeployedVersion)})},200,F)}if(B.pathname==="/api/configuration/transfer"&&C.method==="POST"){let X=await ie(C),j=go.get(String(X.id??"")),Z=oa({...X,scopeType:X.targetScopeType,scopeId:X.targetScopeId},M);if(!j||j.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,F);if(j.kind==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let me=await un.transfer({entryId:j.id,targetScope:Z,mode:X.mode==="move"?"move":"copy",confirmed:X.confirm===j.key,actorId:Oe(se).actor?.id,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey});return b({ok:!0,entry:un.list({projectId:a.project.id,scope:Z,canReadSecretMetadata:l}).find((le)=>le.id===me.entry.id),mutation:me.mutation},200,F)}catch(me){return b({ok:!1,error:me instanceof Error?me.message:String(me)},409,F)}}if(B.pathname==="/api/configuration/bulk"&&C.method==="POST"){let X=await ie(C),j=Array.isArray(X.ids)?X.ids.map(String).slice(0,500):[],Z=j.map((le)=>go.get(le)).filter((le)=>!!le&&le.projectId===a.project.id);if(Z.length!==j.length)return b({ok:!1,error:"One or more configuration entries were not found."},404,F);if(Z.some((le)=>le.kind==="secret")&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);if(X.action!=="delete"||X.confirm!=="bulk")return b({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,F);let me=[];try{for(let le of Z)me.push(await un.remove({entryId:le.id,expectedVersion:le.version,confirmed:!0,actorId:Oe(se).actor?.id}));return b({ok:!0,removed:me.flatMap((le)=>le.removed),affectedResourceIds:[...new Set(me.flatMap((le)=>le.affectedResourceIds))].sort()},200,F)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le),partial:me.flatMap((qe)=>qe.removed)},409,F)}}if(B.pathname==="/api/configuration/reveal"&&C.method==="POST"){let X=await ie(C),j=Bt.resolveSession(C);try{return b({ok:!0,value:await un.reveal({entryId:String(X.id??""),canRevealSecrets:l,recentlyAuthenticated:!Re||!!j&&we.isRecentlyAuthenticated(j),actorId:Oe(se).actor?.id})},200,F)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},403,F)}}if(B.pathname==="/api/configuration"&&C.method==="DELETE"){let X=await ie(C),j=go.get(String(X.id??""));if(j?.kind==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);if(!j||j.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,F);try{return b({ok:!0,mutation:await un.remove({entryId:j.id,expectedVersion:Number(X.expectedVersion),confirmed:String(X.confirm??"")===j.key,actorId:Oe(se).actor?.id})},200,F)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},409,F)}}}if(B.pathname.startsWith("/api/fleet")){let d=Oe(se).actor?.id,l=(k,M=409)=>b({ok:!1,error:k instanceof Error?k.message:String(k)},M,{"cache-control":"no-store"});if(B.pathname==="/api/fleet"&&C.method==="GET")return b({ok:!0,servers:ua.list(a.project.id),resources:a.store.listResources(a.project.id),operations:kt.list({projectId:a.project.id,limit:200}).filter((k)=>k.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(B.pathname==="/api/fleet"&&C.method==="POST"){let k=await ie(C);try{return b({ok:!0,server:Di.enroll({organizationId:a.organization.id,projectId:a.project.id,name:String(k.name??""),provider:["aws","hetzner"].includes(String(k.provider))?k.provider:"ssh",providerId:k.providerId?String(k.providerId):void 0,region:k.region?String(k.region):void 0,zone:k.zone?String(k.zone):void 0,endpoint:String(k.endpoint??""),sshUser:String(k.sshUser??"deploy"),sshPort:k.sshPort?Number(k.sshPort):22,credentialRef:String(k.credentialRef??""),roles:Array.isArray(k.roles)?k.roles:[],labels:k.labels&&typeof k.labels==="object"?k.labels:{}})},201)}catch(M){return l(M,422)}}if(B.pathname==="/api/fleet/action"&&C.method==="POST"){let k=await ie(C),M=String(k.id??""),F=String(k.action??"");try{if(F==="test")return b({ok:!0,server:await Di.test(M)});if(F==="validate")return b({ok:!0,server:await Di.validate(M)});if(F==="review_host_key")return b({ok:!0,server:Di.reviewHostKey(M,String(k.fingerprint??""))});if(F==="bootstrap")return b({ok:!0,...Di.bootstrap(M,k.confirmed===!0)},k.confirmed===!0?202:200);if(F==="heartbeat")return b({ok:!0,server:Di.heartbeat(M,{usage:k.usage&&typeof k.usage==="object"?k.usage:{}})});if(F==="drain")return b({ok:!0,server:Di.drain(M,k.completed===!0)});if(F==="uncordon")return b({ok:!0,server:Di.uncordon(M)});if(F==="archive")return b({ok:!0,server:Di.archive(M,String(k.confirmation??""))});return l("Unsupported fleet action.",422)}catch(X){return l(X)}}}if(B.pathname.startsWith("/api/capacity")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(B.pathname==="/api/capacity"&&C.method==="GET")return b({ok:!0,pools:fo.listPools(a.project.id),placements:fo.listPlacements(a.project.id),servers:ua.list(a.project.id)},200,{"cache-control":"no-store"});if(B.pathname==="/api/capacity"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,pool:fo.createPool({organizationId:a.organization.id,projectId:a.project.id,name:String(l.name??""),purpose:String(l.purpose??"application"),backend:String(l.backend??"server"),region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{},requiredServerLabels:l.requiredServerLabels&&typeof l.requiredServerLabels==="object"?l.requiredServerLabels:{},toleratedTaints:Array.isArray(l.toleratedTaints)?l.toleratedTaints.map(String):[],capacity:l.capacity&&typeof l.capacity==="object"?l.capacity:{},maxWorkloads:Number(l.maxWorkloads??10),costWeight:Number(l.costWeight??1),spreadKey:l.spreadKey?String(l.spreadKey):void 0,concurrency:Number(l.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(k){return d(k,422)}}if(B.pathname==="/api/capacity/member"&&C.method==="POST"){let l=await ie(C);try{return fo.addMember(String(l.poolId??""),String(l.serverId??"")),b({ok:!0,pool:fo.getPool(String(l.poolId??""))})}catch(k){return d(k,422)}}if(B.pathname==="/api/capacity/explain"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,decisions:mp.explain(a.project.id,{purpose:String(l.purpose??"application"),resources:l.resources&&typeof l.resources==="object"?l.resources:{},region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{}})})}catch(k){return d(k,422)}}if(B.pathname==="/api/capacity/action"&&C.method==="POST"){let l=await ie(C);try{if(l.action==="drain")return b({ok:!0,...mp.drainPool(String(l.poolId??""))});if(l.action==="enable")return b({ok:!0,pool:fo.updatePool(String(l.poolId??""),{status:"active"})});if(l.action==="disable")return b({ok:!0,pool:fo.updatePool(String(l.poolId??""),{status:"disabled"})});return d("Unsupported capacity action.",422)}catch(k){return d(k,422)}}}if(B.pathname.startsWith("/api/regions")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(B.pathname==="/api/regions"&&C.method==="GET")return b({ok:!0,topologies:Bo.list(a.project.id).map((l)=>({topology:l,targets:Bo.targets(l.id),channels:Bo.channels(l.id),route:Bo.route(l.id),executions:Bo.executions(l.id)}))},200,{"cache-control":"no-store"});if(B.pathname==="/api/regions"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,topology:fp.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:a.environments.get(ye)?.id,name:String(l.name??""),hostname:String(l.hostname??""),regions:Array.isArray(l.regions)?l.regions:[],trafficPolicy:l.trafficPolicy==="weighted"||l.trafficPolicy==="latency"?l.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(l.replicate)?l.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(l.maxLagSeconds??30),retainOnDestroy:l.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:l.cdnEnabled===!0,wafEnabled:l.wafEnabled===!0})},201)}catch(k){return d(k,422)}}if(B.pathname==="/api/regions/action"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...fp.enqueue({topologyId:String(l.topologyId??""),kind:String(l.action??""),targetRegion:l.targetRegion?String(l.targetRegion):void 0,revision:l.revision?String(l.revision):void 0,manifest:l.manifest&&typeof l.manifest==="object"?l.manifest:{},confirmation:l.confirmation?String(l.confirmation):void 0,deleteData:l.deleteData===!0})},202)}catch(k){return d(k,422)}}}if(B.pathname.startsWith("/api/maintenance")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(B.pathname==="/api/maintenance"&&C.method==="GET")return b({ok:!0,manifests:Ui.manifests(a.organization.id),windows:Ui.windows(a.project.id),campaigns:Ui.campaigns(a.project.id).map((l)=>({campaign:l,targets:Ui.targets(l.id)})),cleanups:Ui.cleanups(a.project.id),drills:Ui.drills(a.project.id)},200,{"cache-control":"no-store"});if(B.pathname==="/api/maintenance/cleanup-preview"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,plan:await Nd.previewCleanup({projectId:a.project.id,kind:String(l.kind??"operations"),criteria:{olderThanDays:Number(l.olderThanDays??30)}},hp)},201)}catch(k){return d(k,422)}}if(B.pathname==="/api/maintenance/cleanup-apply"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...Nd.enqueueCleanup(String(l.planId??""),String(l.confirmation??""))},202)}catch(k){return d(k,422)}}if(B.pathname==="/api/maintenance/drill"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,drill:Ui.createDrill({projectId:a.project.id,scenario:String(l.scenario??"control_plane"),isolatedTarget:String(l.isolatedTarget??""),expectedRpoMinutes:Number(l.expectedRpoMinutes??60),expectedRtoMinutes:Number(l.expectedRtoMinutes??30),recoveryPointId:l.recoveryPointId?String(l.recoveryPointId):void 0,topologyId:l.topologyId?String(l.topologyId):void 0})},201)}catch(k){return d(k,422)}}if(B.pathname==="/api/maintenance/drill-run"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...Nd.enqueueDrill(String(l.drillId??""))},202)}catch(k){return d(k,422)}}}if(B.pathname.startsWith("/api/volumes")){let d=a.environments.get(ye),l=Oe(se).actor?.id,k=(M,F=409)=>b({ok:!1,error:M instanceof Error?M.message:String(M)},F,{"cache-control":"no-store"});if(B.pathname==="/api/volumes"&&C.method==="GET"){let M=Od.inventory(a.project.id,d?.id),F=a.store.listResources(a.project.id,d?.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind,provider:X.provider,providerId:X.providerId}));return b({ok:!0,volumes:M,resources:F,operations:kt.list({projectId:a.project.id,limit:100}).filter((X)=>X.operation.kind.startsWith("volume.")),recoveryPoints:Yt.listRecoveryPoints(a.project.id).filter((X)=>X.kind==="volume"),providers:_d.map((X)=>({provider:X.provider,type:X.type,capabilities:X.capabilities()}))},200,{"cache-control":"no-store"})}if(B.pathname==="/api/volumes"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:M.resourceId?String(M.resourceId):void 0,name:String(M.name??""),provider:String(M.provider??"docker"),type:M.type==="docker"?"docker":M.type,capacityBytes:M.capacityBytes==null?void 0:Number(M.capacityBytes),filesystem:M.filesystem?String(M.filesystem):void 0,encrypted:M.encrypted===!0,desiredState:M.desiredState&&typeof M.desiredState==="object"?M.desiredState:{},actorId:l})},202,{"cache-control":"no-store"})}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/attach"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.attach(String(M.volumeId??""),{resourceId:String(M.resourceId??""),targetPath:String(M.targetPath??""),readOnly:M.readOnly===!0,uid:M.uid==null?void 0:Number(M.uid),gid:M.gid==null?void 0:Number(M.gid),mode:M.mode?String(M.mode):void 0,propagation:M.propagation,driverOptions:M.driverOptions&&typeof M.driverOptions==="object"?M.driverOptions:{},actorId:l})},202)}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/detach"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.detach(String(M.volumeId??""),String(M.attachmentId??""),{force:M.force===!0,drained:M.drained===!0,unmounted:M.unmounted===!0,confirmation:M.confirmation?String(M.confirmation):void 0,actorId:l})},202)}catch(F){return k(F)}}if(B.pathname==="/api/volumes/resize"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.resize(String(M.volumeId??""),Number(M.capacityBytes),{drained:M.drained===!0,actorId:l})},202)}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/snapshot"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.snapshot(String(M.volumeId??""),{name:M.name?String(M.name):void 0,actorId:l})},202)}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/restore"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.restore(String(M.snapshotId??""),{name:String(M.name??""),actorId:l})},202)}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/discover"&&C.method==="POST")try{return b({ok:!0,volumes:await ji.discover({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,actorId:l})})}catch(M){return k(M,502)}if(B.pathname==="/api/volumes/adopt"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,volume:ji.adopt(String(M.volumeId??""),{name:String(M.name??""),actorId:l})})}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes"&&C.method==="DELETE"){let M=await ie(C),F=Bt.resolveSession(C);try{return b({ok:!0,...ji.delete(String(M.volumeId??""),{recentAuthAt:!Re||F&&we.isRecentlyAuthenticated(F)?new Date().toISOString():void 0,confirmation:M.confirmation?String(M.confirmation):void 0,backupOverride:M.backupOverride===!0,backupOverrideConfirmation:M.backupOverrideConfirmation?String(M.backupOverrideConfirmation):void 0,actorId:l})},202)}catch(X){return k(X)}}}if(B.pathname==="/api/backups"&&C.method==="GET"){let d=a.environments.get(ye),l=Yt.listPolicies(a.project.id,d?.id),k=new Set(l.map((Z)=>Z.id)),M=Yt.listRecoveryPoints(a.project.id).filter((Z)=>!Z.policyId||k.has(Z.policyId)),F=Yt.listJobs(a.project.id).filter((Z)=>!Z.policyId||k.has(Z.policyId)),X=(Z)=>({...Z,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Z.credentialRef,clientEncryptionConfigured:!!Z.encryptionKeyRef}),j=await Promise.all(Yt.listDestinations(a.project.id).map(async(Z)=>({...X(Z),credentialStatus:await Nh(Z,Fi)})));return b({ok:!0,destinations:j,policies:l,recoveryPoints:M,jobs:F,coverage:Yt.coverage(a.project.id).filter((Z)=>k.has(Z.policy.id)),resources:d?a.store.listResources(a.project.id,d.id).map((Z)=>({id:Z.id,name:Z.name,slug:Z.slug,kind:Z.kind})):[]})}if(B.pathname==="/api/backups/destinations"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim(),k=String(d.provider??""),M=String(d.encryption??"provider"),F=`secret://data-services/backups/${a.project.id}/${l}`,X=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(k))return b({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(M))return b({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let j,Z;if(d.credentials&&typeof d.credentials==="object"&&!Array.isArray(d.credentials))j=`${F}/credentials`,await Fi.put(j,JSON.stringify(d.credentials)),X.push(j);if(M!=="provider"){let le=String(d.encryptionKey??"");if(le.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");Z=`${F}/encryption-key`,await Fi.put(Z,le),X.push(Z)}let me=Yt.createDestination({organizationId:a.organization.id,projectId:a.project.id,name:l,provider:k,endpoint:d.endpoint?String(d.endpoint):void 0,endpointPolicy:d.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:d.bucket?String(d.bucket):void 0,prefix:String(d.prefix??""),region:d.region?String(d.region):mo,forcePathStyle:d.forcePathStyle===!0,credentialRef:j,encryption:M,encryptionKeyRef:Z,immutability:d.immutability&&typeof d.immutability==="object"&&!Array.isArray(d.immutability)?d.immutability:{},status:"untested"});return b({ok:!0,destination:{...me,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!j,clientEncryptionConfigured:!!Z}},201)}catch(j){for(let Z of X)await Fi.remove(Z).catch(()=>{});return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}if(B.pathname==="/api/backups/destinations/test"&&C.method==="POST"){let d=await ie(C),l=Yt.getDestination(String(d.id??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(l.provider==="aws_backup")return b({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await gp.test(l),b({ok:!0,destination:Yt.recordDestinationTest(l.id,{ok:!0})})}catch(k){let M=k instanceof Error?k.message:String(k);return Yt.recordDestinationTest(l.id,{ok:!1,error:M}),b({ok:!1,error:M},502)}}if(B.pathname==="/api/backups/policies"&&C.method==="POST"){let d=await ie(C),l=a.environments.get(ye),k=Yt.getDestination(String(d.destinationId??"")),M=String(d.resourceKind??""),F=d.dataServiceId?String(d.dataServiceId):void 0,X=F?Ot.get(F):void 0,j=d.resourceId?String(d.resourceId):void 0,Z=j?a.store.getResource(j):void 0;if(!l)return b({ok:!1,error:"Environment was not found."},404);if(!k||k.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(M))return b({ok:!1,error:"A supported backup resource kind is required."},422);if(F&&(!X||X.projectId!==a.project.id||X.environmentId!==l.id))return b({ok:!1,error:"Data service was not found in this environment."},404);if(j&&(!Z||Z.projectId!==a.project.id||Z.environmentId!==l.id))return b({ok:!1,error:"Resource was not found in this environment."},404);if(M==="managed_database"&&!X)return b({ok:!1,error:"Managed database policies require a data service."},422);if(M==="logical_database"&&(!X||!["container","server"].includes(X.provider)))return b({ok:!1,error:"Logical database policies require an on-box data service."},422);if(M==="volume"&&(!Z||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(d.volumeName??""))))return b({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let me=Array.isArray(d.includePatterns)?d.includePatterns.map(String).filter(Boolean):[];if(M==="files"&&(!Z||!me.length))return b({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(M==="control_plane"&&k.encryption==="provider")return b({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(M==="infrastructure"&&(k.provider!=="aws_backup"||!me.some((le)=>le.startsWith("resource:arn:"))||!me.some((le)=>le.startsWith("role:arn:"))))return b({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let le=Yt.createPolicy({organizationId:a.organization.id,projectId:a.project.id,environmentId:l.id,resourceId:j,dataServiceId:F,destinationId:k.id,name:String(d.name??"").trim(),resourceKind:M,schedule:String(d.schedule??"daily"),timezone:String(d.timezone??"UTC"),retention:d.retention&&typeof d.retention==="object"&&!Array.isArray(d.retention)?d.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(d.compression))?d.compression:"gzip",encryption:["destination","client_side","both"].includes(String(d.encryption))?d.encryption:"destination",includePatterns:M==="volume"?[String(d.volumeName),...me]:me,excludePatterns:Array.isArray(d.excludePatterns)?d.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(d.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(d.expectedRtoMinutes)||120),healthCheckId:d.healthCheckId?String(d.healthCheckId):void 0,enabled:d.enabled!==!1});return b({ok:!0,policy:le},201)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le)},422)}}if(B.pathname==="/api/backups/run"&&C.method==="POST"){let d=await ie(C),l=Yt.getPolicy(String(d.policyId??"")),k=a.environments.get(ye);if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Backup policy was not found in this environment."},404);try{let M=Lo.enqueueBackup(l,new Date().toISOString(),Oe(se).actor?.id);return b({ok:!0,job:M},202)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:String(M)},409)}}if(B.pathname==="/api/backups/verify"&&C.method==="POST"){let d=await ie(C),l=Yt.getRecoveryPoint(String(d.recoveryPointId??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);return b({ok:!0,job:Lo.enqueueVerification(l)},202)}if(B.pathname==="/api/backups/restore"&&C.method==="POST"){let d=await ie(C),l=Yt.getRecoveryPoint(String(d.recoveryPointId??"")),k=d.mode==="in_place"?"in_place":"isolated",M=d.target&&typeof d.target==="object"&&!Array.isArray(d.target)?{...d.target,inPlace:k==="in_place"}:{inPlace:k==="in_place"},F=Bt.resolveSession(C),X={mode:k,target:M,targetName:String(d.targetName??""),confirm:d.confirm?String(d.confirm):void 0,recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F),downtimeAcknowledged:d.downtimeAcknowledged===!0,safetyBackupId:d.safetyBackupId?String(d.safetyBackupId):void 0};if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.drill===!0&&k!=="isolated")return b({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let j=Lo.planRestore(l,X);if(d.execute!==!0)return b({ok:!0,plan:j,executionCreated:!1});let Z=Lo.enqueueRestore(l,{...X,drill:d.drill===!0,actorId:Oe(se).actor?.id});return b({ok:!0,plan:j,job:Z},202)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},409)}}if(B.pathname==="/api/backups/recovery-points"&&C.method==="POST"){let d=await ie(C),l=Yt.getRecoveryPoint(String(d.id??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.held==null&&d.pinned==null)return b({ok:!1,error:"held or pinned must be provided."},422);return b({ok:!0,recoveryPoint:Yt.updateRecoveryPoint(l.id,{held:d.held==null?l.held:d.held===!0,pinned:d.pinned==null?l.pinned:d.pinned===!0})})}if(B.pathname==="/api/backups/retention"&&C.method==="POST")return b({ok:!0,jobs:Lo.enqueueRetention()},202);if(B.pathname==="/api/data-services/capabilities"&&C.method==="GET"){let d=String(B.searchParams.get("engine")??""),l=String(B.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(d)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(l))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,engine:d,provider:l,capabilities:sr(d,l)})}if(B.pathname==="/api/data-services"&&C.method==="GET"){let d=a.environments.get(ye),l=Ot.list(a.project.id,d?.id).map((k)=>{let M=Ot.credential(k.id);return{...k,credentialRef:void 0,credential:M?{configured:!0,username:M.username,version:M.version,rotatedAt:M.rotatedAt}:void 0,dependencies:Ot.dependencies(k.id).map((F)=>({resourceId:F.resourceId,requiresRedeploy:F.requiresRedeploy}))}});return b({ok:!0,services:l})}if(B.pathname==="/api/data-services/preview"&&C.method==="POST"){let d=await ie(C);if(d.id){let M=Ot.get(String(d.id)),F=a.environments.get(ye),X=String(d.action??"");if(!M||M.projectId!==a.project.id||M.environmentId!==F?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Rd.includes(X))return b({ok:!1,error:`Action must be one of: ${Rd.join(", ")}.`},422);try{return b({ok:!0,plan:Ua.plan(M,X,d.changes??{})})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}let l=String(d.engine??""),k=String(d.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(k))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,capabilities:sr(l,k),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(B.pathname==="/api/data-services"&&C.method==="POST"){let d=await ie(C),l=String(d.engine??""),k=String(d.provider??""),M=a.environments.get(ye),F=Oe(se);if(!M)return b({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(k))return b({ok:!1,error:"A supported engine and provider are required."},422);let X={organizationId:a.organization.id,projectId:a.project.id,environmentId:M.id,resourceId:d.resourceId?String(d.resourceId):void 0,name:String(d.name??"").trim(),engine:l,provider:k,placement:String(d.placement??d.name??"").trim(),engineVersion:d.engineVersion?String(d.engineVersion):void 0,plan:String(d.plan??(k==="aws_elasticache"?"cache.t4g.micro":k==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:d.storageGb==null?void 0:Number(d.storageGb),highAvailability:d.highAvailability===!0,publicExposure:d.publicExposure===!0,allowedCidrs:Array.isArray(d.allowedCidrs)?d.allowedCidrs.map(String):[],desiredState:d.desiredState&&typeof d.desiredState==="object"&&!Array.isArray(d.desiredState)?d.desiredState:{},observedState:{},origin:d.adopt===!0?"adopted":"managed",managementEnabled:d.adopt!==!0,ownerActorId:F.actor?.id,username:d.username?String(d.username):void 0};try{if(d.adopt===!0){let Z=Ot.create({...X,status:"adopted",credentialRef:void 0});return b({ok:!0,service:Z,readOnly:!0},201)}if(!pp({provider:k,engine:l}))return b({ok:!1,error:`No ${k}/${l} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let j=await Ua.create(X);return b({ok:!0,service:j.service,operationId:j.operationId,oneTimeCredential:j.credential},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}if(B.pathname==="/api/data-services/connections"&&C.method==="GET"){let d=Ot.get(String(B.searchParams.get("id")??"")),l=a.environments.get(ye);if(!d||d.projectId!==a.project.id||d.environmentId!==l?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);let k=typeof d.observedState.endpoint==="string"?d.observedState.endpoint:void 0,M=typeof d.observedState.readerEndpoint==="string"?d.observedState.readerEndpoint:void 0,F=Number(d.observedState.port)||(d.engine==="postgres"?5432:d.engine==="redis"?6379:d.engine==="mongodb"?27017:d.engine==="libsql"?8080:3306),X=typeof d.observedState.database==="string"?d.observedState.database:void 0,j=typeof d.observedState.tls==="boolean"?d.observedState.tls:d.provider.startsWith("aws_"),Z=[...k?[{type:d.publicExposure?"external":"internal",host:k,port:F,database:X,tls:j}]:[],...M?[{type:"internal",host:M,port:F,database:X,tls:j}]:[],{type:"tunnel",host:k??d.placement,port:F,database:X,tls:j}];return b({ok:!0,serviceId:d.id,guidance:Wn(d,Z)})}if(B.pathname==="/api/data-services/action"&&C.method==="POST"){let d=await ie(C),l=Ot.get(String(d.id??"")),k=a.environments.get(ye),M=String(d.action??"");if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Rd.includes(M))return b({ok:!1,error:`Action must be one of: ${Rd.join(", ")}.`},422);let F=d.changes&&typeof d.changes==="object"&&!Array.isArray(d.changes)?d.changes:{};try{let X=Ua.plan(l,M,F);if(d.execute!==!0)return b({ok:!0,plan:X,productionExecutionCreated:!1});let j=Ua.enqueue(l,M,F,Oe(se).actor?.id);return b({ok:!0,plan:X,operationId:j},202)}catch(X){return b({ok:!1,error:X instanceof Error?X.message:String(X)},409)}}if(B.pathname==="/api/data-services/dependencies"&&C.method==="POST"){let d=await ie(C),l=Ot.get(String(d.id??"")),k=a.environments.get(ye),M=a.store.getResource(String(d.resourceId??""));if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M||M.projectId!==a.project.id||M.environmentId!==k?.id)return b({ok:!1,error:"Dependent resource was not found in this environment."},404);if(d.remove===!0)return b({ok:Ot.removeDependency(l.id,M.id)});return Ot.addDependency({serviceId:l.id,resourceId:M.id,secretRef:l.credentialRef??`secret://data-services/${l.projectId}/${l.name}`,requiresRedeploy:d.requiresRedeploy!==!1}),b({ok:!0,dependencies:Ot.dependencies(l.id).map((F)=>({resourceId:F.resourceId,requiresRedeploy:F.requiresRedeploy}))})}if(B.pathname==="/api/data-services/management"&&C.method==="POST"){let d=await ie(C),l=Ot.get(String(d.id??"")),k=a.environments.get(ye);if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(l.origin!=="adopted"||d.reviewed!==!0||d.confirm!==l.name)return b({ok:!1,error:`Enabling management requires reviewed=true and typing ${l.name}.`},409);return b({ok:!0,service:Ot.update(l.id,l.version,{managementEnabled:!0})})}if(B.pathname==="/api/data-services/reveal"&&C.method==="POST"){let d=await ie(C),l=Ot.get(String(d.id??"")),k=a.environments.get(ye),M=l?Ot.credential(l.id):void 0;if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M)return b({ok:!1,error:"No managed credential is configured."},404);return b({ok:!0,credential:{username:M.username,password:await Fi.resolve(M.secretRef),version:M.version}},200,{"cache-control":"no-store"})}if(B.pathname==="/api/databases"&&C.method==="GET")return b(await xm(o,ye));if(B.pathname==="/api/databases"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim();if(!Qi(l))return b({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return b({...await Dm(o,ye,l),name:l})}if(B.pathname==="/api/databases/vitess"&&C.method==="GET"){let d=await $m(o,ye);return b({...d,unhealthy:Mm(d.tablets),missingPrimary:Lm(d)})}if(B.pathname==="/api/databases/vitess/provision"&&C.method==="POST"){let d=await ie(C);try{return b(await yy(o,ye,{keyspace:String(d.keyspace??""),username:String(d.username??""),password:String(d.password??""),sharded:d.sharded===!0,confirm:String(d.confirm??"")}))}catch(l){return b({ok:!1,error:l instanceof Error?l.message:String(l)},422)}}if(B.pathname==="/api/databases/vitess/migrations"&&C.method==="GET"){let d=B.searchParams.get("keyspace")??void 0;return b(await fy(o,ye,d))}if(B.pathname==="/api/databases/vitess/migrations/action"&&C.method==="POST"){let d=await ie(C),l=String(d.uuid??"").trim(),k=String(d.action??"");if(!["retry","cancel","cleanup","complete"].includes(k))return b({ok:!1,error:"Unknown migration action."},422);return b(await hy(o,ye,l,k))}if(B.pathname==="/api/databases/vitess/keyspaces"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim(),k=d.sharded===!0;return b(await py(o,ye,l,{sharded:k}))}if(B.pathname==="/api/databases/vitess/vschema"&&C.method==="POST"){let d=await ie(C),l=String(d.keyspace??"").trim(),k=typeof d.vschema==="string"?d.vschema:JSON.stringify(d.vschema??null);return b(await gy(o,ye,l,k))}if(B.pathname==="/api/databases/vitess/schema"&&C.method==="POST"){let d=await ie(C),l=String(d.sql??"");return b(await my(o,ye,l))}if(B.pathname==="/api/databases/vitess/install-client"&&C.method==="POST")return b(await ly(o,ye));if(B.pathname==="/api/databases/backups"&&C.method==="GET")return b(await Nm(o,ye));if(B.pathname==="/api/databases/backup"&&C.method==="POST"){let d=await ie(C),l=String(d.database??"").trim();if(!Qi(l))return b({ok:!1,error:"Database name must be a valid identifier."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to back up this database.`},409);return b(await _m(o,ye,l))}if(B.pathname==="/api/databases/users"&&C.method==="POST"){let d=await ie(C),l=String(d.username??"").trim(),k=String(d.password??""),M=String(d.database??"").trim()||void 0,F=d.access==="readonly"?"readonly":"all";if(!Qi(l))return b({ok:!1,error:"Username must be a valid identifier."},422);if(!k)return b({ok:!1,error:"Password is required."},422);if(M&&!Qi(M))return b({ok:!1,error:"Database must be a valid identifier."},422);return b({...await Om(o,ye,{username:l,password:k,database:M,access:F}),username:l})}if(B.pathname==="/api/dashboard-data")return _t=K.get(ye)??await tt(ye),tt(ye),b(Zl(_t,{user:An,slug:o.project.slug}));if(B.pathname==="/api/users"&&C.method==="GET")return b({ok:!0,users:dn(t).map(ia)});if(B.pathname==="/api/users"&&C.method==="POST"){let d=await ie(C),l=String(d.username??"").trim();if(!Id(l))return b({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let k=d.sites&&typeof d.sites==="object"?d.sites:{},M=new Set(Object.keys(o.sites??{})),F={};for(let[Z,me]of Object.entries(k)){if(!M.has(Z))return b({ok:!1,error:`Site '${Z}' was not found.`},404);if(me!=="owner"&&me!=="collaborator")return b({ok:!1,error:`Unknown site role '${me}'. Use 'owner' or 'collaborator'.`},422);F[Z]=me}let X=typeof d.password==="string"&&d.password.trim()?d.password.trim():void 0;if(X&&X.length<12)return b({ok:!1,error:"Password must be at least 12 characters."},422);let j=$a(t,{username:l,password:X,name:typeof d.name==="string"?d.name:void 0,sites:F});return Xa(a,dn(t)),_n(),b({ok:!0,user:ia(j.user),password:j.password})}if(B.pathname==="/api/users"&&C.method==="DELETE"){let d=await ie(C),l=String(d.username??"").trim();if(l.toLowerCase()===se.username.toLowerCase())return b({ok:!1,error:"You cannot remove your own account."},409);let k=On(dn(t),l),M=k?a.store.getActorByExternalId("user",`dashboard:${k.username.toLowerCase()}`):void 0,F=M?a.store.getMembershipForActor(a.organization.id,M.id):void 0;if(F&&F.source!=="legacy")return b({ok:!1,error:"Organization members must be removed from Organization access."},409);let X=Xl(t,l);if(!X.ok)return b(X,409);return Xa(a,dn(t)),ke.clear(),b({ok:!0,username:l})}if(B.pathname==="/api/actions/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.action?vA(d.action,ye):void 0;if(!l)return b({ok:!1,error:"Unknown dashboard action."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this action.`},409);let k=await Vi({controlPlane:a,environment:ye,actor:se,kind:`dashboard.action.${l.id}`,input:{action:l.id},execute:()=>dp(l,{cwd:t,cliEntry:i})});return b({...k.result,controlPlaneOperation:k.operation})}if(B.pathname==="/api/server/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.operation?si(d.operation,o,_t):void 0;if(!l)return b({ok:!1,error:"Unknown or unavailable server operation."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let k=ue(a,String(ye));await new ns(rt).run(new Pa,{...k,artifactRoot:t});let M=gr(rt,{scope:k,desiredConfigHash:a.project.desiredConfigHash});if(M.decision.outcome==="block")return b({ok:!1,error:`Operation blocked by security policy: ${M.decision.explanation}`,securityReview:M},409);let F=await Vi({controlPlane:a,environment:ye,actor:se,kind:`dashboard.server.${l.id}`,resourceSlug:l.target,input:{operation:l.id,target:l.target,to:d.to??null},execute:()=>Qr(o,ye,l,{to:d.to})});return b({...F.result,controlPlaneOperation:F.operation,securityReview:M})}if(B.pathname==="/api/server/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command on the server.'},409);let l=await Vi({controlPlane:a,environment:ye,actor:se,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>pr(o,ye,String(d.command??""))});return b({...l.result,controlPlaneOperation:l.operation})}if(B.pathname==="/api/serverless/operations")return b(ip(o,ye,_t));if(B.pathname==="/api/serverless/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.operation?Vy(d.operation,o,ye,_t):void 0;if(!l)return b({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let k=await Vi({controlPlane:a,environment:ye,actor:se,kind:`dashboard.serverless.${l.id}`,input:{operation:l.id,min:d.min??null,max:d.max??null},execute:()=>qy(o,ye,l,{min:d.min,max:d.max})});return _t=await gs(o,ye),K.set(ye,_t),b({...k.result,controlPlaneOperation:k.operation})}if(B.pathname==="/api/serverless/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command.'},409);return b(await Gy(o,ye,String(d.command??"")))}if(B.pathname==="/api/serverless/dlq"&&C.method==="GET"){let d=Number(B.searchParams.get("max"))||10;return b(await Jy(o,ye,d))}if(B.pathname==="/api/serverless/dlq/redrive"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="redrive")return b({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return b(await Hy(o,ye,{max:d.max,targetQueue:d.targetQueue}))}if(B.pathname==="/api/serverless/dlq/purge"&&C.method==="POST"){if((await C.json().catch(()=>({}))).confirm!=="purge")return b({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return b(await Wy(o,ye))}if(B.pathname==="/api/serverless/secrets"&&C.method==="GET")return b({secrets:Ky(o,ye)});if(B.pathname==="/api/serverless/secrets"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return b({ok:!1,error:"A secret id is required."},422);if(typeof d.value!=="string"||d.value==="")return b({ok:!1,error:"A non-empty value is required."},422);return b(await Qy(o,ye,l,d.value))}if(B.pathname==="/api/serverless/secrets"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return b({ok:!1,error:"A secret id is required."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to delete this secret.`},409);return b(await Yy(o,ye,l))}if(B.pathname==="/api/serverless/functions/config"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.mode??"").trim();if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to update this function.`},409);return b(await Xy(o,ye,l,{memory:d.memory,timeout:d.timeout}))}if(B.pathname==="/api/serverless/alarms"&&C.method==="GET")return b(await Zy(o,ye));if(B.pathname==="/api/serverless/alarms"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.preset??"").trim(),k=Number(d.threshold);if(!l)return b({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(k))return b({ok:!1,error:"A numeric threshold is required."},422);return b(await eb(o,ye,l,k))}if(B.pathname==="/api/serverless/alarms"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),l=String(d.name??"").trim();if(!l)return b({ok:!1,error:"An alarm name is required."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to delete this alarm.`},409);return b(await tb(o,ye,l))}if(B.pathname==="/api/serverless/traces"&&C.method==="GET"){let d=Number(B.searchParams.get("minutes"))||30;return b(await Ad(o,ye,d))}if(B.pathname==="/api/serverless/scheduler"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.action??"").trim();if(l!=="enable"&&l!=="disable"&&l!=="run")return b({ok:!1,error:"Unknown scheduler action."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to ${l} the scheduler.`},409);return b(await ap(o,ye,l))}if(!bb(B.pathname,An))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(ye)}`}});let vs=await ki(se,ye);if(!vs)return xd("ts-cloud dashboard UI is unavailable.",503);return Sb(vs,B.pathname)}catch(Fo){if(e.verbose)console.error(Fo);return b({ok:!1,error:Fo?.message??String(Fo)},500)}})();if(!Qt)return Qt;if(ct&&(B.pathname.startsWith("/api/")||B.pathname.startsWith("/auth/"))){let Ye;if((Ie.headers.get("content-type")||"").includes("application/json"))Ye=await Ie.json().catch(()=>{return});let Cr=Bt.resolveUser(C),br=Cr?Oe(Cr).actor:void 0;a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,actorId:br?.id,correlationId:Ve,type:Qt.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:Qt.status<400?"info":"warning",payload:iA(C.method,B.pathname,Ye,Qt.status,Date.now()-De)})}return Qt.headers.set("x-request-id",Ve),Qt}});za?.start();let $b=e.spendLoop??!0,Pp;if($b)(async()=>{let{SpendRunner:C,SpendLoopLease:Te,startSpendLoop:De}=await import("./chunk-y9qdpwa6.js"),{store:Ie}=await wb(a.store),Ve=new C({controlPlane:a.store,store:Ie,alerts:Ge});Pp=De(Ve,{lease:new Te(a.store,{owner:`dashboard:${process.pid}`}),onError:(ct)=>console.error(`[ts-cloud] spend cycle failed: ${ct instanceof Error?ct.message:String(ct)}`)})})();let Mb=bs.stop.bind(bs);return bs.stop=(C)=>{clearInterval(Tp),clearInterval(Ap),clearInterval(kp),clearInterval(Ep),clearInterval(Cp),clearInterval(Sp),clearInterval(vp),clearInterval(wp),clearInterval(Ip),_n(),Zt.clear(),za?.stop(),Pp?.();let Te=Mb(C);if(za)za.settled().finally(()=>a.store.close());else a.store.close();return Te},{server:bs,url:`http://${r}:${bs.port}/`}}
+`);return new Response(et,{headers:{"content-disposition":'attachment; filename="ts-cloud-telemetry.csv"',"content-type":"text/csv; charset=utf-8"}})}if(B.pathname==="/api/telemetry/saved-queries"&&C.method==="GET"){let be=Oe(se);return b({ok:!0,queries:l.listSavedQueries(a.project.id,be.actor?.id)})}if(B.pathname==="/api/telemetry/saved-queries"&&C.method==="POST"){let be=await ie(C),_e=Oe(se);return b({ok:!0,query:l.saveQuery(a.project.id,_e.actor?.id,String(be.name??""),Z(be.query??be))},201)}if(B.pathname==="/api/telemetry/saved-queries"&&C.method==="DELETE"){let be=await ie(C),_e=Oe(se),Se=l.deleteSavedQuery(a.project.id,_e.actor?.id,String(be.id??""));return b({ok:Se},Se?200:404)}}if(B.pathname.startsWith("/api/configuration")){let d=a.environments.get(ye),l=se.role==="admin"||!!An.capabilities?.includes("secrets:read"),k=se.role==="admin"||!!An.capabilities?.includes("secrets:write"),M={projectId:a.project.id,environmentId:d?.id},F={"cache-control":"no-store"};if(B.pathname==="/api/configuration"&&C.method==="GET"){let X=Object.fromEntries(B.searchParams),j=X.scopeType||X.scopeId?oa(X,M):void 0,Z=["variable","secret"].includes(String(X.kind))?X.kind:void 0,me=j?.type==="preview"?Kt.previews.getInstance(j.id):void 0,le=me?Kt.previews.getDefinition(me.definitionId):void 0,qe=j?await un.resolve({projectId:a.project.id,environmentId:j.environmentId,resourceId:j.resourceId,functionId:j.type==="function"?j.id:void 0,previewId:j.previewId,trustedPreview:!!me&&!me.fork,allowedPreviewSecrets:le?.inheritedSecrets,nativeReferences:!0,canReadSecretMetadata:l}):void 0,be=a.store.listResources(a.project.id);return b({ok:!0,entries:un.list({projectId:a.project.id,scope:j,kind:Z,search:X.search,canReadSecretMetadata:l}),effectiveEntries:qe?Object.values(qe.entries).filter((_e)=>!Z||_e.kind===Z).filter((_e)=>!X.search||_e.key.toLowerCase().includes(String(X.search).toLowerCase())):[],configurationHash:qe?.configurationHash,warnings:qe?.warnings??[],scopes:{project:a.project,environments:a.store.listEnvironments(a.project.id),resources:be.filter((_e)=>_e.kind!=="function"),functions:be.filter((_e)=>_e.kind==="function"),previews:Kt.previews.listInstances({projectId:a.project.id}).filter((_e)=>_e.status!=="destroyed").map((_e)=>({id:_e.id,name:_e.name,environmentId:_e.baseEnvironmentId,resourceId:_e.resourceId,fork:_e.fork,status:_e.status}))}},200,F)}if(B.pathname==="/api/configuration/export"&&C.method==="GET"){let X=oa(Object.fromEntries(B.searchParams),M);return new Response(un.exportVariables({projectId:a.project.id,scope:X}),{headers:{...F,"content-disposition":'attachment; filename="ts-cloud.env"',"content-type":"text/plain; charset=utf-8"}})}if(B.pathname==="/api/configuration/plan"&&C.method==="POST"){let X=await ie(C),j=oa(X,M),Z=X.values&&typeof X.values==="object"&&!Array.isArray(X.values)?Object.fromEntries(Object.entries(X.values).map(([me,le])=>[me,String(le)])):{};return b({ok:!0,plan:un.plan({projectId:a.project.id,scope:j,values:Z,removeMissing:X.removeMissing===!0})},200,F)}if(B.pathname==="/api/configuration"&&C.method==="POST"){let X=await ie(C),j=oa(X,M),Z=X.kind==="secret"?"secret":"variable",me=String(X.key??"");if(Z==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let le=await un.set({organizationId:a.organization.id,projectId:a.project.id,scope:j,key:me,kind:Z,value:X.value==null?void 0:String(X.value),reference:X.reference==null?void 0:String(X.reference),backend:X.backend,required:X.required===!0,expectedVersion:X.expectedVersion==null?void 0:Number(X.expectedVersion),confirmed:String(X.confirm??"")===me,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:Oe(se).actor?.id});return b({ok:!0,entry:un.list({projectId:a.project.id,scope:j,canReadSecretMetadata:l}).find((qe)=>qe.id===le.entry.id),mutation:le.mutation,warnings:le.warnings},le.mutation.added.length?201:200,F)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le)},409,F)}}if(B.pathname==="/api/configuration/import"&&C.method==="POST"){let X=await ie(C),j=oa(X,M),Z=Array.isArray(X.secretKeys)?X.secretKeys.map(String):[];if(Z.length&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let me=await un.importDotenv({organizationId:a.organization.id,projectId:a.project.id,scope:j,source:String(X.source??""),secretKeys:Z,backend:X.backend,confirmed:X.confirm==="import",idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey,actorId:Oe(se).actor?.id});return b({ok:me.document.valid,diagnostics:me.document.diagnostics,mutation:me.mutation,warnings:me.warnings},me.document.valid?200:422,F)}catch(me){return b({ok:!1,error:me instanceof Error?me.message:String(me)},409,F)}}if(B.pathname==="/api/configuration/dependencies"&&C.method==="POST"){let X=await ie(C),j=go.get(String(X.entryId??"")),Z=a.store.getResource(String(X.resourceId??""));if(!j||j.projectId!==a.project.id||!Z||Z.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry or dependent resource was not found."},404,F);return b({ok:!0,dependency:go.setDependency({entryId:j.id,resourceId:Z.id,injectionTarget:["native_reference","file"].includes(String(X.injectionTarget))?X.injectionTarget:"environment",required:X.required!==!1,requiresRedeploy:X.requiresRedeploy!==!1,lastDeployedVersion:X.lastDeployedVersion==null?void 0:Number(X.lastDeployedVersion)})},200,F)}if(B.pathname==="/api/configuration/transfer"&&C.method==="POST"){let X=await ie(C),j=go.get(String(X.id??"")),Z=oa({...X,scopeType:X.targetScopeType,scopeId:X.targetScopeId},M);if(!j||j.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,F);if(j.kind==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);try{let me=await un.transfer({entryId:j.id,targetScope:Z,mode:X.mode==="move"?"move":"copy",confirmed:X.confirm===j.key,actorId:Oe(se).actor?.id,idempotencyKey:C.headers.get("idempotency-key")??X.idempotencyKey});return b({ok:!0,entry:un.list({projectId:a.project.id,scope:Z,canReadSecretMetadata:l}).find((le)=>le.id===me.entry.id),mutation:me.mutation},200,F)}catch(me){return b({ok:!1,error:me instanceof Error?me.message:String(me)},409,F)}}if(B.pathname==="/api/configuration/bulk"&&C.method==="POST"){let X=await ie(C),j=Array.isArray(X.ids)?X.ids.map(String).slice(0,500):[],Z=j.map((le)=>go.get(le)).filter((le)=>!!le&&le.projectId===a.project.id);if(Z.length!==j.length)return b({ok:!1,error:"One or more configuration entries were not found."},404,F);if(Z.some((le)=>le.kind==="secret")&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);if(X.action!=="delete"||X.confirm!=="bulk")return b({ok:!1,error:"Bulk deletion requires action delete and confirm bulk."},409,F);let me=[];try{for(let le of Z)me.push(await un.remove({entryId:le.id,expectedVersion:le.version,confirmed:!0,actorId:Oe(se).actor?.id}));return b({ok:!0,removed:me.flatMap((le)=>le.removed),affectedResourceIds:[...new Set(me.flatMap((le)=>le.affectedResourceIds))].sort()},200,F)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le),partial:me.flatMap((qe)=>qe.removed)},409,F)}}if(B.pathname==="/api/configuration/reveal"&&C.method==="POST"){let X=await ie(C),j=Bt.resolveSession(C);try{return b({ok:!0,value:await un.reveal({entryId:String(X.id??""),canRevealSecrets:l,recentlyAuthenticated:!Re||!!j&&we.isRecentlyAuthenticated(j),actorId:Oe(se).actor?.id})},200,F)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},403,F)}}if(B.pathname==="/api/configuration"&&C.method==="DELETE"){let X=await ie(C),j=go.get(String(X.id??""));if(j?.kind==="secret"&&!k)return b({ok:!1,error:"Secret write permission is required."},403,F);if(!j||j.projectId!==a.project.id)return b({ok:!1,error:"Configuration entry was not found."},404,F);try{return b({ok:!0,mutation:await un.remove({entryId:j.id,expectedVersion:Number(X.expectedVersion),confirmed:String(X.confirm??"")===j.key,actorId:Oe(se).actor?.id})},200,F)}catch(Z){return b({ok:!1,error:Z instanceof Error?Z.message:String(Z)},409,F)}}}if(B.pathname.startsWith("/api/fleet")){let d=Oe(se).actor?.id,l=(k,M=409)=>b({ok:!1,error:k instanceof Error?k.message:String(k)},M,{"cache-control":"no-store"});if(B.pathname==="/api/fleet"&&C.method==="GET")return b({ok:!0,servers:ua.list(a.project.id),resources:a.store.listResources(a.project.id),operations:kt.list({projectId:a.project.id,limit:200}).filter((k)=>k.operation.kind.startsWith("fleet."))},200,{"cache-control":"no-store"});if(B.pathname==="/api/fleet"&&C.method==="POST"){let k=await ie(C);try{return b({ok:!0,server:Di.enroll({organizationId:a.organization.id,projectId:a.project.id,name:String(k.name??""),provider:["aws","hetzner"].includes(String(k.provider))?k.provider:"ssh",providerId:k.providerId?String(k.providerId):void 0,region:k.region?String(k.region):void 0,zone:k.zone?String(k.zone):void 0,endpoint:String(k.endpoint??""),sshUser:String(k.sshUser??"deploy"),sshPort:k.sshPort?Number(k.sshPort):22,credentialRef:String(k.credentialRef??""),roles:Array.isArray(k.roles)?k.roles:[],labels:k.labels&&typeof k.labels==="object"?k.labels:{}})},201)}catch(M){return l(M,422)}}if(B.pathname==="/api/fleet/action"&&C.method==="POST"){let k=await ie(C),M=String(k.id??""),F=String(k.action??"");try{if(F==="test")return b({ok:!0,server:await Di.test(M)});if(F==="validate")return b({ok:!0,server:await Di.validate(M)});if(F==="review_host_key")return b({ok:!0,server:Di.reviewHostKey(M,String(k.fingerprint??""))});if(F==="bootstrap")return b({ok:!0,...Di.bootstrap(M,k.confirmed===!0)},k.confirmed===!0?202:200);if(F==="heartbeat")return b({ok:!0,server:Di.heartbeat(M,{usage:k.usage&&typeof k.usage==="object"?k.usage:{}})});if(F==="drain")return b({ok:!0,server:Di.drain(M,k.completed===!0)});if(F==="uncordon")return b({ok:!0,server:Di.uncordon(M)});if(F==="archive")return b({ok:!0,server:Di.archive(M,String(k.confirmation??""))});return l("Unsupported fleet action.",422)}catch(X){return l(X)}}}if(B.pathname.startsWith("/api/capacity")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(B.pathname==="/api/capacity"&&C.method==="GET")return b({ok:!0,pools:fo.listPools(a.project.id),placements:fo.listPlacements(a.project.id),servers:ua.list(a.project.id)},200,{"cache-control":"no-store"});if(B.pathname==="/api/capacity"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,pool:fo.createPool({organizationId:a.organization.id,projectId:a.project.id,name:String(l.name??""),purpose:String(l.purpose??"application"),backend:String(l.backend??"server"),region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{},requiredServerLabels:l.requiredServerLabels&&typeof l.requiredServerLabels==="object"?l.requiredServerLabels:{},toleratedTaints:Array.isArray(l.toleratedTaints)?l.toleratedTaints.map(String):[],capacity:l.capacity&&typeof l.capacity==="object"?l.capacity:{},maxWorkloads:Number(l.maxWorkloads??10),costWeight:Number(l.costWeight??1),spreadKey:l.spreadKey?String(l.spreadKey):void 0,concurrency:Number(l.concurrency??1),ephemeralWorkspaces:!0,allowProductionSecrets:!1,status:"active"})},201)}catch(k){return d(k,422)}}if(B.pathname==="/api/capacity/member"&&C.method==="POST"){let l=await ie(C);try{return fo.addMember(String(l.poolId??""),String(l.serverId??"")),b({ok:!0,pool:fo.getPool(String(l.poolId??""))})}catch(k){return d(k,422)}}if(B.pathname==="/api/capacity/explain"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,decisions:mp.explain(a.project.id,{purpose:String(l.purpose??"application"),resources:l.resources&&typeof l.resources==="object"?l.resources:{},region:l.region?String(l.region):void 0,architecture:l.architecture?String(l.architecture):void 0,labels:l.labels&&typeof l.labels==="object"?l.labels:{}})})}catch(k){return d(k,422)}}if(B.pathname==="/api/capacity/action"&&C.method==="POST"){let l=await ie(C);try{if(l.action==="drain")return b({ok:!0,...mp.drainPool(String(l.poolId??""))});if(l.action==="enable")return b({ok:!0,pool:fo.updatePool(String(l.poolId??""),{status:"active"})});if(l.action==="disable")return b({ok:!0,pool:fo.updatePool(String(l.poolId??""),{status:"disabled"})});return d("Unsupported capacity action.",422)}catch(k){return d(k,422)}}}if(B.pathname.startsWith("/api/regions")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(B.pathname==="/api/regions"&&C.method==="GET")return b({ok:!0,topologies:Bo.list(a.project.id).map((l)=>({topology:l,targets:Bo.targets(l.id),channels:Bo.channels(l.id),route:Bo.route(l.id),executions:Bo.executions(l.id)}))},200,{"cache-control":"no-store"});if(B.pathname==="/api/regions"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,topology:fp.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:a.environments.get(ye)?.id,name:String(l.name??""),hostname:String(l.hostname??""),regions:Array.isArray(l.regions)?l.regions:[],trafficPolicy:l.trafficPolicy==="weighted"||l.trafficPolicy==="latency"?l.trafficPolicy:"active_passive",dataPolicy:{replicate:Array.isArray(l.replicate)?l.replicate:["s3","dynamodb","secrets"],maxLagSeconds:Number(l.maxLagSeconds??30),retainOnDestroy:l.retainOnDestroy!==!1},dnsProvider:"route53",cdnEnabled:l.cdnEnabled===!0,wafEnabled:l.wafEnabled===!0})},201)}catch(k){return d(k,422)}}if(B.pathname==="/api/regions/action"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...fp.enqueue({topologyId:String(l.topologyId??""),kind:String(l.action??""),targetRegion:l.targetRegion?String(l.targetRegion):void 0,revision:l.revision?String(l.revision):void 0,manifest:l.manifest&&typeof l.manifest==="object"?l.manifest:{},confirmation:l.confirmation?String(l.confirmation):void 0,deleteData:l.deleteData===!0})},202)}catch(k){return d(k,422)}}}if(B.pathname.startsWith("/api/maintenance")){let d=(l,k=409)=>b({ok:!1,error:l instanceof Error?l.message:String(l)},k,{"cache-control":"no-store"});if(B.pathname==="/api/maintenance"&&C.method==="GET")return b({ok:!0,manifests:Ui.manifests(a.organization.id),windows:Ui.windows(a.project.id),campaigns:Ui.campaigns(a.project.id).map((l)=>({campaign:l,targets:Ui.targets(l.id)})),cleanups:Ui.cleanups(a.project.id),drills:Ui.drills(a.project.id)},200,{"cache-control":"no-store"});if(B.pathname==="/api/maintenance/cleanup-preview"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,plan:await Nd.previewCleanup({projectId:a.project.id,kind:String(l.kind??"operations"),criteria:{olderThanDays:Number(l.olderThanDays??30)}},hp)},201)}catch(k){return d(k,422)}}if(B.pathname==="/api/maintenance/cleanup-apply"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...Nd.enqueueCleanup(String(l.planId??""),String(l.confirmation??""))},202)}catch(k){return d(k,422)}}if(B.pathname==="/api/maintenance/drill"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,drill:Ui.createDrill({projectId:a.project.id,scenario:String(l.scenario??"control_plane"),isolatedTarget:String(l.isolatedTarget??""),expectedRpoMinutes:Number(l.expectedRpoMinutes??60),expectedRtoMinutes:Number(l.expectedRtoMinutes??30),recoveryPointId:l.recoveryPointId?String(l.recoveryPointId):void 0,topologyId:l.topologyId?String(l.topologyId):void 0})},201)}catch(k){return d(k,422)}}if(B.pathname==="/api/maintenance/drill-run"&&C.method==="POST"){let l=await ie(C);try{return b({ok:!0,...Nd.enqueueDrill(String(l.drillId??""))},202)}catch(k){return d(k,422)}}}if(B.pathname.startsWith("/api/volumes")){let d=a.environments.get(ye),l=Oe(se).actor?.id,k=(M,F=409)=>b({ok:!1,error:M instanceof Error?M.message:String(M)},F,{"cache-control":"no-store"});if(B.pathname==="/api/volumes"&&C.method==="GET"){let M=Od.inventory(a.project.id,d?.id),F=a.store.listResources(a.project.id,d?.id).map((X)=>({id:X.id,name:X.name,slug:X.slug,kind:X.kind,provider:X.provider,providerId:X.providerId}));return b({ok:!0,volumes:M,resources:F,operations:kt.list({projectId:a.project.id,limit:100}).filter((X)=>X.operation.kind.startsWith("volume.")),recoveryPoints:Yt.listRecoveryPoints(a.project.id).filter((X)=>X.kind==="volume"),providers:_d.map((X)=>({provider:X.provider,type:X.type,capabilities:X.capabilities()}))},200,{"cache-control":"no-store"})}if(B.pathname==="/api/volumes"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.create({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,resourceId:M.resourceId?String(M.resourceId):void 0,name:String(M.name??""),provider:String(M.provider??"docker"),type:M.type==="docker"?"docker":M.type,capacityBytes:M.capacityBytes==null?void 0:Number(M.capacityBytes),filesystem:M.filesystem?String(M.filesystem):void 0,encrypted:M.encrypted===!0,desiredState:M.desiredState&&typeof M.desiredState==="object"?M.desiredState:{},actorId:l})},202,{"cache-control":"no-store"})}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/attach"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.attach(String(M.volumeId??""),{resourceId:String(M.resourceId??""),targetPath:String(M.targetPath??""),readOnly:M.readOnly===!0,uid:M.uid==null?void 0:Number(M.uid),gid:M.gid==null?void 0:Number(M.gid),mode:M.mode?String(M.mode):void 0,propagation:M.propagation,driverOptions:M.driverOptions&&typeof M.driverOptions==="object"?M.driverOptions:{},actorId:l})},202)}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/detach"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.detach(String(M.volumeId??""),String(M.attachmentId??""),{force:M.force===!0,drained:M.drained===!0,unmounted:M.unmounted===!0,confirmation:M.confirmation?String(M.confirmation):void 0,actorId:l})},202)}catch(F){return k(F)}}if(B.pathname==="/api/volumes/resize"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.resize(String(M.volumeId??""),Number(M.capacityBytes),{drained:M.drained===!0,actorId:l})},202)}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/snapshot"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.snapshot(String(M.volumeId??""),{name:M.name?String(M.name):void 0,actorId:l})},202)}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/restore"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,...ji.restore(String(M.snapshotId??""),{name:String(M.name??""),actorId:l})},202)}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes/discover"&&C.method==="POST")try{return b({ok:!0,volumes:await ji.discover({organizationId:a.organization.id,projectId:a.project.id,environmentId:d?.id,actorId:l})})}catch(M){return k(M,502)}if(B.pathname==="/api/volumes/adopt"&&C.method==="POST"){let M=await ie(C);try{return b({ok:!0,volume:ji.adopt(String(M.volumeId??""),{name:String(M.name??""),actorId:l})})}catch(F){return k(F,422)}}if(B.pathname==="/api/volumes"&&C.method==="DELETE"){let M=await ie(C),F=Bt.resolveSession(C);try{return b({ok:!0,...ji.delete(String(M.volumeId??""),{recentAuthAt:!Re||F&&we.isRecentlyAuthenticated(F)?new Date().toISOString():void 0,confirmation:M.confirmation?String(M.confirmation):void 0,backupOverride:M.backupOverride===!0,backupOverrideConfirmation:M.backupOverrideConfirmation?String(M.backupOverrideConfirmation):void 0,actorId:l})},202)}catch(X){return k(X)}}}if(B.pathname==="/api/backups"&&C.method==="GET"){let d=a.environments.get(ye),l=Yt.listPolicies(a.project.id,d?.id),k=new Set(l.map((Z)=>Z.id)),M=Yt.listRecoveryPoints(a.project.id).filter((Z)=>!Z.policyId||k.has(Z.policyId)),F=Yt.listJobs(a.project.id).filter((Z)=>!Z.policyId||k.has(Z.policyId)),X=(Z)=>({...Z,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!Z.credentialRef,clientEncryptionConfigured:!!Z.encryptionKeyRef}),j=await Promise.all(Yt.listDestinations(a.project.id).map(async(Z)=>({...X(Z),credentialStatus:await Nh(Z,Fi)})));return b({ok:!0,destinations:j,policies:l,recoveryPoints:M,jobs:F,coverage:Yt.coverage(a.project.id).filter((Z)=>k.has(Z.policy.id)),resources:d?a.store.listResources(a.project.id,d.id).map((Z)=>({id:Z.id,name:Z.name,slug:Z.slug,kind:Z.kind})):[]})}if(B.pathname==="/api/backups/destinations"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim(),k=String(d.provider??""),M=String(d.encryption??"provider"),F=`secret://data-services/backups/${a.project.id}/${l}`,X=[];if(!["aws_s3","s3_compatible","aws_backup"].includes(k))return b({ok:!1,error:"A supported backup destination provider is required."},422);if(!["provider","client_side","both"].includes(M))return b({ok:!1,error:"Encryption must be provider, client_side, or both."},422);try{let j,Z;if(d.credentials&&typeof d.credentials==="object"&&!Array.isArray(d.credentials))j=`${F}/credentials`,await Fi.put(j,JSON.stringify(d.credentials)),X.push(j);if(M!=="provider"){let le=String(d.encryptionKey??"");if(le.length<32)throw Error("Client-side encryption keys must contain at least 32 characters.");Z=`${F}/encryption-key`,await Fi.put(Z,le),X.push(Z)}let me=Yt.createDestination({organizationId:a.organization.id,projectId:a.project.id,name:l,provider:k,endpoint:d.endpoint?String(d.endpoint):void 0,endpointPolicy:d.endpointPolicy==="allow_private"?"allow_private":"public_https",bucket:d.bucket?String(d.bucket):void 0,prefix:String(d.prefix??""),region:d.region?String(d.region):mo,forcePathStyle:d.forcePathStyle===!0,credentialRef:j,encryption:M,encryptionKeyRef:Z,immutability:d.immutability&&typeof d.immutability==="object"&&!Array.isArray(d.immutability)?d.immutability:{},status:"untested"});return b({ok:!0,destination:{...me,credentialRef:void 0,encryptionKeyRef:void 0,credentialsConfigured:!!j,clientEncryptionConfigured:!!Z}},201)}catch(j){for(let Z of X)await Fi.remove(Z).catch(()=>{});return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}if(B.pathname==="/api/backups/destinations/test"&&C.method==="POST"){let d=await ie(C),l=Yt.getDestination(String(d.id??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(l.provider==="aws_backup")return b({ok:!1,error:"AWS Backup destinations are verified by creating a provider recovery point."},422);try{return await gp.test(l),b({ok:!0,destination:Yt.recordDestinationTest(l.id,{ok:!0})})}catch(k){let M=k instanceof Error?k.message:String(k);return Yt.recordDestinationTest(l.id,{ok:!1,error:M}),b({ok:!1,error:M},502)}}if(B.pathname==="/api/backups/policies"&&C.method==="POST"){let d=await ie(C),l=a.environments.get(ye),k=Yt.getDestination(String(d.destinationId??"")),M=String(d.resourceKind??""),F=d.dataServiceId?String(d.dataServiceId):void 0,X=F?Ot.get(F):void 0,j=d.resourceId?String(d.resourceId):void 0,Z=j?a.store.getResource(j):void 0;if(!l)return b({ok:!1,error:"Environment was not found."},404);if(!k||k.projectId!==a.project.id)return b({ok:!1,error:"Backup destination was not found."},404);if(!["managed_database","logical_database","volume","files","control_plane","infrastructure"].includes(M))return b({ok:!1,error:"A supported backup resource kind is required."},422);if(F&&(!X||X.projectId!==a.project.id||X.environmentId!==l.id))return b({ok:!1,error:"Data service was not found in this environment."},404);if(j&&(!Z||Z.projectId!==a.project.id||Z.environmentId!==l.id))return b({ok:!1,error:"Resource was not found in this environment."},404);if(M==="managed_database"&&!X)return b({ok:!1,error:"Managed database policies require a data service."},422);if(M==="logical_database"&&(!X||!["container","server"].includes(X.provider)))return b({ok:!1,error:"Logical database policies require an on-box data service."},422);if(M==="volume"&&(!Z||!/^[A-Za-z0-9][A-Za-z0-9_.-]{1,127}$/.test(String(d.volumeName??""))))return b({ok:!1,error:"Volume policies require a scoped resource and valid volumeName."},422);let me=Array.isArray(d.includePatterns)?d.includePatterns.map(String).filter(Boolean):[];if(M==="files"&&(!Z||!me.length))return b({ok:!1,error:"File policies require a scoped resource and at least one project-relative include path."},422);if(M==="control_plane"&&k.encryption==="provider")return b({ok:!1,error:"Control-plane policies require a destination with client-side encryption."},422);if(M==="infrastructure"&&(k.provider!=="aws_backup"||!me.some((le)=>le.startsWith("resource:arn:"))||!me.some((le)=>le.startsWith("role:arn:"))))return b({ok:!1,error:"Infrastructure policies require an AWS Backup destination plus resource:<arn> and role:<arn> include values."},422);try{let le=Yt.createPolicy({organizationId:a.organization.id,projectId:a.project.id,environmentId:l.id,resourceId:j,dataServiceId:F,destinationId:k.id,name:String(d.name??"").trim(),resourceKind:M,schedule:String(d.schedule??"daily"),timezone:String(d.timezone??"UTC"),retention:d.retention&&typeof d.retention==="object"&&!Array.isArray(d.retention)?d.retention:{keepLast:7,expireAfterDays:30},compression:["none","gzip","zstd"].includes(String(d.compression))?d.compression:"gzip",encryption:["destination","client_side","both"].includes(String(d.encryption))?d.encryption:"destination",includePatterns:M==="volume"?[String(d.volumeName),...me]:me,excludePatterns:Array.isArray(d.excludePatterns)?d.excludePatterns.map(String):[],expectedRpoMinutes:Math.max(1,Number(d.expectedRpoMinutes)||1440),expectedRtoMinutes:Math.max(1,Number(d.expectedRtoMinutes)||120),healthCheckId:d.healthCheckId?String(d.healthCheckId):void 0,enabled:d.enabled!==!1});return b({ok:!0,policy:le},201)}catch(le){return b({ok:!1,error:le instanceof Error?le.message:String(le)},422)}}if(B.pathname==="/api/backups/run"&&C.method==="POST"){let d=await ie(C),l=Yt.getPolicy(String(d.policyId??"")),k=a.environments.get(ye);if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Backup policy was not found in this environment."},404);try{let M=Lo.enqueueBackup(l,new Date().toISOString(),Oe(se).actor?.id);return b({ok:!0,job:M},202)}catch(M){return b({ok:!1,error:M instanceof Error?M.message:String(M)},409)}}if(B.pathname==="/api/backups/verify"&&C.method==="POST"){let d=await ie(C),l=Yt.getRecoveryPoint(String(d.recoveryPointId??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);return b({ok:!0,job:Lo.enqueueVerification(l)},202)}if(B.pathname==="/api/backups/restore"&&C.method==="POST"){let d=await ie(C),l=Yt.getRecoveryPoint(String(d.recoveryPointId??"")),k=d.mode==="in_place"?"in_place":"isolated",M=d.target&&typeof d.target==="object"&&!Array.isArray(d.target)?{...d.target,inPlace:k==="in_place"}:{inPlace:k==="in_place"},F=Bt.resolveSession(C),X={mode:k,target:M,targetName:String(d.targetName??""),confirm:d.confirm?String(d.confirm):void 0,recentAuth:!Re||!!F&&we.isRecentlyAuthenticated(F),downtimeAcknowledged:d.downtimeAcknowledged===!0,safetyBackupId:d.safetyBackupId?String(d.safetyBackupId):void 0};if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.drill===!0&&k!=="isolated")return b({ok:!1,error:"Recovery drills must use an isolated target."},422);try{let j=Lo.planRestore(l,X);if(d.execute!==!0)return b({ok:!0,plan:j,executionCreated:!1});let Z=Lo.enqueueRestore(l,{...X,drill:d.drill===!0,actorId:Oe(se).actor?.id});return b({ok:!0,plan:j,job:Z},202)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},409)}}if(B.pathname==="/api/backups/recovery-points"&&C.method==="POST"){let d=await ie(C),l=Yt.getRecoveryPoint(String(d.id??""));if(!l||l.projectId!==a.project.id)return b({ok:!1,error:"Recovery point was not found."},404);if(d.held==null&&d.pinned==null)return b({ok:!1,error:"held or pinned must be provided."},422);return b({ok:!0,recoveryPoint:Yt.updateRecoveryPoint(l.id,{held:d.held==null?l.held:d.held===!0,pinned:d.pinned==null?l.pinned:d.pinned===!0})})}if(B.pathname==="/api/backups/retention"&&C.method==="POST")return b({ok:!0,jobs:Lo.enqueueRetention()},202);if(B.pathname==="/api/data-services/capabilities"&&C.method==="GET"){let d=String(B.searchParams.get("engine")??""),l=String(B.searchParams.get("provider")??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(d)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(l))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,engine:d,provider:l,capabilities:sr(d,l)})}if(B.pathname==="/api/data-services"&&C.method==="GET"){let d=a.environments.get(ye),l=Ot.list(a.project.id,d?.id).map((k)=>{let M=Ot.credential(k.id);return{...k,credentialRef:void 0,credential:M?{configured:!0,username:M.username,version:M.version,rotatedAt:M.rotatedAt}:void 0,dependencies:Ot.dependencies(k.id).map((F)=>({resourceId:F.resourceId,requiresRedeploy:F.requiresRedeploy}))}});return b({ok:!0,services:l})}if(B.pathname==="/api/data-services/preview"&&C.method==="POST"){let d=await ie(C);if(d.id){let M=Ot.get(String(d.id)),F=a.environments.get(ye),X=String(d.action??"");if(!M||M.projectId!==a.project.id||M.environmentId!==F?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Rd.includes(X))return b({ok:!1,error:`Action must be one of: ${Rd.join(", ")}.`},422);try{return b({ok:!0,plan:Ua.plan(M,X,d.changes??{})})}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}let l=String(d.engine??""),k=String(d.provider??"");if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(k))return b({ok:!1,error:"A supported engine and provider are required."},422);return b({ok:!0,capabilities:sr(l,k),defaults:{publicExposure:!1,backupRetentionDays:7,deletionProtection:!0},productionExecutionCreated:!1})}if(B.pathname==="/api/data-services"&&C.method==="POST"){let d=await ie(C),l=String(d.engine??""),k=String(d.provider??""),M=a.environments.get(ye),F=Oe(se);if(!M)return b({ok:!1,error:"Environment was not found."},404);if(!["postgres","mysql","mariadb","redis","mongodb","libsql"].includes(l)||!["aws_rds","aws_aurora","aws_elasticache","server","container","external"].includes(k))return b({ok:!1,error:"A supported engine and provider are required."},422);let X={organizationId:a.organization.id,projectId:a.project.id,environmentId:M.id,resourceId:d.resourceId?String(d.resourceId):void 0,name:String(d.name??"").trim(),engine:l,provider:k,placement:String(d.placement??d.name??"").trim(),engineVersion:d.engineVersion?String(d.engineVersion):void 0,plan:String(d.plan??(k==="aws_elasticache"?"cache.t4g.micro":k==="aws_aurora"?"db.serverless":"db.t4g.micro")),storageGb:d.storageGb==null?void 0:Number(d.storageGb),highAvailability:d.highAvailability===!0,publicExposure:d.publicExposure===!0,allowedCidrs:Array.isArray(d.allowedCidrs)?d.allowedCidrs.map(String):[],desiredState:d.desiredState&&typeof d.desiredState==="object"&&!Array.isArray(d.desiredState)?d.desiredState:{},observedState:{},origin:d.adopt===!0?"adopted":"managed",managementEnabled:d.adopt!==!0,ownerActorId:F.actor?.id,username:d.username?String(d.username):void 0};try{if(d.adopt===!0){let Z=Ot.create({...X,status:"adopted",credentialRef:void 0});return b({ok:!0,service:Z,readOnly:!0},201)}if(!pp({provider:k,engine:l}))return b({ok:!1,error:`No ${k}/${l} provisioning adapter is configured; adopt it read-only or choose a supported provider.`},422);let j=await Ua.create(X);return b({ok:!0,service:j.service,operationId:j.operationId,oneTimeCredential:j.credential},201)}catch(j){return b({ok:!1,error:j instanceof Error?j.message:String(j)},422)}}if(B.pathname==="/api/data-services/connections"&&C.method==="GET"){let d=Ot.get(String(B.searchParams.get("id")??"")),l=a.environments.get(ye);if(!d||d.projectId!==a.project.id||d.environmentId!==l?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);let k=typeof d.observedState.endpoint==="string"?d.observedState.endpoint:void 0,M=typeof d.observedState.readerEndpoint==="string"?d.observedState.readerEndpoint:void 0,F=Number(d.observedState.port)||(d.engine==="postgres"?5432:d.engine==="redis"?6379:d.engine==="mongodb"?27017:d.engine==="libsql"?8080:3306),X=typeof d.observedState.database==="string"?d.observedState.database:void 0,j=typeof d.observedState.tls==="boolean"?d.observedState.tls:d.provider.startsWith("aws_"),Z=[...k?[{type:d.publicExposure?"external":"internal",host:k,port:F,database:X,tls:j}]:[],...M?[{type:"internal",host:M,port:F,database:X,tls:j}]:[],{type:"tunnel",host:k??d.placement,port:F,database:X,tls:j}];return b({ok:!0,serviceId:d.id,guidance:Wn(d,Z)})}if(B.pathname==="/api/data-services/action"&&C.method==="POST"){let d=await ie(C),l=Ot.get(String(d.id??"")),k=a.environments.get(ye),M=String(d.action??"");if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!Rd.includes(M))return b({ok:!1,error:`Action must be one of: ${Rd.join(", ")}.`},422);let F=d.changes&&typeof d.changes==="object"&&!Array.isArray(d.changes)?d.changes:{};try{let X=Ua.plan(l,M,F);if(d.execute!==!0)return b({ok:!0,plan:X,productionExecutionCreated:!1});let j=Ua.enqueue(l,M,F,Oe(se).actor?.id);return b({ok:!0,plan:X,operationId:j},202)}catch(X){return b({ok:!1,error:X instanceof Error?X.message:String(X)},409)}}if(B.pathname==="/api/data-services/dependencies"&&C.method==="POST"){let d=await ie(C),l=Ot.get(String(d.id??"")),k=a.environments.get(ye),M=a.store.getResource(String(d.resourceId??""));if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M||M.projectId!==a.project.id||M.environmentId!==k?.id)return b({ok:!1,error:"Dependent resource was not found in this environment."},404);if(d.remove===!0)return b({ok:Ot.removeDependency(l.id,M.id)});return Ot.addDependency({serviceId:l.id,resourceId:M.id,secretRef:l.credentialRef??`secret://data-services/${l.projectId}/${l.name}`,requiresRedeploy:d.requiresRedeploy!==!1}),b({ok:!0,dependencies:Ot.dependencies(l.id).map((F)=>({resourceId:F.resourceId,requiresRedeploy:F.requiresRedeploy}))})}if(B.pathname==="/api/data-services/management"&&C.method==="POST"){let d=await ie(C),l=Ot.get(String(d.id??"")),k=a.environments.get(ye);if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(l.origin!=="adopted"||d.reviewed!==!0||d.confirm!==l.name)return b({ok:!1,error:`Enabling management requires reviewed=true and typing ${l.name}.`},409);return b({ok:!0,service:Ot.update(l.id,l.version,{managementEnabled:!0})})}if(B.pathname==="/api/data-services/reveal"&&C.method==="POST"){let d=await ie(C),l=Ot.get(String(d.id??"")),k=a.environments.get(ye),M=l?Ot.credential(l.id):void 0;if(!l||l.projectId!==a.project.id||l.environmentId!==k?.id)return b({ok:!1,error:"Data service was not found in this environment."},404);if(!M)return b({ok:!1,error:"No managed credential is configured."},404);return b({ok:!0,credential:{username:M.username,password:await Fi.resolve(M.secretRef),version:M.version}},200,{"cache-control":"no-store"})}if(B.pathname==="/api/databases"&&C.method==="GET")return b(await xm(o,ye));if(B.pathname==="/api/databases"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim();if(!Qi(l))return b({ok:!1,error:"Database name must be a valid identifier (letters, numbers, underscore; not starting with a digit)."},422);return b({...await Dm(o,ye,l),name:l})}if(B.pathname==="/api/databases/vitess"&&C.method==="GET"){let d=await $m(o,ye);return b({...d,unhealthy:Mm(d.tablets),missingPrimary:Lm(d)})}if(B.pathname==="/api/databases/vitess/provision"&&C.method==="POST"){let d=await ie(C);try{return b(await yy(o,ye,{keyspace:String(d.keyspace??""),username:String(d.username??""),password:String(d.password??""),sharded:d.sharded===!0,confirm:String(d.confirm??"")}))}catch(l){return b({ok:!1,error:l instanceof Error?l.message:String(l)},422)}}if(B.pathname==="/api/databases/vitess/migrations"&&C.method==="GET"){let d=B.searchParams.get("keyspace")??void 0;return b(await fy(o,ye,d))}if(B.pathname==="/api/databases/vitess/migrations/action"&&C.method==="POST"){let d=await ie(C),l=String(d.uuid??"").trim(),k=String(d.action??"");if(!["retry","cancel","cleanup","complete"].includes(k))return b({ok:!1,error:"Unknown migration action."},422);return b(await hy(o,ye,l,k))}if(B.pathname==="/api/databases/vitess/keyspaces"&&C.method==="POST"){let d=await ie(C),l=String(d.name??"").trim(),k=d.sharded===!0;return b(await py(o,ye,l,{sharded:k}))}if(B.pathname==="/api/databases/vitess/vschema"&&C.method==="POST"){let d=await ie(C),l=String(d.keyspace??"").trim(),k=typeof d.vschema==="string"?d.vschema:JSON.stringify(d.vschema??null);return b(await gy(o,ye,l,k))}if(B.pathname==="/api/databases/vitess/schema"&&C.method==="POST"){let d=await ie(C),l=String(d.sql??"");return b(await my(o,ye,l))}if(B.pathname==="/api/databases/vitess/install-client"&&C.method==="POST")return b(await ly(o,ye));if(B.pathname==="/api/databases/backups"&&C.method==="GET")return b(await Nm(o,ye));if(B.pathname==="/api/databases/backup"&&C.method==="POST"){let d=await ie(C),l=String(d.database??"").trim();if(!Qi(l))return b({ok:!1,error:"Database name must be a valid identifier."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to back up this database.`},409);return b(await _m(o,ye,l))}if(B.pathname==="/api/databases/users"&&C.method==="POST"){let d=await ie(C),l=String(d.username??"").trim(),k=String(d.password??""),M=String(d.database??"").trim()||void 0,F=d.access==="readonly"?"readonly":"all";if(!Qi(l))return b({ok:!1,error:"Username must be a valid identifier."},422);if(!k)return b({ok:!1,error:"Password is required."},422);if(M&&!Qi(M))return b({ok:!1,error:"Database must be a valid identifier."},422);return b({...await Om(o,ye,{username:l,password:k,database:M,access:F}),username:l})}if(B.pathname==="/api/dashboard-data")return _t=K.get(ye)??await tt(ye),tt(ye),b(Zl(_t,{user:An,slug:o.project.slug}));if(B.pathname==="/api/users"&&C.method==="GET")return b({ok:!0,users:dn(t).map(ia)});if(B.pathname==="/api/users"&&C.method==="POST"){let d=await ie(C),l=String(d.username??"").trim();if(!Id(l))return b({ok:!1,error:"Username must be 2-32 characters: letters, numbers, dot, dash or underscore."},422);let k=d.sites&&typeof d.sites==="object"?d.sites:{},M=new Set(Object.keys(o.sites??{})),F={};for(let[Z,me]of Object.entries(k)){if(!M.has(Z))return b({ok:!1,error:`Site '${Z}' was not found.`},404);if(me!=="owner"&&me!=="collaborator")return b({ok:!1,error:`Unknown site role '${me}'. Use 'owner' or 'collaborator'.`},422);F[Z]=me}let X=typeof d.password==="string"&&d.password.trim()?d.password.trim():void 0;if(X&&X.length<12)return b({ok:!1,error:"Password must be at least 12 characters."},422);let j=$a(t,{username:l,password:X,name:typeof d.name==="string"?d.name:void 0,sites:F});return Xa(a,dn(t)),_n(),b({ok:!0,user:ia(j.user),password:j.password})}if(B.pathname==="/api/users"&&C.method==="DELETE"){let d=await ie(C),l=String(d.username??"").trim();if(l.toLowerCase()===se.username.toLowerCase())return b({ok:!1,error:"You cannot remove your own account."},409);let k=On(dn(t),l),M=k?a.store.getActorByExternalId("user",`dashboard:${k.username.toLowerCase()}`):void 0,F=M?a.store.getMembershipForActor(a.organization.id,M.id):void 0;if(F&&F.source!=="legacy")return b({ok:!1,error:"Organization members must be removed from Organization access."},409);let X=Xl(t,l);if(!X.ok)return b(X,409);return Xa(a,dn(t)),ke.clear(),b({ok:!0,username:l})}if(B.pathname==="/api/actions/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.action?vA(d.action,ye):void 0;if(!l)return b({ok:!1,error:"Unknown dashboard action."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this action.`},409);let k=await Vi({controlPlane:a,environment:ye,actor:se,kind:`dashboard.action.${l.id}`,input:{action:l.id},execute:()=>dp(l,{cwd:t,cliEntry:i})});return b({...k.result,controlPlaneOperation:k.operation})}if(B.pathname==="/api/server/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.operation?si(d.operation,o,_t):void 0;if(!l)return b({ok:!1,error:"Unknown or unavailable server operation."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let k=ue(a,String(ye));await new ns(rt).run(new Pa,{...k,artifactRoot:t});let M=gr(rt,{scope:k,desiredConfigHash:a.project.desiredConfigHash});if(M.decision.outcome==="block")return b({ok:!1,error:`Operation blocked by security policy: ${M.decision.explanation}`,securityReview:M},409);let F=await Vi({controlPlane:a,environment:ye,actor:se,kind:`dashboard.server.${l.id}`,resourceSlug:l.target,input:{operation:l.id,target:l.target,to:d.to??null},execute:()=>Qr(o,ye,l,{to:d.to})});return b({...F.result,controlPlaneOperation:F.operation,securityReview:M})}if(B.pathname==="/api/server/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command on the server.'},409);let l=await Vi({controlPlane:a,environment:ye,actor:se,kind:"dashboard.server.command",input:{source:"interactive-command"},execute:()=>pr(o,ye,String(d.command??""))});return b({...l.result,controlPlaneOperation:l.operation})}if(B.pathname==="/api/serverless/operations")return b(ip(o,ye,_t));if(B.pathname==="/api/serverless/operations/run"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=d.operation?Vy(d.operation,o,ye,_t):void 0;if(!l)return b({ok:!1,error:"Unknown or unavailable serverless operation."},404);if(l.mutates&&d.confirm!==l.confirm)return b({ok:!1,error:`Type "${l.confirm}" to run this operation.`},409);let k=await Vi({controlPlane:a,environment:ye,actor:se,kind:`dashboard.serverless.${l.id}`,input:{operation:l.id,min:d.min??null,max:d.max??null},execute:()=>qy(o,ye,l,{min:d.min,max:d.max})});return _t=await gs(o,ye),K.set(ye,_t),b({...k.result,controlPlaneOperation:k.operation})}if(B.pathname==="/api/serverless/command"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="run")return b({ok:!1,error:'Type "run" to execute this command.'},409);return b(await Gy(o,ye,String(d.command??"")))}if(B.pathname==="/api/serverless/dlq"&&C.method==="GET"){let d=Number(B.searchParams.get("max"))||10;return b(await Jy(o,ye,d))}if(B.pathname==="/api/serverless/dlq/redrive"&&C.method==="POST"){let d=await C.json().catch(()=>({}));if(d.confirm!=="redrive")return b({ok:!1,error:'Type "redrive" to move messages back onto a source queue.'},409);return b(await Hy(o,ye,{max:d.max,targetQueue:d.targetQueue}))}if(B.pathname==="/api/serverless/dlq/purge"&&C.method==="POST"){if((await C.json().catch(()=>({}))).confirm!=="purge")return b({ok:!1,error:'Type "purge" to permanently discard every DLQ message.'},409);return b(await Wy(o,ye))}if(B.pathname==="/api/serverless/secrets"&&C.method==="GET")return b({secrets:Ky(o,ye)});if(B.pathname==="/api/serverless/secrets"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return b({ok:!1,error:"A secret id is required."},422);if(typeof d.value!=="string"||d.value==="")return b({ok:!1,error:"A non-empty value is required."},422);return b(await Qy(o,ye,l,d.value))}if(B.pathname==="/api/serverless/secrets"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),l=String(d.secretId??"").trim();if(!l)return b({ok:!1,error:"A secret id is required."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to delete this secret.`},409);return b(await Yy(o,ye,l))}if(B.pathname==="/api/serverless/functions/config"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.mode??"").trim();if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to update this function.`},409);return b(await Xy(o,ye,l,{memory:d.memory,timeout:d.timeout}))}if(B.pathname==="/api/serverless/alarms"&&C.method==="GET")return b(await Zy(o,ye));if(B.pathname==="/api/serverless/alarms"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.preset??"").trim(),k=Number(d.threshold);if(!l)return b({ok:!1,error:"An alarm metric is required."},422);if(!Number.isFinite(k))return b({ok:!1,error:"A numeric threshold is required."},422);return b(await eb(o,ye,l,k))}if(B.pathname==="/api/serverless/alarms"&&C.method==="DELETE"){let d=await C.json().catch(()=>({})),l=String(d.name??"").trim();if(!l)return b({ok:!1,error:"An alarm name is required."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to delete this alarm.`},409);return b(await tb(o,ye,l))}if(B.pathname==="/api/serverless/traces"&&C.method==="GET"){let d=Number(B.searchParams.get("minutes"))||30;return b(await Ad(o,ye,d))}if(B.pathname==="/api/serverless/scheduler"&&C.method==="POST"){let d=await C.json().catch(()=>({})),l=String(d.action??"").trim();if(l!=="enable"&&l!=="disable"&&l!=="run")return b({ok:!1,error:"Unknown scheduler action."},422);if(d.confirm!==l)return b({ok:!1,error:`Type "${l}" to ${l} the scheduler.`},409);return b(await ap(o,ye,l))}if(!bb(B.pathname,An))return new Response(null,{status:302,headers:{location:`/access-denied?env=${encodeURIComponent(ye)}`}});let vs=await ki(se,ye);if(!vs)return xd("ts-cloud dashboard UI is unavailable.",503);return Sb(vs,B.pathname)}catch(Fo){if(e.verbose)console.error(Fo);return b({ok:!1,error:Fo?.message??String(Fo)},500)}})();if(!Qt)return Qt;if(ct&&(B.pathname.startsWith("/api/")||B.pathname.startsWith("/auth/"))){let Ye;if((Ie.headers.get("content-type")||"").includes("application/json"))Ye=await Ie.json().catch(()=>{return});let Cr=Bt.resolveUser(C),br=Cr?Oe(Cr).actor:void 0;a.store.appendEvent({organizationId:a.organization.id,projectId:a.project.id,actorId:br?.id,correlationId:Ve,type:Qt.status<400?"dashboard.mutation.succeeded":"dashboard.mutation.failed",level:Qt.status<400?"info":"warning",payload:iA(C.method,B.pathname,Ye,Qt.status,Date.now()-De)})}return Qt.headers.set("x-request-id",Ve),Qt}});za?.start();let $b=e.spendLoop??!0,Pp;if($b)(async()=>{let{SpendRunner:C,SpendLoopLease:Te,startSpendLoop:De}=await import("./chunk-rpsnnr53.js"),{store:Ie}=await wb(a.store),Ve=new C({controlPlane:a.store,store:Ie,alerts:Ge});Pp=De(Ve,{lease:new Te(a.store,{owner:`dashboard:${process.pid}`}),onError:(ct)=>console.error(`[ts-cloud] spend cycle failed: ${ct instanceof Error?ct.message:String(ct)}`)})})();let Mb=bs.stop.bind(bs);return bs.stop=(C)=>{clearInterval(Tp),clearInterval(Ap),clearInterval(kp),clearInterval(Ep),clearInterval(Cp),clearInterval(Sp),clearInterval(vp),clearInterval(wp),clearInterval(Ip),_n(),Zt.clear(),za?.stop(),Pp?.();let Te=Mb(C);if(za)za.settled().finally(()=>a.store.close());else a.store.close();return Te},{server:bs,url:`http://${r}:${bs.port}/`}}
 export{Me,_,$n,y,Ln,Zi,Mn,us,qr,lt,xe,Un,Bn,jn,Vn,zn,Hn,Gn,qn,oe,sr,ar,Wn,Wr,Kn,Jn,Xn,Qn,Yn,Zn,ei,ti,dt,cr,lr,$t,Kr,dr,ur,eo,Lt,ri,de,ni,ii,oi,Jr,Xr,si,Qr,pr,mr,ut,Mt,Ut,Yr,ue,ai,gc,fc,gr,hc,G,to,We,pt,mt,ci,Zr,li,en,di,ui,tn,ps,pe,ve,Ue,Ce,pi,fr};